Towards Tackling Common Web Application Vulnerabilities Using Secure Design Patterns

Abstract

Many software vulnerabilities originate during the design stage of the software development process. Secure design patterns can address vulnerabilities in the design level. However, few solid research studies have been done on applying secure pat-terns to tackle web application vulnerabilities and the researchers found that the security patterns are harder for developers to use than conventional design patterns. This paper presents an approach for selecting appropriate secure design patterns to tackle web application vulnerabilities. In this pilot study, we focus on two most common web application vulnerabilities: SQL injection (SQLi) and Cross-site scripting (XSS). The paper also uses a case study to demonstrate the implementation of the chosen pattern in redesigning a vulnerable application. The results from the evaluation show that the proposed pattern can effectively address SQLi and XSS vulnerabilities. Although SQLi and XSS are the targeted vulnerabilities in the approach, based on the success of this study, we believe that the approach is promising to be applied more generally.