Slashdot Mirror
New PHP Interpreter Finds XSS, Injection Holes
rkrishardy writes "A group of researchers from MIT, Stanford, and Syracuse has developed a new program, named 'Ardilla,' which can analyze PHP code for cross-site scripting (XSS) and SQL injection attack vulnerabilities. (Here is the paper, in PDF, and a table of results from scanning six PHP applications.) Ardilla uses a modified Zend interpreter to analyze the code, trace the data, and determine whether the threat is real or not, significantly decreasing false positives." Unfortunately, license issues prevent the tool in its current form from being released as open source.
Things I'd like to get my hands on...
THE HONOUR OF THE KNIGHTS - CC Licensed Sci-Fi Novel
Reminds me of CmdrTaco's taint: hairy, sweaty, and cakes in shit, semen, and blood.
I find it deliciously ironic that you're using perl to mock php on the same day that the slashcode team apparently decided that they hadn't fucked this site up enough in the past few months. Of course, just because slashdot can't write perl worth a shit doesn't mean that all perl is bad, but if we were to take that attitude, I'm guessing the majority of the criticisms against php would dry up as well.
Did I mention that I'm really, really fucking tired of having slashdot render badly because they can't do a half-decent job of quality control or even, you know, click through the damn site with the new code before pushing it to the live servers? Seriously, slashdot coders, this is unacceptable. If my team released half the mistakes that you have in the past few months, we'd all be fired and probably end up committing suicide because we'd be forced to admit that we were terrible coders who'd never amount to anything in life.