Towards a Taint Mode for Cloud Computing Web Application
Paper in proceedings, 2012

Cloud computing is generally understood as the distribution of data and computations over the Internet. Over the past years, there has been a steep increase in web sites using this technology. Unfortunately, those web sites are not exempted from injection flaws and cross-site scripting, two of the most common security risks in web applications. Taint analysis is an automatic approach to detect vulnerabilities. Cloud computing platforms possess several features that, while facilitating the development of web applications, make it difficult to apply off-the-shelf taint analysis techniques. More specifically, several of the existing taint analysis techniques do not deal with persistent storage (e.g. object datastores), opaque objects (objects whose implementation cannot be accessed and thus tracking tainted data becomes a challenge), or a rich set of security policies (e.g. forcing a specific order of sanitizers to be applied). We propose a taint analysis for could computing web applications that consider these aspects. Rather than modifying interpreters or compilers, we provide taint analysis via a Python library for the cloud computing platform Google App Engine (GAE). To evaluate the use of our library, we harden an existing GAE web application against cross-site scripting attacks.

library

Python

taint analysis

web applications

cloud computing

Author

Luciano Bello

Chalmers, Computer Science and Engineering (Chalmers), Software Technology (Chalmers)

Alejandro Russo

Chalmers, Computer Science and Engineering (Chalmers), Software Technology (Chalmers)

7th Workshop on Programming Languages and Analysis for Security

7:1--7:12-

Subject Categories

Computer Engineering

Software Engineering

Computer Science

Areas of Advance

Information and Communication Technology

Roots

Basic sciences

DOI

10.1145/2336717.2336724

ISBN

978-1-4503-1441-1