Difficult XSS Code Patterns for Static Code Analysis Tools

Felix Schuckert,Hanno Langweg,Basel Katt

doi:10.1007/978-3-030-42051-2_9

Difficult XSS Code Patterns for Static Code Analysis Tools

Felix Schuckert, Hanno Langweg + Show 1 more

https://doi.org/10.1007/978-3-030-42051-2_9

Copy DOI

Publication Date: Jan 1, 2020

Citations: 4

Affiliation: HTWG Hochschule Konstanz - Technik, Wirtschaft und Gestaltung, Norwegian University of Science and Technology

#Static Analysis #Static Code Analysis Tools + Show 8 more

Abstract
Full-Text PDF
Similar Papers

Abstract

We present source code patterns that are difficult for modern static code analysis tools. Our study comprises 50 different open source projects in both a vulnerable and a fixed version for XSS vulnerabilities reported with CVE IDs over a period of seven years. We used three commercial and two open source static code analysis tools. Based on the reported vulnerabilities we discovered code patterns that appear to be difficult to classify by static analysis. The results show that code analysis tools are helpful, but still have problems with specific source code patterns. These patterns should be a focus in training for developers.

Full Text