itextsharp pdf to image converter c#: Create a fillable pdf form from a pdf control Library utility azure asp.net windows visual studio 2011UsenixWebApps0-part372

PHP Aspis: Using Partial Taint Tracking

To Protect Against Injection Attacks

IoannisPapagiannis

Imperial CollegeLondon

Matteo Migliavacca

Imperial CollegeLondon

Peter Pietzuch

Imperial CollegeLondon

Abstract

Web applicationsare increasingly popularvictimsofse-

curity attacks. Injection attacks, such as Cross Site

Scripting or SQL Injection, are a persistent problem.

Eventhoughdevelopersareawareofthem,thesuggested

best practices for protection are error prone: unless all

userinputisconsistentlyﬁltered,anyapplicationmaybe

vulnerable. Whenhostingwebapplications, administra-

tors face a dilemma: they can only deploy applications

thataretrustedortheyrisktheirsystem’ssecurity.

To prevent injection vulnerabilities, we introduce

PHP Aspis: a source code transformation tool that ap-

pliespartialtainttrackingatthelanguagelevel.PHPAs-

pis augments values with taint meta-data to track their

origin in order to detectinjection vulnerabilities. To im-

proveperformance,PHPAspiscarriesouttaintpropaga-

tiononlyinanapplication’smostvulnerableparts: third-

party plugins. We evaluate PHP Aspis with Wordpress,

apopular open source weblog platform, and show that

itpreventsallcode injection exploitsthat were found in

Wordpresspluginsin2010.

1 Introduction

The most common types of web application attacks in-

volvecodeinjection[4]:Javascriptthatisembeddedinto

thegeneratedHTML(CrossSiteScripting,orXSS),SQL

thatispartofagenerateddatabasequery(SQLInjection,

or SQLI) or scripts that are executed on the web server

(Shell Injection and Eval Injection). These attackscom-

monlyexploitthewebapplication’strustinuser-provided

data. If user-provided data are not properly ﬁltered and

sanitised before use, an attacker can trick the applica-

tioninto generatingarbitraryHMTLresponsesandSQL

queries,orevenexecuteuser-supplied,maliciouscode.

Even though web developers are generally aware of

code injection vulnerabilities, applications continue to

sufferfromrelevantexploits. In2010,23.9%ofthe total

reportedvulnerabilitiestotheCVEdatabasewereclassi-

ﬁed as SQLIorXSS [12]. Morover,injection vulnera-

bilitiesareoftencommoninthird-partypluginsinsteadof

thewell-testedcore ofawebapplication: in2010,10out

of 12 reported Wordpress injection exploits in the CVE

database involvedpluginsandnotWordpressitself.

Suchvulnerabilitiesstillremainbecausesuggestedso-

lutions often require manual tracking and ﬁltering of

user-generateddata throughoutthesourcecode ofanap-

plication. Yet, even a single unprotected input chan-

nel in an application is enough to cause an injection

vulnerability. Thus, less experienced and therefore less

security-conscious developers of third-party plugins are

morelikelytowritevulnerablecode.

Pastresearchhassuggestedruntimetainttracking[19,

18, 14] as an effective solution to prevent injection ex-

ploits. In this approach, the origin of all data within

the application is tracked by associating meta-data with

strings. When anapplicationexecutesa sensitive opera-

tion,suchasoutputtingHTML,thesemeta-dataare used

to escape potentially dangerous values. The most efﬁ-

cient implementation of taint tracking iswithin the lan-

guage runtime.Runtimetainttrackingisnotwidelyused

in PHP, however, because it relies on custom runtimes

thatare notavailable in productionenvironments. Thus,

developersareforcedtoavoidvulnerabilitiesmanually.

