F4F

This paper presents F4F (Framework For Frameworks), a system for effective taint analysis of framework-based web applications. Most modern web applications utilize one or more web frameworks, which provide useful abstractions for common functionality. Due to extensive use of reflective language constructs in framework implementations, existing static taint analyses are often ineffective when applied to framework-based applications. While previous work has included ad hoc support for certain framework constructs, adding support for a large number of frameworks in this manner does not scale from an engineering standpoint.

To increase and maintain web application security, developers could use some different methods, one of them is static code analysis. This method could find security vulnerabilities inside a source code without the need of running the program. It could also be automated by using tools, which considered more efficient than manual reviews. One specific method which is commonly used in static code analysis is taint analysis. Taint analysis usually utilizes source code modeling to prepare the code for analysis process to detect any untrusted data flows into security sensitives computations. While this kind of analysis could be very helpful, static code analysis tool for Laravel-based web application is still quite rare, despite its popularity. Therefore, in this research, we want to know how static code (taint) analysis could be utilized to detect security vulnerabilities and how the projects (Laravel-based) should be modeled in order to facilitate this analysis. We then developed a static analysis tool, which models the application’s source code using AST and dictionary to be used as the base of the taint analysis. The tool first parsed the route file of Laravel project to get a list of controller files. Each file in that list would be parsed in order to build the source code representation, before actually being analyzed using taint analysis method. The experiments was done using this tool shows that the tools (with taint analysis) could detect 13 security vulnerabilities from 6 Laravel-based projects with one False Negative. An ineffective sanitizer was the suspected cause of this False Negative. This also shows that proposed modeling technique could be helpful in facilitating taint analysis in Laravel-based projects. For future development and studies, this tool should be tested with more Laravel and even other framework based web application with a wider range of security vulnerabilities.

The article provides a comparative analysis of web frameworks based on the Python programming language. The right choice of a software development tool will allow developers to speed up the process of designing and software implementation of web resources. With the development of programming languages, solutions have begun to appear that make it easier for programmers to create web applications. In recent years, many tools of this type have been developed, including web frameworks. Some of them are used to develop small web applications, and other frameworks are used to create large-scale systems. The existing web frameworks differ from each other, but choosing them can be a difficult task for a programmer. Therefore, it is necessary to specify several parameters that are common to frameworks, according to which the desired web framework should be selected. The selected criteria make it possible to evaluate the frameworks more qualitatively and more objectively and speed up the process of design and software implementation of web resources. Due to the high demand for web applications, developers need to develop cost-effective, secure and well-coded web applications. Analyzing the Django framework, it can be argued that it is the most popular for web development, written in the Python programming language and using the MVC architecture. It is ideal for application projects with limited time and a small budget. If the application is not very voluminous and only simple URL routing and templates with a simple context are needed, then the Flask framework can be used instead of Django. The framework for building a Flask application in the resulting HTML files contains additional tags and scripts. The mechanism of work of processing forms also works differently. Flask stores more information about form fields on pages. The size of HTML files created using the Flask framework turns out to be significantly larger.

Taint analysis, a form of information-flow analysis, establishes whether values from untrusted methods and parameters may flow into security-sensitive operations. Taint analysis can detect many common vulnerabilities in Web applications, and so has attracted much attention from both the research community and industry. However, most static taint-analysis tools do not address critical requirements for an industrial-strength tool. Specifically, an industrial-strength tool must scale to large industrial Web applications, model essential Web-application code artifacts, and generate consumable reports for a wide range of attack vectors. We have designed and implemented a static Taint Analysis for Java (TAJ) that meets the requirements of industry-level applications. TAJ can analyze applications of virtually any size, as it employs a set of techniques designed to produce useful answers given limited time and space. TAJ addresses a wide variety of attack vectors, with techniques to handle reflective calls, flow through containers, nested taint, and issues in generating useful reports. This paper provides a description of the algorithms comprising TAJ, evaluates TAJ against production-level benchmarks, and compares it with alternative solutions.

Web applications are a frequent target of successful attacks. In most web frameworks, the damage is amplified by the fact that application code is responsible for security enforcement. In this paper, we design and evaluate Radiatus, a shared-nothing web framework where application-specific computation and storage on the server is contained within a sandbox with the privileges of the end-user. By strongly isolating users, user data and service availability can be protected from application vulnerabilities.

