Page 224 - 《软件学报》2026年第7期

毛祥煜 等: 面向 Web 应用漏洞检测的多数据流静态分析方法 2909

[21] Dan Book. perlsec—Perl security. 2025. https://perldoc.perl.org/perlsec
[22] MyBatis 3. 2025. https://mybatis.org/mybatis-3/
[23] CodeQL. 2025. https://codeql.github.com/
[24] Wikipedia. Datalog. 2025. https://en.wikipedia.org/wiki/Datalog
[25] BlackDuck. Coverity static analysis. 2025. https://www.blackduck.com/static-analysis-tools-sast/coverity.html
[26] OWASP Foundation. OWASP benchmark project. 2025. https://owasp.org/www-project-benchmark/
[27] GitHub. 2025. https://github.com/
[28] NPM. 2025. https://www.npmjs.com/
[29] BlackDuck. Coverity static analysis coverage for common weakness enumeration (CWE). 2025. https://www.blackduck.com/static-
analysis-tools-sast/cwe.html
[30] GitHub. The CWEs supported by CodeQL. 2025. https://github.com/github/codeql/tree/main/java/ql/src/Security/CWE
[31] GitHub. Commonly used taint-config of Tai-e. 2025. https://github.com/pascal-lab/Tai-e/tree/master/src/main/resources/commonly-used-
taint-config
[32] Reps T, Horwitz S, Sagiv M. Precise interprocedural dataflow analysis via graph reachability. In: Proc. of the 22nd ACM SIGPLAN-
SIGACT Symp. on Principles of Programming Languages. San Francisco: ACM, 1995. 49–61. [doi: 10.1145/199448.199462]
[33] Aho AV, Lam MS, Sethi R, Ullman JD. Compilers: Principles, Techniques, & Tools. 2nd ed., Boston: Pearson, 2007.
[34] Liu JY, Han JX, Huang C. Vulnerability detection in source code using statice analysis. Journal of Cyber Security, 2022, 7(4): 100–113
(in Chinese with English abstract). [doi: 10.19363/J.cnki.cn10-1380/tn.2022.07.08]
[35] Wang L, Li F, Li L, Feng XB. Principle and practice of taint analysis. Ruan Jian Xue Bao/Journal of Software, 2017, 28(4): 860–882 (in
Chinese with English abstract). http://www.jos.org.cn/1000-9825/5190.htm [doi: 10.13328/j.cnki.jos.005190]
[36] Zhang J, Zhang C, Xuan JF, Xiong YF, Wang QX, Liang B, Li L, Dou WS, Chen ZB, Chen LQ, Cai Y. Recent progress in program
analysis. Ruan Jian Xue Bao/Journal of Software, 2019, 30(1): 80–109 (in Chinese with English abstract). http://www.jos.org.cn/1000-
9825/5651.htm [doi: 10.13328/j.cnki.jos.005651]
[37] Jovanovic N, Kruegel C, Kirda E. Static analysis for detecting taint-style vulnerabilities in Web applications. Journal of Computer
Security, 2010, 18(5): 861–907. [doi: 10.5555/1841962.1841968]
[38] Jovanovic N, Kruegel C, Kirda E. Pixy: A static analysis tool for detecting Web application vulnerabilities. In: Proc. of the 2006 IEEE
Symp. on Security and Privacy. Berkeley: IEEE, 2006. 258–263. [doi: 10.1109/SP.2006.29]
[39] Livshits VB, Lam MS. Finding security vulnerabilities in Java applications with static analysis. In: Proc. of the 14th Conf. on USENIX
Security Symp. Baltimore: USENIX Association, 2005. 18. [doi: 10.5555/1251398.1251416]
[40] Arzt S, Rasthofer S, Fritz C, Bodden E, Bartel A, Klein J, Le Traon Y, Octeau D, McDaniel P. FlowDroid: Precise context, flow, field,
object-sensitive and lifecycle-aware taint analysis for Android Apps. ACM Sigplan Notices, 2014, 49(6): 259–269. [doi: 10.1145/
2666356.2594299]
[41] Yamaguchi F, Golde N, Arp D, Rieck K. Modeling and discovering vulnerabilities with code property graphs. In: Proc. of the 2014 IEEE
Symp. on Security and Privacy. Berkeley: IEEE, 2014. 590–604. [doi: 10.1109/SP.2014.44]
[42] Wang J, Wu YG, Zhou G, Yu YM, Guo ZY, Xiong YF. Scaling static taint analysis to industrial SOA applications: A case study at
alibaba. In: Proc. of the 28th ACM Joint Meeting on European Software Engineering Conf. and Symp. on the Foundations of Software
Engineering. ACM, 2020. 1477–1486. [doi: 10.1145/3368089.3417059]
[43] Liu FY, Zhang Y, Chen T, Shi YK, Yang GL, Lin ZH, Yang M, He JY, Li Q. Detecting taint-style vulnerabilities in microservice-
structured Web applications. In: Proc. of the 2025 IEEE Symp. on Security and Privacy. San Francisco: IEEE, 2025. 972–990. [doi: 10.
1109/SP61157.2025.00137]
[44] Park C, Won S, Jin J, Ryu S. Static analysis of JavaScript Web applications in the wild via practical DOM modeling. In: Proc. of the 30th
IEEE/ACM Int’l Conf. on Automated Software Engineering. Lincoln: IEEE, 2015. 552–562. [doi: 10.1109/ASE.2015.27]
[45] Zhong ZX, Liu JC, Wu DY, Di P, Sui Y, Liu AX, Lui JCS. Scalable compositional static taint analysis for sensitive data tracing on
industrial micro-services. In: Proc. of the 45th IEEE/ACM Int’l Conf. on Software Engineering: Software Engineering in Practice.
Melbourne: IEEE, 2023. 110–121. [doi: 10.1109/ICSE-SEIP58684.2023.00015]
[46] Olsson E, Eriksson B, Doupé A, Sabelfeld A. Spider-scents: Grey-box database-aware Web scanning for stored XSS. In: Proc. of the 33rd
USENIX Conf. on Security Symp. Philadelphia: USENIX Association, 2024. 377. [doi: 10.5555/3698900.3699277]
[47] Alhuzali A, Gjomemo R, Eshete B, Venkatakrishnan VN. NAVEX: Precise and scalable exploit generation for dynamic Web
applications. In: Proc. of the 27th USENIX Conf. on Security Symp. Baltimore: USENIX Association, 2018. 377–392. [doi: 10.5555/
3277203.3277232]