Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code
Internet-based distributed systems dominate contemporary software applications. To enable these applications to operate securely, software developers must mitigate the threats posed by malicious actors. For instance, the developers must identify vulnerabilities in the software and eliminate them. Ho...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2024-01-01
|
| Series: | Software |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2674-113X/3/1/2 |
| _version_ | 1827305007246999552 |
|---|---|
| author | Kedar Sambhus Yi Liu |
| author_facet | Kedar Sambhus Yi Liu |
| author_sort | Kedar Sambhus |
| collection | DOAJ |
| description | Internet-based distributed systems dominate contemporary software applications. To enable these applications to operate securely, software developers must mitigate the threats posed by malicious actors. For instance, the developers must identify vulnerabilities in the software and eliminate them. However, to do so manually is a costly and time-consuming process. To reduce these costs, we designed and implemented Code Auto-Remediation for Enhanced Security (CARES), a web application that automatically identifies and remediates the two most common types of vulnerabilities in Java-based web applications: SQL injection (SQLi) and Cross-Site Scripting (XSS). As is shown by a case study presented in this paper, CARES mitigates these vulnerabilities by refactoring the Java code using the Intercepting Filter design pattern. The flexible, microservice-based CARES design can be readily extended to support other injection vulnerabilities, remediation design patterns, and programming languages. |
| first_indexed | 2024-04-24T17:49:54Z |
| format | Article |
| id | doaj.art-d15368cd3b3b49d2aaabb9481cd9ccc4 |
| institution | Directory Open Access Journal |
| issn | 2674-113X |
| language | English |
| last_indexed | 2024-04-24T17:49:54Z |
| publishDate | 2024-01-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Software |
| spelling | doaj.art-d15368cd3b3b49d2aaabb9481cd9ccc42024-03-27T14:04:45ZengMDPI AGSoftware2674-113X2024-01-0131284610.3390/software3010002Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in CodeKedar Sambhus0Yi Liu1Department of Computer and Information Science, University of Massachusetts Dartmouth, 285 Old Westport Road, Dartmouth, MA 02747, USADepartment of Computer and Information Science, University of Massachusetts Dartmouth, 285 Old Westport Road, Dartmouth, MA 02747, USAInternet-based distributed systems dominate contemporary software applications. To enable these applications to operate securely, software developers must mitigate the threats posed by malicious actors. For instance, the developers must identify vulnerabilities in the software and eliminate them. However, to do so manually is a costly and time-consuming process. To reduce these costs, we designed and implemented Code Auto-Remediation for Enhanced Security (CARES), a web application that automatically identifies and remediates the two most common types of vulnerabilities in Java-based web applications: SQL injection (SQLi) and Cross-Site Scripting (XSS). As is shown by a case study presented in this paper, CARES mitigates these vulnerabilities by refactoring the Java code using the Intercepting Filter design pattern. The flexible, microservice-based CARES design can be readily extended to support other injection vulnerabilities, remediation design patterns, and programming languages.https://www.mdpi.com/2674-113X/3/1/2vulnerability mitigationsecure design patternautomated code refactoring |
| spellingShingle | Kedar Sambhus Yi Liu Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code Software vulnerability mitigation secure design pattern automated code refactoring |
| title | Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code |
| title_full | Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code |
| title_fullStr | Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code |
| title_full_unstemmed | Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code |
| title_short | Automating SQL Injection and Cross-Site Scripting Vulnerability Remediation in Code |
| title_sort | automating sql injection and cross site scripting vulnerability remediation in code |
| topic | vulnerability mitigation secure design pattern automated code refactoring |
| url | https://www.mdpi.com/2674-113X/3/1/2 |
| work_keys_str_mv | AT kedarsambhus automatingsqlinjectionandcrosssitescriptingvulnerabilityremediationincode AT yiliu automatingsqlinjectionandcrosssitescriptingvulnerabilityremediationincode |