Static enforcement of web application integrity through strong typing

摘要: Security vulnerabilities continue to plague web applications, allowing attackers access sensitive data and co-opt legitimate sites as a hosting ground for malware. Accordingly, researchers have focused on various approaches detecting preventing common classes of security in including anomaly-based detection mechanisms, static dynamic analyses server-side application code, client-side policy enforcement. This paper presents different approach security. In this work, we present framework that leverages existing work strong type systems statically enforce separation between the structure content both documents database queries generated by application, show how can automatically prevent introduction cross-site scripting SQL injection vulnerabilities. We an evaluation framework, demonstrate coverage correctness our sanitization functions. Finally, experimental results suggest applications developed using perform competitively with traditional frameworks.