Modern web applications are built on top of web frameworks, which offer benefits such as feature reuse and productivity improvement. By relying on web frameworks, developers can safely handle the multiple needs of real-world web applications. Despite the benefits of web frameworks, they are not intended to address all requirements to create web applications. In particular, the Django web framework provides a rich software ecosystem of reusable applications to support developers with advanced development aspects, such as modern authentication, caching, and deployment. However, currently, it is not clear what solutions developers can reuse or how active and reliable this ecosystem really is. To overcome this gap, this paper proposes an empirical study to assess the Django ecosystem of reusable applications. We analyze 487 reusable applications to understand their target domain, activity level, frequency of tests, and compatibility. We find that reusable applications are mostly concentrated in three categories: developer tools (27.8%), user interface (17.1%), and persistence (15.9%). Overall, these categories have distinct characteristics; for example, developer tools have the highest concentration of young and inactive applications, while persistence applications are the oldest. The reusable applications are 7.7 years old but have 10.17 months without commits, on the median. We also find that 80% of the reusable applications include the supported Python versions, 64% include the Django versions, and only 61% include both Python and Django versions. We detect that upgrading to recent versions of Django and Python may not be supported in some reusable applications, but compatibility issues become less problematic in recent Django and Python versions. Finally, based on our findings, we provide implications for practitioners and researchers.

Web applications represent an important category of applications that owe much of their popularity to the ubiquitous accessibility using standard web browsers. The complexity of web applications is steadily increasing since the inception of the Internet and the way it is perceived changes from a pure information source to a platform for applications. Many different web frameworks exist that support recurring and tedious development tasks in order to simplify the process of building web applications. Most of the currently available web frameworks adhere to the widely accepted Model 2 design pattern that targets a clean separation of model, view and controller parts of an application in the sense of MVC. Nevertheless, existing frameworks are conceived to work with standard object-oriented business applications only and do not respect the particularities and possibilities of agent applications. Hence, in this paper a new architecture, in accordance with the Model 2 design pattern, is proposed that is able to combine the strengths of agent-based computing with web interactions. This architecture is the basis for the Jadex Webbridge framework, which enables a seamless integration of the Jadex BDI framework with state-of-the art JSP technology. The usage of web technology in combination with agents is further exemplified by an electronic bookstore case study.

Modern and Responsive Mobile-enabled Web Applications

Cross-site scripting (XSS) vulnerabilities are significant threats to web applications. The number of XSS vulnerabilities reported has increased annually for the past three years, posing a considerable challenge to web application maintainers. Black-box scanners are mainstream tools for security engineers to perform penetration testing and detect XSS vulnerabilities. Unfortunately, black-box scanners rely on crawlers to find input points of web applications and cannot guarantee all input points are tested. To this end, we propose a grey-box fuzzing method based on reinforcement learning, which can detect reflected and stored XSS vulnerabilities for Java web applications. We first use static analysis to identify potential input points from components (i.e., Java code, configuration files, and HTML files) of the Java web application. Then, an XSS vulnerability payload generation method is proposed, which is used together with the reinforcement learning model. We define the state, action, and reward functions of three reinforcement learning models for XSS vulnerability detection scenarios so that the fuzz loop can be performed automatically. To demonstrate the effectiveness of the proposed method, we compare it against four state-of-the-art web scanners. Experimental results show that our method finds all XSS vulnerabilities and has no false positives.

Today’s applications can be described in terms of the frameworks they use—web applications use web frameworks, service tiers use remoting and persistence frameworks (such as ORMs and Spring’s remoting hierarchy), messaging applications use messaging frameworks, and so on. Often, however, there is another type of application that sits in all these layers and handles bulk operations—operations that deal with large amounts of data, such as data loading, exporting, synchronizing. Bulk processing, or batch processing, is a common requirement for most applications, both in the initial setup and the ongoing maintenance. The only thing most batch processing applications have in common, however, is the manipulation of large amounts of data; how they get the data, where it’s written, and what must be done to adapt it all tend to be unique. Spring Batch provides a very flexible, expressive way to deal with large amounts of data.

