We propose a solution combining source code static analysis with searchable symmetric encryption to detect input validation vulnerabilities of web applications in encrypted PHP code, allowing developers to protect their codebase from malicious third parties while simultaneously discovering vulnerabilities in it. Results show that our solution is capable of identifying vulnerabilities with similar precision when compared with non-confidential tools and exhibits a moderate overhead increase of around 16,55%.

Jorge Martins

LASIGE, Faculdade de Ciências, Universidade de Lisboa, Portugal

Portugal

Ibéria Medeiros

LaSIGE, Faculdade de Ciências da Universidade de Lisboa

Portugal

Bernardo Ferreira

LASIGE, Faculdade de Ciências, Universidade de Lisboa, Portugal

Portugal