A static backward taint data analysis method for detecting web application vulnerabilities

This paper addresses detecting taint-style vulnerabilities in PHP code. It extends classical taint-style model with an element called “cleans”, which is used to specify sanitation routines. Based on the new model, a static backward taint data analysis method is proposed to detecting taint-style vulnerabilities. This method includes four key steps, first of which is collecting sinks and constructing contexts, the second is backward tracing variables during a basic block, the third is tracing variables between blocks, and the last is tracing variables crossing function call. A tool called POSE implements this method and testing results show that the method is valid for detecting taint-style web application vulnerabilities.