1. A system comprising:
a black-box tester comprising a hardware processor configured to interact with a web application during its execution to identify a web page exposed by the web application, the web application being hosted by a server and accessible by a client computer;
a constraint manager configured to:
receive the web page identified by the black-box tester;
statically analyze the web page to identify a hidden parameter within the web page that is constrained by a client-side validation measure and that is to be sent to the web application, the hidden parameter to indicate an authorization level of a user of the client computer; and
determine a server-side validation measure to be applied to the hidden parameter comprising the web application checking for a correlation between a value of the hidden parameter and a value of at least one other parameter from the user; and
a static analyzer configured to:
statically analyze the web application to identify a location within the web application where the hidden parameter is input into the web application;
query the constraint manager for the server-side validation measure to be applied to the hidden parameter;
determine whether the web application checks for the correlation between the value of the hidden parameter and the value of the least one other client-supplied parameter according to the server-side validation measure from the constraint manager prior to the hidden parameter being used in a security-sensitive operation; and
identify the hidden parameter as a security vulnerability where the web application does not check for the correlation between the value of the hidden parameter and the value of the at least one other client-supplied parameter prior to the hidden parameter being used in the security-sensitive operation.
2. The system of claim 1 wherein the static analyzer is further configured to statically analyze the web application by building a control-flow model and a data-flow model of the web application.
3. A computer program product comprising:
a non-transitory computer readable storage medium; and
computer-readable program code stored in the computer-readable storage medium, where the computer-readable program code is configured to:
interact with a web application during its execution to identify a web page exposed by the web application, the web application being hosted by a server and accessible by a client computer;
statically analyze the web page to identify a hidden parameter within the web page that is constrained by a client-side validation measure and that is to be sent to the web application, the hidden parameter to indicate an authorization level of a user of the client computer;
determine a server-side validation measure to be applied to the hidden parameter comprising the web application checking for a correlation between a value of the hidden parameter and a value of at least one other parameter from the user;
statically analyze the web application to identify a location within the web application where the hidden parameter is input into the web application;
determine whether the web application checks for the correlation between the value of the hidden parameter and the value of the least one other client-supplied parameter according to the server-side validation measure prior to the hidden parameter being used in a security-sensitive operation; and
identify the hidden parameter as a security vulnerability where the web application does not check for the correlation between the value of the hidden parameter and the value of the at least one other client-supplied parameter prior to the hidden parameter being used in the security-sensitive operation.
4. The computer program product of claim 3 wherein the computer-readable program code is further configured to build a control-flow model and a data-flow model of the web application.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A method of treating burns, wounds and other topical infections of human being or animal hosts comprising spraying a non-aerosol spray system onto a disorder area, wherein the non-aerosol spray system comprises:
(a) a hand or finger trigger sprayable hydrophilic matrix composition; wherein the hydrophilic matrix composition comprises:
(i) a bisbiguanide salt or a micronized sulfanilamide salt;
(ii) about 0.1 to about 25% of a hydrophilic base, wherein the hydrophilic base is about 0.1 to about 2% of cross-linked acrylic acid polymer or polymers with about 0.1 to about 2% of alkaline solution or about 1 to about 25% of polyoxyethylene alkyl ether or ethers, wherein the cross-linked acrylic acid polymer is Carbomer 934, Carbomer 940, or Carbomer 941, wherein the alkaline solution is about 25% of sodium hydroxide solution or strong ammonia solution;
(iii) about 3 to about 40% of a humectant;
(iv) about 0.1 to about 1% of a preservative; and
(v) suitable amount of purified water to adjust to 100%; and
(b) a hand or finger trigger actuated pump spray device designed to spray a wide or narrow spray pattern.
2. A method of treating burns, wounds and other topical infections of human being or animal hosts comprising pouring a non-aerosol spray system onto a disorder area, wherein the non-aerosol spray system comprises:
(a) a hand or finger trigger sprayable hydrophilic matrix composition; wherein the hydrophilic matrix composition comprises:
(i) a bisbiguanide salt or a micronized sulfanilamide salt;
(ii) about 0.1 to about 25% of a hydrophilic base, wherein the hydrophilic base is about 0.1 to about 2% of cross-linked acrylic acid polymer or polymers with about 0.1 to about 2% of alkaline solution or about 1 to about 25% of polyoxyethylene alkyl ether or ethers, wherein the cross-linked acrylic acid polymer is Carbomer 934, Carbomer 940, or Carbomer 941, wherein the alkaline solution is about 25% of sodium hydroxide solution or strong ammonia solution;
(iii) about 3 to about 40% of a humectant;
(iv) about 0.1 to about 1% of a preservative; and
(v) suitable amount of purified water to adjust to 100%; and
(b) a hand or finger trigger actuated pump spray device designed to spray a wide or narrow spray pattern; and
wherein the hand or finger trigger actuated pump spray device is removed prior to pouring.
