CONSCRIPT: Specifying and enforcing fine-grained security policies for JavaScript in the browser

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2010, Pages 481-496

  Meyerovich, Leo A ^a   Livshits, Benjamin ^b  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b MICROSOFT RESEARCH   (United States)

Author keywords

Aspects; Browsers; JavaScript; Language security; Security policies; Web and client side programming

Indexed keywords

APPLICATION-SPECIFIC; FINE-GRAINED SECURITY POLICIES; GOOGLE MAPS; INTERNET EXPLORERS; JAVASCRIPT; JAVASCRIPT LANGUAGE; RUN-TIME ANALYSIS; RUNTIMES; SECURITY POLICY; TYPE SYSTEMS; WEB PAGE;

BENCHMARKING; HIGH LEVEL LANGUAGES; JAVA PROGRAMMING LANGUAGE; LINGUISTICS; RELIABILITY ANALYSIS; SECURITY SYSTEMS; SERVERS; WEBSITES;

WEB BROWSERS;

EID: 77955186827     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2010.36     Document Type: Conference Paper

References (44)

1. B. Chess, Y. T. O'Neil, and J. West, "JavaScript hijacking," www.fortifysoftware.com/servlet/downloads/public/ JavaScript-Hijacking.pdf, Mar. 2007.
2. H. Kikuchi, D. Yu, A. Chander, H. Inamura, and I. Serikov, "JavaScript instrumentation in practice," in Proceedings of the Asian Symposium on Programming Languages and Systems, 2008.
3. P. H. Phung, D. Sands, and A. Chudnov, "Lightweight selfprotecting JavaScript," in Proceedings of the International Symposium on Information, Computer, and Communications Security, 2009.
4. T. Jim, N. Swamy, and M. Hicks, "Defeating script injection attacks with browser-enforced embedded policies," in Proceedings of the International Conference on World Wide Web, 2007.
5. J. Howell, C. Jackson, H. J. Wang, and X. Fan, "MashupOS: Operating system abstractions for client mashups," in Proceedings of the Workshop on Hot Topics in Operating Systems, May 2007.
6. U. Erlingsson, B. Livshits, and Y. Xie, "End-to-end Web application security," in Proceedings of the Workshop on Hot Topics in Operating Systems, May 2007.
7. M. S. Miller, M. Samuel, B. Laurie, I. Awad, and M. Stay, "Caja - safe active content in sanitized JavaScript," October 2007, http://google-caja.googlecode.com/files/caja-spec2007-10-11.pdf.
8. S. Isaacs and D. Manolescu, "Web Sandbox - Microsoft Live Labs," http://websandbox.livelabs.com/, 2009.
9. C. Reis, J. Dunagan, H. Wang, O. Dubrovsky, and S. Esmeir, "BrowserShield: Vulnerability-driven filtering of dynamic HTML," in Proceedings of the Operating System Design and Implementation, 2006.
10. T. Elrad, R. E. Filman, and A. Bader, "Aspect-oriented programming: Introduction," Communications of the ACM, vol. 44, no. 10, 2001.
11. S. Guarnieri and B. Livshits, "Gatekeeper: Mostly static enforcement of security and reliability policies for JavaScript code," in Proceedings of the Usenix Security Symposium, Aug. 2009.
12. R. Chugh, J. A. Meister, R. Jhala, and S. Lerner, "Staged information flow for JavaScript," in Proceedings of the Conference on Programming Language Design and Implementation, 2009.
13. Mozilla Foundation, "Using JavaScript code modules," Sep. 2009.
14. D. Crockford, "ADSafe," adsafe.org.
15. G. Kiczales, E. Hilsdale, J. Hugunin, M. Kersten, J. Palm, and W. G. Griswold, "An overview of AspectJ," in Proceedings of the European Conference on Object-Oriented Programming, 2001.
16. ECMA International, "ECMA-262: ECMAScript language specification, version 3.1," Sep. 2009.
17. A. C. Myers, "JFlow: practical mostly-static information flow control," in Proceedings of the Symposium on Principles of Programming Languages, 1999.
18. D. Greenfleldboyce and J. S. Foster, "Type qualifier inference for Java," SIGPLAN Notices, vol. 42, no. 10, 2007.
19. B. Livshits and L. A. Meyerovich, "ConScript: Specifying and enforcing fine-grained security policies for JavaScript in the browser," Microsoft Research, Tech. Rep. MSR-TR-2009158, Nov. 2009.
