{"id":"https://openalex.org/W4404570849","doi":"https://doi.org/10.48550/arxiv.2411.11380","title":"Extracting Database Access-Control Policies From Web Applications","display_name":"Extracting Database Access-Control Policies From Web Applications","publication_year":2024,"publication_date":"2024-11-18","ids":{"openalex":"https://openalex.org/W4404570849","doi":"https://doi.org/10.48550/arxiv.2411.11380"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2411.11380","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2411.11380","pdf_url":"https://arxiv.org/pdf/2411.11380","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2411.11380","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101791753","display_name":"Wen Zhang","orcid":"https://orcid.org/0009-0007-3721-2882","observed_orcids":["https://orcid.org/0009-0007-3721-2882"]},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhang, Wen","raw_affiliation_strings":["UC Berkeley"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UC Berkeley","institution_ids":["https://openalex.org/I95457486"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5095829689","display_name":"Dev Bali","orcid":"https://orcid.org/0009-0001-9273-9835","observed_orcids":["https://orcid.org/0009-0001-9273-9835"]},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bali, Dev","raw_affiliation_strings":["UC Berkeley"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UC Berkeley","institution_ids":["https://openalex.org/I95457486"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5105100627","display_name":"Jamison Kerney","orcid":"https://orcid.org/0009-0007-8647-2680","observed_orcids":["https://orcid.org/0009-0007-8647-2680"]},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kerney, Jamison","raw_affiliation_strings":["UC Berkeley"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UC Berkeley","institution_ids":["https://openalex.org/I95457486"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073895064","display_name":"Aurojit Panda","orcid":"https://orcid.org/0000-0001-9664-4377","observed_orcids":["https://orcid.org/0000-0001-9664-4377"]},"institutions":[{"id":"https://openalex.org/I57206974","display_name":"New York University","ror":"https://ror.org/0190ak572","country_code":"US","type":"education","lineage":["https://openalex.org/I57206974"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Panda, Aurojit","raw_affiliation_strings":["NYU"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NYU","institution_ids":["https://openalex.org/I57206974"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5040529929","display_name":"Scott J. Shenker","orcid":"https://orcid.org/0000-0002-1357-7533","observed_orcids":["https://orcid.org/0000-0002-1357-7533"]},"institutions":[{"id":"https://openalex.org/I1297971548","display_name":"International Computer Science Institute","ror":"https://ror.org/01ewh7m12","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I1297971548"]},{"id":"https://openalex.org/I134446601","display_name":"Berkeley College","ror":"https://ror.org/02xewxa75","country_code":"US","type":"education","lineage":["https://openalex.org/I134446601"]},{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shenker, Scott","raw_affiliation_strings":["UC Berkeley & ICSI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"UC Berkeley & ICSI","institution_ids":["https://openalex.org/I1297971548","https://openalex.org/I134446601","https://openalex.org/I95457486"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.711899995803833,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.711899995803833,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.13439999520778656,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.07519999891519547,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/web-application","display_name":"web application","score":0.746999979019165},{"id":"https://openalex.org/keywords/concolic-execution","display_name":"concolic execution","score":0.7369999885559082},{"id":"https://openalex.org/keywords/ruby-on-rails","display_name":"Ruby on Rails","score":0.8040000200271606},{"id":"https://openalex.org/keywords/policy-enforcement","display_name":"policy enforcement","score":0.5649999976158142},{"id":"https://openalex.org/keywords/ote","display_name":"OTE","score":0.6010000109672546}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6460167169570923},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.6107858419418335},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.4668724238872528},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.45025622844696045},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.4348214864730835},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.15910354256629944},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.05745530128479004}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2411.11380","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2411.11380","pdf_url":"https://arxiv.org/pdf/2411.11380","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2411.11380","doi":"https://doi.org/10.48550/arxiv.2411.11380","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2411.11380","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2411.11380","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2411.11380","pdf_url":"https://arxiv.org/pdf/2411.11380","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4404570849.pdf","grobid_xml":"https://content.openalex.org/works/W4404570849.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"To":[0],"safeguard":[1],"sensitive":[2],"user":[3],"data,":[4],"web":[5,144],"developers":[6],"typically":[7],"rely":[8],"on":[9,142],"implicit":[10],"access-control":[11,49,93],"policies,":[12],"which":[13],"they":[14],"implement":[15],"using":[16],"access":[17],"checks":[18,31],"and":[19,32,40,122,162,170,191],"query":[20],"filters.":[21],"This":[22,83],"ad":[23],"hoc":[24],"approach":[25],"is":[26,54,62],"error-prone":[27],"as":[28,79,114,129],"these":[29,172],"scattered":[30],"filters":[33],"are":[34],"easy":[35],"to":[36,58,126,150,187,195],"misplace":[37],"or":[38],"misspecify,":[39],"the":[41,70,88,92,118,155,181,202],"lack":[42],"of":[43,90,159],"an":[44,75,97],"explicit":[45],"policy":[46,61,86,94,138,177],"precludes":[47],"external":[48],"enforcement.":[50],"More":[51],"critically,":[52],"it":[53],"difficult":[55],"for":[56,109,117,140],"humans":[57],"discern":[59],"what":[60,68],"embedded":[63,95],"in":[64,96,201],"application":[65,71,98],"code":[66,130],"(i.e.,":[67],"data":[69,102,120],"may":[72],"access)":[73],"--":[74],"issue":[76],"that":[77,164,178],"worsens":[78],"development":[80],"teams":[81],"evolve.":[82],"paper":[84],"tackles":[85],"extraction:":[87],"task":[89],"extracting":[91],"by":[99],"summarizing":[100],"its":[101],"queries.":[103],"An":[104],"extracted":[105,193],"policy,":[106],"once":[107],"vetted":[108],"errors,":[110],"can":[111,123],"stand":[112],"alone":[113],"a":[115,137,175],"specification":[116],"application's":[119],"access,":[121],"be":[124],"enforced":[125],"ensure":[127],"compliance":[128],"changes":[131],"over":[132],"time.":[133],"We":[134,184],"introduce":[135],"Ote,":[136],"extractor":[139],"Ruby":[141],"Rails":[143],"applications.":[145],"Ote":[146,186],"uses":[147],"concolic":[148],"execution":[149,152],"explore":[151],"paths":[153],"through":[154],"application,":[156],"generating":[157],"traces":[158,173],"SQL":[160],"queries":[161],"conditions":[163],"trigger":[165],"them.":[166],"It":[167],"then":[168],"merges":[169],"simplifies":[171],"into":[174],"final":[176],"aligns":[179],"with":[180],"observed":[182],"behaviors.":[183],"applied":[185],"three":[188],"real-world":[189],"applications":[190],"compared":[192],"policies":[194],"handwritten":[196],"ones,":[197],"revealing":[198],"several":[199],"errors":[200],"latter.":[203]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-10-13T10:08:12.033832","created_date":"2025-10-10T00:00:00"}