We show that injection vulnerabilities in PHP can be

addressedbyapplyingtainttrackingentirelyatthesource

code level without modiﬁcations to the PHP language

runtime. To reduce the incurred performance overhead

duetoextensivesourcecoderewriting,weintroducepar-

tial taint tracking, which limits taint tracking only to

functionsofthewebapplicationinwhichvulnerabilities

aremorelikelytooccur. Partialtainttrackingeffectively

capturesthe different levelsoftrust placedinto different

parts of web applications. It offers better performance

becausepartsoftheapplicationcoderemainunchanged.

We demonstrate this approach using PHP Aspis

, a

1AnAspiswasthecircularwoodenshieldcarriedbysoldiersinan-

cientGreece.

Create a fillable pdf form from a pdf - C# PDF Field Edit Library: insert, delete, update pdf form field in C#.net, ASP.NET, MVC, Ajax, WPF

Online C# Tutorial to Insert, Delete and Update Fields in PDF Document

create a pdf form that can be filled out; add signature field to pdf

Create a fillable pdf form from a pdf - VB.NET PDF Field Edit library: insert, delete, update pdf form field in vb.net, ASP.NET, MVC, Ajax, WPF

How to Insert, Delete and Update Fields in PDF Document with VB.NET Demo Code

add fillable fields to pdf online; add an image to a pdf form

toolthatperformstainttrackingonlyonthird-partyplug-

insby rewriting theirsource code to explicitly trackand

propagate theoriginofcharactersinstrings. PHPAspis

augmentsvaluesto include taint meta-data and rewrites

PHPstatementstooperate inthepresence of taintmeta-

data and propagate these correctly. PHP Aspis then

uses the taint meta-data to automatically sanitise user-

provided untrusted values and transparently prevent in-

jection attacks. Overall, PHP Aspis does not require

modiﬁcationstothePHPlanguageruntime ortotheweb

server.

Ourevaluationshowsthat,byusingpartialtainttrack-

ing, PHP Aspis successfully prevents most XSS and

SQLIexploitsreportedinpublicWordpresspluginssince

2010.Pagegenerationtimeissigniﬁcantlyreducedcom-

paredtotrackingtaintintheentireWordpresscodebase.

Insummary,thecontributionsofthispaperare:

• a taint tracking implementation for PHP that uses

source codetransformationsonly;

• amethodforapplyingtainttrackingonlytopartsof

awebapplication,inwhichexploitsare morelikely

tooccur;

• animplementationofacodetransformationtooland

its evaluation with real-world exploits reported in

theWordpressplatform.

The next section provides background on code injec-

tionvulnerabilitiesandintroducespartialtainttrackingas

asuitable defence. In §3, we describe our approach for

achievingtaintpropagationinPHPbasedoncoderewrit-

ing,andweshowhowtolimitthescopeoftainttracking

topartsofa codebase. Finally,we evaluate ourapproach

bysecuringWordpressin§4andconcludein§5.

2 Preventing Injection Vulnerabilities

2.1 Injection Vulnerabilities

Consideraweblogwithasearchﬁeld.Typically,inputto

the search ﬁeld results in a web request with the search

termasaparameter:

http://goodsite.com/find?t=spaceship

Aresponseofthewebservertothisrequestmaycontain

the followingfragment:

<p> The term ``spaceship ' ' was not found. </p>

The important element ofthe above response isthat the

user-submittedsearchtermisincludedasisintheoutput.

Thiscanbeeasilyexploitedbyanattackertoconstructan

XSSattack.TheattackerﬁrstcreatesthefollowingURL:

http://goodsite.com/find?t=<script\%20

src='http://attack.com/attack.js'/>

2002

2003

2004

2005

2006

2007

2008

2009

2010

Total Vulnerabilities (%)

Year

XSS

SQLI

Figure1: HistoricalpercentageofXSSand SQLIinallCVE

vulnerabilities

When an unsuspecting user clicks on this link, the fol-

lowingHTMLfragmentisgenerated:

<p> The term ``<script src='http:// attack.com/

attack.js ' />'' was not found. </p>

The victim’s browser then fetches the malicious

Javascript code and executes it. Since the HTML doc-

ument originated from

goodsite.com

,the scriptisex-

ecutedwith full access to the victim’s web browserses-

sion.Iftheuserhasanaccountwiththisweblogandisal-

readyloggedon,theircookiescanbesenttotheattacker.

