Towards a Taint Mode for Cloud Computing Web Application
Paper i proceeding, 2012

Cloud computing is generally understood as the distribution of data and computations over the Internet. Over the past years, there has been a steep increase in web sites using this technology. Unfortunately, those web sites are not exempted from injection flaws and cross-site scripting, two of the most common security risks in web applications. Taint analysis is an automatic approach to detect vulnerabilities. Cloud computing platforms possess several features that, while facilitating the development of web applications, make it difficult to apply off-the-shelf taint analysis techniques. More specifically, several of the existing taint analysis techniques do not deal with persistent storage (e.g. object datastores), opaque objects (objects whose implementation cannot be accessed and thus tracking tainted data becomes a challenge), or a rich set of security policies (e.g. forcing a specific order of sanitizers to be applied). We propose a taint analysis for could computing web applications that consider these aspects. Rather than modifying interpreters or compilers, we provide taint analysis via a Python library for the cloud computing platform Google App Engine (GAE). To evaluate the use of our library, we harden an existing GAE web application against cross-site scripting attacks.

library

Python

taint analysis

web applications

cloud computing

Författare

Luciano Bello

Chalmers, Data- och informationsteknik, Programvaruteknik

Alejandro Russo

Chalmers, Data- och informationsteknik, Programvaruteknik

7th Workshop on Programming Languages and Analysis for Security

7:1--7:12-

Ämneskategorier

Datorteknik

Programvaruteknik

Datavetenskap (datalogi)

Styrkeområden

Informations- och kommunikationsteknik

Fundament

Grundläggande vetenskaper

DOI

10.1145/2336717.2336724

ISBN

978-1-4503-1441-1