Understanding and detecting server-side request races in web applications
Understanding and detecting server-side request races in web applications
复制标题
DOI：
10.1145/3468264.3468594
复制
发表时间：
2021-08
期刊：
影响因子：
--
通讯作者：
Zhengyi Qiu;Shudi Shao;Qi Zhao;Guoliang Jin
中科院分区：
文献类型：
--
作者：
Zhengyi Qiu;Shudi Shao;Qi Zhao;Guoliang Jin
现代网站经常在服务器上运行Web应用程序，以处理用户的HTTP请求并生成动态响应。由于其并发性质，Web应用程序很容易受到服务器端请求竞赛的影响。随着Web应用程序的不断流行，问题变得更加严重。我们首先对从不同流行类型的Web应用程序收集的157个现实服务器端请求种族进行了全面的特征研究。这项研究的结果可以为对服务器端请求竞赛的未来开发支持提供指导。在我们的研究结果的指导下，我们开发了一个动态框架Reqracer，用于检测和暴露Web应用程序中的服务器端请求赛车。我们提出了新颖的方法来建模在HTTP请求之间发生的关系之前，这对于Web应用程序至关重要。我们的评估表明，Reqracer可以有效，有效地检测已知和未知的请求种族。
Modern web sites often run web applications on the server to handle HTTP requests from users and generate dynamic responses. Due to their concurrent nature, web applications are vulnerable to server-side request races. The problem becomes more severe with the ever-increasing popularity of web applications. We first conduct a comprehensive characteristic study of 157 real-world server-side request races collected from different, popular types of web applications. The findings of this study can provide guidance for future development support in combating server-side request races. Guided by our study results, we develop a dynamic framework, ReqRacer, for detecting and exposing server-side request races in web applications. We propose novel approaches to model happens-before relationships between HTTP requests, which are essential to web applications. Our evaluation shows that ReqRacer can effectively and efficiently detect known and unknown request races.