![](bgb.png)
ACKNOWLEDGMENTS
This work was partially supported by the na-
tional funds through FCT with reference to SEAL
project (PTDC/CCI-INF/29058/2017), and LASIGE
Research Unit (UIDB/50021/2020).
REFERENCES
Acar, Y., Backes, M., Fahl, S., Kim, D., Mazurek, M. L.,
and Stransky, C. (2016). You Get Where You’re Look-
ing for: The Impact of Information Sources on Code
Security. In Proceedings of the IEEE Symposium on
Security and Privacy.
Algaith, A., Nunes, P., Fonseca, J., Gashi, I., and Viera, M.
(2018). Finding SQL Injection and Cross Site Script-
ing Vulnerabilities with Diverse Static Analysis Tools.
In Proceedings of the European Dependable Comput-
ing Conference.
Anderson, D. and Hills, M. (2017). Query Construction Pat-
terns in PHP. In Proceedings of the International Con-
ference on Software Analysis, Evolution and Reengi-
neering.
Dahse, J. and Holz, T. (2014). Static Detection of Second-
Order Vulnerabilities in Web Applications. In Pro-
ceedings of the USENIX Security Symposium.
Fischer, F., B
¨
ottinger, K., Xiao, H., Stransky, C., Acar,
Y., Backes, M., and Fahl, S. (2017). Stack Overflow
Considered Harmful? The Impact of Copy Paste on
Android Application Security. In Proceedings of the
IEEE Symposium on Security and Privacy.
Flynn, L., Snavely, W., Svoboda, D., VanHoudnos, N., Qin,
R., Burns, J., Zubrow, D., Stoddard, R., and Marce-
Santurio, G. (2018). Prioritizing Alerts from Multi-
ple Static Analysis Tools, Using Classification Mod-
els. In Proceedings of the International Workshop on
Software Qualities and Their Dependencies.
Grieco, G., Grinblat, G. L., Uzal, L., Rawat, S., Feist, J., and
Mounier, L. (2016). Toward Large-Scale Vulnerabil-
ity Discovery Using Machine Learning. In Proceed-
ings of the ACM Conference on Data and Application
Security and Privacy.
Halfond, W. G. J. and Orso, A. (2005). AMNESIA: Anal-
ysis and Monitoring for NEutralizing SQL-injection
Attacks. In Proceedings of the IEEE/ACM Interna-
tional Conference on Automated Software Engineer-
ing.
Halfond, W. G. J., Orso, A., and Manolios, P. (2008).
WASP: Protecting Web Applications Using Positive
Tainting and Syntax-Aware Evaluation. IEEE Trans-
actions on Software Engineering.
Huang, J., Li, Y., Zhang, J., and Dai, R. (2019). UChecker:
Automatically Detecting PHP-Based Unrestricted File
Upload Vulnerabilities. In Proceedings of the IEEE/I-
FIP International Conference on Dependable Systems
and Networks.
Huang, Y.-W., Yu, F., Hang, C., Tsai, C.-H., Lee, D.-T.,
and Kuo, S.-Y. (2004). Securing Web Application
Code by Static Analysis and Runtime Protection. In
Proceedings of the International Conference on World
Wide Web.
Livshits, V. B. and Lam, M. S. (2005). Finding Security
Vulnerabilities in Java Applications with Static Anal-
ysis. In Proceedings of the USENIX Security Sympo-
sium.
Medeiros, I., Neves, N. F., and Correia, M. (2014). Au-
tomatic Detection and Correction of Web Applica-
tion Vulnerabilities using Data Mining to Predict False
Positives. In Proceedings of the International World
Wide Web Conference.
Medeiros, I., Neves, N. F., and Correia, M. (2016).
DEKANT: a static analysis tool that learns to detect
web application vulnerabilities. In Proceedings of
the 25th International Symposium on Software Testing
and Analysis.
Nunes, P., Medeiros, I., Fonseca, J., Neves, N. F., Correia,
M., and Vieira, M. (2017). On Combining Diverse
Static Analysis Tools for Web Security: An Empirical
Study. In Proceedings of the European Dependable
Computing Conference.
Schwartz, E. J., Avgerinos, T., and Brumley, D. (2010).
All You Ever Wanted to Know about Dynamic Taint
Analysis and Forward Symbolic Execution (but Might
Have Been Afraid to Ask). In Proceedings of the IEEE
Symposium on Security and Privacy.
Shar, L. K. and Tan, H. B. K. (2012). Mining Input Saniti-
zation Patterns for Predicting SQL Injection and Cross
Site Scripting Vulnerabilities. In Proceedings of the
International Conference on Software Engineering.
Shar, L. K., Tan, H. B. K., and Briand, L. C. (2013). Mining
SQL Injection and Cross Site Scripting Vulnerabilities
using Hybrid Program Analysis. In Proceedings of the
International Conference on Software Engineering.
Shirey, R. (2007). Internet Security Glossary. RFC 4949,
IETF.
Steffens, M., Rossow, C., Johns, M., and Stock, B. (2019).
Don’t trust the locals: Investigating the prevalence of
persistent client-side cross-site scripting in the wild.
In Proceedings of the Network and Distributed System
Security Symposium.
van der Stock, A., Glas, B., Smithline, N., and Gigler, T.
(2017). Owasp Top 10 2017 The Ten Most Critical
Web Application Security Risks. Technical report,
OWASP.
WhiteHat Security (2019). Technical report, WhiteHat Se-
curity.
Yamaguchi, F., Lindner, F., and Rieck, K. (2011). Vulner-
ability Extrapolation: Assisted Discovery of Vulner-
abilities Using Machine Learning. In Proceedings of
the USENIX Conference on Offensive Technologies.
Zheng, Y., Zhang, X., and Ganesh, V. (2013). Z3-str: A Z3-
based String Solver for Web Application Analysis. In
Proceedings of the Joint Meeting on Foundations of
Software Engineering.
ENASE 2020 - 15th International Conference on Evaluation of Novel Approaches to Software Engineering
96