Towards a SQL Injection Vulnerability Detector Based on Session Types

António Silvestre, Ibéria Medeiros, Andreia Mordido

2024

Abstract

Vulnerabilities in web applications pose a risk for organisations. Among them, SQL injections (SQLi) give the attacker access to private data by submitting malicious SQL queries to the database via invalidated entry points. Although there are various techniques for detecting SQLi, static analysis is widely used as it inspects the application code without executing it. However, static analysis tools are not always precise. In this work, we explore an avenue that links the detection of SQLi to type checking, thus providing stronger guarantees of their existence. We propose a novel approach which consists of interpreting the behaviour of a web application as if it was a communication protocol and uses session types to specify this behaviour. We leverage FreeST, a functional programming language for session types, to implement FREESQLI, a seminal detector of SQLi in PHP web applications. The tool translates the PHP code into FreeST code and capitalizes on FreeST’s type checker to verify protocol adherence and detect inconsistencies associated with the presence of SQLi.

Paper Citation

in Harvard Style

Silvestre A., Medeiros I. and Mordido A. (2024). Towards a SQL Injection Vulnerability Detector Based on Session Types. In Proceedings of the 19th International Conference on Evaluation of Novel Approaches to Software Engineering - Volume 1: ENASE; ISBN 978-989-758-696-5, SciTePress, pages 711-718. DOI: 10.5220/0012732500003687

in Bibtex Style

@conference{enase24,
author={António Silvestre and Ibéria Medeiros and Andreia Mordido},
title={Towards a SQL Injection Vulnerability Detector Based on Session Types},
booktitle={Proceedings of the 19th International Conference on Evaluation of Novel Approaches to Software Engineering - Volume 1: ENASE},
year={2024},
pages={711-718},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0012732500003687},
isbn={978-989-758-696-5},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 19th International Conference on Evaluation of Novel Approaches to Software Engineering - Volume 1: ENASE
TI - Towards a SQL Injection Vulnerability Detector Based on Session Types
SN - 978-989-758-696-5
AU - Silvestre A.
AU - Medeiros I.
AU - Mordido A.
PY - 2024
SP - 711
EP - 718
DO - 10.5220/0012732500003687
PB - SciTePress