Bidirectional Analysis Method of Static XSS Defect Detection Technique Based On Database Query Language

Along with the wide use of web application, XSS vulnerability has become one of the most common security problems and caused many serious losses. In this paper, on the basis of database query language technique, we put forward a static analysis method of XSS defect detection of Java web application by analyzing data flow reversely. This method first converts the JSP file to a Servlet file, and then uses the mock test method to generate calls for all Java code automatically for comprehensive analysis. We get the methods where XSS security defect may occur by big data analysis. Originated from the methods where XSS security defect may occur, we analyze the data flow and program semantic reversely to detect XSS defect by judging whether it can be introduced by user input without filter. Moreover, to trace the taint path and to improve the analysis precision, we put forward bidirectional analysis. Originated from the results of the reverse analysis, we analyze the data flow forward to trace the taint path. These two methods have effectively reduced analyzing tasks which are necessary in forward ways. It was proved by experiments on some open source Java web projects, bidirectional and reverse methods not only improved the efficiency of detection, but also improved the detection accuracy for XSS defect.