NDLI: Using web application construction frameworks to protect against code injection attacks

Please wait, while we are loading the content...

Jifclipse: development tools for security-typed languages

Quantitative analysis of leakage for multi-threaded programs

Cautious virus detection in the extreme

Large-scale analysis of format string vulnerabilities in Debian Linux

Improving usability of information flow security in java

A simulation-based proof technique for dynamic information flow

Localized delimited release: combining the what and where dimensions of information release

Guarded models for intrusion detection

A domain-specific programming language for secure multiparty computation

Towards a logical account of declassification

Using web application construction frameworks to protect against code injection attacks

Fast probabilistic simulation, nontermination, and secure information flow

ABASH: finding bugs in bash scripts

Informal presentation: a trust management perspective on managing policy updates in security-typed languages

Using web application construction frameworks to protect against code injection attacks

Content Provider	ACM Digital Library
Author	Livshits, Benjamin Erlingsson, Úlfar
Abstract	In recent years, the security landscape has changed, with Web applications vulnerabilities becoming more prominent that vulnerabilities stemming from the lack of type safety, such as buffer overruns. Many reports point to code injection attacks such as cross-site scripting and RSS injection as being the most common attacks against Web applications to date. With Web 2.0 existing security problems are further exacerbated by the advent of Ajax technology that allows one to create and compose HTML content from different sources within the browser at runtime, as exemplified by customizable mashup pages like My Yahoo! or Live.com This paper proposes a simple to support, yet a powerful scheme for eliminating a wide range of script injection vulnerabilities in applications built on top of popular Ajax development frameworks such as the Dojo Toolkit, prototype.js, and AJAX.NET. Unlike other client-side runtime enforcement proposals, the approach we are advocating requires only minor browser modifications. This is because our proposal can be viewed as a natural finer-grained extension of the same-origin policy for JavaScript already supported by the majority of mainstream browsers, in which we treat individual user interface widgets as belonging to separate domains Fortunately, in many cases no changes to the development process need to take place: for applications that are built on top of frameworks described above, a slight framework modification will result in appropriate changes in the generated HTML, completely obviating the need for manual code annotation. In this paper we demonstrate how these changes can prevent cross-site scripting and RSS injection attacks using the Dojo Toolkit, a popular Ajax library, as an example.
Starting Page	95
Ending Page	104
Page Count	10
File Format	PDF
ISBN	9781595937117
DOI	10.1145/1255329.1255346
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2007-06-14
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Code injection attacks Software construction frameworks Same-origin policy Software security
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in