Security of web mashups: A survey

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 7127 LNCS, Issue , 2012, Pages 223-238

  De Ryck, Philippe ^a   Decat, Maarten ^a   Desmet, Lieven ^a   Piessens, Frank ^a   Joosen, Wouter ^a  

^a UNIVERSITY OF LEUVEN   (Belgium)

Author keywords

[No Author keywords available]

Indexed keywords

ACADEMIC RESEARCH; BEHAVIOR CONTROL; DIFFERENT ORIGINS; HIGH POTENTIAL; MASHUPS; NEW SERVICES; WEB APPLICATION DEVELOPMENT;

BEHAVIORAL RESEARCH; COMMUNICATION; SECURITY OF DATA; SEPARATION;

INFORMATION TECHNOLOGY;

EID: 84861642854     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-27937-9_16     Document Type: Conference Paper

References (35)

1. Adobe Systems Inc. Cross-domain policy file specification (January 2010), http://www.adobe.com/devnet/articles/crossdomain-policy-file-spec.html
2. Barth, A., Jackson, C., Hickson, I.: The web origin concept (June 2010), http://tools.ietf.org/html/draft-abarth-origin-07
3. Barth, A., Jackson, C., Mitchell, J.C.: Securing frame communication in browsers. In: In Proceedings of the 17th USENIX Security Symposium (USENIX Security 2008) (2008)
4. Crites, S., Hsu, F., Chen, H.: Omash: Enabling secure web mashups via object abstractions. In: Proceedings of the 15th ACM Conference on Computer and Communications Security, pp. 99-108. ACM (2008)
5. Crockford, D.: The module tag (October 2006), http://www.json.org/module. html
6. Crockford, D.: Adsafe (December 2009), http://www.adsafe.org/
7. De Keukelaere, F., Bhola, S., Steiner, M., Chari, S., Yoshihama, S.: Smash: Secure component model for cross-domain mashups on unmodified browsers. In: Proceedings of the 17th International Conference on WorldWide Web, pp. 535-544. ACM (2008)
8. Devriese, D., Piessens, F.: Non-interference through secure multi-execution. In: 2010 IEEE Symposium on Security and Privacy Proceedings, pp. 109-124 (2010)
9. Dutta, S.: Client-side cross-domain security (June 2008), http://msdn.microsoft.com/library/cc709423.aspx
10. Facebook Developer Wiki. Cross domain communication (January 2009), http://wiki.developers.facebook.com/index.php/Cross Domain Communication
11. Facebook Developer Wiki. FBJS (August 2010), http://wiki.developers. facebook.com/index.php/FBJS
12. Harmonia, Inc. Liquidapps (2010), http://www.liquidappsworld.com/
13. Hickson, I., Hyatt, D.: Html 5 working draft (June 2010), http://www.w3.org/TR/html5/
14. Hickson, I., Hyatt, D.: Html 5 working draft - cross-document messaging (June 2010), http://www.w3.org/TR/html5/comms.html#crossDocumentMessages
15. Hickson, I., Hyatt, D.: Html 5 working draft - the sandbox attribute (June 2010), http://www.w3.org/TR/html5/the-iframe-element.html#attr-iframe- sandbox
16. IBM. IBM Mashup Center (2010), http://www-01.ibm.com/software/info/ mashup-center/
17. Intel Corporation. Mash Maker (2010), http://mashmaker.intel.com/web/
18. JackBe Corporation. Presto: Powering the enterprise app store (2010), http://www.jackbe.com/products/
19. Jackson, C., Wang, H.J.: Subspace: secure cross-domain communication for web mashups. In: Proceedings of the 16th International Conference on World Wide Web, p. 620 (2007)
20. Li, Z., Zhang, K., Wang, X.F.: Mash-if: Practical information-flow control within client-side mashups. In: 2010 IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 251-260 (2010)
21. Livshits, B., Meyerovich, L.: Conscript: Specifying and enforcing fine-grained security policies for javascript in the browser. Technical report, Microsoft Research (2009)
22. Maffeis, S., Mitchell, J.C., Taly, A.: Object capabilities and isolation of untrusted web applications. In: Proceedings of IEEE Security and Privacy 2010. IEEE (2010)
23. Maffeis, S., Taly, A.: Language-based isolation of untrusted javascript. In: 22nd IEEE Computer Security Foundations Symposium, pp. 77-91 (2009)
24. Magazinius, J., Askarov, A., Sabelfeld, A.: A lattice-based approach to mashup security. In: Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, pp. 15-23 (2010)
25. Magazinius, J., Phung, P., Sands, D.: Safe wrappers and sane policies for self protecting javascript. In: 15th Nordic Conference on Secure IT Systems (2010)
26. Meyerovich, L.A., Felt, A.P., Miller, M.S.: Object views: Fine-grained sharing in browsers. In: Proceedings of the 19th International Conference on World Wide Web, pp. 721-730 (2010)
27. Miller, M.S., Samuel, M., Laurie, B., Awad, I., Stay, M.: Caja: Safe active content in sanitized javascript (January 2008), http://google-caja. googlecode.com/files/caja-spec-2008-01-15.pdf
28. OpenAjax Alliance. Openajax hub 2.0 specification (July 2009), http://www.openajax.org/member/wiki/index.php?title=OpenAjax Hub 2.0 Specification&oldid=12174
29. Phung, P.H., Sands, D., Chudnov, A.: Lightweight self-protecting javascript. In: Proceedings of the 4th International Symposium on Information, Computer, and Communications Security, pp. 47-60 (2009)
30. Ter Louw, M., Ganesh, K.T., Venkatakrishnan, V.N.: Adjail: Practical enforcement of confidentiality and integrity policies on web advertisements. In: 19th USENIX Security Symposium (2010)
31. Thorpe, D.: Secure cross-domain communication in the browser (July 2007), http://msdn.microsoft.com/en-us/library/bb735305.aspx
32. van Kesteren, A.: Cross-origin resource sharing (2009)
33. Wang, H.J., Fan, X., Howell, J., Jackson, C.: Protection and communication abstractions for web browsers in mashupos. ACM SIGOPS Operating Systems Review 41(6), 16 (2007)
34. Zalewski, M.: Browser security handbook (2010), http://code.google.com/p/ browsersec/wiki/Main
35. Zarandioon, S., Yao, D.D., Ganapathy, V.: Omos: A framework for secure communication in mashup applications. In: Annual Computer Security Applications Conference, ACSAC 2008, pp. 355-364 (2008)