{"id":"https://openalex.org/W4281737341","doi":"https://doi.org/10.1007/s10664-022-10165-y","title":"Fluently specifying taint-flow queries with fluentTQL","display_name":"Fluently specifying taint-flow queries with fluentTQL","publication_year":2022,"publication_date":"2022-05-30","ids":{"openalex":"https://openalex.org/W4281737341","doi":"https://doi.org/10.1007/s10664-022-10165-y"},"language":"en","primary_location":{"id":"doi:10.1007/s10664-022-10165-y","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-022-10165-y","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-022-10165-y.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10664-022-10165-y.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077569016","display_name":"Goran Piskachev","orcid":"https://orcid.org/0000-0003-4424-5838"},"institutions":[{"id":"https://openalex.org/I4210093498","display_name":"Fraunhofer Institute for Mechatronic Systems Design","ror":"https://ror.org/004nttc42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210093498","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Goran Piskachev","raw_affiliation_strings":["Fraunhofer IEM, Paderborn, Germany"],"raw_orcid":"https://orcid.org/0000-0003-4424-5838","affiliations":[{"raw_affiliation_string":"Fraunhofer IEM, Paderborn, Germany","institution_ids":["https://openalex.org/I4210093498"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008520601","display_name":"Johannes Sp\u00e4th","orcid":"https://orcid.org/0000-0003-4462-9372"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Johannes Sp\u00e4th","raw_affiliation_strings":["CodeShield GmbH, Paderborn, Germany"],"raw_orcid":"https://orcid.org/0000-0003-4462-9372","affiliations":[{"raw_affiliation_string":"CodeShield GmbH, Paderborn, Germany","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035886639","display_name":"Ingo Budde","orcid":"https://orcid.org/0000-0003-0124-6291"},"institutions":[{"id":"https://openalex.org/I4210093498","display_name":"Fraunhofer Institute for Mechatronic Systems Design","ror":"https://ror.org/004nttc42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210093498","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Ingo Budde","raw_affiliation_strings":["Fraunhofer IEM, Paderborn, Germany"],"raw_orcid":"https://orcid.org/0000-0003-0124-6291","affiliations":[{"raw_affiliation_string":"Fraunhofer IEM, Paderborn, Germany","institution_ids":["https://openalex.org/I4210093498"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5076678278","display_name":"Eric Bodden","orcid":"https://orcid.org/0000-0003-3470-3647"},"institutions":[{"id":"https://openalex.org/I206945453","display_name":"Paderborn University","ror":"https://ror.org/058kzsd48","country_code":"DE","type":"education","lineage":["https://openalex.org/I206945453"]},{"id":"https://openalex.org/I4210093498","display_name":"Fraunhofer Institute for Mechatronic Systems Design","ror":"https://ror.org/004nttc42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210093498","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Eric Bodden","raw_affiliation_strings":["Department of Computer Science, Paderborn University, Paderborn, Germany","Fraunhofer IEM, Paderborn, Germany"],"raw_orcid":"https://orcid.org/0000-0003-3470-3647","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Paderborn University, Paderborn, Germany","institution_ids":["https://openalex.org/I206945453"]},{"raw_affiliation_string":"Fraunhofer IEM, Paderborn, Germany","institution_ids":["https://openalex.org/I4210093498"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5077569016"],"corresponding_institution_ids":["https://openalex.org/I4210093498"],"apc_list":{"value":2890,"currency":"USD","value_usd":2890},"apc_paid":{"value":2890,"currency":"USD","value_usd":2890},"fwci":0.6967,"has_fulltext":true,"cited_by_count":7,"citation_normalized_percentile":{"value":0.640761,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"27","issue":"5","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8828792572021484},{"id":"https://openalex.org/keywords/taint-checking","display_name":"Taint checking","score":0.7063467502593994},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.5997452139854431},{"id":"https://openalex.org/keywords/fluent","display_name":"Fluent","score":0.5803954601287842},{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.4274102449417114},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.375601589679718},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.32730937004089355},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.19994765520095825}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8828792572021484},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.7063467502593994},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.5997452139854431},{"id":"https://openalex.org/C2780411076","wikidata":"https://www.wikidata.org/wiki/Q5462653","display_name":"Fluent","level":3,"score":0.5803954601287842},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.4274102449417114},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.375601589679718},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.32730937004089355},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.19994765520095825},{"id":"https://openalex.org/C44154836","wikidata":"https://www.wikidata.org/wiki/Q45045","display_name":"Simulation","level":1,"score":0.0},{"id":"https://openalex.org/C500300565","wikidata":"https://www.wikidata.org/wiki/Q925667","display_name":"Computer simulation","level":2,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s10664-022-10165-y","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-022-10165-y","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-022-10165-y.