LaBaSec: Language-based Security       


 Luciano Bello photoMarco Pistoia photo

LaBaSec: Language-based Security - F4F: Taint Analysis of Framework-Based Web Applications

F4F (Framework For Frameworks) is a system for effective taint analysis of framework-based web applications. Most modern web applications utilize one or more web frameworks, which provide useful abstractions for common functionality. Due to extensive use of reflective language constructs in framework implementations, existing static taint analyses are often ineffective when applied to framework-based applications. While previous work has included ad hoc support for certain framework constructs, adding support for a large number of frameworks in this manner does not scale from an engineering standpoint.

F4F employs an initial analysis pass in which both application code and configuration files are processed to generate a specification of framework-related behaviors. A taint analysis engine can leverage these specifications to perform a much deeper, more precise analysis of framework-based applications. Furthermore, our specification language has only a small number of simple but powerful constructs, easing analysis engine integration. With this architecture, new frameworks can be handled with no changes to the core analysis engine, yielding significant engineering benefits.

Supporting material for OOPSLA 2011 paper

Here are links to the open-source benchmarks we used in our evaluation.

The generated WAFL specifications for these applications are available in XML format (along with an XML Schema file documenting the format) here.