Authors:
António Silvestre
;
Ibéria Medeiros
and
Andreia Mordido
Affiliation:
LASIGE, Departamento de Informática, Faculdade de Ciências, Universidade de Lisboa, Portugal
Keyword(s):
SQL Injection Vulnerabilities, Session Types, Type Checking, Static Analysis, Software Security.
Abstract:
Vulnerabilities in web applications pose a risk for organisations. Among them, SQL injections (SQLi) give the attacker access to private data by submitting malicious SQL queries to the database via invalidated entry points. Although there are various techniques for detecting SQLi, static analysis is widely used as it inspects the application code without executing it. However, static analysis tools are not always precise. In this work, we explore an avenue that links the detection of SQLi to type checking, thus providing stronger guarantees of their existence. We propose a novel approach which consists of interpreting the behaviour of a web application as if it was a communication protocol and uses session types to specify this behaviour. We leverage FreeST, a functional programming language for session types, to implement FREESQLI, a seminal detector of SQLi in PHP web applications. The tool translates the PHP code into FreeST code and capitalizes on FreeST’s type checker to verify
protocol adherence and detect inconsistencies associated with the presence of SQLi.
(More)