최소 단어 이상 선택하여야 합니다.
최대 10 단어까지만 선택 가능합니다.
다음과 같은 기능을 한번의 로그인으로 사용 할 수 있습니다.
NTIS 바로가기情報保護學會論文誌 = Journal of the Korea Institute of Information Security and Cryptology, v.31 no.2, 2021년, pp.263 - 277
문태근 (성균관대학교 소프트웨어학과) , 김형식 (성균관대학교 소프트웨어학과)
Taint analysis techniques are popularly used to detect web vulnerabilities originating from unverified user input data, such as Cross-Site Scripting (XSS) and SQL Injection, in web applications written in JavaScript. To detect such vulnerabilities, it would be necessary to trace variables affected b...
SQL Injection | OWASP, https://owasp.org/www-community/attacks/SQL_Injection, accessed on Feb. 28. 2021
Cross Site Scripting (XSS) Software Attack | OWASP Foundation, https://owasp.org/www-community/attacks/xss/, accessed on Feb. 28. 2021
OWASP Top 10 Application Security Risks - 2017, https://owasp.org/www-project-top-ten/2017/Top_10.html, accessed on Feb. 28. 2021
K. Cao, J. He, W. Fan, W. Huang, L. Chen, and Y. Pan, "PHP vulnerability detection based on taint analysis," 6th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO), pp. 436-439, Sept. 2017
R. Jahanshahi and A. Doupe, and Manuel Egele, "You shall not pass: Mitigating SQL Injection Attacks on Legacy Web Applications," Proceedings of the 15th ACM Asia Conference on Computer and Communications Security, pp. 445-457, Oct. 2020
S.F. Syed, A. Ahmed, G. D'mello, and Z. Ansari, "Removal of Web Application Vulnerabilities using Taint Analyzer and Code Corrector," 2019 International Conference on Nascent Technologies in Engineering (ICNTE), pp. 1-7, Jan. 2019
W. Huang, Y. Dong, and A. Milanova, "Type-Based Taint Analysis for Java Web Applications," Fundamental Approaches to Software Engineering. FASE 2014, pp. 140-154, Apr. 2014
B. Livshits and M. Lam, "Finding Security Vulnerabilities in Java Applications with Static Analysis," 14th USENIX Security Symposium, Jul. 2005
M. Backes, K. Rieck, M. Skoruppa, B. Stock, and F. Yamaguchi, "Efficient and Flexible Discovery of PHP Application Vulnerabilities," 2017 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 334-349, Apr. 2017
Usage statistics of server-side programming languages for websites, https://w3techs.com/technologies/overview/programming_language, accessed on Feb. 28. 2021
J. Strimpel and M. Najim, Building Isomorphic JavaScript Apps, ISBN: 9781491932933, O'Reilly Media, Inc., pp. 3-13, Sept. 2016
R. Karim, F. Tip, A. Sochurkova, and K. Sen, "Platform-Independent Dynamic Taint Analysis for JavaScript," IEEE Transactions on Software Engineering, vol. 46, no. 12, pp. 1364-1379, Dec. 2020
R. Wang, Guangquan Xu, Xianjiao Zeng, X. Li, and Z. Feng, "TT-XSS: A novel taint tracking based dynamic detection framework for DOM Cross-Site Scripting," J. Parallel Distributed Comput, vol. 118, pp. 100-106, Aug. 2018
S. Wei and B. Ryder. "Practical blended taint analysis for JavaScript," Proceedings of the 2013 International Symposium on Software Testing and Analysis (ISSTA 2013), pp. 336-346, Jul. 2013
Static Code Analysis Control | OWASP Foundation, https://owasp.org/www-community/controls/Static_Code_Analysis#taint-analysis, accessed on Feb. 28. 2021
TypeScript: Typed JavaScript at Any Scale, https://www.typescriptlang.org, accessed on Feb. 28. 2021
