The Second International Conference on Availability, Reliability and Security (ARES'07) (2007)
Apr. 10, 2007 to Apr. 13, 2007
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ARES.2007.43
Gabriel Hermosillo , ITESM-CEM-Dpto. Ciencias Computacionales, Mexico
Roberto Gomez , ITESM-CEM-Dpto. Ciencias Computacionales, Mexico
Lionel Seinturier , LIFL - INRIA Jacquard Project, France
Laurence Duchien , LIFL - INRIA Jacquard Project, France
Adding security functions in existing Web application servers is now vital for the IS of companies and organizations. Writing crosscutting functions in complex software should take advantage of the modularity offered by new software development approaches. With Aspect-Oriented Programming (AOP), separating concerns when designing an application fosters reuse, parameterization and maintenance. In this paper, we design a security aspect called AProSec for detecting SQL injection and Cross Scripting Site (XSS) that are common attacks in web servers. We experiment this aspect with the AspectJ language and the JBoss AOP framework. With this experimentation, we show the advantage of runtime platforms such as JBoss AOP for changing security policies at runtime. Finally, we describe related work on security and AOP.
L. Duchien, G. Hermosillo, R. Gomez and L. Seinturier, "AProSec: an Aspect for Programming Secure Web Applications," The Second International Conference on Availability, Reliability and Security (ARES'07)(ARES), Vienna, Austria, 2007, pp. 1026-1033.