Dynamic taint propagation for Java

摘要: Improperly validated user input is the underlying root cause for a wide variety of attacks on Web-based applications. Static approaches detecting this problem help at time development, but require source code and report number false positives. Hence, they are little use securing fully deployed rapidly evolving We propose dynamic solution that tags tracks runtime prevents its improper to maliciously affect execution program. Our implementation can be transparently applied Java classfiles, does not code. Benchmarks show overhead enforcement negligible prevent