Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code

Internet-based distributed systems dominate contemporary software applications. To enable these applications to operate securely, software developers must mitigate the threats posed by malicious actors. For instance, the developers must identify vulnerabilities in the software and eliminate them. Ho...

Celý popis

Uložené v:

Podrobná bibliografia
Vydané v:	Software Ročník 3; číslo 1; s. 28 - 46
Hlavní autori:	Sambhus, Kedar, Liu, Yi
Médium:	Journal Article
Jazyk:	English
Vydavateľské údaje:	MDPI AG 12.01.2024
Predmet:	automated code refactoring secure design pattern vulnerability mitigation
ISSN:	2674-113X, 2674-113X
On-line prístup:	Získať plný text
Tagy:	Pridať tag Žiadne tagy, Buďte prvý, kto otaguje tento záznam!

Popis
Shrnutí:	Internet-based distributed systems dominate contemporary software applications. To enable these applications to operate securely, software developers must mitigate the threats posed by malicious actors. For instance, the developers must identify vulnerabilities in the software and eliminate them. However, to do so manually is a costly and time-consuming process. To reduce these costs, we designed and implemented Code Auto-Remediation for Enhanced Security (CARES), a web application that automatically identifies and remediates the two most common types of vulnerabilities in Java-based web applications: SQL injection (SQLi) and Cross-Site Scripting (XSS). As is shown by a case study presented in this paper, CARES mitigates these vulnerabilities by refactoring the Java code using the Intercepting Filter design pattern. The flexible, microservice-based CARES design can be readily extended to support other injection vulnerabilities, remediation design patterns, and programming languages.
ISSN:	2674-113X 2674-113X
DOI:	10.3390/software3010002