AUTOMATIC UNIT TESTING TO DETECT SECURITY VULNERABILITIES IN WEB APPLICATIONS

1 online resource (109 pages) : PDF

2018

University of North Carolina at Charlotte

Web applications consume data from different inputs. Some of these inputs originate from untrusted sources, such as user inputs which will be rendered in browsers or browser-based applications such as mobile apps. Many applications with these functions are subject to cross-site scripting attacks (XSS), as injected malicious inputs can cause undesired remote code execution in browsers.The prevalence of these script injection attacks is due to a mixture of data and code in web pages. To prevent such Cross Site Scripting (XSS) attacks, one of the most common security attacks today, web applications should sanitize untrusted data using output encoding functions before displaying them on web pages. To successfully prevent XSS attacks, the encoding must match the context in which untrusted data appears, such as HTML body, JavaScript, and style sheets. A common programming error is the use of a wrong type of encoder to sanitize untrusted data, leaving the application vulnerable.I introduce a security unit testing approach to detect XSS vulnerabilities caused by improper encoding of untrusted data. Unit tests for the XSS vulnerability are constructed out of each web page and then evaluated by a unit test execution framework. A grammar-based attack generator is devised to automatically generate test inputs. I also introduce a vulnerability repair technique that can automatically fix detected vulnerabilities in many situations. Evaluation of this approach has been conducted on an open source medical record application written in JSP.

doctoral dissertations

Computer science

Ph.D.

Dynamic Analysis
Program Analysis
Static Analysis
Vulnerability Detection
Web Applications

Computer Science

Chu, Bei-Tseng (Bill)

Richter Lipford, Heather
Wang, Weichao
Sridhar, Meera
Wang, Sheng-Guo

Thesis (Ph.D.)--University of North Carolina at Charlotte, 2018.

This Item is protected by copyright and/or related rights. You are free to use this Item in any way that is permitted by the copyright and related rights legislation that applies to your use. For other uses you need to obtain permission from the rights-holder(s). For additional information, see http://rightsstatements.org/page/InC/1.0/.

Copyright is held by the author unless otherwise indicated.

Mohammadi_uncc_0694D_11897

http://hdl.handle.net/20.500.13093/etd:1795