Noncespaces: Using Randomization to Enforce Information Flow Tracking and Thwart Cross-Site Scripting Attacks
Cached
Download Links
| Citations: | 14 - 1 self |
BibTeX
@MISC{Gundy_noncespaces:using,
author = {Matthew Van Gundy and Hao Chen},
title = {Noncespaces: Using Randomization to Enforce Information Flow Tracking and Thwart Cross-Site Scripting Attacks},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Cross-site scripting (XSS) vulnerabilities are among the most common and serious web application vulnerabilities. Eliminating XSS is challenging because it is difficult for web applications to sanitize all user inputs appropriately. We present Noncespaces, a technique that enables web clients to distinguish between trusted and untrusted content to prevent exploitation of XSS vulnerabilities. Using Noncespaces, a web application randomizes the XML namespace prefixes of tags in each document before delivering it to the client. As long as the attacker is unable to predict the randomized prefixes, the client can distinguish between trusted content created by the web application and untrusted content provided by an attacker. To implement Noncespaces with minimal changes to web applications, we leverage a popular web application architecture to automatically apply Noncespaces to static content processed through a popular PHP template engine. We show that with simple policies Noncespaces thwarts popular XSS attack vectors. 1.
Keyphrases
enforce information flow tracking web application thwart cross-site scripting attack untrusted content xml namespace prefix static content x vulnerability web client present noncespaces serious web application vulnerability popular web application architecture popular php template engine randomized prefix minimal change cross-site scripting
