{"id":"https://openalex.org/W7126265623","doi":"https://doi.org/10.1109/raid67961.2025.00057","title":"{{alert(\u2019CSTI\u2019)}}: Large-Scale Detection of Client-Side Template Injection","display_name":"{{alert(\u2019CSTI\u2019)}}: Large-Scale Detection of Client-Side Template Injection","publication_year":2025,"publication_date":"2025-10-19","ids":{"openalex":"https://openalex.org/W7126265623","doi":"https://doi.org/10.1109/raid67961.2025.00057"},"language":"en","primary_location":{"id":"doi:10.1109/raid67961.2025.00057","is_oa":false,"landing_page_url":"https://doi.org/10.1109/raid67961.2025.00057","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 28th International Symposium on Research in Attacks, Intrusions and Defenses (RAID)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://hdl.handle.net/11584/477445","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5104421737","display_name":"Lorenzo Pisu","orcid":null},"institutions":[{"id":"https://openalex.org/I172446870","display_name":"University of Cagliari","ror":"https://ror.org/003109y17","country_code":"IT","type":"education","lineage":["https://openalex.org/I172446870"]}],"countries":["IT"],"is_corresponding":true,"raw_author_name":"Lorenzo Pisu","raw_affiliation_strings":["University of Cagliari,Cagliari,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Cagliari,Cagliari,Italy","institution_ids":["https://openalex.org/I172446870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002025561","display_name":"Davide Balzarotti","orcid":"https://orcid.org/0000-0001-5957-6213"},"institutions":[{"id":"https://openalex.org/I1902872","display_name":"EURECOM","ror":"https://ror.org/00sse7z02","country_code":"FR","type":"education","lineage":["https://openalex.org/I1902872","https://openalex.org/I205703379"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Davide Balzarotti","raw_affiliation_strings":["Sophia Antipolis,Eurecom,France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sophia Antipolis,Eurecom,France","institution_ids":["https://openalex.org/I1902872"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051452548","display_name":"Davide Maiorca","orcid":"https://orcid.org/0000-0003-2640-4663"},"institutions":[{"id":"https://openalex.org/I172446870","display_name":"University of Cagliari","ror":"https://ror.org/003109y17","country_code":"IT","type":"education","lineage":["https://openalex.org/I172446870"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Davide Maiorca","raw_affiliation_strings":["University of Cagliari,Cagliari,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Cagliari,Cagliari,Italy","institution_ids":["https://openalex.org/I172446870"]}]},{"author_position":"last","author":{"id":null,"display_name":"Giorgio Giacinto","orcid":null},"institutions":[{"id":"https://openalex.org/I4210099418","display_name":"CoNISMa","ror":"https://ror.org/00t74vp97","country_code":"IT","type":"other","lineage":["https://openalex.org/I4210099418"]},{"id":"https://openalex.org/I4210115176","display_name":"National Interuniversity Consortium for the Physical Sciences of Matter","ror":"https://ror.org/026vvkz19","country_code":"IT","type":"nonprofit","lineage":["https://openalex.org/I4210115176"]},{"id":"https://openalex.org/I4210152452","display_name":"Consorzio Interuniversitario Nazionale per l'Informatica","ror":"https://ror.org/03v8v5y65","country_code":"IT","type":"facility","lineage":["https://openalex.org/I4210152452"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Giorgio Giacinto","raw_affiliation_strings":["National Interuniversity Consortium for Informatics,Rome,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Interuniversity Consortium for Informatics,Rome,Italy","institution_ids":["https://openalex.org/I4210152452","https://openalex.org/I4210115176","https://openalex.org/I4210099418"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5104421737"],"corresponding_institution_ids":["https://openalex.org/I172446870"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.811056,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"363","last_page":"377"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9412000179290771,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9412000179290771,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.01899999938905239,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.011099999770522118,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/javascript","display_name":"JavaScript","score":0.7882999777793884},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.7842000126838684},{"id":"https://openalex.org/keywords/rendering","display_name":"Rendering (computer graphics)","score":0.6132000088691711},{"id":"https://openalex.org/keywords/cross-site-scripting","display_name":"Cross-site scripting","score":0.49630001187324524},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.47029998898506165},{"id":"https://openalex.org/keywords/plug-in","display_name":"Plug-in","score":0.349700003862381}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8215000033378601},{"id":"https://openalex.org/C544833334","wikidata":"https://www.wikidata.org/wiki/Q2005","display_name":"JavaScript","level":2,"score":0.7882999777793884},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.7842000126838684},{"id":"https://openalex.org/C205711294","wikidata":"https://www.wikidata.org/wiki/Q176953","display_name":"Rendering (computer graphics)","level":2,"score":0.6132000088691711},{"id":"https://openalex.org/C39569185","wikidata":"https://www.wikidata.org/wiki/Q371199","display_name":"Cross-site