一句话：提出首个针对使用数据访问层的现代 Web 应用的存储型 XSS 静态检测框架 Splendor。
论文针对现代 Web 应用中存储型 XSS 的静态检测难题：数据库操作常被封装为数据访问层（DAL），并大量使用面向对象与动态特性，导致静态污点分析难以追踪污点在源码与数据库位置间的流动。作者提出首个面向使用 DAL 的现代 Web 应用的存储型 XSS 静态分析框架，并实现 PHP 原型 Splendor。核心是启发式而精确的 token 匹配方法，用于定位数据库读写位置，精度分别达 91.3% 和 82.6%；据此可静态拼接断开的污点路径，得到完整传播链。在 5 个真实应用上与现有工作比较，并在 GitHub 上大规模实验，表明 Splendor 显著优于最先进静态与动态方法，发现 17 个零日漏洞。
In modern websites, stored Cross-Site Scripting (XSS) is the most dangerous XSS vulnerability, which can store payloads in the web system and be triggered directly by the victim. Database (DB) as the most commonly used storage medium for data on websites is therefore also the most common place where stored XSS occurs. Due to the modularity of modern programming architectures, the complex underlying database operations will often be encapsulated and abstracted as a Data Access Layer (DAL) to provide unified data access services to the business layer. The heavy use of Object-Oriented (OO) and dynamic language features involved in the encapsulation makes it increasingly challenging for static taint analysis tools to understand how tainted data flows between the source code and the exact locations in database. In this paper, we propose the first static analysis framework for detecting stored XSS in modern web applications using DAL and implement a prototype Splendor for PHP code analysis. The highlight in the framework is the design of a heuristic but precise token-matching method to locate the flows of taint data between database and source code. The precisions of the identified DB read and write (R/W) locations are 91.3% and 82.6%, respectively. With the identified R/W locations, the disconnected taint paths can be statically stitched to obtain a complete taint propagation path of stored XSS. Comparisons with existing works on 5 real-world applications and large-scale experiments on PHP web applications in Github show that Splendor significantly outperforms both the state-of-the-art static and dynamic approaches on stored-XSS detection, and detects 17 zero-day vulnerabilities.
@inproceedings{SuLXHSSCH23,
title = {Splendor: Static Detection of Stored XSS in Modern Web Applications},
author = {He Su and Feng Li and Lili Xu and Wenbo Hu and Yujie Sun and Qing Sun and Huina Chao and Wei Huo},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598116}
}