![](bg8.png)
The results of the K-DBTaint are compared with the
results obtained from some of the available static taint
analysis tools, such as WAP-TA (Evans and Larochelle,
2002), Pixy (Jovanovic et al., 2006), (Wassermann
and Su, 2008), and (Cao et al., 2017), are reported
in columns 3-7. The notations ‘7
+
’ and ‘7
−
’ indi-
cate failures due to false positives and false negatives
respectively, whereas ‘X’ indicates a successful de-
tection of taint vulnerabilities. Observe that, due to
the flow-sensitivity, context-sensitivity, the enhance-
ment to deal with constant functions and semantics
of SQL statements, K-DBTaint significantly reduces
the occurrences of false alarms. In Table 4, we show
how K-DBTaint successfully captures taint flows of the
motivating example in Figure 1 by showing its corre-
sponding execution steps.
7 CONCLUSIONS
In this paper, we proposed an executable rewriting
logic semantics for static taint analysis of a database
language in the K framework. The proposed anal-
ysis addressed the semantics of both the database
statements and the imperative program statements to-
gether. We develop a prototype K-DBTaint in K
based on the theoretical foundation, which allows the
user to analyse PL/SQL code for integrity issues. As
compared to existing works, the proposed approach
has improved precision, as shown by our experimen-
tal evaluation on a set of benchmark programs. In
future, we aim to add more semantic rules to cover
more language features such as aggregate functions,
nested queries, set operations, etc., as an extension
to the current database language and we also address
more semantics-based non-dependencies.
REFERENCES
Alam, M., Halder, R., Goswami, H., Pinto, J. S., et al.
(2018). K-taint: an executable rewriting logic seman-
tics for taint analysis in the k framework. In Proc of
the 13th Int. Conf. on ENASE, pages 359–366.
Alam, M. I. and Halder, R. (2021). Formal verification of
database applications using predicate abstraction. SN
Computer Science, 2(3):1–24.
Alam, M. I., Halder, R., and Pinto, J. S. (2021). A de-
ductive reasoning approach for database applications
using verification conditions. Journal of Systems and
Software, 175:110903.
As
˘
avoae, I. M. (2014). Abstract semantics for alias anal-
ysis in k. Electronic Notes in Theoretical Computer
Science, 304:97–110.
Cao, K., He, J., Fan, W., Huang, W., Chen, L., and Pan,
Y. (2017). Php vulnerability detection based on taint
analysis. In 2017 6th ICRITO, pages 436–439. IEEE.
Clavel, M. and et al. (2007). All about maude-a high-
performance logical framework: how to specify, pro-
gram and verify systems in rewriting logic, volume
4350. Springer-Verlag.
Evans, D. and Larochelle, D. (2002). Improving security
using extensible lightweight static analysis. IEEE soft-
ware, 19(1):42–51.
Halim, V. H. and Asnar, Y. D. W. (2019). Static code ana-
lyzer for detecting web application vulnerability using
control flow graphs. In 2019 International Conference
on Data and Software Engineering (ICoDSE), pages
1–6. IEEE.
Huang, W., Dong, Y., and Milanova, A. (2014). Type-based
taint analysis for java web applications. In In Proc.
of Int. Conf. on Fundamental Approaches to Software
Engineering, pages 140–154. Springer.
Hunt, S. and Sands, D. (2006). On flow-sensitive security
types. In Conf. Record of the 33rd ACM SIGPLAN-
SIGACT Sym. on POPL, pages 79–90, S. California.
ACM.
Jana, A., Alam, M. I., and Halder, R. (2018). A symbolic
model checker for database programs. In ICSOFT,
pages 381–388.
Jovanovic, N., Kruegel, C., and Kirda, E. (2006). Pixy: A
static analysis tool for detecting web application vul-
nerabilities. In IEEE, S&P’06, pages pp. 258–263.
Maskur, A. F. and Asnar, Y. D. W. (2019). Static code anal-
ysis tools with the taint analysis method for detect-
ing web application vulnerability. In 2019 Interna-
tional Conference on Data and Software Engineering
(ICoDSE), pages 1–6. IEEE.
Medeiros, I., Neves, N., and Correia, M. (2015). Detect-
ing and removing web application vulnerabilities with
static analysis and data mining. IEEE Transactions on
Reliability, 65(1):54–69.
Meseguer, J. and Ro¸su, G. (2007). The rewriting logic
semantics project. Theoretical Computer Science,
373(3):213–237.
PL/SQL(2021). Github pl/sql project. https://github. com/-
topics/plsql. [Online accessed March-2021].
Ro¸su, G. and ¸Serb
˘
anut
˘
a, T. F. (2010). An overview of the k
semantic framework. The Journal of Logic and Alge-
braic Programming, 79(6):397–434.
Su, G., Wang, F., and Li, Q. (2018). Research on sql injec-
tion vulnerability attack model. In 2018 5th IEEE Int.
Conf. on CCIS, pages 217–221. IEEE.
Tripp, O., Pistoia, M., Fink, S. J., Sridharan, M., and Weis-
man, O. (2009). Taj: effective taint analysis of web ap-
plications. In ACM Sigplan Notices, volume 44, pages
87–97. ACM.
Vijayalakshmi, K. and Syed Mohamed, E. (2021). Case
study: Extenuation of xss attacks through various de-
tecting and defending techniques. Journal of Applied
Security Research, 16(1):91–126.
Wassermann, G. and Su, Z. (2008). Static detec-
tion of cross-site scripting vulnerabilities. In 2008
ACM/IEEE 30th International Conference on Soft-
ware Engineering, pages 171–180. IEEE.
Tailoring Taint Analysis for Database Applications in the K Framework
377