Static detection of cross-site scripting vulnerabilities

13 years 2 months ago
Static detection of cross-site scripting vulnerabilities
Web applications support many of our daily activities, but they often have security problems, and their accessibility makes them easy to exploit. In cross-site scripting (XSS), an attacker exploits the trust a web client (browser) has for a trusted server and executes injected script on the browser with the server's privileges. In 2006, XSS constituted the largest class of newly reported vulnerabilities making it the most prevalent class of attacks today. Web applications have XSS vulnerabilities because the validation they perform on untrusted input does not suffice to prevent that input from invoking a browser's JavaScript interpreter, and this validation is particularly difficult to get right if it must admit some HTML mark-up. Most existing approaches to finding XSS vulnerabilities are taintbased and assume input validation functions to be adequate, so they either miss real vulnerabilities or report many false positives. This paper presents a static analysis for finding ...
Gary Wassermann, Zhendong Su
Added 17 Nov 2009
Updated 17 Nov 2009
Type Conference
Year 2008
Where ICSE
Authors Gary Wassermann, Zhendong Su
Comments (0)