Ingeneral,the scriptcan issue any unveriﬁed operations

onbehalfofthe user.

SQLInjectionattacksareanalogous: theytakeadvan-

tage of applications that process user input to form an

SQLquery to a database. Similarly, Eval and Shell In-

jection attacks target PHP’s

eval()

and

exec()

state-

mentsrespectively. Since these statementsexecute arbi-

trary code at runtime, such anattack caneasily compro-

misethe hostmachine.

Figure 1 shows the percentage of reported SQLI and

XSS vulnerabilities in recent years, as classiﬁed in the

CVE database. Both problems continue to affect appli-

cations despite an increase of developer awareness. Ta-

ble 1 shows our classiﬁcation of vulnerabilities for two

popularopensourcewebplatforms,WordpressandDru-

pal. Codeinjectionvulnerabilitiesare the most common

typeinboth,with higherpercentagescomparedtotradi-

tional applications acrossall programming languages in

Figure 1. By relying on prepared statements, an auto-

matedwaytoavoidSQLI(see§2.2),theDrupalplatform

hascomparativelyfewsuchexploits.

2.2 Existing Practices

The traditional approachto addressinjection vulnerabil-

itiesistotreatallinformation thatmay potentiallycome

fromtheuserasuntrusted—itshouldnotbeusedforsen-

sitiveoperations,suchaspagegenerationorSQLqueries,

unlessproperly sanitised orﬁltered. In the previousex-

ample, a proper sanitisation functionwould translate all

C# Create PDF Library SDK to convert PDF from other file formats

Create fillable PDF document with fields. Load PDF from existing documents and image in SQL server. Load PDF from stream programmatically.

adding a signature to a pdf form; add editable fields to pdf

VB.NET Create PDF from OpenOffice to convert odt, odp files to PDF

Edit Bookmark. Metadata: Edit, Delete Metadata. Form Process. Create PDF document from OpenOffice Text Document with ODT, ODS, ODP forms into fillable PDF formats

create a pdf form in word; change pdf to fillable form

Num.ofOccurrences

Type

Wordpress

Drupal

CrossSiteScripting

SQLInjection

InformationLeakage

InsufﬁcientAccessControl

EvalInjection

CrossSiteRequestForgery

Table1:Webapplicationvulnerabilitiesin2010

characters with special meaning in HTML to their dis-

play equivalents(e.g. “

”to“

”). Sanitisationfunc-

tionssuchas

htmlentities()

escapeshellarg()

are part of the PHP language. After sanitisation, the

string can safely be echoed to the client because it can

nolongerchange the semanticsofthe output. SQLI ﬁl-

tering functionsoperatesimilarlybuttheyalsocheckfor

user-providedSQLkeywordsinthequery[13,19].

Unfortunately,sanitisationfunctionsaredifﬁculttoap-

plyinpractice. Eachsensitiveoperationrequiresadiffer-

entsanitisationfunction. Forexample,ifthesamestring

isechoed tothe userand used aspart of anSQL query,

twodifferentstringsmustbegeneratedbasedontheorig-

inal value. Centralisedﬁltering of inputdata when they

arereceivedisimpracticalbecausethereisnosingledata

representation that is both meaningful and secure in all

possible contexts. For example, the string “

WHERE

” is

safe in HTMLbut not in an SQLquery. Therefore,de-

velopershavetopropagatetheoriginaluserdataandonly

sanitisethembeforebeingused.

In addition, sanitisation assumes that developers can

effectively trackthe originofdata andenforcethatuser-

generateddata alwayspassthroughtheirrespective sani-

tisationfunction.Inpractice,left-outchecksbyinexperi-

enceddevelopersorunforeseeninteractionsthatresultin

unexpecteddataﬂow (e.g.assuming that ascript cannot

becalledfromanexternaluser)arelikelytooccur.

