Proceedings of the 7th Workshop on Programming Languages and Analysis for Security最新文献

Development of secured systems by mixing programs, specifications and proofs in an object-oriented programming environment: a case study within the FoCaLiZe environment 通过在面向对象编程环境中混合程序、规范和证明来开发安全系统:FoCaLiZe环境中的一个案例研究

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717.2336726

Damien Doligez, M. Jaume, R. Rioboo

引用次数: 5

Static flow-sensitive & context-sensitive information-flow analysis for software product lines: position paper 软件产品线的静态流敏感和上下文敏感信息流分析:立场文件

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717.2336723

E. Bodden

引用次数: 9

Security-policy monitoring and enforcement with JavaMOP 使用JavaMOP监视和实施安全策略

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717.2336720

Soha Hussein, P. Meredith, Grigore Roşu

引用次数: 19

Towards a taint mode for cloud computing web applications 面向云计算web应用程序的污点模式

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717.2336724

Luciano Bello, Alejandro Russo

{"title":"Towards a taint mode for cloud computing web applications","authors":"Luciano Bello, Alejandro Russo","doi":"10.1145/2336717.2336724","DOIUrl":"https://doi.org/10.1145/2336717.2336724","url":null,"abstract":"Cloud computing is generally understood as the distribution of data and computations over the Internet. Over the past years, there has been a steep increase in web sites using this technology. Unfortunately, those web sites are not exempted from injection flaws and cross-site scripting, two of the most common security risks in web applications. Taint analysis is an automatic approach to detect vulnerabilities. Cloud computing platforms possess several features that, while facilitating the development of web applications, make it difficult to apply off-the-shelf taint analysis techniques. More specifically, several of the existing taint analysis techniques do not deal with persistent storage (e.g. object datastores), opaque objects (objects whose implementation cannot be accessed and thus tracking tainted data becomes a challenge), or a rich set of security policies (e.g. forcing a specific order of sanitizers to be applied). We propose a taint analysis for could computing web applications that consider these aspects. Rather than modifying interpreters or compilers, we provide taint analysis via a Python library for the cloud computing platform Google App Engine (GAE). To evaluate the use of our library, we harden an existing GAE web application against cross-site scripting attacks.","PeriodicalId":149360,"journal":{"name":"Proceedings of the 7th Workshop on Programming Languages and Analysis for Security","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131530430","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 19

Security correctness for secure nested transactions: position paper 安全嵌套事务的安全正确性:立场文件

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717.2336721

Dominic Duggan, Ye Wu

引用次数: 1

Typing illegal information flows as program effects 输入非法信息流作为程序影响

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717.2336718

Ana Gualdina Almeida Matos, J. Santos

{"title":"Typing illegal information flows as program effects","authors":"Ana Gualdina Almeida Matos, J. Santos","doi":"10.1145/2336717.2336718","DOIUrl":"https://doi.org/10.1145/2336717.2336718","url":null,"abstract":"Specification of information flow policies is classically based on a security labeling and a lattice of security levels that establishes how information can flow between security levels. We present a type and effect system for determining the least permissive relaxation of a given confidentiality policy that allows to type a program, given a fixed security labeling. To this end, sets of illegal information flows are represented as downward closure operators (here referred to as flow kernels) on a given lattice of security levels. Illegal information flows can then be seen as program effects, and their representation as flow kernels subsumes in granularity previous lattice-oriented representations of information flow policies. Effect soundness, optimality and preservation results are presented for the proposed type and effect system, for programs written in a concurrent higher-order imperative lambda-calculus with reference creation. Our type and effect system provides a mechanism for deriving the flow kernel that characterizes the illegal flows that occur within a program, and which can be used to support runtime decisions of compliance to other policies. This point is illustrated by means of an application to a setting where local programs run under the control of a dynamic allowed flow policy.","PeriodicalId":149360,"journal":{"name":"Proceedings of the 7th Workshop on Programming Languages and Analysis for Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116444673","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security 第七届程序设计语言与安全分析研讨会论文集

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717

S. Maffeis, Tamara Rezk

引用次数: 2

A generic approach for security policies composition: position paper 安全策略组合的通用方法:立场文件

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717.2336722

A. Hernandez, F. Nielson

引用次数: 0

Hash-flow taint analysis of higher-order programs 高阶程序的哈希流污染分析

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717.2336725

Shuying Liang, M. Might

{"title":"Hash-flow taint analysis of higher-order programs","authors":"Shuying Liang, M. Might","doi":"10.1145/2336717.2336725","DOIUrl":"https://doi.org/10.1145/2336717.2336725","url":null,"abstract":"As web applications have grown in popularity, so have attacks on such applications. Cross-site scripting and injection attacks have become particularly problematic. Both vulnerabilities stem, at their core, from improper sanitization of user input. We propose static taint analysis, which can verify the absence of unsanitized input errors at compile-time. Unfortunately, precise static analysis of modern scripting languages like Python is challenging: higher-orderness and complex control-flow collide with opaque, dynamic data structures like hash maps and objects. The interdependence of data-flow and control-flow make it hard to attain both soundness and precision. In this work, we apply abstract interpretation to sound and precise taint-style static analysis of scripting languages. We first define λH, a core calculus of modern scripting languages, with hash maps, dynamic objects, higher-order functions and first class control. Then we derive a framework of k-CFA-like CESK-style abstract machines for statically reasoning about λH, but with hash maps factored into a \"Curried Object store.\" The Curried object store---and shape analysis on this store---allows us to recover field sensitivity, even in the presence of dynamically modified fields. Lastly, atop this framework, we devise a taint-flow analysis, leveraging its field-sensitive, interprocedural and context-sensitive properties to soundly and precisely detect security vulnerabilities, like XSS attacks in web applications. We have prototyped the analytical framework for Python, and conducted preliminary experiments with web applications. A low rate of false alarms demonstrates the promise of this approach.","PeriodicalId":149360,"journal":{"name":"Proceedings of the 7th Workshop on Programming Languages and Analysis for Security","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-06-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132481487","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

Knowledge-oriented secure multiparty computation 面向知识的安全多方计算

Proceedings of the 7th Workshop on Programming Languages and Analysis for Security Pub Date : 2012-06-15 DOI: 10.1145/2336717.2336719

Piotr (Peter) Mardziel, M. Hicks, Jonathan Katz, M. Srivatsa

引用次数: 19