{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:35:43Z","timestamp":1791459343367,"version":"4.3.4"},"publisher-location":"Cham","reference-count":40,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031642845","type":"print"},{"value":"9783031642852","type":"electronic"}],"license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2024]]},"DOI":"10.1007\/978-3-031-64285-2_10","type":"book-chapter","created":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T18:04:50Z","timestamp":1719857090000},"page":"180-200","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Taint Analysis for\u00a0Graph APIs Focusing on\u00a0Broken Access Control"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6937-5167","authenticated-orcid":false,"given":"Leen","family":"Lambers","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6971-1589","authenticated-orcid":false,"given":"Lucas","family":"Sakizloglou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-2952-5023","authenticated-orcid":false,"given":"Osama","family":"Al-Wardi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-7720-1160","authenticated-orcid":false,"given":"Taisiya","family":"Khakharova","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,7,2]]},"reference":[{"key":"10_CR1","doi-asserted-by":"publisher","unstructured":"Al\u00a0Wardi, O., Khakharova, T., Sakizloglou, L., Lambers, L.: Supplement to Submission, v2 (2024). https:\/\/doi.org\/10.5281\/zenodo.11197370. Accessed 15 May 2024","DOI":"10.5281\/zenodo.11197370"},{"key":"10_CR2","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1016\/J.TCS.2016.10.018","volume":"685","author":"S Alves","year":"2017","unstructured":"Alves, S., Fern\u00e1ndez, M.: A graph-based framework for the analysis of access control policies. Theor. Comput. Sci. 685, 3\u201322 (2017). https:\/\/doi.org\/10.1016\/J.TCS.2016.10.018","journal-title":"Theor. Comput. Sci."},{"key":"10_CR3","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"121","DOI":"10.1007\/978-3-642-16145-2_9","volume-title":"Model Driven Engineering Languages and Systems","author":"T Arendt","year":"2010","unstructured":"Arendt, T., Biermann, E., Jurack, S., Krause, C., Taentzer, G.: Henshin: advanced concepts and tools for in-place EMF model transformations. In: Petriu, D.C., Rouquette, N., Haugen, \u00d8. (eds.) MODELS 2010. LNCS, vol. 6394, pp. 121\u2013135. Springer, Heidelberg (2010). https:\/\/doi.org\/10.1007\/978-3-642-16145-2_9"},{"key":"10_CR4","doi-asserted-by":"publisher","unstructured":"Belhadi, A., Zhang, M., Arcuri, A.: Random testing and evolutionary testing for fuzzing GraphQL APIs. ACM Trans. Web 18(1), 14:1\u201314:41 (2024). https:\/\/doi.org\/10.1145\/3609427","DOI":"10.1145\/3609427"},{"key":"10_CR5","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"125","DOI":"10.1007\/978-3-319-61470-0_8","volume-title":"Graph Transformation","author":"K Born","year":"2017","unstructured":"Born, K., Lambers, L., Str\u00fcber, D., Taentzer, G.: Granularity of conflicts and dependencies in graph transformation systems. In: de Lara, J., Plump, D. (eds.) ICGT 2017. LNCS, vol. 10373, pp. 125\u2013141. Springer, Cham (2017). https:\/\/doi.org\/10.1007\/978-3-319-61470-0_8"},{"key":"10_CR6","doi-asserted-by":"publisher","unstructured":"B\u00fcrger, J., J\u00fcrjens, J., Wenzel, S.: Restoring security of evolving software models using graph transformation. Int. J. Softw. Tools Technol. Transf. 