DROPS

Document

Framework for Static Analysis of PHP Applications (Artifact)

Authors: David Hauzar and Jan Kofron

Published in: DARTS, Volume 1, Issue 1, Special Issue of the 29th European Conference on Object-Oriented Programming (ECOOP 2015)

Abstract

This artifact is based on Weverca, a static analyzer framework for PHP applications. The aim of Weverca is to provide developers with a framework that would allow for an easy implementation of custom static analyses of PHP, while not coping with the dynamic language issues. The framework processes the input source code in two phases. In the first phase, the program-point graph is constructed, which has the dynamic constructs (eval, dynamic includes, type information) already resolved. The developer can then implement a custom static analysis in the second phase, exploiting the output of the first phase. The provided package is designed to support repeatability of the experiments of the companion paper: in particular to perform security (taint) analyses of two bundled applications. Instruction to compile and run the analyzer are also provided.

Cite as

David Hauzar and Jan Kofron. Framework for Static Analysis of PHP Applications (Artifact). In Special Issue of the 29th European Conference on Object-Oriented Programming (ECOOP 2015). Dagstuhl Artifacts Series (DARTS), Volume 1, Issue 1, pp. 11:1-11:2, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2015)

Copy BibTex To Clipboard

@Article{hauzar_et_al:DARTS.1.1.11,
  author =	{Hauzar, David and Kofron, Jan},
  title =	{{Framework for Static Analysis of PHP Applications (Artifact)}},
  pages =	{11:1--11:2},
  journal =	{Dagstuhl Artifacts Series},
  ISSN =	{2509-8195},
  year =	{2015},
  volume =	{1},
  number =	{1},
  editor =	{Hauzar, David and Kofron, Jan},
  publisher =	{Schloss Dagstuhl -- Leibniz-Zentrum f{\"u}r Informatik},
  address =	{Dagstuhl, Germany},
  URL =		{https://drops.dagstuhl.de/entities/document/10.4230/DARTS.1.1.11},
  URN =		{urn:nbn:de:0030-drops-55208},
  doi =		{10.4230/DARTS.1.1.11},
  annote =	{Keywords: Static analysis, abstract interpretation, dynamic languages, PHP, security}
}

Document

DOI: 10.4230/LIPIcs.ECOOP.2015.689

Framework for Static Analysis of PHP Applications

Authors: David Hauzar and Jan Kofron

Published in: LIPIcs, Volume 37, 29th European Conference on Object-Oriented Programming (ECOOP 2015)

Abstract

Dynamic languages, such as PHP and JavaScript, are widespread and heavily used. They provide dynamic features such as dynamic type system, virtual and dynamic method calls, dynamic includes, and built-in dynamic data structures. This makes it hard to create static analyses, e.g., for automatic error discovery. Yet exploiting errors in such programs, especially in web applications, can have significant impacts. In this paper, we present static analysis framework for PHP, automatically resolving features common to dynamic languages and thus reducing the complexity of defining new static analyses. In particular, the framework enables defining value and heap analyses for dynamic languages independently and composing them automatically and soundly. We used the framework to implement static taint analysis for finding security vulnerabilities. The analysis has revealed previously unknown security problems in real application. Comparing to existing state-of-the-art analysis tools for PHP, it has found more real problems with a lower false-positive rate.

Cite as

David Hauzar and Jan Kofron. Framework for Static Analysis of PHP Applications. In 29th European Conference on Object-Oriented Programming (ECOOP 2015). Leibniz International Proceedings in Informatics (LIPIcs), Volume 37, pp. 689-711, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2015)

Copy BibTex To Clipboard

@InProceedings{hauzar_et_al:LIPIcs.ECOOP.2015.689,
  author =	{Hauzar, David and Kofron, Jan},
  title =	{{Framework for Static Analysis of PHP Applications}},
  booktitle =	{29th European Conference on Object-Oriented Programming (ECOOP 2015)},
  pages =	{689--711},
  series =	{Leibniz International Proceedings in Informatics (LIPIcs)},
  ISBN =	{978-3-939897-86-6},
  ISSN =	{1868-8969},
  year =	{2015},
  volume =	{37},
  editor =	{Boyland, John Tang},
  publisher =	{Schloss Dagstuhl -- Leibniz-Zentrum f{\"u}r Informatik},
  address =	{Dagstuhl, Germany},
  URL =		{https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ECOOP.2015.689},
  URN =		{urn:nbn:de:0030-drops-52435},
  doi =		{10.4230/LIPIcs.ECOOP.2015.689},
  annote =	{Keywords: Static analysis, abstract interpretation, dynamic languages, PHP, security}
}

Search Results

Documents authored by Hauzar, David

Framework for Static Analysis of PHP Applications (Artifact)

Abstract

Cite as

Framework for Static Analysis of PHP Applications

Abstract

Cite as

Thanks for your feedback!

Could not send message