2.2.1 Static Approaches

Past researchhassuggested static analysis toolsthatde-

tectinjectionvulnerabilitiesinPHPscripts.Pixy[11]and

WebSSARI[10]relyondata ﬂow analysistodetectsen-

sitive functionsthat may receive userdata without sani-

tisation and produce warnings. Wassermannand Su[16]

modelstringvaluesandoperationsasgrammarsandthen

inspect thembefore queryoperations to reduce thefalse

positiverate forSQLIdetection. XieandAiken[17]use

symbolic execution to support PHP’s dynamic features

andreportalowfalsepositiverate.

Althoughstaticanalysistoolsdonotintroduceruntime

overhead,theyarenotfullyautomated,cannotsupportall

PHPfeaturesand do notalwaysachievea lowfalse pos-

itive rate. In addition,they cannothandlevulnerabilities

that involve the ﬁle systemorthe database. Asa result,

suchtoolsarenotwidelyusedforPHPdevelopment.

Prepared statementsare away toavoidSQLIexploits.

Instead of concatenating queries, an application deﬁnes

static placeholder queries with parameters ﬁlled in at

runtime. Parameters passed to the placeholders cannot

change thesemanticsofthe query,asitsstructure isde-

termined in advance when the statementisprepared. In

practice,manyPHPapplicationsdonotusethembecause

theywerenottraditionallysupportedbyPHPorMySQL

andinsteadmanuallysanitiseSQLqueries.

2.2.2 Dynamic TaintTracking

Adynamic approach to addressing injection vulnerabil-

itiesinexisting applications whenthey occur is runtime

taint tracking [19, 6]. It automates the tracking of the

origin of data and enforcesthat data pass through their

respective sanitisation functions. Runtime tainttracking

involvesthreedifferentsteps:

1. Dataentrypoints.Alldataenteringtheapplication

that may originate from the user are transparently

augmentedwithtaint meta-data. Theformofthese

meta-datamayvary: fromone bitthat marksthata

particularstringisuser-provided(ortainted)[14]to

apointerthatlinkstoarbitrarypolicyobjects[19].

2. Taint propagation. As the application processes

data, the runtime system transparently propagates

the associated taint meta-data. For example, when

ataintedstring is concatenated with anotherstring,

theresultmustbe markedastainted.

3. Guardedsinks.Everyoperationthatcanbeusedin

aninjectionvulnerability(e.g.

echo()

and

eval()

)

isintercepted. The interceptorexamines the corre-

spondingtaintmeta-dataandcallsthe relevantsani-

tisationfunctionorabortstheoperation.

Tainttrackinghasbeenshowntobeeffectiveinsecur-

ing existing web applications [19, 18, 9, 14, 6]. Com-

pared to static approaches, it does not require either de-

bugging or refactoring an existing codebase. Perl and

Rubysupport it in someform(throughPerl’staintmode

and Ruby’ssafe levels) but not PHP. Taint tracking can

beappliedtoPHPbymodifyingthecoreofthePHPrun-

time [19]. Typically, it has been implemented by aug-

mentingtheinterpreter’s

zval

structwithtaintdata.Sim-

ple approaches[13,14] assign one bitoftaint meta-data

perstringcharacterandpropagatethatmeta-datatosinks

independentlyoftheapplication’ssanitisationefforts.

Later systems stored more meta-data per character in

order to provide more ﬁne-grained guarantees. Neme-

sis [7] usestwo taint bitsto automatically infer authen-

tication and enforce access control. Resin [19] uses a

pointer to arbitrary policy objects that can be also used

C# Create PDF from OpenOffice to convert odt, odp files to PDF in

Create PDF document from OpenOffice Presentation in both .NET WinForms and ASP.NET NET control to change ODT, ODS, ODP forms to fillable PDF formats in Visual

best way to make pdf forms; pdf form creation

VB.NET Create PDF Library SDK to convert PDF from other file

Create fillable PDF document with fields in Visual Basic .NET application. Load PDF from existing documents and image in SQL server.

create a fillable pdf form in word; add text fields to pdf

topreventinjectionvulnerabilities.

