{"id":"https://openalex.org/W2002079460","doi":"https://doi.org/10.1145/2046707.2046736","title":"Fear the EAR","display_name":"Fear the EAR","publication_year":2011,"publication_date":"2011-10-17","ids":{"openalex":"https://openalex.org/W2002079460","doi":"https://doi.org/10.1145/2046707.2046736","mag":"2002079460"},"language":"en","primary_location":{"id":"doi:10.1145/2046707.2046736","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2046707.2046736","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM conference on Computer and communications security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5050806439","display_name":"Adam Doup\u00e9","orcid":"https://orcid.org/0000-0003-2634-3901"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Adam Doup\u00e9","raw_affiliation_strings":["University of California, Santa Barbara, Santa Barbara, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Santa Barbara, Santa Barbara, CA, USA","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071664443","display_name":"Bryce Boe","orcid":null},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bryce Boe","raw_affiliation_strings":["University of California, Santa Barbara, Santa Barbara, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Santa Barbara, Santa Barbara, CA, USA","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022177364","display_name":"Christopher Kruegel","orcid":"https://orcid.org/0000-0001-5140-3414"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Christopher Kruegel","raw_affiliation_strings":["University of California, Santa Barbara, Santa Barbara, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Santa Barbara, Santa Barbara, CA, USA","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5075685499","display_name":"Giovanni Vigna","orcid":"https://orcid.org/0000-0002-3422-5369"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Giovanni Vigna","raw_affiliation_strings":["University of California, Santa Barbara, Santa Barbara, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Santa Barbara, Santa Barbara, CA, USA","institution_ids":["https://openalex.org/I154570441"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I154570441"],"apc_list":null,"apc_paid":null,"fwci":4.2639,"has_fulltext":false,"cited_by_count":53,"citation_normalized_percentile":{"value":0.94892846,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"251","last_page":"262"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9926000237464905,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9678999781608582,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.842215895652771},{"id":"https://openalex.org/keywords/cross-site-scripting","display_name":"Cross-site scripting","score":0.8290287256240845},{"id":"https://openalex.org/keywords/web-application-security","display_name":"Web application security","score":0.7169346213340759},{"id":"https://openalex.org/keywords/sql-injection","display_name":"SQL injection","score":0.6091262102127075},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6069103479385376},{"id":"https://openalex.org/keywords/web-application","display_name":"Web application","score":0.5825362205505371},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.5630854368209839},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.5038082003593445},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4505595862865448},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.4450920820236206},{"id":"https://openalex.org/keywords/web-development","display_name":"Web development","score":0.423692524433136},{"id":"https://openalex.org/keywords/web-service","display_name":"Web service","score":0.36542993783950806},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.20689594745635986}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.842215895652771},{"id":"https://openalex.org/C39569185","wikidata":"https://www.wikidata.org/wiki/Q371199","display_name":"Cross-site scripting","level":5,"score":0.8290287256240845},{"id":"https://openalex.org/C59241245","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Web application security","level":4,"score":0.7169346213340759},{"id":"https://openalex.org/C150451098","wikidata":"https://www.wikidata.org/wiki/Q506059","display_name":"SQL injection","level":5,"score":0.6091262102127075},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6069103479385376},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.5825362205505371},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.5630854368209839},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.5038082003593445},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4505595862865448},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.4450920820236206},{"id":"https://openalex.org/C79373723","wikidata":"https://www.wikidata.org/wiki/Q386275","display_name":"Web