Finding security vulnerabilities in java applications with static analysis Export

@inproceedings{citeulike:2637269, abstract = {This paper proposes a static analysis technique for detecting many recently discovered application vulnerabilities such as SQL injections, cross-site scripting, and HTTP splitting attacks. These vulnerabilities stem from unchecked input, which is widely recognized as the most common source of security vulnerabilities in Web applications. We propose a static analysis approach based on a scalable and precise points-to analysis. In our system, user-provided specifications of vulnerabilities are automatically translated into static analyzers. Our approach finds all vulnerabilities matching a specification in the statically analyzed code. Results of our static analysis are presented to the user for assessment in an auditing interface integrated within Eclipse, a popular Java development environment.}, address = {Berkeley, CA, USA}, author = {Livshits, V. Benjamin and Lam, Monica S.}, booktitle = {SSYM'05: Proceedings of the 14th conference on USENIX Security Symposium}, citeulike-article-id = {2637269}, citeulike-linkout-0 = {http://portal.acm.org/citation.cfm?id=1251416}, keywords = {information\_flow, joe\_e, security, stanford, static\_analysis, web\_application\_security}, location = {Baltimore, MD}, pages = {18}, posted-at = {2009-10-16 23:13:45}, priority = {2}, publisher = {USENIX Association}, title = {Finding security vulnerabilities in java applications with static analysis}, url = {http://portal.acm.org/citation.cfm?id=1251416}, year = {2005} }

TY - CONF ID - citeulike:2637269 L3 - citeulike-article-id:2637269 N2 - This paper proposes a static analysis technique for detecting many recently discovered application vulnerabilities such as SQL injections, cross-site scripting, and HTTP splitting attacks. These vulnerabilities stem from unchecked input, which is widely recognized as the most common source of security vulnerabilities in Web applications. We propose a static analysis approach based on a scalable and precise points-to analysis. In our system, user-provided specifications of vulnerabilities are automatically translated into static analyzers. Our approach finds all vulnerabilities matching a specification in the statically analyzed code. Results of our static analysis are presented to the user for assessment in an auditing interface integrated within Eclipse, a popular Java development environment. CY - Baltimore, MD AD - Berkeley, CA, USA EP - 18 TI - Finding security vulnerabilities in java applications with static analysis PB - USENIX Association T2 - SSYM'05: Proceedings of the 14th conference on USENIX Security Symposium SP - 18 KW - information_flow KW - joe_e KW - security KW - stanford KW - static_analysis KW - web_application_security AU - Livshits, Benjamin AU - Lam, Monica PY - 2005/// UR - http://portal.acm.org/citation.cfm?id=1251416 ER -