利用脚本封装抵御跨站脚本攻击

Mitigating cross-site script attacks on script encapsulation

跨站脚本攻击是一类脚本注入攻击,当发生这类攻击时,浏览器所运行的脚本被分作两类:来自应用程序模板的良性脚本和来自其他途径的可疑脚本.文章提出基于脚本封装的抵御跨站脚本攻击的方法ScriptE,该方法采用额外的HTML标签封装良性脚本,然后通过浏览器插件或网页自带的检测脚本,在客户端实现两类脚本的区分,进而抵御可能的跨站脚本攻击,实验验证了所设计的方法.

Cross-site script （XSS） attack is a kind of code injection attacks. When it occurs, the scripts running at client side can be classified into the benign ones, from application templates, and the suspicious ones, from others. This paper presents ScriptE, a method to mitigate XSS attacks based on script encapsulation. According to this method, the benign scripts will be encapsulated by an extra HTML tag at server side. By applying a designed browser add-on or embedding analyzing scripts in response pages, the suspicious scripts can be distinguished at client side and hence the XSS attack can be detected. We have conducted some experiments to validate our proposed ScriptE method.