Web-based systems pervade our society, supporting business-critical applications frequently requesting/storing customer's personal information, necessitating increasingly higher levels of information assurance. Novice web programmers, with little or no secure programming skills, unknowingly develop web applications ripe with security vulnerabilities, thus compromising the integrity of the application. As a result, a number of static analysis security tools have been developed to flag potential security vulnerabilities. Yet, these tools are difficult to use, divorced from the software integrated development environments (IDE) and remain unknown to novice developers. This paper contributes an Eclipse plugin that enables static analysis of PHP source code using existing tools directly within a common IDE to enable novice developers to build more secure web applications. We make two claims for the extension of SSVChecker. First, it seamlessly embeds into a common IDE making it easy/familiar to use for novice developers. Second, it provides functionality leveraging multiple tools to reduce reported false positives and better focus novice developers on potential security vulnerabilities. To demonstrate these claims, we use SSVChecker on a popular, open source, PHP-based web application with known security vulnerabilities.
[1]
Viktor Kuncak,et al.
On Using Static Analysis to Detect Type Errors in PHP Applications
,
2010
.
[2]
Josh Dehlinger,et al.
SSVChecker: unifying static security vulnerability detection tools in an Eclipse plug-in
,
2006,
eclipse '06.
[3]
Gary McGraw,et al.
ITS4: a static vulnerability scanner for C and C++ code
,
2000,
Proceedings 16th Annual Computer Security Applications Conference (ACSAC'00).
[4]
David Evans,et al.
Improving Security Using Extensible Lightweight Static Analysis
,
2002,
IEEE Softw..
[5]
Jacob West,et al.
Secure Programming with Static Analysis
,
2007
.
[6]
Christopher Krügel,et al.
Pixy: a static analysis tool for detecting Web application vulnerabilities
,
2006,
2006 IEEE Symposium on Security and Privacy (S&P'06).
[7]
Christopher Krügel,et al.
Static analysis for detecting taint-style vulnerabilities in web applications
,
2010,
J. Comput. Secur..
[8]
Viktor Kuncak,et al.
Phantm: PHP analyzer for type mismatch
,
2010,
FSE '10.
[9]
David A. Wagner,et al.
A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities
,
2000,
NDSS.