development","level":3,"score":0.423692524433136},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.36542993783950806},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.20689594745635986},{"id":"https://openalex.org/C97854310","wikidata":"https://www.wikidata.org/wiki/Q19541","display_name":"Search engine","level":2,"score":0.0},{"id":"https://openalex.org/C194222762","wikidata":"https://www.wikidata.org/wiki/Q114486","display_name":"Query by Example","level":4,"score":0.0},{"id":"https://openalex.org/C164120249","wikidata":"https://www.wikidata.org/wiki/Q995982","display_name":"Web search query","level":3,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2046707.2046736","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2046707.2046736","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th ACM conference on Computer and communications security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.7599999904632568}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":16,"referenced_works":["https://openalex.org/W33764377","https://openalex.org/W1505465226","https://openalex.org/W1584091223","https://openalex.org/W1834251436","https://openalex.org/W1975428729","https://openalex.org/W1983142587","https://openalex.org/W2072978486","https://openalex.org/W2081212007","https://openalex.org/W2083940415","https://openalex.org/W2085925880","https://openalex.org/W2121417161","https://openalex.org/W2128325590","https://openalex.org/W2144271133","https://openalex.org/W2148001343","https://openalex.org/W2171816001","https://openalex.org/W3211269949"],"related_works":["https://openalex.org/W2167752994","https://openalex.org/W2955734438","https://openalex.org/W2775081089","https://openalex.org/W2504194819","https://openalex.org/W2407701912","https://openalex.org/W1982746004","https://openalex.org/W4256450364","https://openalex.org/W2791970934","https://openalex.org/W4245700610","https://openalex.org/W4238821156"],"abstract_inverted_index":{"The":[0],"complexity":[1],"of":[2,17,72,137],"modern":[3],"web":[4,32,38,79,90,144,184,205],"applications":[5,140],"makes":[6],"it":[7],"difficult":[8],"for":[9],"developers":[10],"to":[11,26,30,125,147,177,201],"fully":[12],"understand":[13],"the":[14,22,31,103,117,153,156,161,165],"security":[15,24],"implications":[16],"their":[18],"code.":[19],"Attackers":[20],"exploit":[21],"resulting":[23],"vulnerabilities":[25,40],"gain":[27],"unauthorized":[28],"access":[29,127],"application":[33,39,91],"environment.":[34],"Previous":[35],"research":[36],"into":[37],"has":[41],"mostly":[42],"focused":[43],"on":[44,182],"input":[45],"validation":[46],"flaws,":[47],"such":[48],"as":[49],"cross":[50],"site":[51],"scripting":[52],"and":[53,129],"SQL":[54],"injection,":[55],"while":[56],"logic":[57,76],"flaws":[58],"have":[59],"received":[60],"comparably":[61],"less":[62],"attention.":[63],"In":[64],"this":[65],"paper,":[66],"we":[67,82,169,197],"present":[68,170],"a":[69,73,99],"comprehensive":[70],"study":[71],"relatively":[74],"unknown":[75],"flaw":[77],"in":[78,142,180,192,204],"applications,":[80],"which":[81,122],"call":[83],"Execution":[84],"After":[85],"Redirect,":[86],"or":[87],"EAR.":[88],"A":[89,109],"developer":[92],"can":[93,123],"introduce":[94],"an":[95,135,171,199],"EAR":[96,148,157,190],"by":[97],"calling":[98],"redirect":[100],"method":[101],"under":[102],"assumption":[104],"that":[105],"execution":[106,114],"will":[107],"halt.":[108],"vulnerability":[110],"occurs":[111],"when":[112],"server-side":[113],"continues":[115],"after":[116],"developer's":[118],"intended":[119],"halting":[120],"point,":[121],"lead":[124],"broken/insufficient":[126],"controls":[128],"information":[130],"leakage.":[131],"We":[132,150],"start":[133],"with":[134],"analysis":[136,175],"how":[138],"susceptible":[139],"written":[141],"nine":[143],"frameworks":[145],"are":[146],"vulnerabilities.":[149],"then":[151],"discuss":[152],"results":[154],"from":[155],"challenge":[158],"contained":[159],"within":[160],"2010":[162],"International":[163],"Capture":[164],"Flag":[166],"Competition.":[167],"Finally,":[168,196],"open-source,":[172],"white-box,":[173],"static":[174],"tool":[176,187],"detect":[178],"EARs":[179,203],"Ruby":[181],"Rails":[183],"applications.":[185,195],"This":[186],"found":[188],"3,944":[189],"instances":[191],"18,127":[193],"open-source":[194],"describe":[198],"approach":[200],"prevent":[202],"frameworks.":[206]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2023,"cited_by_count":3},{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":4},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":5},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":7},{"year":2015,"cited_by_count":8},{"year":2014,"cited_by_count":7},{"year":2013,"cited_by_count":9},{"year":2012,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2016-06-24T00:00:00"}