Abstract interpretation: a semantics-based tool for program analysis
Handbook of logic in computer science (vol. 4)
Demand interprocedural dataflow analysis
SIGSOFT '95 Proceedings of the 3rd ACM SIGSOFT symposium on Foundations of software engineering
A practical framework for demand-driven interprocedural data flow analysis
ACM Transactions on Programming Languages and Systems (TOPLAS)
Data flow analysis of applicative programs using minimal function graphs
POPL '86 Proceedings of the 13th ACM SIGACT-SIGPLAN symposium on Principles of programming languages
ACM Transactions on Internet Technology (TOIT)
The SGML Handbook
Simultaneous Demand-Driven Data-Flow and Call Graph Analysis
ICSM '99 Proceedings of the IEEE International Conference on Software Maintenance
Extending Java for high-level Web service construction
ACM Transactions on Programming Languages and Systems (TOPLAS)
Grammar-based analysis of string expressions
TLDI '05 Proceedings of the 2005 ACM SIGPLAN international workshop on Types in languages design and implementation
Static approximation of dynamically generated Web pages
WWW '05 Proceedings of the 14th international conference on World Wide Web
The essence of command injection attacks in web applications
Conference record of the 33rd ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Sound and precise analysis of web applications for injection vulnerabilities
Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation
Static checking of dynamically generated queries in database applications
ACM Transactions on Software Engineering and Methodology (TOSEM)
A Translation from the HTML DTD into a Regular Hedge Grammar
CIAA '08 Proceedings of the 13th international conference on Implementation and Applications of Automata
Abstract Parsing: Static Analysis of Dynamically Generated String Output Using LR-Parsing Technology
SAS '09 Proceedings of the 16th International Symposium on Static Analysis
Precise analysis of string expressions
SAS'03 Proceedings of the 10th international conference on Static analysis
Static analysis for java servlets and JSP
SAS'06 Proceedings of the 13th international conference on Static Analysis
XML validation for context-free grammars
APLAS'06 Proceedings of the 4th Asian conference on Programming Languages and Systems
A practical string analyzer by the widening approach
APLAS'06 Proceedings of the 4th Asian conference on Programming Languages and Systems
Position paper: the science of boxing
Proceedings of the Eighth ACM SIGPLAN workshop on Programming languages and analysis for security
| Hi-index | 0.00 |
We explain and illustrate abstract parsing, a static-analysis technique based on abstract interpretation, LR-parsing, and partial evaluation for validating PHP-like scripts that generate HTML/XML-style documents. A validated script is guaranteed to generate documents that are well formed with respect to the document language's LR(k)- grammar. In this way, abstract parsing resembles compiler data-type checking: a validated script will "not go wrong" and output a malformed, dynamically generated document. After presenting abstract parsing for LR(k)-grammars, we handle these important extensions: (i) String-replacement operations are analyzed by composing the finite-state automaton defined by a string replacement with the finite-state control of the LR(k)-parser. (ii) Conditional-test expressions are implemented by filter automata, which are also composed with the parser's finite-state control. (iii) Dynamically supplied and potentially malicious user input is predicted by characterizing it with an LR(k)-grammar and analyzing the strings generated by the grammar. (iv) Synthesized-attribute grammars are employed to calculate the semantics of the dynamically generated documents.