Xu et al. [18] suggest that a taint tracking implemen-

tationinC can be usedto compilethe PHPruntime and

transparentlyadd taint tracking support. Their approach

ignores sanitisation efforts of the hosted PHP applica-

tion and therefore suffers from false positives. Also, it

does not support different policies for different applica-

tions running in the same runtime, a common scenario

formanyPHPdeployments.

However, unless taint tracking is considered part of

PHP and is ofﬁcially adopted, third party implementa-

tionsare impractical. Asthe PHPmanualputsit:

“modiﬁcations to the Zend

engine should be

avoided. Changes here result in incompati-

bilities with the rest of the world, and hardly

anyone will ever adapt to specially patched

Zend engines. Modiﬁcationscan’tbedetached

fromthemainPHPsourcesandareoverridden

withthenextupdateusingthe“ofﬁcial”source

repositories. Therefore, thismethod is gener-

allyconsideredbadpractice”

In the past, taint tracking support has been suggested

as a feature to the PHP community but it has not been

adopted,partlybecauseoffearsthatitmayleadtoafalse

senseofsecurity[15].

2.3 Partial TaintTracking

PHP is the most popular web development language,as

indicated by web surveys [2], and its gentle learning

curve oftenattractslessexperienceddevelopers. Inexpe-

rienced developers are more likely to extend webappli-

cationsthroughthird-partycodeintheformofplugins.

Such extensibility is frequently a popular feature for

web applicationsbut leadstoa signiﬁcant securitythreat

fromplugins. In2009,theCVEdatabasereportedthatthe

Wordpress platform suffered from 15 injection vulnera-

bilities, out of which 13 were introduced by third-party

pluginsandonly 2 involved the core platform. In 2010,

the breakdown wassimilar: 10 vulnerabilitieswere due

topluginsandonly2duetoWordpressitself.

Asaresult,notallapplicationcodeisequallyproneto

injectionvulnerabilities.Forexample,Wordpressspends

much of its page generation time in initialisation code,

setting up the platform before handling user requests.

Thisinvolvestime-consumingstepssuchasqueryingthe

database forinstalledplugins, settingthemup, and gen-

eratingstaticpartsoftheresponseinvolvingtheme-aware

headersandfooters.

Injectionvulnerabilities,onthe otherhand,tendtoap-

pear in code that handlesuser-generated content: CVE-

2010-4257, an SQLI vulnerability, involved a function

ZendisthenameoftheofﬁcialPHPscriptingengine

PHP Aspis Transformed Application

Taint-Tracking Code

Non Tracking Code

"spaceship"

Taint

PHP Statements

Library Calls

Sanitization Operations

HTML output

<p>spaceship</p>

SQL query

WHERE p=spaceship

Eval statement

spaceship()

Guarded sinks

Input

HTTP request

Figure2:PartialtainttrackingusingPHPAspis

that handles track-backs after a user published a post;

CVE-2009-3891, an XSSvulnerability, involveda func-

tion that validates uploaded ﬁles; and CVE-2009-2851

andCVE-2010-4536,againXSSvulnerabilities,involved

multiplefunctionsthatdisplayusercomments.

Weexploitthisobservationbyintroducingpartialtaint

tracking, which only transforms the source code of the

most vulnerable parts of an application in order to sup-

port taint tracking. By relying on source-level transfor-

mations, partial taint tracking does not require the de-

velopmentandmaintenance ofamodiﬁedversionofthe

PHPruntime.

Weuseasimpleapproachtodecidewhentotracktaint:

wefocusonpartsofthird-partypluginsthathandle user-

generated data. This restricts source code transforma-

tionsto a small fraction of the codebase ofa web appli-

cation. Asa consequence, we mitigate the large perfor-

mancepenaltythatexhaustivetainttrackingatthesource

levelwouldincur.