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:null:publica/435852","is_oa":false,"landing_page_url":"https://publica.fraunhofer.de/handle/publica/435852","pdf_url":null,"source":{"id":"https://openalex.org/S4306400318","display_name":"Fraunhofer-Publica (Fraunhofer-Gesellschaft)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4923324","host_organization_name":"Fraunhofer-Gesellschaft","host_organization_lineage":["https://openalex.org/I4923324"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"journal article"}],"best_oa_location":{"id":"doi:10.1007/s10664-022-10165-y","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-022-10165-y","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-022-10165-y.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5199999809265137,"display_name":"Quality Education","id":"https://metadata.un.org/sdg/4"}],"awards":[{"id":"https://openalex.org/G5743991854","display_name":null,"funder_award_id":"ERDF-0801379","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"}],"funders":[{"id":"https://openalex.org/F4320335322","display_name":"European Regional Development Fund","ror":"https://ror.org/00k4n6c32"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4281737341.pdf","grobid_xml":"https://content.openalex.org/works/W4281737341.grobid-xml"},"referenced_works_count":34,"referenced_works":["https://openalex.org/W240302486","https://openalex.org/W1537891716","https://openalex.org/W2009696102","https://openalex.org/W2017025011","https://openalex.org/W2127723417","https://openalex.org/W2138788987","https://openalex.org/W2162635569","https://openalex.org/W2166743230","https://openalex.org/W2513927163","https://openalex.org/W2514084604","https://openalex.org/W2735026211","https://openalex.org/W2792425537","https://openalex.org/W2796301966","https://openalex.org/W2850983117","https://openalex.org/W2884017574","https://openalex.org/W2900918122","https://openalex.org/W2910404958","https://openalex.org/W2940466285","https://openalex.org/W2941753076","https://openalex.org/W2953940813","https://openalex.org/W2961642335","https://openalex.org/W2964817188","https://openalex.org/W3015681498","https://openalex.org/W3031020798","https://openalex.org/W3033482452","https://openalex.org/W3033653001","https://openalex.org/W3037099619","https://openalex.org/W3102504333","https://openalex.org/W3208077293","https://openalex.org/W4206579740","https://openalex.org/W4233410239","https://openalex.org/W4248587618","https://openalex.org/W4250404129","https://openalex.org/W4299818415"],"related_works":["https://openalex.org/W2060629665","https://openalex.org/W2029684113","https://openalex.org/W3154138117","https://openalex.org/W2063408151","https://openalex.org/W3144105599","https://openalex.org/W999383042","https://openalex.org/W2005010039","https://openalex.org/W2368171720","https://openalex.org/W4200210064","https://openalex.org/W2360681677"],"abstract_inverted_index":{"Abstract":[0],"Previous":[1],"work":[2],"has":[3],"shown":[4],"that":[5,36],"taint":[6,59,143,153,195,227,287],"analyses":[7],"are":[8,20,46,53,126],"only":[9],"useful":[10],"if":[11],"correctly":[12],"customized":[13],"to":[14,55,67,177,265,285],"the":[15,30,170,193,203,220,225,268],"context":[16],"in":[17,58,186,202,215,290],"which":[18],"they":[19,282],"used.":[21],"Existing":[22],"domain-specific":[23],"languages":[24,66],"(DSLs)":[25],"allow":[26],"such":[27],"customization":[28],"through":[29],"definition":[31],"of":[32,128,135,142,146,151,219],"deny-listing":[33],"data-flow":[34],"rules":[35],"describe":[37],"potentially":[38],"vulnerable":[39,217],"or":[40,107],"malicious":[41,242],"taint-flows.":[42,82,233],"These":[43],"languages,":[44],"however,":[45,63],"designed":[47],"primarily":[48],"for":[49,81,180],"security":[50,183],"experts":[51],"who":[52],"expected":[54,232,241],"be":[56,68],"knowledgeable":[57],"analysis.":[60],"Software":[61],"developers,":[62,255],"consider":[64],"these":[65],"complex.":[69],"This":[70,110],"paper":[71,111],"thus":[72],"presents":[73],"fluent":[74,83,94,113,136,147,162,175,256,275],"TQL,":[75,148],"a":[76,91,140,216,249,259],"query":[77],"specification":[78],"language":[79],"particularly":[80],"TQL":[84,95,137,163,176,257,276],"is":[85],"internal":[86],"Java":[87,221],"DSL":[88,270],"and":[89,116,119,132,157,160,279],"uses":[90],"fluent-interface":[92],"design.":[93],"queries":[96,138,179,289],"can":[97],"express":[98],"various":[99],"taint-style":[100],"vulnerability":[101,184],"types,":[102],"e.g.":[103],"injections,":[104],"cross-site":[105],"scripting":[106],"path":[108],"traversal.":[109],"describes":[112],"TQL\u2019s":[114],"abstract":[115],"concrete":[117],"syntax":[118],"defines":[120],"its":[121],"runtime":[122],"semantics.":[123],"The":[124],"semantics":[125],"independent":[127],"any":[129],"underlying":[130],"analysis":[131,154,196,228,288],"allows":[133],"evaluation":[134],"by":[139,271],"variety":[141],"analyses.":[144],"Instantiations":[145],"on":[149,166],"top":[150],"two":[152],"solvers,":[155],"Boomerang":[156],"FlowDroid,":[158],"show":[159],"validate":[161],"expressiveness.":[164],"Based":[165],"existing":[167],"examples":[168],"from":[169],"literature,":[171],"we":[172],"have":[173],"used":[174],"implement":[178],"11":[181],"popular":[182],"types":[185],"Java.":[187],"Using":[188],"our":[189],"SQL":[190],"injection":[191],"specification,":[192],"Boomerang-based":[194,226],"found":[197,229,274],"all":[198,230],"17":[199],"known":[200],"taint-flows":[201,211,245],"OWASP":[204],"WebGoat":[205],"application,":[206,224],"whereas":[207],"with":[208,239,252,280],"FlowDroid":[209],"13":[210],"were":[212,246,283],"found.":[213],"Similarly,":[214],"version":[218],"Spring":[222],"PetClinic":[223],"seven":[231,235],"In":[234,248,263],"real-world":[236],"Android":[237],"apps":[238],"25":[240],"taint-flows,":[243],"18":[244],"detected.":[247],"user":[250],"study":[251],"26":[253],"software":[254],"reached":[258],"high":[260],"usability":[261],"score.":[262],"comparison":[264],"CodeQL":[266],",":[267],"state-of-the-art":[269],"Semmle/GitHub,":[272],"participants":[273],"more":[277],"usable":[278],"it":[281],"able":[284],"specify":[286],"shorter":[291],"time.":[292]},"counts_by_year":[{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}