Preventing Client Side XSS with Rewrite Based Dynamic Information Flow

Abstract

This paper presents the design and implementation of an information flow tracking framework based on code rewrite to prevent sensitive information leaks in browsers, combining the ideas of taint and information flow analysis. Our system has two main processes. First, it abstracts the semantic of JavaScript code and converts it to a general form of intermediate representation on the basis of JavaScript abstract syntax tree. Second, the abstract intermediate representation is implemented as a special taint engine to analyze tainted information flow. Our approach can ensure fine-grained isolation for both confidentiality and integrity of information. We have implemented a proof-of-concept prototype, named JSTFlow, and have deployed it as a browser proxy to rewrite web applications at runtime. The experiment results show that JSTFlow can guarantee the security of sensitive data and detect XSS attacks with about 3x performance overhead. Because it does not involve any modifications to the target system, our system is readily deployable in practice.

An Analysis of the Prevention and Detection of Cross Site Scripting Attack

“…To prevent illegal input on the server-side output of the script's content, wish to identify any harmful may be recognised by any input filtering system, and XSS-GUARD uses research on dynamic web applications to ask for any HTML in order to build the script set that will run. J.Sun [17] stops the browser from leaking information by using the stain model and information flow analysis, by rewriting code track framework. For this firstly we have to abstract the semantic of JavaScript and convert the code into Syntax tree for intermediate representation of JavaScript.…”

Cross-Site Scripting Attacks and Defensive Techniques: A Comprehensive Survey

“…Essentially, the researchers [50] proposed that the objective of this approach is to detect any questionable JavaScript code. Tainted-browsing technology is used.…”

Important factors to remember when constructing a cross-site scripting prevention mechanism

“…To safeguard the web application from XSS attacks, an execution flow analyzer has been built that can emulate client program behavior [29]. A browser proxy has been designed to secure the security of sensitive data using an information flow approach [30]. A server-side approach has been implemented in some research that limits user input from untrusted sites, removes the nooutput script, and readily accommodates complicated attacks [31]- [35].…”

“…Several researchers have produced some technologies that can reduce XSS attacks from online applications by taking into account design, coding, testing, and incorporating validation [26], [27], [36]- [38]. Need to modify the web source code Xiao et al [30] information flow The security of sensitive data is ensured by using JSTFlow as a browser proxy…”