20. A. Guha, S. Krishnamurthi, and T. Jim, "Using static analysis for AJAX intrusion detection," in Proceedings of the International Conference on World Wide Web, 2009.
21. A. Barth, C. Jackson, and J. C. Mitchell, "Securing frame communication in browsers," in Proceedings of the Conference on Security Symposium, 2008.
22. C. Yue and H. Wang, "Characterizing insecure JavaScript practices on the Web," in Proceedings of the International Conference on World Wide Web, 2009.
23. "Google Web Toolkit," http://code.google.com/webtoolkit.
24. Microsoft Corporation, "Microsoft Live Labs Volta," http:// labs.live.com/volta/, 2007.
25. N. Kothari, "Script;," http://projects.nikhilk.net/ScriptSharp/ , 2008.
26. A. Kennedy, "Securing the .NET programming model," Theoretical Computer Science, vol. 364, no. 3, 2006.
27. C. Warrender, S. Forrest, and B. Pearlmutter, "Detecting intrusions using system calls: Alternative data models," in Proceedings of the IEEE Symposium on Security and Privacy, vol. 0, 1999.
28. E. Eskin, S. J. Stolfo, and W. Lee, "Modeling system calls for intrusion detection with dynamic window sizes," DARPA Information Survivability Conference and Exposition,, vol. 1, 2001.
29. "The JS.Yamanner worm," http://www.f-secure.com/v-descs/ yamanner-a.shtml, 2006.
30. L. A. Meyerovich, A. P. Felt, and M. S. Miller, "Object views: Fine-grained sharing in browsers," in Proceedings of the International Conference on World Wide Web, April 2010.
31. C. G. Jones, R. Liu, L. Meyerovich, K. Asanovic, and R. Bodk, "Parallelizing the web browser," in Proceedings of the Workshop on Hot Topics in Parallelism, March 2009.
32. E. Lawrence, "Fiddler: Web debugging proxy," http://www. flddlertool.com/flddler/, 2007.
33. E. Kiciman and B. Livshits, "AjaxScope: a platform for remotely monitoring the client-side behavior of Web 2.0 applications," in Proceedings of ACM Symposium on Operating Systems Principles, Oct. 2007.
34. B. Livshits and E. Kiciman, "Doloto: Code splitting for network-bound Web 2.0 applications," in Proceedings of the International Symposium on the Foundations of Software Engineering, Sep. 2008.
35. F. Pottier and S. Conchon, "Information flow inference for free," SIGPLAN Notices, vol. 35, no. 9, 2000.
36. Facebook, "FBJS - Facebook Developer Wiki," July 2007, http://wiki.developers.facebook.com/index.php/FBJS.
37. M. Finifter, J. Weinberger, and A. Barth, "Preventing capability leaks in secure Javascript subsets," in Proceedings of the Network and Distributed System Security Symposium, 2010.
38. A. G. Guha, J. Matthews, R. B. Findler, and S. Krishnamurthi, "Relationally-parametric polymorphic contracts," in Proceedings of the Symposium on Dynamic Languages, 2007.
39. M. S. Miller, "Robust composition: Towards a unified approach to access control and concurrency control," Ph.D. dissertation, Johns Hopkins University, Baltimore, Maryland, USA, May 2006.
40. R. Porotnikov, "AOP fun with JavaScript," July 2001, http://www.jroller.com/deep/date/20030701.
41. H. Washizaki, A. Kubo, T. Mizumachi, K. Eguchi, Y Fukazawa, N. Yoshioka, H. Kanuka, T. Kodaka, N. Sugimoto, Y Nagai, and R. Yamamoto, "AOJS: Aspect-oriented JavaScript programming framework for Web development," in Proceedings of the Workshop on Aspects, Components, and Patterns for Infrastructure Software, 2009.
42. D. S. Dantas and D. Walker, "Harmless advice," in Proceedings of the Symposium on Principles of Programming Languages, 2006.
43. D. Evans and A. Twyman, "Flexible policy-directed code safety," in Proceedings of the IEEE Symposium on Security and Privacy, 1999.
44. Úlfar Erlingsson and R B. Schneider, "Sasi enforcement of security policies: a retrospective," in Proceedings of the Workshop on New Security Paradigms. New York, NY, USA: ACM, 2000.