conference proceedings Proceedings of the 2nd USENIX Conference Application on Web Development 2nd USENIX Conference on Web Application Development (WebApps ’11) Portland, OR, USA Portland, OR, USA June 15–16, 2011 Sponsored by June 15–16, 2011 © 2011 by The USENIX Association All Rights Reserved This volume is published as a collective work. Rights to individual papers remain with the author or the author’s employer. Permission is granted for the noncommercial reproduction of the complete work for educational or research purposes. Permission is granted to print, primarily for one person’s exclusive use, a single copy of these Proceedings. USENIX acknowledges all trademarks herein. ISBN 978-931971-86-7 USENIX Association Proceedings of the 2nd USENIX Conference on Web Application Development June 15–16, 2011 Portland, OR, USA Conference Organizers Program Chair Armando Fox, University of California, Berkeley Program Committee Adam Barth, Google Inc. Abdur Chowdhury, Twitter Jon Howell, Microsoft Research Collin Jackson, Carnegie Mellon University Bobby Johnson, Facebook Emre Kıcıman, Microsoft Research Michael E. Maximilien, IBM Research Owen O’Malley, Yahoo! Research John Ousterhout, Stanford University Swami Sivasubramanian, Amazon Web Services Geoffrey M. Voelker, University of California, San Diego Nickolai Zeldovich, Massachusetts Institute of Technology The USENIX Association Staff WebApps ’11: 2nd USENIX Conference on Web Application Development June 15–16, 2011 Portland, OR, USA Message from the Program Chair . v Wednesday, June 15 10:30–Noon GuardRails: A Data-Centric Web Application Security Framework . 1 Jonathan Burket, Patrick Mutchler, Michael Weaver, Muzzammil Zaveri, and David Evans, University of Virginia PHP Aspis: Using Partial Taint Tracking to Protect Against Injection Attacks . 13 Ioannis Papagiannis, Matteo Migliavacca, and Peter Pietzuch, Imperial College London Secure Data Preservers for Web Services . 25 Jayanthkumar Kannan, Google Inc.; Petros Maniatis, Intel Labs; Byung-Gon Chun, Yahoo! Research 1:00–2:30 BenchLab: An Open Testbed for Realistic Benchmarking of Web Applications . 37 Emmanuel Cecchet, Veena Udayabhanu, Timothy Wood, and Prashant Shenoy, University of Massachusetts Amherst Resource Provisioning of Web Applications in Heterogeneous Clouds . 49 Jiang Dejun, VU University Amsterdam and Tsinghua University Beijing; Guillaume Pierre, VU University Amsterdam; Chi-Hung Chi, Tsinghua University Beijing C3: An Experimental, Extensible, Reconfigurable Platform for HTML-based Applications . 61 Benjamin S. Lerner and Brian Burg, University of Washington; Herman Venter and Wolfram Schulte, Microsoft Research 3:00–4:30 The Effectiveness of Application Permissions . .. 75 Adrienne Porter Felt, Kate Greenwood, and David Wagner, University of California, Berkeley Experiences on a Design Approach for Interactive Web Applications . 87 Janne Kuuskeri, Tampere University of Technology Exploring the Relationship Between Web Application Development Tools and Security . 99 Matthew Finifter and David Wagner, University of California, Berkeley Thursday, June 16 1:00–2:30 Integrating Long Polling with an MVC Web Framework . 113 Eric Stratmann, John Ousterhout, and Sameer Madan, Stanford University Detecting Malicious Web Links and Identifying Their Attack Types . .125 Hyunsang Choi, Korea University; Bin B. Zhu, Microsoft Research Asia; Heejo Lee, Korea University Maverick: Providing Web Applications with Safe and Flexible Access to Local Devices . 137 David W. Richardson and Steven D. Gribble, University of Washington Message from the WebApps ’11 Program Chair Welcome to WebApps ’11, the second annual USENIX Conference on Web Application Development. Our con- tinuing emphasis is ensuring that attendees are exposed to the most interesting new work from both industry and academia. To that end, both the program committee and the accepted papers represent a balanced mix of industry practitioners from the highest-profile Web companies and university researchers working on cutting-edge Web technologies. The twelve papers presented (of 28 submissions received) were subjected to the rigorous review standards for which USENIX’s academically focused conferences are known. All papers received at least three thorough reviews and some received more; each paper got a fair and complete discussion at the in-person program committee meet- ing in Berkeley; and each paper was assigned a shepherd to help improve the final presentation. We hope you will be pleased with the results, which showcase a wide variety of Web applications and technologies. I’d like to thank the authors for taking the time to submit a paper, whether it was accepted or not. Preparing a paper is a lot of work, and we are still exploring ways to