A Systematic Analysis of XSS Sanitization in Web Application Frameworks

Abstract

Abstract. While most research on XSS defense has focused on techniques for securing existing applications and re-architecting browser mechanisms, sanitization remains the industry-standard defense mechanism. By streamlining and automating XSS sanitization, web application frameworks stand in a good position to stop XSS but have received little research attention. In order to drive research on web frameworks, we systematically study the security of the XSS sanitization abstractions frameworks provide. We develop a novel model of the web browser and characterize the challenges of XSS sanitization. Based on the model, we systematically evaluate the XSS abstractions in 14 major commercially-used web frameworks. We find that frameworks often do not address critical parts of the XSS conundrum. We perform an empirical analysis of 8 large web applications to extract the requirements of sanitization primitives from the perspective of realworld applications. Our study shows that there is a wide gap between the abstractions provided by frameworks and the requirements of applications.

Security Testing and Assessment of Vulnerability Scanners in Quest of Current Information Security Landscape

“…Thus, the XSS flaw is as a result of not validated or sanitized input parameters. There are three types of XSS: Non-Persistent, called Reflected XSS; Persistent or Stored XSS; and Document Object Model (DOM)-based [16].…”

“…XSS attacks are usually divided into three categories: NonPersistent or Reflected XSS Attack; Persistent or Stored XSS Attack; and DOM-Based XSS Attack [16].…”

Web Application Vulnerabilities: A Survey

“…In [22] author proposed the initial explanation of command injection attacks in the perception of web applications, and dispenses absolute algorithm for preventing them founded on context-free grammars and compiler parsing techniques. Author"s assessment is that, for an attack to be successful, the input that gets circulated into the database query or the output document must modify the intended syntactic organization of the query or document.…”

“…Web application development usually give auto sanitization options a recent study [22] shows, they still cannot meet the entire necessities exhibit by trendy internet applications. Designing and reasoning context-sensitive sanitization routines still need substantial work.…”

Mining Cross Site Scripting Vulnerabilities Based on HTML5 in Email Systems

“…Due to the great destructiveness of XSS, many security researchers began to study various prevention methods [9][10][11]. As in 2010, Bateset al proposed a new filtering technology.…”