| 
|
QuoteRef: martM10_2005
Topic:
debugging by usage rules
Topic:
exception handling with resumption
Topic:
execution tracing
Topic:
dynamic type checking
Topic:
pattern matching
Topic:
logging data and events
Topic:
safe use of pointers
Topic:
logic programming
Group:
security
Topic:
security leaks and weaknesses
Reference
Martin, M., Livshits, B., Lam, M.S., "Finding application errors and security flaws using PQL: a program query language", OOPSLA'05 Conference Proceedings. 20th Annual ACM Conference on Object-Oriented Programming, Systems, Languages, and Applications, San Diego, California, USA, October 2005, ACM Press, pp. 365-383. Google
abstract ;;Quote: a PQL query is the shortest amount of code that violates a design rule; handles event sequences over related objects
abstract ;;Quote: detect violations of design rules by instrumenting the code using a static alias analysis; can correct erroneous executions on the fly
abstract ;;Quote: dynamic analysis by PQL found 200 errors in Eclipse; security flaws, resource leaks, and consistency invariants
366 ;;Quote: runtime overhead of PQL ranges from 9% to 125%; static analysis helps a lot; max is 19x slowdown
367 ;;Quote: execution trace as object dereference; field load/store, array load/store w/o index, method call/return, object create, and end program
367 ;;Quote: a PQL query is a pattern to be matched on the execution trace; typed variables match an object of that type; subqueries; action to perform on match
369 ;;Quote: PQL queries match a context-sensitive pattern of events; subqueries match context-free grammars over the call chain; the partial-order operator matches the intersection of context-free languages
371 ;;Quote: store points-to information as binary decision diagrams in bddbddb; from Whaley and Lam's pointer alias analysis; query with Datalog
375 ;;Quote: use PQL for runtime security protection; dynamically detect and correct SQL injection, cross-site scripting, and path traversal attacks
Topic: debugging by usage rules (41 items)
Topic: exception handling with resumption (31 items)
Topic: execution tracing (42 items)
Topic: dynamic type checking (43 items)
Topic: pattern matching (42 items)
Topic: logging data and events (17 items)
Topic: safe use of pointers (102 items)
Topic: logic programming (34 items)
Group: security (23 topics, 874 quotes)
Topic: security leaks and weaknesses (67 items)