A Deep Study of the Effects and Fixes of Server-Side Request Races in Web Applications
A Deep Study of the Effects and Fixes of Server-Side Request Races in Web Applications
复制标题
DOI：
10.1145/3524842.3528463
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
Zhengyi Qiu;Shudi Shao;Qi Zhao;Hassan Ali Khan;Xinning Hui;Guoliang Jin
中科院分区：
文献类型：
--
作者：
Zhengyi Qiu;Shudi Shao;Qi Zhao;Hassan Ali Khan;Xinning Hui;Guoliang Jin
服务器端Web应用程序很容易受到请求竞赛的影响。尽管存在一些对现实请求种族的研究，但它们主要集中于这些错误的根本原因。为了更好地在服务器端Web应用程序中进行战斗请求竞赛，我们需要对其特征有深入的了解。在本文中，我们通过使用对象相关映射（ORM）框架开发的Web应用程序的一组请求竞赛提供了对种族效果和修复的互补关注。我们重新审视了以前有关新纳入请求种族的研究中使用的特征性问题，区分请求种族的外部和内部效果，并将RequestRace修复与语言和框架中的并发控制机制联系起来，以开发服务器端网络应用程序。我们的研究表明：（1）从基于ORM的Web应用程序中请求与RAW-SQL Web应用程序的特征相同的特征； （2）违反应用程序语义的请求种族在没有明确崩溃和错误消息的情况下是常见的，而潜在请求种族只能在内部损坏某些共享资源，但需要额外的请求才能暴露不当行为的行为； （3）使用同步机制以外的各种修复策略用于修复请求种族。我们希望我们的结果可以帮助开发人员更好地了解请求竞赛，并指导设计和开发打击请求种族的工具。
Server-side web applications are vulnerable to request races. While some previous studies of real-world request races exist, they primarily focus on the root cause of these bugs. To better combat request races in server-side web applications, we need a deep understanding of their characteristics. In this paper, we provide a complementary focus on race effects and fixes with an enlarged set of request races from web applications developed with Object-Relational Mapping (ORM) frameworks. We revisit characterization questions used in previous studies on newly included request races, distinguish the external and internal effects of request races, and relate requestrace fixes with concurrency control mechanisms in languages and frameworks for developing server-side web applications. Our study reveals that: (1) request races from ORM-based web applications share the same characteristics as those from raw-SQL web applications; (2) request races violating application semantics without explicit crashes and error messages externally are common, and latent request races, which only corrupt some shared resource internally but require extra requests to expose the misbehavior, are also common; and (3) various fix strategies other than using synchronization mechanisms are used to fix request races. We expect that our results can help developers better understand request races and guide the design and development of tools for combating request races.