An Empirical Analysis of Input Validation Mechanisms in Web Applications and Languages Theodoor Scholte Davide Balzarotti SAP Research Institute Eurecom Sophia Antipolis, France Sophia Antipolis, France
[email protected] [email protected] William Robertson Engin Kirda Northeastern University Northeastern University Boston Boston
[email protected] [email protected] ABSTRACT 1. INTRODUCTION Web applications have become an integral part of the daily Web applications have become essential in our daily lives, lives of millions of users. Unfortunately, web applications and millions of users access these applications to communi- are also frequently targeted by attackers, and attacks such cate, socialize, and perform financial transactions. Unfortu- as XSS and SQL injection are still common. In this pa- nately, due to their increased popularity as well as the high per, we present an empirical study of more than 7000 input value data they expose, web applications have also become validation vulnerabilities with the aim of gaining deeper in- common targets for attackers. sights into how these common web vulnerabilities can be In the past decade, much effort has been spent on mak- prevented. In particular, we focus on the relationship be- ing web applications more secure, and much of this work tween the specific programming language used to develop has focused on mitigating input validation vulnerabilities. web applications and the vulnerabilities that are commonly The security research community has proposed numerous reported. Our findings suggest that most SQL injection and tools and techniques to detect and prevent such vulnera- a significant number of XSS vulnerabilities can be prevented bilities, including static code analysis [8, 11, 27, 28, 31], using straight-forward validation mechanisms based on com- dynamic tainting [18, 19, 20], prevention by construction or mon data types.