Design of automatic vulnerability detection system for Web application program
Binbin Qu, Beihai Liang, Sheng Jiang, Chutian Ye · 2013
At present, Web application vulnerability safety problems widely exist because of the lack of effective validation and filtering mechanism for untrusted user data. This paper shows the design of the prototype system against SQL injection and cross-site scripting vulnerability. The main steps of the detection are as follows: construct the taint dependency graph for the program by the static analysis of source code; use finite state automata to represent the value of tainted string; verify whether the program has effective safe handling for the user input by matching with the attack pattern and then implement the prototype system for automatic detection on the Java Web program vulnerability based on taint dependency analysis. The experimental results show that the system is comprehensive and accurate for the detection of related vulnerabilities.