Blueprint: Robust Prevention of Cross-site Scripting Attacks for Existing Browsers

Abstract

As social networking sites proliferate across the World Wide Web, complex user-created HTML content is rapidly becoming the norm rather than the exception. User-created web content is a notorious vector for cross-site scripting (XSS) attacks that target websites and confidential user data. In this threat climate, mechanisms that render web applications immune to XSS attacks have been of recent research interest.A challenge for these security mechanisms is enabling web applications to accept complex HTML input from users, while disallowing malicious script content. This challenge is made difficult by anomalous web browser behaviors, which are often used as vectors for successful XSS attacks.Motivated by this problem, we present a new XSS defense strategy designed to be effective in widely deployed existing web browsers, despite anomalous browser behavior. Our approach seeks to minimize trust placed on browsers for interpreting untrusted content. We implemented this approach in a tool called BLUEPRINT that was integrated with several popular web applications. We evaluated BLUEPRINT against a barrage of stress tests that demonstrate strong resistance to attacks, excellent compatibility with web browsers and reasonable performance overheads.

Tracking the Trackers: Fast and Scalable Dynamic Analysis of Web Content for Privacy Violations

“…BrowserShield [25], for instance, rewrites dynamic scripts into safe equivalents before sending them to the clients. BLUEPRINT [26], on the other hand, integrates with web applications to encode user-generated HTML content into a syntactically inert format and decodes it at the client. This allows them to bypass the anomalous parsing behaviors from client web browsers.…”

Cloud Computing Security Aspects, Vulnerabilities and Countermeasures

“…A blueprint based methodology that minimizes the reliance on web browsers towards recognizing untrusted content over the internet has been proposed in [26].…”

Protection, usability and improvements in reflected XSS filters

“…Blueprint [13] is a server side defense which converts the untrusted HTML embedded in a page into JavaScript code. The purpose of this transformation is to fix the browser's interpretation of the page at the server-side, adding JavaScript code to reliably reconstruct the parse tree once the page is rendered by the browser.…”

“…Many of these efforts [12,13,15,27,11,28,3,23] have focused on the server-side, and attempt to detect (or prevent) unauthorized scripts from being included in the server output. Modern web-browsers incorporate very complex logic to "fix" HTML syntax errors and hence provide an acceptable rendering of syntactically incorrect pages.…”

“…Modern web-browsers incorporate very complex logic to "fix" HTML syntax errors and hence provide an acceptable rendering of syntactically incorrect pages. Several researchers [11,15,27,13] have eloquently argued that no server-side logic can accurately account for all such "browser quirks." As a result, hybrid approaches that combine client-side support with a primarily server-side XSS defense have been developed [27,15,23].…”