DMCA
Staged information flow for JavaScript (2009)
Cached
Download Links
| Venue: | In ACM SIGPLAN Conference on Programming Language Design and Implementation |
| Citations: | 104 - 5 self |
BibTeX
@INPROCEEDINGS{Chugh09stagedinformation,
author = {Ravi Chugh and Jeffrey A. Meister and Ranjit Jhala and Sorin Lerner},
title = {Staged information flow for JavaScript},
booktitle = {In ACM SIGPLAN Conference on Programming Language Design and Implementation},
year = {2009}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Modern websites are powered by JavaScript, a flexible dynamic scripting language that executes in client browsers. A common paradigm in such websites is to include third-party JavaScript code in the form of libraries or advertisements. If this code were malicious, it could read sensitive information from the page or write to the location bar, thus redirecting the user to a malicious page, from which the entire machine could be compromised. We present an information-flow based approach for inferring the effects that a piece of JavaScript has on the website in order to ensure that key security properties are not violated. To handle dynamically loaded and generated JavaScript, we propose a framework for staging information flow properties. Our framework propagates information flow through the currently known code in order to compute a minimal set of syntactic residual checks that are performed on the remaining code when it is dynamically loaded. We have implemented a prototype framework for staging information flow. We describe our techniques for handling some difficult features of JavaScript and evaluate our system’s performance on a variety of large realworld websites. Our experiments show that static information flow is feasible and efficient for JavaScript, and that our technique allows the enforcement of information-flow policies with almost no run-time overhead.
Keyphrases
information flow location bar information flow property large realworld website minimal set sensitive information prototype framework static information flow run-time overhead flexible dynamic scripting language modern website client browser syntactic residual check difficult feature system performance information-flow policy key security property entire machine third-party javascript code malicious page common paradigm
