Practical information flow for legacy web applications

摘要: The popularity of web applications, coupled with the data they operate on, makes them prime targets for hackers that want to misuse them. To make matters worse, a lot these have not been implemented security in mind, while refactoring an existing, large application implement or privacy policy is prohibitively difficult. This paper presents LabelFlow, extension PHP simplifies implementation policies applications. enforce policy, LabelFlow tracks propagation information throughout application, transparently and efficiently, both runtime through persistent storage. We provide strong theoretical guarantees enforcement LabelFlow; we define its semantics simple calculus prove it protects against leaks. used add access control three popular real-world scale applications: MediaWiki, Wordpress OpenCart. requires minimal code changes 50--100 lines per incurring little execution overhead up 5.6% at worst.