Visible to the public Detecting Cross-Site Scripting Vulnerabilities through Automated Unit Testing

TitleDetecting Cross-Site Scripting Vulnerabilities through Automated Unit Testing
Publication TypeConference Paper
Year of Publication2017
AuthorsMohammadi, M., Chu, B., Lipford, H. R.
Conference Name2017 IEEE International Conference on Software Quality, Reliability and Security (QRS)
Date Publishedjul
KeywordsAttack generation, automated unit testing, automatic programming, Browsers, Cross Site Scripting, cross-site scripting vulnerabilities detection, Data Sanitization, encoder, encoding, grammar-based attack generator, grammars, HTML, Human Behavior, injection attacks, Java, Metrics, open source medical records application, program analysis, program diagnostics, program testing, programming error, pubcrawl, public domain software, Resiliency, security, security of data, security unit testing approach, Testing, unit test execution framework, Unit testing, untrusted data sanitization, Web Browser Security, Web page context, Web pages, XSS Attacks, XSS vulnerability

The best practice to prevent Cross Site Scripting (XSS) attacks is to apply encoders to sanitize untrusted data. To balance security and functionality, encoders should be applied to match the web page context, such as HTML body, JavaScript, and style sheets. A common programming error is the use of a wrong encoder to sanitize untrusted data, leaving the application vulnerable. We present a security unit testing approach to detect XSS vulnerabilities caused by improper encoding of untrusted data. Unit tests for the XSS vulnerability are automatically constructed out of each web page and then evaluated by a unit test execution framework. A grammar-based attack generator is used to automatically generate test inputs. We evaluate our approach on a large open source medical records application, demonstrating that we can detect many 0-day XSS vulnerabilities with very low false positives, and that the grammar-based attack generator has better test coverage than industry best practices.

Citation Keymohammadi_detecting_2017