17(3), 267\u2013289 (2015). https:\/\/doi.org\/10.1007\/S10009-014-0364-8","DOI":"10.1007\/S10009-014-0364-8"},{"key":"10_CR7","series-title":"Monographs in Theoretical Computer Science. An EATCS Series","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-31188-2","volume-title":"Fundamentals of Algebraic Graph Transformation","author":"H Ehrig","year":"2006","unstructured":"Ehrig, H., Ehrig, K., Prange, U., Taentzer, G.: Fundamentals of Algebraic Graph Transformation. MTCSAES, Springer, Heidelberg (2006). https:\/\/doi.org\/10.1007\/3-540-31188-2"},{"issue":"3","key":"10_CR8","doi-asserted-by":"publisher","first-page":"99","DOI":"10.1145\/2494522","volume":"57","author":"W Enck","year":"2014","unstructured":"Enck, W., et al.: Taintdroid: an information flow tracking system for real-time privacy monitoring on smartphones. Commun. ACM 57(3), 99\u2013106 (2014). https:\/\/doi.org\/10.1145\/2494522","journal-title":"Commun. ACM"},{"key":"10_CR9","unstructured":"GitHub: Access permissions on GitHub. https:\/\/docs.github.com\/en\/get-started\/learning-about-github\/access-permissions-on-github. Accessed 08 Mar 2024"},{"key":"10_CR10","unstructured":"GitHub: GitHub GraphQL API community discussions. https:\/\/github.com\/orgs\/community\/discussions\/. Accessed 01 Mar 2024"},{"key":"10_CR11","unstructured":"GitHub: GitHub GraphQL API documentation. https:\/\/docs.github.com\/en\/graphql. Accessed 01 Mar 2024"},{"key":"10_CR12","unstructured":"GitHub: Scopes for OAuth apps. https:\/\/docs.github.com\/en\/apps\/oauth-apps\/building-oauth-apps\/scopes-for-oauth-apps. Accessed 07 Mar 2024"},{"key":"10_CR13","unstructured":"The GraphQL Foundation: GraphQL | A query language for your API. https:\/\/graphql.org\/. Accessed 05 Dec 2023"},{"key":"10_CR14","unstructured":"The GraphQL Foundation: Schemas and Types | GraphQL. https:\/\/graphql.org\/learn\/schema\/. Accessed 08 Mar 2024"},{"key":"10_CR15","unstructured":"Graw, G.M.: Software Security: Building Security in. Addison-Wesley Professional, Boston (2007)"},{"key":"10_CR16","doi-asserted-by":"publisher","unstructured":"Heckel, R., Taentzer, G.: Graph Transformation for Software Engineers - With Applications to Model-Based Development and Domain-Specific Language Engineering. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-43916-3","DOI":"10.1007\/978-3-030-43916-3"},{"key":"10_CR17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"174","DOI":"10.1007\/978-3-642-38883-5_16","volume-title":"Theory and Practice of Model Transformations","author":"S Hildebrandt","year":"2013","unstructured":"Hildebrandt, S., Lambers, L., Giese, H.: Complete specification coverage in automatically generated conformance test cases for TGG implementations. In: Duddy, K., Kappel, G. (eds.) ICMT 2013. LNCS, vol. 7909, pp. 174\u2013188. Springer, Heidelberg (2013). https:\/\/doi.org\/10.1007\/978-3-642-38883-5_16"},{"key":"10_CR18","doi-asserted-by":"publisher","unstructured":"Hu, V.C., Kuhn, R., Yaga, D.: Verification and test methods for access control policies\/models. Technical report, NIST SP 800-192, National Institute of Standards and Technology, Gaithersburg, MD (2017). https:\/\/doi.org\/10.6028\/NIST.SP.800-192","DOI":"10.6028\/NIST.SP.800-192"},{"key":"10_CR19","doi-asserted-by":"publisher","unstructured":"Karlsson, S., Causevic, A., Sundmark, D.: Automatic property-based testing of GraphQL APIs. In: 2nd IEEE\/ACM International Conference on Automation of Software Test, AST@ICSE 2021, Madrid, Spain, 20\u201321 May 2021, pp. 1\u201310. IEEE (2021). https:\/\/doi.org\/10.1109\/AST52587.2021.00009","DOI":"10.1109\/AST52587.2021.00009"},{"issue":"1","key":"10_CR20","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/J.JCSS.2004.11.002","volume":"71","author":"M Koch","year":"2005","unstructured":"Koch, M., Mancini, L.V., Parisi-Presicce, F.: Graph-based specification of access control policies. J. Comput. Syst. Sci. 71(1), 1\u201333 (2005). https:\/\/doi.org\/10.1016\/J.JCSS.2004.11.002","journal-title":"J. Comput. Syst. Sci."