TL;DR: A static analysis algorithm for detecting security vulnerabilities in PHP, a popular server-side scripting language for building web applications, is presented, finding 105 previously unknown security vulnerabilities, most of which it believes are remotely exploitable.
Abstract: We present a static analysis algorithm for detecting security vulnerabilities in PHP, a popular server-side scripting language for building web applications. Our analysis employs a novel three-tier architecture to capture information at decreasing levels of granularity at the intrablock, intraprocedural, and interprocedural level. This architecture enables us to handle dynamic features of scripting languages that have not been adequately addressed by previous techniques.
We demonstrate the effectiveness of our approach on six popular open source PHP code bases, finding 105 previously unknown security vulnerabilities, most of which we believe are remotely exploitable.
TL;DR: In this paper, a system, method and article of manufacture are provided for affording test maintenance in an automated scripting framework, where a plurality of test scripts are developed and stored in a centrally located database.
Abstract: A system, method and article of manufacture are provided for affording test maintenance in an automated scripting framework. First, a plurality of test scripts are developed. Then, the plurality of test scripts are stored in a centrally located database. A user is then allowed to edit a specific test script located on the centrally located database. Finally, the user edits to the specific test script are propagated to each of the plurality of test scripts.
TL;DR: In this paper, a method and system for injecting code into an existing HTML document that enables the conditional generation and incorporation of an injectable component is provided, which enables a user to display an add-on user interface component within a web page using a technique that is transparent to the normal processing within a browser application.
Abstract: A method and system for injecting code into an existing HTML document that enables the conditional generation and incorporation of an injectable component is provided. The injection mechanism provided enables a user to display an add-on user interface component within a web page using a technique that is transparent to the normal processing within a browser application. The injection mechanism installs interceptor code as a proxy server between a client browser and a server. The interceptor code monitors all HTTP messages sent from the client browser and injects code into each HTML document that is sent from a server to the client browser. The injected code when executed by the client browser conditionally inserts HTML code into the received HTML document. The inserted HTML code is then used by the client browser to generate a new component, for example a user interface component. The code injected by the interceptor code is dependent upon the type of the browser and whether certain tags are present in the received HTML document. In addition, the code may be written in a script language, such as Javascript or VBscript.
TL;DR: In this paper, an environment for developing clientside/serverside code is described, which supports programming in an event-driven paradigm while the execution of the resultant programs are executed in a serial execution paradigm.
Abstract: An environment for developing clientside/serverside code is disclosed. The environment supports programming in an event-driven paradigm while the execution of the resultant programs are executed in a serial execution paradigm. Through shielding the developer from complex scripting segments, the environment provides the developer with the suggestion that that resultant execution model is event-driven. By treating scripts as later-definable objects, the designing phase of a page may be lessened, as the appropriate codings needed to implement a page are determined at a later date. In one example, the codings may be preliminary set as server side or client side, with the environment later adding the appropriate scripting language to complete the developed page.
TL;DR: In this paper, a system is provided for the automatic process and delivery of multimedia to a Web server, which uses the input to generate an optimized Web media, generates HTML references and automatically deploys the HTML and media to the Web serve.
Abstract: A system is provided for the automatic process and delivery of multimedia to a Web server. This system uses the input to generate an optimized Web media, generates HTML references and automatically deploys the HTML and media to the Web serve. The Web authoring process involves the creation of the media and the modification of the HTML document to contain a proprietary tag that contains the media's unique name, the modification to be performed on the media and the Web page format for the media. A Web server passes the HTML the client browser capabilities and current server traffic to the system, which parses the HTML or browser language searching for the proprietary tags. If the proprietary tag is found, the tag is processed. The system replaces the proprietary tag with standard HTML tags containing the generated media and the Web page delivery to the browser. The proprietary tag is combined with current server load statistics and client browser browser capabilities to generate a key. The key is looked up in the system's database. If the key is found, the associated HTML tag is received and the proprietary's tag is replaced as discussed above. An created based on the proprietary tag and contains the generated media. The information is stored in the system database in case identical proprietary tags are processed.