Impact of Coding Styles on Behaviours of Static Analysis Tools for Web Applications

Web applications have become an essential resource to access the services of diverse subjects (e.g., financial, healthcare) available on the Internet. Despite the efforts that have been made on its security, namely on the investigation of better techniques to detect vulnerabilities on its source cod...

Full description

Saved in:
Bibliographic Details
Published in2020 50th Annual IEEE-IFIP International Conference on Dependable Systems and Networks-Supplemental Volume (DSN-S) pp. 55 - 56
Main Authors Medeiros, Iberia, Neves, Nuno
Format Conference Proceeding
LanguageEnglish
Published IEEE 01.06.2020
Subjects
coding styles
Cross-site scripting
Electronic mail
Encoding
Registers
software security
Static analysis
Static analysis tools
Web vulnerabilities
Online AccessGet full text

Cover

More Information
Summary:Web applications have become an essential resource to access the services of diverse subjects (e.g., financial, healthcare) available on the Internet. Despite the efforts that have been made on its security, namely on the investigation of better techniques to detect vulnerabilities on its source code, the number of vulnerabilities exploited has not decreased. Static analysis tools (SATs) are often used to test the security of applications since their outcomes can help developers in the correction of the bugs they found. The conducted investigation made over SATs stated they often generate errors (false positives (FP) and false negatives (FN)), whose cause is recurrently associated with very diverse coding styles, i.e., similar functionality is implemented in distinct manners, and programming practices that create ambiguity, such as the reuse and share of variables. Based on a common practice of using multiple forms in a same webpage and its processing in a single file, we defined a use case for user login and register with six coding styles scenarios for processing their data, and evaluated the behaviour of three SATs (phpSAFE, RIPS and WAP) with them to verify and understand why SATs produce FP and FN.
DOI:10.1109/DSN-S50200.2020.00030