Static detection of resource contention problems in server-side scripts

Proceedings - International Conference on Software Engineering

Volumn , Issue , 2012, Pages 584-594

  Zheng, Yunhui ^a   Zhang, Xiangyu ^a  

^a PURDUE UNIVERSITY   (United States)

Author keywords

constraint solving; php; resource contention; static analysis

Indexed keywords

ATOMICITY VIOLATIONS; BUSINESS LOGIC; CONSTRAINT SOLVING; DATABASE TABLES; DETECTION TECHNIQUE; EXTERNAL RESOURCES; INTER-PROCEDURAL; MULTICORE ARCHITECTURES; MULTIPLE INSTANCES; MULTIPLE OPERATIONS; PHP; RESOURCE CONTENTION; RESOURCE CONTENTION PROBLEM; SERIALIZABILITY; SHARED MEMORIES; THREE COMPONENT; WEB APPLICATION;

COMPUTER ARCHITECTURE; STATIC ANALYSIS;

SOFTWARE ENGINEERING;

EID: 84864258272     PISSN: 02705257     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICSE.2012.6227158     Document Type: Conference Paper

References (37)

1. ProductCart overselling. http://www.rotofugi.com/toyscart/pc/viewContent. asp?idpage=48.
2. OpenCart overselling. http://forum.opencart.com/viewtopic.php?f=20&t= 37073.
3. Drupal critical runtime failure. http://drupal.org/node/566832.
4. Joomla file corruption. http://forum.joomla.org/viewtopic.php?p=1795892.
5. 5 Best Open Source Shopping Carts. http://www.stylomart.com/technology/5- best-open-source-shopping-carts/.
6. Phc: open source PHP compiler. http://www.phpcompiler.org/.
7. The LLVM Compiler Infrastructure Project. http://llvm.org/.
8. The STP Constraint Solver. https://sites.google.com/site/stpfastprover/.
9. A. Aho, M. Lam, R. Sethi, and J. Ullman. Compilers: principles, techniques, and tools (2nd Ed.). Pearson Education, Inc, 2006.
10. G. Antoniol, M. Penta, M. Zazzara. Understanding Web Applications through Dynamic Analysis. IWPC'04.
11. S. Artzi, J. Dolby, F. Tip and M. Pistoia. Practical fault localization for dynamic web applications. ICSE'10.
12. A. Carzaniga, A. Gorla, N. Perino and M. Pezzè. Automatic workarounds for web applications. FSE'10.
13. E. Clarke, D. Kroening and K. Yorav. Behavioral consistency of C and verilog programs using bounded model checking. DAC'03.
14. C. Flanagan and S. Freund. Atomizer: a dynamic atomicity checker for multithreaded programs. In POPL'04.
15. W. Halfond, S. Anand and A. Orso. Precise interface identification to improve testing and analysis of web applications. In ISSTA'09.
16. M. Harman and N. Alshahwan. Automated Session Data Repair for Web Application Regression Testing. In ICST'08.
17. A. Hassan and R. Holt. Architecture recovery of web applications. In ICSE'02.
18. Z. Lai, S. C. Cheung and W. K. Chan. Detecting atomicset serializability violations in multithreaded programs through active randomized testing invariants. In ICSE'10.
19. S. Lu, J. Tucek, F. Qin and Y. Zhou. AVIO: detecting atomicity violations via access interleaving invariants. In ASPLOS-XII.
20. G. Lucca and M. Penta. Integrating Static and Dynamic Analysis to improve the Comprehension of Existing Web Applications. WSE'05.
21. A. Marchetto, R. Tiella, P. Tonella, N. Alshahwan, M. Harman. Crawlability metrics for automated web testing. STTT 13(2) 2011.
22. M. Naik, A. Aiken and J. Whaley. Effective static race detection for Java. In PLDI'06 .
23. A. Nistor, D. Marinov and J. Torrellas. Light64: lightweight hardware support for data race detection during systematic testing of parallel programs. In MICRO-42.
24. R. O'Callahan and J. Choi. Hybrid dynamic data race detection. In PPoPP'03.
25. R. Paleari, D. Marrone, D. Bruschi and M. Monga. On Race Vulnerabilities in Web Applications. In DIMVA'08.
26. C. Park, K.Sen. Randomized active atomicity violation detection in concurrent programs. In SIGSOFT'08/FSE-16 .
27. S. Savage, M. Burrows, G. Nelson, P. Sobalvarro and T. Anderson. Eraser: a dynamic data race detector for multithreaded programs. In TOCS 15(4) 1997.
28. A. Singh, D. Marino, S. Narayanasamy, T. Millstein and M. Musuvathi. Efficient processor support for DRFx, a memory model with exceptions. In ASPLOS'11.
29. B. Smith and L. Williams. Using SQL Hotspots in a Prioritization Heuristic for Detecting All Types of Web Application Vulnerabilities. In ICST'11.
30. S. Sprenkle, L. Pollock and L. Simko. A Study of Usage-Based Navigation Models and Generated Abstract Test Cases for Web Applications. In ICST'11.
31. F. Sun, L. Xu, and Z. Su. Static Detection of Access Control Vulnerabilities in Web Applications. In USENIX Security 2011.
32. M. Vaziri, F. Tip and J. Dolby. Associating synchronization constraints with data in an object-oriented language. In POPL'06.
33. G. Wassermann, D. Yu, A. Chander, D. Dhurjati, H. Inamura and Z. Su. Dynamic test input generation for web applications. In ISSTA'08.
34. D. Weeratunge, X. Zhang, and S. Jagannathan. Accentuating the Positive: Atomicity Inference and Enforcement Using Correct Executions. In OOPSLA'11.
35. Y. Xie and A. Aiken. Scalable error detection using boolean satisfiability. In POPL'05.
36. Y. Xie and A. Aiken. Static detection of security vulnerabilities in scripting languages. In USENIX'06.
37. Y. Zheng, T. Bao and X. Zhang. Statically locating web application bugs caused by asynchronous calls. In WWW'11.