research-article

Code-motion for API migration: fixing SQL injection vulnerabilities in Java

Authors:

Yishai A. Feldman,

Mati ShomratAuthors Info & Claims

WRT '11: Proceedings of the 4th Workshop on Refactoring Tools

Pages 1 - 7

https://doi.org/10.1145/1984732.1984734

Published: 22 May 2011 Publication History

Abstract

Refactoring often requires the reordering of code fragments; such is the case when migrating from one API to another. Performing such reordering manually is complex and error-prone. A specific example in the security domain involves database query execution, in which some of the parameters come from untrusted sources. In Java, the Statement API provides opportunities for SQL injection attacks. The recommended remedy is to replace it with the secure Prepared-Statement API; however, that sometimes requires changing the order in which the query is built. We present an algorithm that performs this migration, moving code as necessary to preserve functionality while changing the structure of the original code as little as possible.

References

[1]

A. Abadi, R. Ettinger, and Y. A. Feldman. Fine slicing for advanced method extraction. In Proc. Third Workshop on Refactoring Tools, Oct. 2009.

[2]

I. Balaban, F. Tip, and R. Fuhrer. Refactoring support for class library migration. In Proc. 20th ACM Conf. Object-Oriented Programming, Systems, Languages and Applications (OOPSLA), pages 265--279, 2005.

Digital Library

[3]

P. Bisht, A. P. Sistla, and V. N. Venkatakrishnan. Automatically preparing safe SQL queries. In Proc. 14th Int'l Conf. on Financial Cryptography and Data Security (FC), Jan. 2010.

Digital Library

[4]

D. Dig, S. Negara, V. Mohindra, and R. Johnson. ReBA: A tool for generating binary adapters for evolving Java libraries. In Proc. 30th Int'l Conf. Software Engineering (ICSE), pages 963--964, 2008.

Digital Library

[5]

F. Dysart and M. Sherriff. Automated fix generator for SQL injection attacks. In Proc. 19th Int'l Symp. on Software Reliability Engineering (ISSRE), pages 311--312, 2008.

Digital Library

[6]

X. Fu, X. Lu, B. Peltsverger, S. Chen, K. Qian, and L. Tao. A static analysis framework for detecting SQL injection vulnerabilities. In Proc. 31st Annual Int'l Computer Software and Applications Conference (COMPSAC), pages 87--96, 2007.

Digital Library

[7]

M. Hafiz, P. Adamczyk, and R. Johnson. Systematically eradicating data injection attacks using security-oriented program transformations. In Proc. Int'l Symp. on Engineering Secure Software and Systems (ESSoS), pages 75--90, 2009.

Digital Library

[8]

M. Hafiz and R. Johnson. A security oriented program transformation to "add on" policies to prevent injection attacks. In Proc. Second Workshop on Refactoring Tools (WRT), pages 1--4, 2008.

Digital Library

[9]

W. G. J. Halfond and A. Orso. AMNESIA: Analysis and monitoring for neutralizing SQL-injection attacks. In Proc. 20th IEEE/ACM Int'l Conf. on Automated Software Engineering (ASE), pages 174--183, 2005.

Digital Library

[10]

D. Hovemeyer and W. Pugh. Finding bugs is easy. SIGPLAN Not., 39:92--106, December 2004.

Digital Library

[11]

M. Howard and D. E. Leblanc. Writing Secure Code. Microsoft Press, 2nd edition, 2002.

Digital Library

[12]

Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, and S.-Y. Kuo. Securing web application code by static analysis and runtime protection. In Proc. 13th Int'l Conf. on World Wide Web (WWW), pages 40--52, 2004.

Digital Library

[13]

V. B. Livshits and M. S. Lam. Finding security vulnerabilities in Java applications with static analysis. In Proc. 14th USENIX Security Symp., pages 18--18, 2005.

Digital Library

[14]

A. Nguyen-tuong, S. Guarnieri, D. Greene, J. Shirley, and D. Evans. Automatically hardening web applications using precise tainting. In Proc. 20th IFIP Int'l Information Security Conference (SEC), pages 372--382, 2005.

[15]

OWASP Top Ten Project. http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project.

[16]

C. Rich. A formal representation for plans in the Programmer's Apprentice. In Proc. 7th Int. Joint Conf. Artificial Intelligence, pages 1044--1052, Vancouver, British Columbia, Canada, Aug. 1981.

Digital Library

[17]

C. Rich and R. C. Waters. The Programmer's Apprentice. ACM Press and Addison Wesley, 1990.

[18]

S. Thomas, L. Williams, and T. Xie. On automated prepared statement generation to remove SQL injection vulnerabilities. Inf. Softw. Technol., 51(3):589--598, 2009.

Digital Library

[19]

O. Tripp, M. Pistoia, S. J. Fink, M. Sridharan, and O. Weisman. TAJ: Effective taint analysis of web applications. In Proc. Conf. Programming Lang. Design and Implementation (PLDI), pages 87--97, 2009.

Digital Library

[20]

G. Wassermann and Z. Su. Sound and precise analysis of web applications for injection vulnerabilities. In Proc. Conf. Programming Lang. Design and Implementation (PLDI), pages 32--41, 2007.

Digital Library

[21]

G. Wassermann, D. Yu, A. Chander, D. Dhurjati, H. Inamura, and Z. Su. Dynamic test input generation for web applications. In Proc. Int'l Symp. on Software Testing and Analysis (ISSTA), pages 249--260, 2008.

