2nd USENIX Conference on Web Application Development ...

Transformation Status Homepage Login Interface Image Gallery
Original Application 8.9 9.6 9.2
Access Control Only 7.1 7.1 6.6
Taint Tracking w/o HTML Parsing 2.5 2.8 2.5
Full System 2.0 2.5 2.2
Table 4: Performance Measurements from Onyx
Each number indicates the number of transactions per second for the given request and configuration.
6.2 Taint Tracking
Taint tracking techniques have been used to find format
string vulnerabilities [20, 22, 28], prevent buffer overflows
[22, 28], improve signature generation [12], and
even to track information flow at the operating system
level [7]. Several systems, like the GIFT framework [9],
are designed, like GuardRails, to be extensible to prevent
many types of injection attacks [1, 15]. As mentioned in
Section 4.1, some recent research has focused on solving
the over/undertainting problem with character-bycharacter
taint tracking [2, 13, 29]. Many systems are
limited to using boolean taint states [22, 28] or make use
of the compiler, making them difficult to directly apply
to a dynamic, interpreted language like Ruby [1, 11].
Similar to our context-specific transformers, the
Context-Sensitive String Evaluation (CSSE) [15] system
treats tainted strings differently depending on the context
of their use. CSSE uses meta-data tags to allow for complex
taint statuses. CSSE, however, focuses on propagating
information about where the content originated from,
with the context-specific code dealing with the tainted
strings at the location of their use based on this origin information.
The Auto Escape mode in Google’s Template
System is another similar system that uses different sanitization
routines depending on the context of a string in
HTML [6]. Without taint-tracking, however, Auto Escape
cannot distinguish between safe and unsafe strings
without explicit specifications from the developer, so it is
necessary to explicitly identify templates that should use
auto escape mode.
Other systems do not modify the web application itself
or the underlying platform, but instead operate between
the application’s key entry and exit points. Sekar developed
one such tool [18] that records the input received
by the application, and later uses taint inference in output
and database commands to find similar strings that
may have been derived from this input. The tool also
focuses on looking for changes in syntax of important
commands that might be indicative of an injection attack.
Another system, DBTaint [4] works outside of the
application, helping to preserve arbitrary taint information
given from an arbitrary application in the database.
Both of these tools have the advantage of being largely
platform-independent, and neither needs any application
modifications.
7 Conclusion
GuardRails seeks to reduce the effort required to build
a secure web application by enforcing security policies
defined with the data model, in particular, access control
policies and context-sensitive string transformations.
The main novelty of GuardRails is the way policies are
tied directly to data models which fits developer understanding
naturally, provides a large amount of expressiveness,
and centralized policies in a way that minimizes
the likelihood of missing necessary access control
checks. Our early experience with GuardRails provides
cause for optimism that application developers can be relieved
of much of the tedious and error-prone work typically
required to build a secure web application. Although
the performance overhead is prohibitive for large
scale commercial sites, many web applications can tolerate
fairly poor performance. Further, although our current
prototype implementation incurs substantial overhead,
we believe many of techniques we advocate could
be implemented more efficiently if they are more fully integrated
into the underlying framework implementation,
and that reducing developer effort and mitigating security
risk will become increasingly important in rapid web
application development.
Availability
GuardRails is available under an open source license
from http://guardrails.cs.virginia.edu/.
Acknowledgements
This work was funded in part by grants from the National
Science Foundation and a MURI award from the Air
Force Office of Scientific Research. The authors thank
Armando Fox for his helpful comments and suggestions,
and thank Dawn Song, Prateek Saxena, and the attendees
at RubyNation for helpful discussions about this work.
<strong>USENIX</strong> Association WebApps ’11: <strong>2nd</strong> <strong>USENIX</strong> <strong>Conference</strong> on Web Application Development 11