Abstract
Security vulnerabilities in the web applications that we use to shop, bank, and socialize online expose us to exploits that cost billions of dollars each year. This paper describes the design and implementation of AspectShield, a system designed to mitigate the most common web application vulnerabilities without requiring costly and potentially dangerous modifications to the source code of vulnerable web applications.
AspectShield uses Aspect Oriented Programming (AOP) techniques to mitigate XSS and SQL Injection vulnerabilities in Java web applications. AOP is a programming paradigm designed to address cross-cutting concerns like logging that affect many modules of a program. AspectShield uses the Fortify Source Code Analyzer to identify vulnerabilities, then generates aspects that weave in code that mitigates Cross-Site Scripting and SQL Injection vulnerabilities. At runtime, the application executes the protective aspect code to mitigate security issues when a block of vulnerable code is executed.
AspectShield was tested with three enterprise scale Java web applications. It successfully mitigated SQL Injection and Cross-Site Scripting vulnerabilities without significantly affecting performance. The use of AspectShield in these enterprise level applications shows that AOP can effectively mitigate the two top vulnerabilities of web applications in a cost and time effective manner.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Webroot. State of Internet Security – Protecting Enterprise Systems [Whitepaper]. Webroot Software Inc., USA (2007)
Electronista. LulzSec hacks Sony Pictures, reveals 1m passwords unguarded. Electronista Media Inc. (June 2, 2011)
Measuring Website Security: Windows of Exposure. WhiteHat Website Security Statistic Report (March 14, 2011)
Shanmughaneethi, V., Yagna Pravin, R., Emilin Shyni, C., Swamynathan, S.: SQLIVD - AOP: Preventing SQL Injection
OWASP (Open Source Web Application Security Project). OWASP Top 10 – 2010 Edition. OWASP Foundation (2010)
Fortify Source Code Analyzer – Capabilities. HP Fortify. Web (2011)
Laddad, R.: AOP @ Work: AOP Myths & Realities. IBM Developer Works (February 14, 2006)
ESAPI Interface Encoder. The Open Web Application Security Project. Web (2011)
ESAPI Validator Library. The Open Web Application Security Project. Web (2011)
Li, S.: AOP: Patching in the 21st Century. Developer Fusion. Web (July 23, 2010)
Bostrom, G.: Database Encryption as an Aspect. In: Proceedings of AOSD 2004 Workshop on AOSD Technology for Application level Security (March 2004)
Laney, R., van der Linden, J., Thomas, P.: Evolution of Aspects for Legacy System Security Concerns. In: Proceedings of AOSD 2004 Workshop on AOSD Technology for Application level Security (March 2004)
Huang, M., Wang, C., Zhang, L.: Toward a Reusable and Generic Security Aspect Library. In: Proceedings of AOSD 2004 Workshop on AOSD Technology for Application level Security (March 2004)
Hermosillo, G., Gomez, R., Seinturier, L., Duchien, L.: Using Aspect Programming to Secure Web Applications. Journal of Software 2(6) (December 2007)
Clarke, J.: SQL Injection Attacks and Defense, 1st edn. Syngress (May 13, 2009) (March 1, 2011)
Mece, E., Kodra, L.: Towards full protection of Web Applications based on Aspect Oriented Programming. GJCST, 33–37 (2012)
Arthur, C.: Twitter users including Sarah Brown hit by malicious hacker attack. Guardian News (September 21, 2010)
Win, B., Shah, V., Joosen, W., Bodkin, R. (eds.): AOSDSEC: AOSD Technology for Application-Level Security (March 2004)
Bodkin, R.: Enterprise Security Aspects. In: Win, B., Shah, V., Joosen, W., Bodkin, R. (eds.) AOSDSEC: AOSD Technology for Application-Level Security (March 2004)
Fortify. Leading Bank Turns Security into a Differentiator with Fortify SCA. Fortify Software Inc. (2008)
Feathers, M.: Working Effectively with Legacy Code. Prentice Hall (2004)
Higgins, K.J.: The Cost of Fixing an Application Vulnerability. Security Dark Reading (May 11, 2009), http://www.darkreading.com/security/news/
Zhu, Z.J., Zulkernine, M.: A model-based aspect-oriented framework for building intrusion-aware software systems. Information and Software Technology 51(5), 865–875 (2009)
Serme, G., De Oliveira, A.S., Guarnieri, M., El Khoury, P.: Towards Assisted Remediation of Security Vulnerabilities. In: 6th International Conference on Emerging Security Information, Systems and Technologies (August 2012)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2013 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Simic, B., Walden, J. (2013). Eliminating SQL Injection and Cross Site Scripting Using Aspect Oriented Programming. In: Jürjens, J., Livshits, B., Scandariato, R. (eds) Engineering Secure Software and Systems. ESSoS 2013. Lecture Notes in Computer Science, vol 7781. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-36563-8_15
Download citation
DOI: https://doi.org/10.1007/978-3-642-36563-8_15
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-36562-1
Online ISBN: 978-3-642-36563-8
eBook Packages: Computer ScienceComputer Science (R0)