Skip to main content
SpringerLink
Log in

Designing a Secure Programming Language

  • Chapter
Handbook of Information and Communication Security

Abstract

In this chapter, we will review security issues from the perspective of a language designer. Preventing inexperienced or careless programmers from creating insecure applications by focusing on careful language design is central to this discussion. Many of these concepts are also applicable to framework designers.

Considering the design of either a specialized language or a framework in amore general-purpose language enables us to make specific assumptions about developers, or the type of applications they create. For example, architects of both PHP and Ruby on Rails largely face the same set of security issues.

Section 35.2 will cover code injection attacks and the approaches available to guard against them at a language/framework level. Section 35.3 will delve into protections that prevent buffer overflow vulnerabilities, including some not traditionally used in safe languages. Section 35.4 will focus on clientside programming, specifically contrasting the approaches used by Java applets and JavaScript. Section 35.5 will cover the application of metaobject protocols and aspect-oriented programming to security, and the types of new security risks they may create.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 349.00
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 449.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD 599.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. J. Rafail: Cross-site scripting vulnerabilities, http://www.cert.org/archive/pdf/cross_site_scripting.pdf (last accessed 2009)

  2. J. Grossman: WhiteHat website security statistics report, WhiteHat Security (2007) http://cs.jhu.edu/ jason/papers/#istv91 (last accessed 2009)

  3. S. Cook: Web developer’s guide to cross-site scripting (2003) http://www.grc.com/sn/files/A_Web_Developers_Guide_to_Cross_Site% _Scripting.pdf (last accessed 2009)

  4. PHP magic quotes (PHP manual) http://us.php.net/magic_quotes (last accessed 2009)

  5. J. Grossman: Phishing with super bait, Black Hat Japan, Tokyo (2005) http://www.blackhat.com/presentations/bh-jp-05/bh-jp-05-grossman.pdf (last accessed 2009)

  6. D. Reiersol, M. Baker, C. Shiflett: PHP in Action: Objects, Design, Agility (Manning Publications, Greenwich 2007)

    Google Scholar 

  7. Smarty: template engine homepage, http://www.smarty.net/ (last accessed 2009)

  8. PHPTAL homepage, http://phptal.motion-twin.com/ (last accessed 2009)

  9. R. Munroe: Exploits of a mom, http://xkcd.com/327/ (last accessed 2009)

  10. Ruby on rails project page, http://rubyonrails.org/ (last accessed 2009)

  11. C. Shiflett: Addslashes() versus mysql_real_escape_string() (Blog posting, 2006) http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-s tring (last accessed 2009)

  12. D. Thomas: Programming Ruby: the Pragmatic Programmer’s Guide, 2nd edn. (The Pragmattic Programmers, Raleigh 2005)

    Google Scholar 

  13. D. Black: Ruby for Rails: Ruby Techniques for Rails Developers (Manning Publications, Greenwich 2006)

    Google Scholar 

  14. D. Bernstein: The qmail security guarantee, http://cr.yp.to/qmail/guarantee.html (accessed 2009)

  15. Twilight Hack, WiiBrew Wiki page, http://wiibrew.org/w/index.php?title=Twilight_Hack (last accessed 2009)

  16. T. Lindholm, F. Yellin: Java Virtual Machine Specification (Addison-Wesley, Boston 2003)

    Google Scholar 

  17. C. Cowan, C. Pu, D. Maier, H. Hintony, J. Walpole, P. Bakke, S. Beattie, A. Grier, P. Wagle, Q. Zhang: StackGuard: automatic adaptive detection and prevention of buffer-overflow attacks, Proc. 7th conf. on USENIX Security Symp., USENIX Assoc., San Antonio (1998)

    Google Scholar 

  18. M. Rinard, C. Cadar, H. Nguyen: Exploring the acceptability envelope, Companion 20th ACM SIGPLAN Conf. on Object-oriented programming, systems, languages, and applications, San Diego (2005) 21–30

    Google Scholar 

  19. M. Rinard, C. Cadar, D. Dumitran, D. Roy, T. Leu, W. Beebee Jr.: Enhancing server availability and security through failure-oblivious computing, Proc. 6th Conf. on Symp. on Opearting Systems Design & Implementation, USENIX Assoc., San Francisco (2004)

    Google Scholar 

  20. M. Rinard, C. Cadar, D. Dumitran, D. Roy, T. Leu: A dynamic technique for eliminating buffer overflow vulnerabilities (and other memory errors), Proc. 20th Computer Security Applications Conf., IEEE Computer Soc. (2004) pp. 82–90

