{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,18]],"date-time":"2025-12-18T12:47:52Z","timestamp":1766062072777,"version":"3.48.0"},"reference-count":44,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"12","license":[{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,12,1]],"date-time":"2025-12-01T00:00:00Z","timestamp":1764547200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IIEEE Trans. Software Eng."],"published-print":{"date-parts":[[2025,12]]},"DOI":"10.1109\/tse.2025.3614304","type":"journal-article","created":{"date-parts":[[2025,9,26]],"date-time":"2025-09-26T17:36:54Z","timestamp":1758908214000},"page":"3435-3451","source":"Crossref","is-referenced-by-count":0,"title":["PHPJoy: A Novel Extended Graph-Based PHP Code Analysis Framework"],"prefix":"10.1109","volume":"51","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-0763-4732","authenticated-orcid":false,"given":"Youkun","family":"Shi","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0726-9996","authenticated-orcid":false,"given":"Yuan","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-5849-4589","authenticated-orcid":false,"given":"Tianhan","family":"Luo","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7066-0109","authenticated-orcid":false,"given":"Guangliang","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-2997-051X","authenticated-orcid":false,"given":"Shengke","family":"Ye","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-2092-3755","authenticated-orcid":false,"given":"Chengyu","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-4680-6513","authenticated-orcid":false,"given":"Fengyu","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9082-3208","authenticated-orcid":false,"given":"Xiapu","family":"Luo","sequence":"additional","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9714-5545","authenticated-orcid":false,"given":"Min","family":"Yang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"year":"2025","key":"ref1","article-title":"Statistics of Programming Languages"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.29"},{"key":"ref3","first-page":"655","article-title":"Precise client-side protection against DOM-based cross-site scripting","volume-title":"Proc. 23rd USENIX Secur. Symp.","author":"Stock","year":"2014"},{"key":"ref4","first-page":"989","article-title":"Static detection of second-order vulnerabilities in web applications","volume-title":"Proc. 23th USENIX Secur. Symp. (USENIX Secur.)","author":"Johannes Dahse","year":"2014"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00164"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23262"},{"key":"ref7","first-page":"377","article-title":"NAVEX: Precise and scalable exploit generation for dynamic web applications","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Secur.)","author":"Alhuzali","year":"2018"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.54"},{"key":"ref10","first-page":"321","article-title":"Devign: Effective vulnerability identification by learning comprehensive program semantics via graph neural networks","volume-title":"Proc. 33rd Conf. Neural Inf. Process. Syst. (NIPS)","author":"Zhou","year":"2019"},{"key":"ref11","first-page":"143","article-title":"Mining Node.js vulnerabilities via object dependence graph and query","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Li","year":"2022"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468542"},{"key":"ref13","first-page":"2525","article-title":"JAW: Studying client-side CSRF with hybrid property graphs and declarative traversals","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Khodayari","year":"2021"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP48549.2020.00012"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179479"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.14"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512235"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645530"},{"key":"ref19","first-page":"1993","article-title":"Backporting security patches of web applications: A prototype design and implementation on injection vulnerability patches","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Shi","year":"2022"},{"key":"ref20","first-page":"1","article-title":"Precise (Un)affected version analysis for web vulnerabilities","volume-title":"Proc. 37th IEEE\/ACM Int. Conf. Automated Softw. Eng. (ASE)","author":"Youkun","year":"2022"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CCWC51732.2021.9376145"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23158"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66402-6_6"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0053"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24308"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3559391"},{"year":"2025","key":"ref27","article-title":"PHP data objects"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556933"},{"year":"2024","key":"ref29","article-title":"Php object-oriented programming design basics"},{"year":"2022","key":"ref30","article-title":"A Dependency Manager for PHP"},{"year":"2022","key":"ref31","article-title":"Traits"},{"year":"2022","key":"ref32","article-title":"Object interfaces"},{"year":"2022","key":"ref33","article-title":"Namespaces overview"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660363"},{"key":"ref35","first-page":"197","article-title":"FUGIO: Automatic exploit generation for PHP object injection vulnerabilities","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Secur.)","author":"Park","year":"2018"},{"key":"ref36","first-page":"299","article-title":"PHPSAFE: A security analysis tool for OOP web application plugins","volume-title":"Proc. 45th Annu. IEEE\/IFIP Int. Conf. Dependable Syst. Networks (DSN)","author":"V","year":"2015"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/988672.988679"},{"year":"2022","key":"ref38","article-title":"PHP AST"},{"year":"2025","key":"ref39","article-title":"The Macth Expression"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME58944.2024.00017"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250739"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/1390832.1390838"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046736"},{"key":"ref44","first-page":"5557","article-title":"Minimalist: Semi-automated debloating of {PHP} web applications through static analysis","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Jahanshahi","year":"2023"}],"container-title":["IEEE Transactions on Software Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/32\/11298241\/11181216.pdf?arnumber=11181216","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,18]],"date-time":"2025-12-18T12:43:59Z","timestamp":1766061839000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11181216\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12]]},"references-count":44,"journal-issue":{"issue":"12"},"URL":"https:\/\/doi.org\/10.1109\/tse.2025.3614304","relation":{},"ISSN":["0098-5589","1939-3520","2326-3881"],"issn-type":[{"type":"print","value":"0098-5589"},{"type":"electronic","value":"1939-3520"},{"type":"electronic","value":"2326-3881"}],"subject":[],"published":{"date-parts":[[2025,12]]}}}