Detecting Cross-Site Scripting Vulnerabilities through Automated Unit Testing

TL;DR

This paper introduces an automated security unit testing method that constructs and executes tests to detect XSS vulnerabilities caused by improper data encoding, improving detection coverage and reducing false positives.

Contribution

It presents a novel approach combining automated test construction and grammar-based attack generation to identify XSS vulnerabilities due to encoding errors.

Findings

Detected many 0-day XSS vulnerabilities in a large medical records app.

Achieved higher test coverage than industry best practices.

Low false positive rate in vulnerability detection.

Abstract

The best practice to prevent Cross Site Scripting (XSS) attacks is to apply encoders to sanitize untrusted data. To balance security and functionality, encoders should be applied to match the web page context, such as HTML body, JavaScript, and style sheets. A common programming error is the use of a wrong encoder to sanitize untrusted data, leaving the application vulnerable. We present a security unit testing approach to detect XSS vulnerabilities caused by improper encoding of untrusted data. Unit tests for the XSS vulnerability are automatically constructed out of each web page and then evaluated by a unit test execution framework. A grammar-based attack generator is used to automatically generate test inputs. We evaluate our approach on a large open source medical records application, demonstrating that we can detect many 0-day XSS vulnerabilities with very low false positives, and that the grammar-based attack generator has better test coverage than industry best practices.