Sciweavers

Share
PLDI
2009
ACM

TAJ: effective taint analysis of web applications

10 years 4 months ago
TAJ: effective taint analysis of web applications
Taint analysis, a form of information-flow analysis, establishes whether values from untrusted methods and parameters may flow into security-sensitive operations. Taint analysis can detect many common vulnerabilities in Web applications, and so has attracted much attention from both the research community and industry. However, most static taint-analysis tools do not address critical requirements for an industrial-strength tool. Specifically, an industrial-strength tool must scale to large industrial Web applications, model essential Web-application code artifacts, and generate consumable reports for a wide range of attack vectors. We have designed and implemented a static Taint Analysis for Java (TAJ) that meets the requirements of industry-level applications. TAJ can analyze applications of virtually any size, as it employs a set of techniques designed to produce useful answers given limited time and space. TAJ addresses a wide variety of attack vectors, with techniques to handle...
Omer Tripp, Marco Pistoia, Stephen J. Fink, Manu S
Added 19 May 2010
Updated 19 May 2010
Type Conference
Year 2009
Where PLDI
Authors Omer Tripp, Marco Pistoia, Stephen J. Fink, Manu Sridharan, Omri Weisman
Comments (0)
books