Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications

446 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask) (2010, background): “Many analyses of Web applications utilize dynamic taint analysis to detect common attacks such as SQL injections [3, 38, 39, 50, 55, 61] and cross-site”
A Large-Scale Analysis of the Security of Embedded Firmwares (2014, methodology): “Hence, in the future we plan to integrate static analysis tools for web applications [30, 11, 53, 38, 1] in our process.”
Back in Black: Towards Formal, Black Box Analysis of Sanitizers and Filters (2016, methodology): “Furthermore, we design an algorithm to convert the inferred models into BEK programs, which allows for further applications such as cross checking different sanitizer implementations and cross compiling sanitizers into different languages supported by the BEK backend.”
Automatic creation of SQL Injection and cross-site scripting attacks (2009, background): “Saner [2] combines static and dynamic analyses to find potential XSS and SQLI vulnerabilities.”
A Symbolic Execution Framework for JavaScript (2010, methodology): “Symbolic analyses and model-checking have been used for server-side code [2], [19]; however, the complexity of path conditions we observe requires more expressive symbolic reasoning than supported by tools for server-side code.”