Security-by-construction in web applications development via database annotations

The source code of a web application executed on the web browser has been exposed to leakage, and it is difficult to implement various web functions compared with other general applications. Therefore, in practical web applications, web plug-in technologies are used. However, web plug-in technology has a platform dependency and is attacked by malicious codes which resulting in a damage of the system. On the other hands, the web-based emulator is independent of platforms as well as web browsers. Recently, various web emulators were introduced, and users can use it as the virtual machine environment of diverse platforms on the web browser. However, these web-based emulator doesn’t provide an interface API to access other web application. In this paper, we propose the modified web-based emulator with the interface module and API, called as the web emulator-based execution engine. Using the proposed system, a native code in a web application is easily written by C, and C++ and compiled. Furthermore it can be distributed and executed directly on the emulator-based web application execution engine. Therefore it solves the leak problem of source codes that is the vulnerability of web applications. The proposed emulator-based web application execution engine is a new concept combined web plug-in and emulator. In the experiment we developed an interface module and an API for the proposed emulator-based web application execution engine. The experimental emulator-based web application was implemented and tested to evaluate the overall system.KeywordsWeb applicationObfuscationEmulatorJavaScriptNative binary

According to Internet Live Stats, it is evident that organizations and developers are underestimating security issues on their system. In this paper, we propose a protective and extensible solution for automatically detecting both the Web application vulnerabilities and malicious Web shells. Based on the original THAPS, we proposed E-THAPS that has a new detecting mechanism, improved SQLi, XSS and vulnerable functions detecting capabilities. For malicious Web shell detection, taint analysis and pattern matching methods are selected as the main approach. The broad experiment that we performed showed our outstanding results in comparison with other solutions for detecting the Web application vulnerabilities and malicious Web shells.

At present, Cross Site Scripting (XSS) vulnerability exists in most web sites. The main reason is the lack of effective validation and filtering mechanisms for user input data from web request. This paper explores vulnerability detection method which based on taint dependence analysis and implements a prototype system for Java Web program. We treat all user input as tainted data, and track the flow of Web applications, then we judge whether it will trigger an attack or not. The taint dependent analysis algorithm mentioned in this paper is used to construct the taint dependency graph. Next the value representation method of the string tainted object based on finite state automata is discussed. Finally, we propose the vulnerability detection method for the program. The experiment result shows that the prototype system can detect reflection cross-site scripting vulnerability well in those programs which dont have effective treatment for the user input data.

BackgroundModern data-driven medical research provides new insights into the development and course of diseases and enables novel methods of clinical decision support. Clinical and translational data warehouses, such as Informatics for Integrating Biology and the Bedside (i2b2) and tranSMART, are important infrastructure components that provide users with unified access to the large heterogeneous data sets needed to realize this and support use cases such as cohort selection, hypothesis generation, and ad hoc data analysis.ObjectiveOften, different warehousing platforms are needed to support different use cases and different types of data. Moreover, to achieve an optimal data representation within the target systems, specific domain knowledge is needed when designing data-loading processes. Consequently, informaticians need to work closely with clinicians and researchers in short iterations. This is a challenging task as installing and maintaining warehousing platforms can be complex and time consuming. Furthermore, data loading typically requires significant effort in terms of data preprocessing, cleansing, and restructuring. The platform described in this study aims to address these challenges.MethodsWe formulated system requirements to achieve agility in terms of platform management and data loading. The derived system architecture includes a cloud infrastructure with unified management interfaces for multiple warehouse platforms and a data-loading pipeline with a declarative configuration paradigm and meta-loading approach. The latter compiles data and configuration files into forms required by existing loading tools, thereby automating a wide range of data restructuring and cleansing tasks. We demonstrated the fulfillment of the requirements and the originality of our approach by an experimental evaluation and a comparison with previous work.ResultsThe platform supports both i2b2 and tranSMART with built-in security. Our experiments showed that the loading pipeline accepts input data that cannot be loaded with existing tools without preprocessing. Moreover, it lowered efforts significantly, reducing the size of configuration files required by factors of up to 22 for tranSMART and 1135 for i2b2. The time required to perform the compilation process was roughly equivalent to the time required for actual data loading. Comparison with other tools showed that our solution was the only tool fulfilling all requirements.ConclusionsOur platform significantly reduces the efforts required for managing clinical and translational warehouses and for loading data in various formats and structures, such as complex entity-attribute-value structures often found in laboratory data. Moreover, it facilitates the iterative refinement of data representations in the target platforms, as the required configuration files are very compact. The quantitative measurements presented are consistent with our experiences of significantly reduced efforts for building warehousing platforms in close cooperation with medical researchers. Both the cloud-based hosting infrastructure and the data-loading pipeline are available to the community as open source software with comprehensive documentation.