Securing web application code by static analysis and runtime protection

TLDR

Security remains a major roadblock to universal Web adoption, especially as remotely exploitable vulnerabilities in web applications have surged, while verification tools have begun uncovering hidden bugs in legacy C programs, suggesting similar success could be achieved for web apps. The paper proposes a sound, holistic approach to ensuring Web application security. The authors developed a lattice‑based static analysis algorithm that models vulnerabilities as secure information flow, instruments code with runtime guards, and implemented it in the WebSSARI tool, which was applied to 230 open‑source projects. The approach uncovered 69 vulnerabilities in 230 projects, 38 developers acknowledged them, and with sufficient annotations the runtime overhead was reduced to zero, achieving a 98.4 % reduction in potential overhead.

Abstract

Security remains a major roadblock to universal acceptance of the Web for many kinds of transactions, especially since the recent sharp increase in remotely exploitable vulnerabilities have been attributed to Web application bugs. Many verification tools are discovering previously unknown vulnerabilities in legacy C programs, raising hopes that the same success can be achieved with Web applications. In this paper, we describe a sound and holistic approach to ensuring Web application security. Viewing Web application vulnerabilities as a secure information flow problem, we created a lattice-based static analysis algorithm derived from type systems and typestate, and addressed its soundness. During the analysis, sections of code considered vulnerable are instrumented with runtime guards, thus securing Web applications in the absence of user intervention. With sufficient annotations, runtime overhead can be reduced to zero. We also created a tool named.WebSSARI (Web application Security by Static Analysis and Runtime Inspection) to test our algorithm, and used it to verify 230 open-source Web application projects on SourceForge.net, which were selected to represent projects of different maturity, popularity, and scale. 69 contained vulnerabilities. After notifying the developers, 38 acknowledged our findings and stated their plans to provide patches. Our statistics also show that static analysis reduced potential runtime overhead by 98.4%.