[aosd-discuss] Dataflow Pointcut

[Hidehiko Masuhara]

Hi Dima,

Yes, you can prevent cross-site scripting attack by just checking
return values of getParameter.  But this can make web applications
useless.  When a web application uses some of the return values of
getParameter for the purposes other than generating HTML responses,
such a prevention mechanism will detect false positives.

So you have to SELECTIVELY check calls to getParameter based on the
information where the return values flow to.  As Rajan commented, you
can manually identify such geteParameter calls by theory.  The
dataflow pointcut helps to identify such information flow.
(Precisely, the dataflow pointcut in the paper tells where the value
comes from, rather than flows to.  So the checking must be done at
generating responses.)

Best regards,

Hidehiko



2008/2/19, dm_alhad at alcor.concordia.ca <dm_alhad at alcor.concordia.ca>:
> Hi ,
> I want to ask about the importance of the dataflow pointcut. It was
> defined as a way to detect cross-site scripting attack in web
> applications.
> In the paper
> "Dataflow Pointcut in Aspect-Oriented Programming", they can detect such
> attack using this pointcut.
> My question is why they don't search for just the call for the method
> getParameter using the call pointcut and filter the input for malicious
> code without the use of the dataflow pointcut.
> Thanks
> Dima
>
>
> _______________________________________________
> discuss mailing list    -    discuss at aosd.net
>
> To unsubscribe and change options, go to:
> http://aosd.net/mailman/listinfo/discuss_aosd.net
>
> Check out the AOSD.net Wiki: http://aosd.net/wiki
>


-- 
Hidehiko Masuhara	http://www.graco.c.u-tokyo.ac.jp/~masuhara/