摘要
跨站脚本是一种针对web客户端的脚本注入攻击技术,在对现有防御思想研究的基础上,提出了一种客户端的防御算法,通过在JavaScript抽象语法树的基础上实施静态约束分析,建立敏感数据的约束系统,从而能准确地对污点进行动态追踪,有效阻止恶意脚本的执行。该模型提升了浏览器安全性,使其能防御跨站脚本攻击,并且无需修改服务器端的程序代码,具有很强的实用性和扩展性。
Cross-site scripting is to inject script content in the user＇s browser through several attacks. A novel client-side ap- proach is proposed to prevent XSS attacks at the basis of existing research. Through a static constraint analysis based on Java Script abstract syntax tree, a constraint system for sensitive information is constructed, which can be used to dynamic tracking tainted data and successfully stop the execution of malicious script. This technique has good flexibility and scalability in that it improves the security of web browser, meanwhile, doesn＇t need to modify the server-side codes.
出处
《计算机工程与设计》
CSCD
北大核心
2013年第4期1192-1196,共5页
Computer Engineering and Design
基金
国家自然科学基金项目(61171173)
关键词
跨站脚本
浏览器安全
约束分析
污点追踪
信息流分析
cross-site scripting
browser security
constraint analysis
taint tracking
flow analysis