3 PHPAspis

We describe the designand implementationofPHPAs-

pis, a PHP source code transformation tool for partial

taint tracking. Figure 2 presents an overview of how

PHP Aspis transforms applications. First, it modiﬁes

codethatreceivesdata from usersand marksthe data as

user-generated (label 1). Second, it divides the applica-

tion’scodebase in twodifferent categories: tracking and

non-trackingcode. Insteadoftrackingtaintuniformly,it

focuses on parts of the codebase that are more likely to

contain code injection vulnerabilities(label 2). Intrack-

ing code, PHP Aspis records the origin of data at the

characterlevel andﬁltersdata atoutput statementswhen

an injection vulnerabilitycould exist (label 3). For non-

tracking code,itdoesnotperformtainttracking,trusting

thecode nottobevulnerable(label4).

Nextweintroducetherepresentationoftaintmeta-data

used to record the origin of the data in each variable.

In §3.2, we describe the transformations that canbe ap-

VB.NET Create PDF from PowerPoint Library to convert pptx, ppt to

Convert multiple pages PowerPoint to fillable and editable PDF documents. Easy to create searchable and scanned PDF files from PowerPoint.

best pdf form creator; pdf add signature field

VB.NET Create PDF from Word Library to convert docx, doc to PDF in

formatting. Create PDF files from both DOC and DOCX formats. Convert multiple pages Word to fillable and editable PDF documents. Professional

create a pdf form online; change font size pdf form reader

Sanitisation

htmlentities()

functions

htmlspecialchars()

Guardedsinks

echo()

)

AspisAntiXss()

print()

)

AspisAntiXss()

:::

Table2:ExcerptofthedeﬁnitionoftheXSStaintcategory

plied to PHP source code to (a) ensure itscorrect oper-

ation in the presence of taint meta-data; (b) propagate

taint meta-data correctly; and (c) attach checks that in-

spect taint meta-data before each “sensitive” operation.

Finally,we discusshowthenon-trackingcode caninter-

actwiththe partsoftheapplicationthathave beentrans-

formedtotracktaintin§3.3

3.1 Taint Representation

PHPAspisusescharacter-level tainttracking,i.e.tracks

thetaintofeachstringcharacterindividually[19]. Tradi-

tionalvariable-level tainttracking implementations (e.g.

Ruby’ssafelevels)requirethedevelopertountaintvalues

explicitly before they are used. Instead,PHP Aspispre-

ventsinjectionattackstransparently,andforthis,itneeds

toknowtheexactcharactersthatoriginate fromthe user.

Forexample,consideran applicationthatconcatenatesa

user-providedvalue witha staticHTMLtemplate,stores

the result in

andthen returns

totheclient asa re-

sponse. Inferringthatvariable

istaintedisoflittleuse

because

also contains application-generated HTML.

Instead, PHP Aspis uses character-level taint meta-data

andonlysanitisestheuser-generatedpartsof

3.1.1 TaintCategories

PHPAspiscantrack multiple independentanduserpro-

videdtaintcategories. Ataint categoryisa genericway

ofdeﬁninghowanapplicationissupposedtosanitisedata

and how PHPAspisshould enforce that the application

alwayssanitisesdatabeforetheyare used.

Each taint category is deﬁned as a set of sanitisation

functionsand a set of guarded sinks. Sanitisation func-

tions can be PHP library functions or can be deﬁned

by the application. A sanitisation function is called by

the application to transform untrusted user data so that

they cannot be used for a particular type of injection

attack. Commonly, sanitisation functions either trans-

formunsafecharactersequencestosafeequivalents(e.g.

htmlentities

)orﬁlteroutasubsetofpotentiallydan-

gerousoccurrences(e.g.byremoving

butnot

<b>

). Calls to sanitisation functions by the application

are intercepted and PHP Aspis untaintsthe correspond-

ingdatatoavoidsanitisingthemagain.

