{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,7]],"date-time":"2024-09-07T03:24:15Z","timestamp":1725679455409},"reference-count":37,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2012,7]]},"DOI":"10.1109\/compsac.2012.34","type":"proceedings-article","created":{"date-parts":[[2012,11,15]],"date-time":"2012-11-15T17:04:49Z","timestamp":1352999089000},"page":"233-243","source":"Crossref","is-referenced-by-count":32,"title":["Preventing Input Validation Vulnerabilities in Web Applications through Automated Type Analysis"],"prefix":"10.1109","author":[{"given":"Theodoor","family":"Scholte","sequence":"first","affiliation":[]},{"given":"William","family":"Robertson","sequence":"additional","affiliation":[]},{"given":"Davide","family":"Balzarotti","sequence":"additional","affiliation":[]},{"given":"Engin","family":"Kirda","sequence":"additional","affiliation":[]}],"member":"263","reference":[{"journal-title":"Proceedings of the Network and Distributed System Security Symposium NDSS 2009","article-title":"Document structure integrity: A robust basis for cross-site scripting defense","year":"2009","author":"nadji","key":"19"},{"key":"35","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250739"},{"key":"17","doi-asserted-by":"publisher","DOI":"10.1145\/948143.948144"},{"journal-title":"An Empirical Analysis of XSS Sanitization in Web Application Frameworks","year":"2011","author":"weinberger","key":"36"},{"key":"18","first-page":"271","article-title":"Finding security errors in java programs with static analysis","author":"livshits","year":"2005","journal-title":"Proceedings of the 14th USENIX Security Symposium"},{"key":"33","doi-asserted-by":"publisher","DOI":"10.1145\/1111037.1111070"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1145\/1141277.1141357"},{"journal-title":"Web Browser Market Share Trends","year":"2011","key":"34"},{"key":"16","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.20"},{"key":"13","doi-asserted-by":"publisher","DOI":"10.1145\/1572272.1572286"},{"key":"14","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2009.5070521"},{"journal-title":"Proceedings of the 15th USENIX Security Symposium","article-title":"Static detection of security vulnerabilities in scripting languages","year":"2006","author":"xie","key":"37"},{"key":"11","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2008.36"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.29"},{"key":"21","first-page":"124","article-title":"Defending against injection attacks through context-sensitive string evaluation","author":"pietraszek","year":"2005","journal-title":"Proceedings of the International Symposium on Recent Advances in Intrusion Detection"},{"journal-title":"National Vulnerability Database Version 2 2","year":"2010","key":"20"},{"key":"22","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866375"},{"key":"23","first-page":"283","article-title":"Static enforcement of web application integrity through strong typing","author":"robertson","year":"2009","journal-title":"The 16th USENIX Security Symposium"},{"journal-title":"Proceeding of the Network and Distributed System Security Symposium (NDSS)","article-title":"Using generalization and characterization techniques in the anomaly-based detection of web attacks","year":"2006","author":"robertson","key":"24"},{"key":"25","first-page":"229","article-title":"Snort - lightweight intrusion detection for networks","author":"roesch","year":"1999","journal-title":"Proceedings of LISA '99 13th System Administration Conference"},{"journal-title":"XSS (Cross Site Scripting) Cheat Sheet Esp for Filter Evasion","year":"2009","author":"snake","key":"26"},{"key":"27","first-page":"587","article-title":"Context-sensitive autosanitization in web templating languages using type qualifiers","author":"samuel","year":"2011","journal-title":"Proceedings of the 18th ACM Conference on Computer and Communications Security CCS '11"},{"key":"28","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.38"},{"journal-title":"Proceedings of the Conference on Computer and Communications Security","article-title":"Scriptgard: Automatic context-sensitive sanitization for large-scale legacy web applications","year":"2011","author":"saxena","key":"29"},{"key":"3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-88873-4_2"},{"key":"2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2008.22"},{"key":"10","doi-asserted-by":"publisher","DOI":"10.1145\/988672.988679"},{"journal-title":"NDSS'11 8th Annual Network and Distributed System Security Symposium","article-title":"Automated discovery of parameter pollution vulnerabilities in web applications","year":"2011","author":"balduzzi","key":"1"},{"journal-title":"International Conference on Finance Cryptography and Data Security","article-title":"Quo vadis A study of the evolution of input validation vulnerabilities in web applications","year":"2011","author":"scholte","key":"30"},{"key":"7","doi-asserted-by":"publisher","DOI":"10.1145\/1572272.1572305"},{"key":"6","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2005.21"},{"key":"32","doi-asserted-by":"publisher","DOI":"10.1145\/511446.511498"},{"journal-title":"Proceedings of the Network and Distributed System Security Symposium NDSS 2009","article-title":"Noncespaces: Using randomization to enforce information flow tracking and thwart crosssite scripting attacks","year":"2009","author":"gundy","key":"5"},{"key":"31","doi-asserted-by":"publisher","DOI":"10.1145\/2245276.2232004"},{"key":"4","first-page":"209","article-title":"Klee: Unassisted and automatic generation of high-coverage tests for complex systems programs","author":"cadar","year":"2008","journal-title":"Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation OSDI'08"},{"key":"9","first-page":"1","article-title":"Fast and precise sanitizer analysis with bek","author":"hooimeijer","year":"2011","journal-title":"Proceedings of the 20th USENIX Conference on Security SEC'11"},{"key":"8","doi-asserted-by":"publisher","DOI":"10.1145\/1101908.1101935"}],"event":{"name":"2012 IEEE 36th Annual Computer Software and Applications Conference - COMPSAC 2012","start":{"date-parts":[[2012,7,16]]},"location":"Izmir, Turkey","end":{"date-parts":[[2012,7,20]]}},"container-title":["2012 IEEE 36th Annual Computer Software and Applications Conference"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/6340121\/6340122\/06340148.pdf?arnumber=6340148","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,3,21]],"date-time":"2017-03-21T20:06:09Z","timestamp":1490126769000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6340148\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012,7]]},"references-count":37,"URL":"https:\/\/doi.org\/10.1109\/compsac.2012.34","relation":{},"subject":[],"published":{"date-parts":[[2012,7]]}}}
