Analyzing the Vulnerabilities in GWT Code and Applications

The Google Web Toolkit (GWT) is a Java based toolkit for creating client-side Web applications by compiling Java code into Java Script. It also provides a mechanism for asynchronous calls to a Web server. This paper will examine GWT to discover APIs in GWT that may be vulnerable to Web application attacks, such as XSS and XSRF, and then analyze the vulnerabilities based on the cases provided in open source GWT code and applications. The data collected from the source code analysis will provide an indication of the extent of vulnerabilities in GWT and difficulties in securing GWT applications.