    Google Scholar 

  21. X. Leroy: Java bytecode verification: algorithms and formalizations, J. Autom. Reason. 30(3/4), 235–269 (2003)

    Article  MATH  MathSciNet  Google Scholar 

  22. Java security overview, Sun Microsystems (2005), http://java.sun.com/developer/technicalArticles/Security/whitepaper/JS% _White_Paper.pdf, accessed 2009

  23. ECMA-262: ECMAScript Language Specification, 3rd edn. (ECMA, Geneva 2008)

    Google Scholar 

  24. Rhino JavaScript homepage, http://www.mozilla.org/rhino/ (last accessed 2009)

  25. D. Flanagan: Javascript: the Definitive Guide, 5th edn. (O’Reilly, Sebastopol 2006)

    Google Scholar 

  26. JavaScript security in Mozilla, http://www.mozilla.org/projects/security/components/jssec.html (last accessed 2009)

  27. V. Anupam, D. Kristol, A. Mayer: A user’s and programmer’s view of the new JavaScript security model, Proc. 2nd Conf. on USENIX Symp. on Internet Technologies and Systems, USENIX Assoc., Boulder (1999)

    Google Scholar 

  28. How to use security zones in Internet Explorer, http://support.microsoft.com/kb/174360 (last accessed 2009)

  29. G. Kiczales, J. Des Rivieres: The Art of the Metaobject Protocol (MIT Press, Cambridge 1991)

    Google Scholar 

  30. É. Tanter, J. Noyé, D. Caromel, P. Cointe: Partial behavioral reflection: spatial and temporal selection of reification, Proc. 18th ACM SIGPLAN Conf. on Object-Oriented Programing, Systems, Languages, and Applications, ACM, Anaheim (2003) 27–46

    Google Scholar 

  31. I. Welch, R. Stroud: From Dalang to Kava – the evolution of a reflective Java extension, Proc. 2nd Int. Conf. on Meta-Level Architectures and Reflection (Springer, Berlin 1999) pp. 2–21

    Google Scholar 

  32. G. Kiczales: Aspect-oriented programming, ACM Comput. Surv. 28, 154 (1996)

    Article  Google Scholar 

  33. AspectJ homepage, http://www.eclipse.org/aspectj/ (last accessed 2009)

  34. G. Kiczales, J. Irwin, J. Lamping, J. Loingtier, C. Lopes, C. Maeda: Aspect-oriented programming, ECOOP’1997 (1997) pp. 220–242

    Google Scholar 

  35. G. O’Regan: Introduction to aspect-oriented programming, O’Reilly OnJava.com (2004), http://www.onjava.com/pub/a/onjava/2004/01/14/aop.html (last accessed 2009)

  36. T. Austin: Expanding JavaScript’s metaobject protocol, San Jose State Univ. (2008)

    Google Scholar 

  37. J. Viega, J. Bloch, P. Chandra: Applying aspect-oriented programming to security, Cutter IT Journal 14(2), 31–39 (2001)

    Google Scholar 

  38. I. Welch, F. Lu: Policy-driven reflective enforcement of security policies, Proc. 2006 ACM symp. on Applied Computing, ACM, Dijon (2006) 1580–1584

    Google Scholar 

  39. B. Arkin, F. Hill, S. Marks, M. Schmid, T. Walls, G. McGraw: How we learned to cheat in online poker: a study in software security, Developer.com (1999), http://www.developer.com/tech/article.php/616221 (last accessed 2006)

  40. C. Constantinides, T. Skotiniotis, M. Störzer: AOP considered harmful, European Interactive Workshop on Aspects in Software (2004)

    Google Scholar 

  41. D. Caromel, F. Huet, J. Vayssière: A simple security-aware MOP for Java, Proc. 3rd Int. Conf. on Metalevel Architectures and Separation of Crosscutting Concerns (Springer, 2001) 118–125

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Computer Science, UC Santa Cruz, 1156 High Street, 95064, Santa Cruz, CA, USA

    Thomas H. Austin

Authors
  1. Thomas H. Austin
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. Technical University of Crete, 73132, Chania, Crete, Greece

    Peter Stavroulakis

  2. Dept. Computer Science, San Jose State University, One Washington Square, 95192, San Jose, CA, USA

    Mark Stamp

Rights and permissions

Reprints and permissions

Copyright information

© 2010 Springer-Verlag Berlin Heidelberg

About this chapter

Cite this chapter

Austin, T. (2010). Designing a Secure Programming Language. In: Stavroulakis, P., Stamp, M. (eds) Handbook of Information and Communication Security. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-04117-4_35

Download citation

  • DOI: https://doi.org/10.1007/978-3-642-04117-4_35

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-642-04116-7

  • Online ISBN: 978-3-642-04117-4

  • eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

Search

Navigation