Digital Library

[22]

W. Wu, Y.-G. Guéhéneuc, G. Antoniol, and M. Kim. AURA: A hybrid approach to identify framework evolution. In Proc. 32nd Int'l Conf. Software Engineering (ICSE), pages 325--334, 2010.

Digital Library

[23]

Y. Xie and A. Aiken. Static detection of security vulnerabilities in scripting languages. In Proc. 15th USENIX Security Symp., 2006.

Digital Library

Cited By

Siddiq MJahin MUl Islam MShahriyar RIqbal A(2021)SQLIFIX: Learning Based Approach to Fix SQL Injection Vulnerabilities in Source Code2021 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)10.1109/SANER50967.2021.00040(354-364)Online publication date: Mar-2021
https://doi.org/10.1109/SANER50967.2021.00040
Marchand-Melsom ANguyen Mai D(2020)Automatic repair of OWASP Top 10 security vulnerabilitiesProceedings of the IEEE/ACM 42nd International Conference on Software Engineering Workshops10.1145/3387940.3392200(23-30)Online publication date: 27-Jun-2020
https://dl.acm.org/doi/10.1145/3387940.3392200
Masri WSleiman S(2015)SQLPILSecurity and Communication Networks10.1002/sec.11998:15(2545-2560)Online publication date: 1-Oct-2015
https://dl.acm.org/doi/10.1002/sec.1199
Show More Cited By

Index Terms

Code-motion for API migration: fixing SQL injection vulnerabilities in Java
1. Software and its engineering
  1. Software creation and management
    1. Software post-development issues
      1. Software reverse engineering

Recommendations

Exploring example-driven migration
Programming '19: Companion Proceedings of the 3rd International Conference on the Art, Science, and Engineering of Programming

Despite many research efforts to automate API usage migration, it remains often a manual task for developers. We aim to reduce the developer's pain by exploring ways to integrate the migration process into the IDE. Our migration workbench leverages API ...
Towards cost-effective API deprecation: A win–win strategy for API developers and API users
Abstract
API deprecation, which enables API developers to assist API users in migration tasks, has been widely employed in API removal management. However, mismanaged API deprecation will cause unnecessary cost and bring negligible benefit to ...
Hybrid API Migration: A Marriage of Small API Mapping Models and Large Language Models
Internetware '23: Proceedings of the 14th Asia-Pacific Symposium on Internetware

API migration is an essential step for code migration between libraries or programming languages, and it is a challenging task as it requires detailed comprehension of both source and target APIs. The existing work either recommends mapped API names ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

WRT '11: Proceedings of the 4th Workshop on Refactoring Tools

May 2011

52 pages

ISBN:9781450305792

DOI:10.1145/1984732

Program Chairs:
Danny Dig
University of Illinois at Urbana-Champaign, USA
,
Don Batory
University of Texas at Austin, USA

Copyright © 2011 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 22 May 2011

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

ICSE11

Sponsor:

SIGSOFT

ICSE11: International Conference on Software Engineering

May 22, 2011

HI, Waikiki, Honolulu, USA

Acceptance Rates

Overall Acceptance Rate 9 of 9 submissions, 100%

Upcoming Conference

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

6
Total Citations
View Citations
458
Total Downloads

Downloads (Last 12 months)17
Downloads (Last 6 weeks)1

Reflects downloads up to 03 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Siddiq MJahin MUl Islam MShahriyar RIqbal A(2021)SQLIFIX: Learning Based Approach to Fix SQL Injection Vulnerabilities in Source Code2021 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)10.1109/SANER50967.2021.00040(354-364)Online publication date: Mar-2021
https://doi.org/10.1109/SANER50967.2021.00040
Marchand-Melsom ANguyen Mai D(2020)Automatic repair of OWASP Top 10 security vulnerabilitiesProceedings of the IEEE/ACM 42nd International Conference on Software Engineering Workshops10.1145/3387940.3392200(23-30)Online publication date: 27-Jun-2020
https://dl.acm.org/doi/10.1145/3387940.3392200
Masri WSleiman S(2015)SQLPILSecurity and Communication Networks10.1002/sec.11998:15(2545-2560)Online publication date: 1-Oct-2015
https://dl.acm.org/doi/10.1002/sec.1199
Ge XDuBose QMurphy-Hill EGlinz MMurphy GPezzè M(2012)Reconciling manual and automatic refactoringProceedings of the 34th International Conference on Software Engineering10.5555/2337223.2337249(211-221)Online publication date: 2-Jun-2012
https://dl.acm.org/doi/10.5555/2337223.2337249
Abadi AEttinger RFeldman Y(2012)Fine slicingProceedings of the 15th international conference on Fundamental Approaches to Software Engineering10.1007/978-3-642-28872-2_32(471-485)Online publication date: 24-Mar-2012
https://dl.acm.org/doi/10.1007/978-3-642-28872-2_32
Abadi AEttinger RFeldman YShomrat MLopes CFisher K(2011)Automatically fixing security vulnerabilities in Java codeProceedings of the ACM international conference companion on Object oriented programming systems languages and applications companion10.1145/2048147.2048149(3-4)Online publication date: 22-Oct-2011
https://dl.acm.org/doi/10.1145/2048147.2048149

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten