Ettore Merlo, Dominic Letarte et Giuliano Antoniol
Rapport technique (2006)
|
Libre accès au plein texte de ce document Version officielle de l'éditeur Conditions d'utilisation: Tous droits réservés Télécharger (476kB) |
Abstract
Web sites are either static sites, programs, or databases. Very often they are a mixture of these three aspects integrating relational databases as a back-end. Web sites require configuration and programming attention to assure security, confidentiality, and trustiness of the published information. SQL-injection attacks rely on some weak validation of textual input used to build database queries. Maliciously crafted input may threaten the confidentiality and the security policies of Web sites relying on a database to store and retrieve information. Furthermore, insiders may introduce malicious code in a Web application, code that, when triggered by some specific input, for example, would violate security policies. This paper presents an original approach that combines static analysis, dynamic analysis, and code reengineering to automatically protect applications written in PHP from both malicious input (outsider threats) and malicious code (insider threats) that carry SQLinjection attacks. The paper also reports preliminary results about experiments performed on an old SQL-injection prone version of phpBB (version 2.0.0, 37193 LOC of PHP version 4.2.2 code). Results show that our approach successfully improved phpBB-2.0.0 resistance to SQLinjection attacks.
Mots clés
SQL-injection, software security analysis, sofware re-engineering
Sujet(s): |
2700 Technologie de l'information > 2700 Technologie de l'information 2700 Technologie de l'information > 2711 Gestion de bases de données |
---|---|
Département: | Département de génie informatique et génie logiciel |
Organismes subventionnaires: | National Sciences and Engineering Research Council of Canada (NSERC) |
URL de PolyPublie: | https://publications.polymtl.ca/3138/ |
Numéro du rapport: | EPM-RT-2006-04 |
Date du dépôt: | 12 juin 2018 10:46 |
Dernière modification: | 17 avr. 2024 05:03 |
Citer en APA 7: | Merlo, E., Letarte, D., & Antoniol, G. (2006). Insider threat resistant SQL-injection prevention in PHP. (Rapport technique n° EPM-RT-2006-04). https://publications.polymtl.ca/3138/ |
---|---|
Statistiques
Total des téléchargements à partir de PolyPublie
Téléchargements par année
Provenance des téléchargements