Annual Computer Security Applications Conference (ACSAC 2012), Date: 2012/12/03 - 2012/12/07, Location: Orlando, Florida, USA
Proceedings of the 28th Annual Computer Security Applications Conference (ACSAC 2012)
Author:
Keywords:
Web application security, Web mashups, Script inclusion, Sandbox, Security architecture, Science & Technology, Technology, Computer Science, Theory & Methods, Engineering, Electrical & Electronic, Computer Science, Engineering, Web Application Security, Web Mashups, Script Inclusion, Security Architecture
Abstract:
The inclusion of third-party scripts in web pages is a common practice. A recent study has shown that more than half of the Alexa top 10 000 sites include scripts from more than 5 different origins. However, such script inclusions carry risks, as the included scripts operate with the privileges of the including website. We propose JSand, a server-driven but client-side JavaScript sandboxing framework. JSand requires no browser modifications: the sandboxing framework is implemented in JavaScript and is delivered to the browser by the websites that use it. Enforcement is done entirely at the client side: JSand enforces a server-specified policy on included scripts without requiring server-side filtering or rewriting of scripts. Most importantly, JSand is complete: access to all resources is mediated by the sandbox. We describe the design and implementation of JSand, and we show that it is secure, backwards compatible, and that it performs sufficiently well.