document: Securing web application code by static analysis and runtime protection Security remains a major roadblock to universal acceptance of the Web for many kinds of transactions , especially since the recent sharp increase in remotely exploitable vulnerabilities have been attributed to Web application bugs . Many verification tools are discovering previously unknown vulnerabilities in legacy C programs , raising hopes that the same success can be achieved with Web applications . In this paper , we describe a sound and holistic approach to ensuring Web application security . Viewing Web application vulnerabilities as a secure information flow problem , we created a lattice-based static analysis algorithm derived from type systems and typestate , and addressed its soundness . During the analysis , sections of code considered vulnerable are instrumented with runtime guards , thus securing Web applications in the absence of user intervention . With sufficient annotations , runtime overhead can be reduced to zero . We also created a tool named . WebSSARI ( Web application Security by Static Analysis and Runtime Inspection ) to test our algorithm , and used it to verify 230 open-source Web application projects on SourceForge.net , which were selected to represent projects of different maturity , popularity , and scale . 69 contained vulnerabilities . After notifying the developers , 38 acknowledged our findings and stated their plans to provide patches . Our statistics also show that static analysis reduced potential runtime overhead by 98.4 % .
doc_bio_tags: O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O