engage industrial authors and get the best industrial work along with the best academic work. I personally welcome any suggestions from authors or prospective authors in this regard. I also thank the program committee for their efforts in reviewing and shepherding, especially some of the indus- trial participants, whose schedules can be particularly hectic. Lastly, as always, USENIX’s professional organization makes the logistical aspects of running a program commit- tee a breeze, especially Ellie Young, Anne Dickison, Casey Henderson, and Jane-Ellen Long, along with the rest of the USENIX staff. I hope that what you see and hear at WebApps ’11 inspires you to submit your own best work to future WebApps conferences. Armando Fox, University of California, Berkeley GuardRails: A Data-Centric Web Application Security Framework Jonathan Burket Patrick Mutchler Michael Weaver Muzzammil Zaveri David Evans http://guardrails.cs.virginia.edu University of Virginia Abstract cies is scattered throughout the application, making ac- cess checks at a variety of locations or sanitizing strings Modern web application frameworks have made it easy where they might be potentially harmful. This decentral- to create powerful web applications. Developing a se- ized approach to security makes it difficult, if not impos- cure web application, however, still requires a developer sible, to be certain that all access points and data flow to posses a deep understanding of security vulnerabili- paths are correctly mediated. Further, security policies ties and attacks. Even for experienced developers it is are rarely completely known from the start; rather they tedious, if not impossible, to find and eliminate all vul- evolve along with the development of the application or nerabilities. This paper presents GuardRails, a source-to- in response to new threats. Changing an existing policy source tool for Ruby on Rails that helps developers build can be very difficult, as changes must be made across the secure web applications. GuardRails works by attach- entire application. ing security policies defined using annotations to the data To alleviate these problems, we developed Guard- model itself. GuardRails produces a version of the input Rails, a source-to-source tool for Ruby on Rails appli- application that automatically enforces the specified poli- cations that centralizes the implementation of security cies. GuardRails helps developers prevent a myriad of policies. GuardRails works by attaching security policies security problems including cross-site scripting attacks directly to data, and automatically enforcing these poli- and access control violations while providing a large de- cies throughout the application. Developers define their gree of flexibility to support a range of policies and de- policies using annotations added to their data model. velopment styles. GuardRails automatically generates the code necessary to enforce the specified policies. The policy decisions are centralized and documented as part of the data model 1 Introduction where they are most relevant, and developers do not need to worry about missing security checks or inconsistent Web application frameworks have streamlined develop- enforcement. ment of web applications in ways that relieve program- Like most web application frameworks, Ruby on Rails mers from managing many details like how data is stored provides an object interface to data stored in database ta- in the database and how output pages are generated. Web bles. This enables GuardRails to attach policies to ob- application frameworks do not, however, provide enough jects and make those policies persist as data moves be- assistance to enable developers to produce secure web tween the application and database. The abstract data applications without a great deal of tedious effort. The model provided by Ruby on Rails is one key advantage goal of this work is to demonstrate that incorporating over systems like DBTaint [4, 18], which have no knowl- data-centric policies and automatic enforcement into a edge of what the relevant data actually represents within web application framework can greatly aid developers in the context of the application. While our implementation producing secure web applications. of GuardRails is specific to Ruby on Rails, we expect When developing web applications, developers typi- most of our approach could also be applied to similar cally have an idea of what security policies they want frameworks for other languages. to enforce. Ranging from which users should have ac- cess to which data to how certain pieces of user input Contributions. Our major contribution is a new ap- should be sanitized, these policies are rarely documented proach for managing web application security focused on in