Z. Gao, C. Bird, and E. Barr, "To Type or Not to Type: QuantifyingDetectable Bugs in JavaScript," 2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE), pp. 758-769, May. 2017
State of JS 2020: JavaScript Flavors, https://2020.stateofjs.com/en-US/technologies/javascript-flavors, accessed on Feb. 28. 2021
TypeScript Compiler Internals, https://basarat.gitbook.io/typescript/overview, accessed on Feb. 28. 2021
B. Stock, S. Lekies, T. Mueller, P. Spiegel, and M. Johns, "Precise Client-side Protection against DOM-based Cross-Site Scripting," 23rd USENIX Security Symposium, pp.655-670, Aug. 2014
S. Lekies, B. Stock, and M. Johns, "25 million flows later: large-scale detection of DOM-based XSS," Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pp. 1193-1204, Nov. 2013
LGTM - Continuous security analysis, https://lgtm.com, accessed on Feb. 22. 2021
SonarQube - Code Quality and Code Security, https://www.sonarqube.org, accessed on Feb. 22. 2021
DeepSource: Automate code reviews with static analysis, https://deepsource.io, accessed on Feb. 22. 2021
Use JSDoc: Index, https://jsdoc.app, accessed on Feb. 28. 2021
Declaration Files, https://www.typescriptlang.org/docs/handbook/declaration-files/introduction.html, accessed on Feb. 28. 2021
Definitely Typed/Definitely Typed, https://github.com/DefinitelyTyped/DefinitelyTyped, accessed on Feb. 28. 2021
Express - Node.js web application framework, https://expressjs.com, accessed on Feb. 28. 2021
mysql2 - npm, https://www.npmjs.com/package/mysql2, accessed on Feb. 28. 2021
C. Staicu, M.T. Torp, M. Schafer, A. Moller, and M. Pradel, "Extracting Taint Specifications for JavaScript Libraries," 2020 IEEE/ACM 42nd International Conference on Software Engineering (ICSE), pp. 198-209, Jun. 2020
C. Staicu, M. Pradel, and B. Livshits, "SYNODE: Understanding and Automatically Preventing Injection Attacks on NODE.JS," Network and Distributed Systems Security (NDSS) Symposium 2018, Feb. 2018
taser/new-lgtm-alerts.md, https://github.com/cs-au-dk/taser/blob/master/data/new-lgtm-alerts.md, accessed on Feb. 28. 2021
mnutt/davros, https://github.com/mnutt/davros, accessed on Feb. 28. 2021
FineUploader/server-examples, https://github.com/FineUploader/server-examples, accessed on Feb. 28. 2021
giper45/DockerSecurityPlayground, https://github.com/giper45/DockerSecurityPlayground, accessed on Feb. 28. 2021
spikebrehm/isomorphic-tutorial , https://github.com/spikebrehm/isomorphic-tutorial, accessed on Feb. 28. 2021
AmpersandJS/ampersand, https://github.com/AmpersandJS/ampersand, accessed on Feb. 28. 2021
halohalospecial/atom-elmjutsu, https://github.com/halohalospecial/atom-elmjutsu, accessed on Feb. 28. 2021
nhn/tui-editor #1022, https://github.com/nhn/tui.editor/pull/1022, accessed on Feb. 28. 2021
CVE-2019-1020008: stacktable.js before 1.0.4 allows XSS, https://www.cvedetails.com/cve/CVE-2019-1020008/, accessed on Feb. 28. 2021
The exponential cost of fixing bugs, https://deepsource.io/blog/exponential-cost-of-fixing-bugs/, accessed on Mar. 25. 2021
Flow: A Static Type Checker for JavaScript, https://flow.org, accessed on Mar. 25. 2021
*원문 PDF 파일 및 링크정보가 존재하지 않을 경우 KISTI DDS 시스템에서 제공하는 원문복사서비스를 사용할 수 있습니다.
Free Access. 출판사/학술단체 등이 허락한 무료 공개 사이트를 통해 자유로운 이용이 가능한 논문
※ AI-Helper는 부적절한 답변을 할 수 있습니다.