The DOI matches its Crossref record; 48 of the 48 references it cites were found in a registry or an index.
Securing web application code by static analysis and runtime protection
Abstract
Security remains a major roadblock to universal acceptance of the Web for many kinds of transactions, especially since the recent sharp increase in remotely exploitable vulnerabilities have been attributed to Web application bugs. Many verification tools are discovering previously unknown vulnerabilities in legacy C programs, raising hopes that the same success can be achieved with Web applications. In this paper, we describe a sound and holistic approach to ensuring Web application security. Viewing Web application vulnerabilities as a secure information flow problem, we created a lattice-based static analysis algorithm derived from type systems and typestate, and addressed its soundness. During the analysis, sections of code considered vulnerable are instrumented with runtime guards, thus securing Web applications in the absence of user intervention. With sufficient annotations, runtime overhead can be reduced to zero. We also created a tool named.WebSSARI (Web application Security by Static Analysis and Runtime Inspection) to test our algorithm, and used it to verify 230 open-source Web application projects on SourceForge.net, which were selected to represent projects of different maturity, popularity, and scale. 69 contained vulnerabilities. After notifying the developers, 38 acknowledged our findings and stated their plans to provide patches. Our statistics also show that static analysis reduced potential runtime overhead by 98.4%.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Cousot, P., & Cousot, R. (1977) · Proceedings of the 4th ACM SIGACT-SIGPLAN symposium on Principles of programming languages - POPL '77 · doi:10.1145/512950.512973 · Cited by 6,279
Security Policies and Security Models
Goguen, J. A., & Meseguer, J. (1982) · 1982 IEEE Symposium on Security and Privacy · doi:10.1109/sp.1982.10014 · Cited by 2,119
Secure Computer System: Unified Exposition and Multics Interpretation
Bell, D. E., & La Padula, L. J. (1976) · doi:10.21236/ada023588 · Cited by 1,916
Language-based information-flow security
Sabelfeld, A., & Myers, A. C. (2003) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2002.806121 · Cited by 1,907
A lattice model of secure information flow
Denning, D. E. (1976) · Communications of the ACM · doi:10.1145/360051.360056 · Cited by 1,907
Necula, G. C. (1997) · Proceedings of the 24th ACM SIGPLAN-SIGACT symposium on Principles of programming languages - POPL '97 · doi:10.1145/263699.263712 · Cited by 1,843
Extended static checking for Java
Flanagan, C., Leino, K. R. M., Lillibridge, M., Nelson, G., Saxe, J. B., & Stata, R. (2002) · Proceedings of the ACM SIGPLAN 2002 conference on Programming language design and implementation · doi:10.1145/512529.512558 · Cited by 1,340
Schneider, F. B. (2000) · ACM Transactions on Information and System Security · doi:10.1145/353323.353382 · Cited by 1,289
StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks
Cowan, C., Pu, C., Maier, D., et al. (1998) · PDXScholar (Portland State University) · Cited by 1,256
Integrity Considerations for Secure Computer Systems
Biba, K. J. (1977) · Defense Technical Information Center (DTIC) · Cited by 1,221
Cited by
Pixy: a static analysis tool for detecting Web application vulnerabilities
Jovanovic, N., Kruegel, C., & Kirda, E. (2006) · 2006 IEEE Symposium on Security and Privacy (S&P'06) · doi:10.1109/sp.2006.29 · Cited by 722
The essence of command injection attacks in web applications
Su, Z., & Wassermann, G. (2006) · Conference record of the 33rd ACM SIGPLAN-SIGACT symposium on Principles of programming languages · doi:10.1145/1111037.1111070 · Cited by 515
Information flow control for secure cloud computing
Bacon, J., Eyers, D., Pasquier, T. F. J.-M., Singh, J., Papagiannis, I., & Pietzuch, P. (2014) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2013.122313.130423 · Cited by 105
Metadata
- Authors
- Huang, Y.-W., Yu, F., Hang, C., Tsai, C.-H., Lee, D.-T., & Kuo, S.-Y.
- Venue
- Proceedings of the 13th international conference on World Wide Web
- Publisher
- ACM
- Published
- 2004-05-17
- Pages
- 40-52
- OpenAlex
- W1983142587
- Cited by
- 567
- References
- 48
- FWCI
- 19.67
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Securing web application code by static analysis and runtime protection. https://app.cochat.ai/papers/10.1145/988672.988679
- The paper
- Huang, Y.-W., Yu, F., Hang, C., Tsai, C.-H., Lee, D.-T., & Kuo, S.-Y. (2004). Securing web application code by static analysis and runtime protection. Proceedings of the 13th international conference on World Wide Web. https://doi.org/10.1145/988672.988679
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
