Language-based isolation of untrusted javascript

Proceedings - IEEE Computer Security Foundations Symposium

Volumn , Issue , 2009, Pages 77-91

  Maffeis, Sergio ^a   Taly, Ankur ^b  

^a IMPERIAL COLLEGE LONDON   (United Kingdom)

^b Stanford University   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CORE PROBLEMS; FACEBOOK; JAVASCRIPT; OPERATIONAL SEMANTICS; SENSITIVE INFORMATIONS;

HIGH LEVEL LANGUAGES; SECURITY SYSTEMS;

LINGUISTICS;

EID: 70350525212     PISSN: 19401434     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSF.2009.11     Document Type: Conference Paper

References (29)

1. I. Aktug, M. Dam, and D. Gurov, "Provably correct runtime monitoring," in Proc. of FM 2008, ser. LNCS, vol. 5014. Springer, 2008, pp. 262-277.
2. C. Anderson, P. Giannini, and S. Drossopoulou, "Towards type inference for JavaScript," in Proc. of ECOOP'05, 2005, pp. 429-452.
3. A. Barth, C. Jackson, and J. Mitchell, "Securing browser frame communication," in Proc. of USENIX Security, 2008.
4. G. Caja Team, "Google-Caja: A source-to-source translator for securing JavaScript-based web," http://code.google.com/p/google-caja/.
5. D. Crockford, "ADsafe: Making JavaScript safe for advertising," http://www.adsafe.org/, 2008.
6. -, "ADsafe: Making JavaScript safe for advertising (2007 version)," http://web.archive.org/web/20071225101246/http://www.adsafe.org/ , 2007.
7. ECMA International, "ECMAScript language specification. stardard ECMA-262, 3rd Edition," http://www.ecma-international.org/publications/ files/ECMA-ST/Ecma-262.pdf, 1999.
8. B. Eich, "JavaScript at ten years," http://www.mozilla.org/js/ language/ICFP-Keynote.ppt.
9. A. Felt, P. Hooimeijer, D. Evans, and W. Weimer, "Talking to strangers without taking their candy: isolating proxied content," in Proc. of SocialNets '08. ACM, 2008.
10. D. Flanagan, JavaScript: The Definitive Guide. O'Reilly, 2006.
11. P. Heidegger and P. Thiemann, "Recency types for dynamically-typed, object-based languages," Proc. of FOOL'09, 2009.
12. P. H. Phung, D. Sands, and A. Chudnov, "Lightweight self protecting JavaScript," in Proc. of ASIACCS 2009. ACM Press, 2009.
13. B. Livshits and S. Guarnieri, "Gatekeeper: Mostly static enforcement of security and reliability policies for JavaScript code," MSR-TR-2009-16, Feb. 2009.
14. S. Maffeis, J. Mitchell, and A. Taly, "Complete ECMA 262-3 operational semantics," http://jssec.net/semantics/.
15. -, "An operational semantics for JavaScript," in Proc. of APLAS'08, ser. LNCS, vol. 5356, 2008, pp. 307-325
16. See also: Dep. of Computing, Imperial College London, Technical Report DTR08-13, 2008.
17. -, "An operational semantics for JavaScript," in Proc. of APLAS'08, ser. LNCS, vol. 5356. Springer Verlag, Dec. 2008, pp. 307-325.
18. -, "Language-based isolation of untrusted JavaScript," Dep. of Computing, Imperial College London, Technical Report DTR09-3, 2009.
19. -, "Run-time enforcement of secure javascript subsets," in Proc of W2SP'09. IEEE, 2009.
20. Prototype Core Team, "Prototype JavaScript framework: Easy Ajax and DOM manipulation for dynamic web applications," http://www.prototypejs.org.
21. C. Reis, J. Dunagan, H. Wang, O. Dubrovsky, and S. Esmeir, "BrowserShield: Vulnerability-driven filtering of Dynamic HTML," ACM Transactions on the Web, vol. 1, no. 3, 2007.
22. A. Sabelfeld and A. Askarov, "Tight enforcement of flexible information-release policies for dynamic languages," Proc. of PCC'08, 2008.
23. The FaceBook Team, "FaceBook," http://www.facebook. com/.
24. -, "FBJS," http://wiki.developers.facebook.com/index. php/FBJS.
25. -, "FBML," http://wiki.developers.facebook.com/index. php/FBML.
26. P. Thiemann, "Towards a type system for analyzing javascript programs," in Proc. of ESOP'05, ser. LNCS, vol. 3444, 2005, pp. 408-422.
27. -, "A type safe DOM API," in Proc. of DBPL'05, 2005, pp. 169-183.
28. K. Vikram and M. Steiner, "Mashup component isolation via server-side analysis and instrumentation," in Proc. of W2SP'08, 2008.
29. D. Yu, A. Chander, N. Islam, and I. Serikov, "JavaScript instrumentation for browser security," in Proc. of POPL'07, 2007, pp. 237-249.