摘要
Web应用程序数量多、应用广泛,然而它们却存在各种能被利用的安全漏洞,这当中跨站脚本(XSS)的比例是最大的。因此为了更好地检测Web应用中的XSS漏洞,提出了一种结合污染传播模型的代码静态分析及净化单元动态检测的方法,其中包括XSS漏洞所对应的源规则、净化规则和接收规则的定义及净化单元动态检测算法的描述。分析表明,该方法能有效地发现Web应用中的XSS漏洞。
Web applications have a variety of security vulnerabilities which can be exploited when large number of Web applications are widely used. Among these security vulnerabilities, the ratio of cross-site scripting （XSS） is the best. Therefore, in order to detect XSS vulnerabilities in Web applications more effectively, this paper presented a method that combines the static code analysis based on Tainted mode model with the sanitizing unit dynamic testing which includes the definition of the source rules, the sanitizing rules and the receiving rules of XSS vulnerabilities and the description of the dynamic detection algorithm for sanitizing unit. Analysis shows that this method can effectively find XSS vulnerabilities in Web applications.
出处
《计算机科学》
CSCD
北大核心
2012年第B06期51-53,85,共4页
Computer Science
关键词
XSS漏洞
污染传播模型
净化单元
静态分析
动态检测
XSS vulnerability
Tainted mode model
Sanitizing unit
Static analysis
Dynamic testing