Guarded sinks are functions that protect data ﬂow to

sensitive sink functions. When a call to a sink function

ismade,PHPAspisinvokesthe guard with referencesto

the parameters passed to the sink function. The guard

is a user-provided function that has access to the rele-

vant taint category meta-data and typically invokes one

ormore sanitisationfunctionsforthattaintcategory.

For example, Table 2 shows an excerpt of an XSS

taintcategorydeﬁnition. It speciﬁesthata user-provided

string can be safely echoed to the user after either

htmlentities

htmlspecialchars

has been in-

voked on it. The second part exhaustively lists all func-

tions that can output strings to the user (e.g.

echo

, etc.) and guards them with an external ﬁlter-

ing function (

AspisAntiXss

). The guard either aborts

theprintoperationorsanitisesanyremainingcharacters.

The administratorcanchangethe deﬁnitionsoftaintcat-

egoriesaccordingtotherequirementsofthe application.

By listing all the sanitisation functions ofan applica-

tionintherelevanttaintcategory,PHPAspiscanclosely

monitor the application’s sanitisation efforts. When ap-

pliedtoa welldesignedapplication, PHPAspisuntaints

userdataastheygetsanitisedbythe application,butbe-

fore they reach the sink guards. Thus, sink guards can

apply a simple, application agnostic, sanitisation opera-

tion(e.g.

htmlentities

)actingasa“safetynet”.

On the other hand, an application may not deﬁne ex-

plicit sanitisation functions or these functions may be

omitted from the relevant taint category. In such cases,

sinkguardshavetoreplicatetheﬁlteringlogic oftheap-

plication. Ingeneral, however, sinkguardslackcontex-

tual information and this prevents them from enforcing

context-aware ﬁltering,e.g.guardscannotenforcesaniti-

sationthatvariesaccordingtothe currentuser.

Adifferenttaintcategorymustbeusedforeachtypeof

injection vulnerability. PHPAspistracksdifferent taint

categoriesindependently from each other. For example,

whena sanitisation functionof anXSS taintcategory is

calledonastring,thestringisstillconsideredunsanitised

forallothertaintcategories. Thisensuresthata sanitisa-

tionfunctionforhandlingonetype ofinjection vulnera-

bilityisnotusedtosanitisedataforanothertype.

3.1.2 Storingtaintmeta-data

Itischallengingtorepresenttaintmeta-datasothatitsup-

ports arbitrary taint categories and character-level taint

tracking. ThisisduetothefollowingpropertiesofPHP:

P1 PHP is not object-oriented. Although it supports

objects, built-in types such as

string

cannot be

augmentedtransparently withtaint meta-data. This

precludes solutions that rely on altered class li-

braries[6].

P2 PHPdoesnotofferdirectaccesstomemory. Anyso-

lutionmusttrackPHPreferencesbecausevariables’

memoryaddressescannotbe used[18].

VB.NET Create PDF from Excel Library to convert xlsx, xls to PDF

Link: Edit URL. Bookmark: Edit Bookmark. Metadata: Edit, Delete Metadata. Form Process. Create fillable and editable PDF documents from Excel in Visual

allow users to save pdf form; pdf form save with reader

C# Create PDF from Excel Library to convert xlsx, xls to PDF in C#

Create fillable and editable PDF documents from Excel in both .NET WinForms and ASP.NET. Create searchable and scanned PDF files from Excel.

adding a text field to a pdf; change font size in pdf fillable form

String

Taintmeta-data

$s='Hello'

array(0=>false)

$n='John'

array(0=>true)

$r=$s.$n

array(0=>false, 5=>true)

Table 3: Representation of taint meta-data for a single taint

itextsharp pdf to image converter c# : Create a fillable pdf form from a pdf control Library utility azure asp.net windows visual studio 2011UsenixWebApps0-part372