Collected research

Testability Tarpits: the Impact of Code Patterns on the Security Testing of Web Applications

Feras Al Kassar, Giulia Clerici, Luca Compagna, Davide Balzarotti and Fabian Yamaguchi · NDSS Symposium

Certain coding patterns stop static application security testing tools from following data flow, so vulnerabilities stay hidden behind what the authors call testability tarpits. They catalogue over 270 such patterns in PHP and JavaScript and show that rewriting a subset lets existing scanners find 440 new potential vulnerabilities across 48 projects, with 182 confirmed and 25 CVEs published.

Record

Researcher

Feras Al Kassar, Giulia Clerici, Luca Compagna, Davide Balzarotti and Fabian Yamaguchi

Published by

NDSS Symposium

Topic

Other

In the archive

• Collected in the 2022 research round

Related sources

• NDSS 2022 Testability Tarpits: the Impact of Code Patterns on the Security Testing of Web Apps
• NDSS 2022 Testability Tarpits: the Impact of Code Patterns on the Security Testing of Web Apps

Tags

• static-analysis
• php
• javascript
• measurement-study
• tooling
• detection
• large-scale-scan
• cve
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Feras Al Kassar, Giulia Clerici, Luca Compagna, Davide Balzarotti and Fabian Yamaguchi, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.