Efficient character-level taint tracking for Java
Efficient character-level taint tracking for Java
复制标题
Java 的高效字符级污点跟踪
DOI：
10.1145/1655121.1655125
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
D. Wagner
中科院分区：
文献类型：
--
作者：
Erika Chin;D. Wagner
超过80%的web服务容易受到攻击，其中大部分危险来自命令注入漏洞。我们为Java web应用程序提供了一个有效的字符级污染跟踪系统，并认为它可以用来防御命令注入漏洞。我们的方法只涉及修改Java库类和Java servlet框架的实现，因此它只需要对服务器进行一次修改，而不需要对web应用程序的字节码进行任何后续修改或访问web应用程序的源代码。这使得部署我们的技术和保护遗留web软件变得容易。我们对JForum web应用程序的初步实验表明，字符级污染跟踪会增加0-15%的运行时开销。
Over 80% of web services are vulnerable to attack, and much of the danger arises from command injection vulnerabilities. We present an efficient character-level taint tracking system for Java web applications and argue that it can be used to defend against command injection vulnerabilities. Our approach involves modification only to Java library classes and the implementation of the Java servlets framework, so it requires only a one-time modification to the server without any subsequent modifications to a web application's bytecode or access to the web application's source code. This makes it easy to deploy our technique and easy to secure legacy web software. Our preliminary experiments with the JForum web application suggest that character-level taint tracking adds 0-15% runtime overhead.