System, method and apparatus for preventing vulnerable interleavings in web applications at compile time

A system comprising:

• at least one processor programmed for:
• receiving, by at least one processor, a computer program;
• compiling, by at least one processor, the computer program;
• at compile-time, performing, by at least one processor, data flow analysis on the computer program to identify accesses to data locations by servlets running on a server and configured for execution of a least a portion of the computer program;
• generating, by at least one processor, based on the data flow analysis, a list of data-flow paths including accesses by the servlets to one or more of the data locations;
• determining, by at least one processor, based on the list of data-flow paths, that a first of the servlets having a first priority and a second of the servlets having a second priority different than the first priority, access the same data location;
• and
• determining, by at least one processor, the existence of a potential vulnerability in at least one of the data-flow paths based at least in part on the determination that the first of the servlets having the first priority and the second of the servlets having the second priority different than the first priority, access the same data location.

A non-transitory computer readable medium storing instructions that, when executed by at least one processor, program the at least one processor for:

• receiving, by at least one processor, a computer program;
• compiling, by at least one processor, the computer program;
• at compile-time, performing, by at least one processor, data flow analysis on the computer program to identify accesses to data locations by servlets running on a server and configured for execution of a least a portion of the computer program;
• generating, by at least one processor, based on the data flow analysis, a list of data-flow paths including accesses by the servlets to one or more of the data locations;
• determining, by at least one processor, based on the list of data-flow paths, that a first of the servlets having a first priority and a second of the servlets having a second priority different than the first priority, access the same data location;
• determining, by at least one processor, the existence of a potential vulnerability in at least one of the data-flow paths based at least in part on the determination that the first of the servlets having the first priority and the second of the servlets having the second priority different than the first priority, access the same data location.