},{"key":"10_CR21","unstructured":"Krekel, H., dev team pytest: Pytest: Helps you write better programs \u2014 pytest documentation. https:\/\/docs.pytest.org\/en\/8.0.x\/. Accessed 06 Mar 2024"},{"key":"10_CR22","unstructured":"Krinke, J.: Python-graphql-client: Python GraphQL Client"},{"key":"10_CR23","doi-asserted-by":"publisher","unstructured":"Kuznetsov, K., Gorla, A., Tavecchia, I., Gross, F., Zeller, A.: Mining android apps for anomalies. In: Bird, C., Menzies, T., Zimmermann, T. (eds.) The Art and Science of Analyzing Software Data, pp. 257\u2013283. Morgan Kaufmann\/Elsevier (2015). https:\/\/doi.org\/10.1016\/B978-0-12-411519-4.00010-0","DOI":"10.1016\/B978-0-12-411519-4.00010-0"},{"key":"10_CR24","doi-asserted-by":"publisher","first-page":"105","DOI":"10.1016\/j.jlamp.2018.11.004","volume":"103","author":"L Lambers","year":"2019","unstructured":"Lambers, L., Born, K., Kosiol, J., Str\u00fcber, D., Taentzer, G.: Granularity of conflicts and dependencies in graph transformation systems: a two-dimensional approach. J. Log. Algebr. Methods Program. 103, 105\u2013129 (2019). https:\/\/doi.org\/10.1016\/j.jlamp.2018.11.004","journal-title":"J. Log. Algebr. Methods Program."},{"key":"10_CR25","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"105","DOI":"10.1007\/978-3-319-75396-6_6","volume-title":"Graph Transformation, Specifications, and Nets","author":"L Lambers","year":"2018","unstructured":"Lambers, L., Born, K., Orejas, F., Str\u00fcber, D., Taentzer, G.: Initial conflicts and dependencies: critical pairs revisited. In: Heckel, R., Taentzer, G. (eds.) Graph Transformation, Specifications, and Nets. LNCS, vol. 10800, pp. 105\u2013123. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-75396-6_6"},{"key":"10_CR26","doi-asserted-by":"publisher","first-page":"17","DOI":"10.1016\/j.entcs.2008.04.026","volume":"211","author":"L Lambers","year":"2008","unstructured":"Lambers, L., Ehrig, H., Orejas, F.: Efficient conflict detection in graph transformation systems by essential critical pairs. Electron. Notes Theor. Comput. Sci. 211, 17\u201326 (2008). https:\/\/doi.org\/10.1016\/j.entcs.2008.04.026","journal-title":"Electron. Notes Theor. Comput. Sci."},{"key":"10_CR27","doi-asserted-by":"publisher","unstructured":"Lambers, L., Str\u00fcber, D., Taentzer, G., Born, K., Huebert, J.: Multi-granular conflict and dependency analysis in software engineering based on graph transformation. In: Proceedings of the 40th International Conference on Software Engineering, ICSE 2018, pp. 716\u2013727. Association for Computing Machinery, New York (2018). https:\/\/doi.org\/10.1145\/3180155.3180258","DOI":"10.1145\/3180155.3180258"},{"key":"10_CR28","unstructured":"Meta: Overview - Graph API - Documentation. https:\/\/developers.facebook.com\/docs\/graph-api\/overview\/. Accessed 01 Mar 2024"},{"key":"10_CR29","doi-asserted-by":"publisher","unstructured":"Pagey, R., Mannan, M., Youssef, A.: All your shops are belong to us: security weaknesses in e-commerce platforms. In: Proceedings of the ACM Web Conference 2023, WWW 2023, pp. 2144\u20132154. Association for Computing Machinery, New York (2023). https:\/\/doi.org\/10.1145\/3543507.3583319","DOI":"10.1145\/3543507.3583319"},{"key":"10_CR30","volume-title":"Software Testing and Analysis - Process, Principles and Techniques","author":"M Pezz\u00e8","year":"2007","unstructured":"Pezz\u00e8, M., Young, M.: Software Testing and Analysis - Process, Principles and Techniques. Wiley, Hoboken (2007)"},{"key":"10_CR31","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"556","DOI":"10.1007\/3-540-58338-6_102","volume-title":"Mathematical Foundations of Computer Science 1994","author":"D Plump","year":"1994","unstructured":"Plump, D.: Critical pairs in term graph rewriting. In: Pr\u00edvara, I., Rovan, B., Ruzi\u010dka, P. (eds.) MFCS 1994. LNCS, vol. 841, pp. 556\u2013566. Springer, Heidelberg (1994). https:\/\/doi.org\/10.1007\/3-540-58338-6_102"},{"key":"10_CR32","doi-asserted-by":"publisher","unstructured":"Qui\u00f1a-Mera, A., Fernandez, P., Garc\u00eda, J.M., Ruiz-Cort\u00e9s, A.: Graphql: a systematic mapping study. ACM Comput. Surv. 55(10), 202:1\u2013202:35 (2023). https:\/\/doi.org\/10.1145\/3561818","DOI":"10.1145\/3561818"},{"key":"10_CR33","doi-asserted-by":"publisher","unstructured":"Ray, I., Li, N., France, R.B., Kim, D.: