Static Analysis Tools Against Cross-site Scripting Vulnerabilities in Web Applications : An Analysis
Nurul Atiqah Abu Talib, Kyung-Goo Doh · Journal of Software Assessment and Valuation · 2021
Reports of rampant cross-site scripting (XSS) vulnerabilities raise growing concerns on the effectiveness of current Static Analysis Security Testing (SAST) tools as an internet security device.Attentive to these concerns, this study aims to examine seven open-source SAST tools in order to account for their capabilities in detecting XSS vulnerabilities in PHP applications and to determine their performance in terms of effectiveness and analysis runtime.The representative tools -categorized as either text-based or graph-based analysis tools -were all test-run using real-world PHP applications with known XSS vulnerabilities.The collected vulnerability detection reports of each tool were analyzed with the aid of PhpStorm's data flow analyzer.It is observed that the detection rates of the tools calculated from the total vulnerabilities in the applications can be as high as 0.968 and as low as 0.006.Furthermore, the tools took an average of less than a minute to complete an analysis.Notably, their runtime is independent of their analysis type.