Lightweight self-protecting JavaScript

Abstract

This paper introduces a method to control JavaScript execution. The aim is to prevent or modify inappropriate behaviour caused by e.g. malicious injected scripts or poorly designed third-party code. The approach is based on modifying the code so as to make it self-protecting: the protection mechanism (security policy) is embedded into the code itself and intercepts security relevant API calls. The challenges come from the nature of the JavaScript language: any variables in the scope of the program can be redefined, and code can be created and run on-the-fly. This creates potential problems, respectively, for tamper-proofing the protection mechanism, and for ensuring that no security relevant events bypass the protection. Unlike previous approaches to instrument and monitor JavaScript to enforce or adjust behaviour, the solution we propose is lightweight in that (i) it does not require a modified browser, and (ii) it does not require any run-time parsing and transformation of code (including dynamically generated code). As a result, the method has low run-time overhead compared to other methods satisfying (i), and the lack of need for browser modifications means that the policy can even be applied on the server to mitigate some effects of cross-site scripting bugs.

Safe Wrappers and Sane Policies for Self Protecting JavaScript

“…This is because JavaScript performs an implicit type conversion. This attack was already addressed in [25] where it is credited to Maffeis (see also [19]). It is also the basis of a recently described attack on ADsafe [18].…”

“…Within this area one can roughly divide the approaches into those which transform the whole program (thus requiring the program to be parsed) and those which perform wrapping without having to modify the code. Phung et al [25] refer to these styles as invasive vs lightweight, respectively. The former approach is taken by the BrowserShield tool [28] which performs a deep wrapping of code, requiring run-time parsing and transformation of the code.…”

“…The lightweight approach refers to techniques which do not require any aggressive code manipulation. There are many JavaScript programming libraries which provide this kind of functionality; the lightweight self-protecting JavaScript work of Phung et al [25] is the only one of these which is security specific. More details of this approach are given below.…”

“…In this paper we focus on problems and improvements in the self protecting JavaScript approach [25]. Here we outline the key ingredients of that approach.…”

Language-Based Isolation of Untrusted JavaScript

“…A short workshop paper [27] also gives an architecture for server-side code analysis and instrumentation, without exploring details or specific methods for constraining JavaScript. Additional related work on rewriting based methods for controlling the execution of JavaScript include [12]. Foundational studies of limited subsets of JavaScript and dynamic languages in general are reported in [2], [25], [28], [11], [21], [1], [26]; see [16].…”