scripting","level":5,"score":0.49630001187324524},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.47029998898506165},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4207000136375427},{"id":"https://openalex.org/C4924752","wikidata":"https://www.wikidata.org/wiki/Q184148","display_name":"Plug-in","level":2,"score":0.349700003862381},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.33730000257492065},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.325300008058548},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3142000138759613},{"id":"https://openalex.org/C89505385","wikidata":"https://www.wikidata.org/wiki/Q47146","display_name":"User interface","level":2,"score":0.2824999988079071},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.27720001339912415},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.26269999146461487}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/raid67961.2025.00057","is_oa":false,"landing_page_url":"https://doi.org/10.1109/raid67961.2025.00057","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 28th International Symposium on Research in Attacks, Intrusions and Defenses (RAID)","raw_type":"proceedings-article"},{"id":"pmh:oai:iris.unica.it:11584/477445","is_oa":true,"landing_page_url":"https://hdl.handle.net/11584/477445","pdf_url":null,"source":{"id":"https://openalex.org/S4377196293","display_name":"UNICA IRIS Institutional Research Information System (University of Cagliari)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172446870","host_organization_name":"University of Cagliari","host_organization_lineage":["https://openalex.org/I172446870"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferencePaper"}],"best_oa_location":{"id":"pmh:oai:iris.unica.it:11584/477445","is_oa":true,"landing_page_url":"https://hdl.handle.net/11584/477445","pdf_url":null,"source":{"id":"https://openalex.org/S4377196293","display_name":"UNICA IRIS Institutional Research Information System (University of Cagliari)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172446870","host_organization_name":"University of Cagliari","host_organization_lineage":["https://openalex.org/I172446870"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferencePaper"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.41286852955818176,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W144897388","https://openalex.org/W1991074244","https://openalex.org/W2002447170","https://openalex.org/W2049214202","https://openalex.org/W2094415856","https://openalex.org/W2102457045","https://openalex.org/W2103262407","https://openalex.org/W2143183078","https://openalex.org/W2151619740","https://openalex.org/W2280761855","https://openalex.org/W2743909715","https://openalex.org/W2901089484","https://openalex.org/W2904027722","https://openalex.org/W3008757785","https://openalex.org/W3040715571","https://openalex.org/W3214196324","https://openalex.org/W4281396748","https://openalex.org/W4307020331","https://openalex.org/W4385679748"],"related_works":[],"abstract_inverted_index":{"Template":[0,57],"engines":[1,108],"are":[2],"software":[3],"components":[4],"that":[5,16,63,138],"enable":[6],"the":[7,20,25,48,88,103,130,179,212],"creation":[8],"of":[9,77,106,115,129,133,214],"reusable":[10],"HTML":[11],"elements":[12],"containing":[13],"special":[14],"keywords":[15],"can":[17,86],"dynamically":[18],"alter":[19],"page\u2019s":[21],"rendering":[22],"based":[23,210],"on":[24,47,164,178,211],"presented":[26],"data.":[27],"This":[28,85],"technology":[29],"is":[30,60,68],"widely":[31],"used":[32],"in":[33,39,109,143],"server-side":[34],"applications":[35],"and":[36,38,54,73],"frameworks,":[37],"recent":[40],"years,":[41],"it":[42],"has":[43],"also":[44],"gained":[45],"adoption":[46,105],"client":[49],"side":[50],"through":[51,196],"JavaScript":[52,94],"frameworks":[53],"libraries.":[55],"Client-Side":[56],"Injection":[58],"(CSTI)":[59],"a":[61,71,112,140,156],"vulnerability":[62],"occurs":[64],"when":[65],"user":[66],"input":[67],"reflected":[69],"inside":[70],"template":[72,89,107,134],"rendered":[74],"as":[75],"part":[76],"it,":[78],"allowing":[79],"attackers":[80],"to":[81,98,146,154,194,206],"inject":[82],"malicious":[83],"instructions.":[84],"trick":[87],"engine":[90],"into":[91],"executing":[92],"arbitrary":[93],"code,":[95],"potentially":[96],"leading":[97,193],"Cross-Site":[99],"Scripting":[100],"(XSS).":[101],"Despite":[102],"widespread":[104],"production":[110],"websites,":[111],"comprehensive":[113],"study":[114],"their":[116],"characteristics":[117,153],"remains":[118],"absent.":[119],"In":[120],"our":[121],"study,":[122],"we":[123,167,185,202],"begin":[124],"by":[125],"providing":[126],"an":[127,169],"overview":[128],"main":[131],"features":[132],"engines,":[135],"highlighting":[136],"attributes":[137],"play":[139],"crucial":[141],"role":[142],"escalating":[144],"CSTI":[145,161,171,209],"XSS.":[147],"We":[148],"then":[149],"use":[150],"these":[151],"extracted":[152],"develop":[155],"systematic":[157],"methodology":[158],"for":[159],"detecting":[160],"vulnerabilities.":[162],"Based":[163],"this":[165],"methodology,":[166],"create":[168],"automatic":[170],"detection":[172],"tool,":[173],"CSTI-Alert.":[174],"By":[175],"running":[176],"CSTI-Alert":[177],"Tranco":[180],"top":[181],"1":[182],"million":[183],"domains,":[184,189],"identify":[186],"532":[187],"CSTI-vulnerable":[188],"with":[190],"72%":[191],"directly":[192],"XSS":[195],"GET":[197],"parameters":[198],"or":[199],"CSRF.":[200],"Finally,":[201],"discuss":[203],"potential":[204],"approaches":[205],"defend":[207],"against":[208],"result":[213],"semi-automatic":[215],"exploitability":[216],"analysis.":[217]},"counts_by_year":[],"updated_date":"2026-04-25T08:17:42.794288","created_date":"2026-02-01T00:00:00"}