3. The method of claim 1, wherein the polyoxyethylene alkyl ether is selected from the group consisting of poloxyl 20 cetostearyl ether, poloxyl 2 cetyl ether, poloxyl 10 cetyl ether, poloxyl 20 cetyl ether, poloxyl 4 lauryl cetyl ether, poloxyl 23 lauryl cetyl ether, poloxyl 2 oleyl ether, poloxyl 10 oleyl ether, poloxyl 20 oleyl ether, poloxyl 2 stearyl ether, poloxyl 10 stearyl ether, poloxyl 20 stearyl ether and poloxyl 100 stearyl ether.
4. The method of claim 1, wherein the humectant or humectants are selected from the group consisting of propylene glycol, polyethylene glycol, sorbitol and glycerine.
5. The method of claim 1, wherein the preservative or preservatives are selected from the group consisting of methylparaben, propylparaben, benzyl alcohol, benzoic acid, sodium benzoate, potassium benzoate, sorbic acid, sodium sorbate, potassium sorbate and phenylethyl alcohol.
6. The composition prepared by the method of claim 1.
7. The method of claim 2, wherein the polyoxyethylene alkyl ether is selected from the group consisting of poloxyl 20 cetostearyl ether, poloxyl 2 cetyl ether, poloxyl 10 cetyl ether, poloxyl 20 cetyl ether, poloxyl 4 lauryl cetyl ether, poloxyl 23 lauryl cetyl ether, poloxyl 2 oleyl ether, poloxyl 10 oleyl ether, poloxyl 20 oleyl ether, poloxyl 2 stearyl ether, poloxyl 10 stearyl ether, poloxyl 20 stearyl ether and poloxyl 100 stearyl ether.
8. The method of claim 2, wherein the humectant or humectants are selected from the group consisting of propylene glycol, polyethylene glycol, sorbitol and glycerine.
9. The method of claim 2, wherein the preservative or preservatives are selected from the group consisting of methylparaben, propylparaben, benzyl alcohol, benzoic acid, sodium benzoate, potassium benzoate, sorbic acid, sodium sorbate, potassium sorbate and phenylethyl alcohol.
10. A non-aerosol spray system for burn treatment and anti-infection on a human being or an animal comprises:
(a) a hand or finger trigger sprayable hydrophilic matrix composition, wherein the hydrophilic matrix composition comprises chlorhexidine salts or micronized sulfadiazine salts; and
(b) a hand or finger trigger actuated pump spray device designed to spray a wide or narrow spray pattern.
11. A non-aerosol spray system for burn treatment and anti-infection on a human being or an animal comprises:
(a) a hand or finger trigger sprayable hydrophilic matrix composition, wherein the hydrophilic matrix composition comprises an antimicrobial agent, wherein the antimicrobial agent is:
(i) a hydrochloride, a digluconate, or an acetate salt of bisbiguanide salt in an amount in the range of about 0.05 to about 10% by weight of the hydrophilic matrix; or
(ii) a micronized silver or a zinc salt of sulfanilamide in an amount in the range of about 0.5 to about 5% by weight of the hydrophilic matrix; and
(b) a hand or finger trigger actuated pump spray device designed to spray a wide or narrow spray pattern.
12. A non-aerosol spray system for burn treatment and anti-infection on a human being or an animal comprises:
(a) a hand or finger trigger sprayable hydrophilic matrix composition; wherein the hydrophilic matrix composition comprises:
(i) a bisbiguanide salt or a micronized sulfanilamide salt;
(ii) about 0.1 to about 25% of a hydrophilic base;
(iii) about 3 to about 40% of a humectant;
(iv) about 0.1 to about 1% of a preservative; and
(v) suitable amount of purified water to adjust to 100%; and
(b) a hand or finger trigger actuated pump spray device designed to spray a wide or narrow spray pattern.