Using UML to visualize role-based access control constraints. In: Jaeger, T., Ferrari, E. (eds.) 9th ACM Symposium on Access Control Models and Technologies, SACMAT 2004, Yorktown Heights, New York, USA, 2\u20134 June 2004, Proceedings, pp. 115\u2013124. ACM (2004). https:\/\/doi.org\/10.1145\/990036.990054","DOI":"10.1145\/990036.990054"},{"key":"10_CR34","doi-asserted-by":"crossref","unstructured":"Rozenberg, G. (ed.): Handbook of Graph Grammars and Computing by Graph Transformations, Volume 1: Foundations. World Scientific, Singapore (1997)","DOI":"10.1142\/9789812384720"},{"key":"10_CR35","doi-asserted-by":"publisher","unstructured":"Runge, O., Khan, T.A., Heckel, R.: Test case generation using visual contracts. Electron. Commun. Eur. Assoc. Softw. Sci. Technol. 58 (2013). https:\/\/doi.org\/10.14279\/TUJ.ECEASST.58.847","DOI":"10.14279\/TUJ.ECEASST.58.847"},{"key":"10_CR36","unstructured":"Team OWASP Top 10: A01 Broken Access Control - OWASP Top 10:2021. https:\/\/owasp.org\/Top10\/A01_2021-Broken_Access_Control\/. Accessed 06 Mar 2024"},{"key":"10_CR37","doi-asserted-by":"publisher","unstructured":"Tripp, O., Pistoia, M., Fink, S.J., Sridharan, M., Weisman, O.: TAJ: effective taint analysis of web applications. In: Hind, M., Diwan, A. (eds.) Proceedings of the 2009 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2009, Dublin, Ireland, 15\u201321 June 2009, pp. 87\u201397. ACM (2009). https:\/\/doi.org\/10.1145\/1542476.1542486","DOI":"10.1145\/1542476.1542486"},{"key":"10_CR38","unstructured":"Vargas, D.M., et al.: Deviation testing: a test case generation technique for GraphQL APIs. In: International Workshop on Smalltalk Technologies (IWST) (2018)"},{"key":"10_CR39","doi-asserted-by":"publisher","unstructured":"Zetterlund, L., Tiwari, D., Monperrus, M., Baudry, B.: Harvesting production graphql queries to detect schema faults. In: 15th IEEE Conference on Software Testing, Verification and Validation, ICST 2022, Valencia, Spain, 4\u201314 April 2022, pp. 365\u2013376. IEEE (2022). https:\/\/doi.org\/10.1109\/ICST53961.2022.00014","DOI":"10.1109\/ICST53961.2022.00014"},{"issue":"2","key":"10_CR40","doi-asserted-by":"publisher","first-page":"498","DOI":"10.1109\/TSE.2022.3154769","volume":"49","author":"N Zhang","year":"2023","unstructured":"Zhang, N., Zou, Y., Xia, X., Huang, Q., Lo, D., Li, S.: Web APIs: features, issues, and expectations - a large-scale empirical study of web APIs from two publicly accessible registries using stack overflow and a user survey. IEEE Trans. Software Eng. 49(2), 498\u2013528 (2023). https:\/\/doi.org\/10.1109\/TSE.2022.3154769","journal-title":"IEEE Trans. Software Eng."}],"container-title":["Lecture Notes in Computer Science","Graph Transformation"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-64285-2_10","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T18:05:48Z","timestamp":1719857148000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-64285-2_10"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"ISBN":["9783031642845","9783031642852"],"references-count":40,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-64285-2_10","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]},"assertion":[{"value":"2 July 2024","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ICGT","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Graph Transformation","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Enschede","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"The Netherlands","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"9 July 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"11 July 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"17","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"icgt2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/conf.researchr.org\/home\/icgt-2024","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}