NDLI: Looking at Web Security Vulnerabilities from the Programming Language Perspective: A Field Study

Content Provider	IEEE Xplore Digital Library
Author	Seixas, N. Fonseca, J. Vieira, M. Madeira, H.
Copyright Year	2009
Abstract	This paper presents a field study on web security vulnerabilities from the programming language type system perspective. Security patches reported for a set of 11 widely used web applications written in strongly typed languages (Java, C#, VB.NET) were analyzed in order to understand the fault types that are responsible for the vulnerabilities observed (SQL injection and XSS). The results are analyzed and compared with a similar work on web applications written using a weakly typed language (PHP). This comparison points out that some of the types of defects that lead to vulnerabilities are programming language independent, while others are strongly related to the language used. Strongly typed languages do reduce the frequency of vulnerabilities, as expected, but there still is a considerable number of vulnerabilities observed in the field. The characterization of those vulnerabilities shows that they are caused by a small number of fault types. This result is relevant to train programmers and code inspectors in the manual detection of such faults, and to improve static code analyzers to automatically detect the most frequent vulnerable program structures found in the field.
Starting Page	129
Ending Page	135
File Size	334557
Page Count	7
File Format	PDF
ISBN	9781424453757
ISSN	10719458
DOI	10.1109/ISSRE.2009.30
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2009-11-16
Publisher Place	India
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Security Computer languages Application software Reliability engineering Java Fault detection Computer bugs Computer hacking Testing Software reliability field study Security vulnerabilities software faults programming languages
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Analysis of the effect of Java software faults on security vulnerabilities and their detection by commercial web vulnerability scanner tool

Are There Language Specific Bug Patterns? Results Obtained from a Case Study Using Mozilla

An Investigation of Java Faults Operators Derived from a Field Data (2009)

Emulation of Software Faults: A Field Data Study and a Practical Approach

Insights on Fault Interference for Programs with Multiple Bugs

Non-operational testing of software for security issues

Web Application Testing with Customized Test Requirements - An Experimental Comparison Study

Static Code Analysis to Detect Software Security Vulnerabilities - Does Experience Matter?

Poison Java [data security]

Looking at Web Security Vulnerabilities from the Programming Language Perspective: A Field Study

Similar Documents

Analysis of the effect of Java software faults on security vulnerabilities and their detection by commercial web vulnerability scanner tool

Are There Language Specific Bug Patterns? Results Obtained from a Case Study Using Mozilla

An Investigation of Java Faults Operators Derived from a Field Data (2009)

Emulation of Software Faults: A Field Data Study and a Practical Approach

Insights on Fault Interference for Programs with Multiple Bugs

Non-operational testing of software for security issues

Web Application Testing with Customized Test Requirements - An Experimental Comparison Study

Static Code Analysis to Detect Software Security Vulnerabilities - Does Experience Matter?

Poison Java [data security]

Looking at Web Security Vulnerabilities from the Programming Language Perspective: A Field Study