A Sanitizer-centric Analysis to Detect Cross-Site Scripting in PHP Programs
He Su, Lili Xu, Huina Chao, Feng Li, Zimu Yuan, Jianhua Zhou, Wei Huo · 2022
A large number of PHP applications suffer from Cross-Site Scripting (XSS) attacks every year. Static taint analysis is a prevalent way to detect taint-style vulnerabilities like XSS. However, the precision of current tools suffers severely due to dynamic features of PHP programs and the incomplete recognition of user-defined sanitizers, which lead to false negatives and a large number of false positives. In this paper, we present PAT, a PHP static Analysis Tool for effective XSS vulnerability detection. A new concept of “inner” source and sink is introduced for the first time to shorten the taint paths needed to be traced statically, which therefore mitigates the broken path problem induced by dynamic language features to a certain extent. A sanitizer-centric approach is proposed to automatically identify them. Moreover, PAT leverages both data flow analysis and NLP technique to accurately identify user-defined sanitizers with a precision 82.8%. Lastly, PAT performs a classical taint analysis with the enhanced taint specifications (i.e., sources, sinks and sanitizers). Evaluations on 5 large, real-world PHP web applications and 5 popular WordPress plugins show that PAT performs better in XSS detection compared with 3 existing tools. Besides, 8 zero-day bugs are detected and confirmed by the developers.