Modular Monitor Extensions for Information Flow Security in JavaScript - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2015

Modular Monitor Extensions for Information Flow Security in JavaScript

Résumé

Client-side JavaScript programs often interact with the web page into which they are included, as well as with the browser itself, through APIs such as the DOM API, the XMLHttpRequest API, and the W3C Geolocation API. Precise reasoning about JavaScript security must therefore take API invocation into account. However, the continuous emergence of new APIs, and the het-erogeneity of their forms and features, renders API behavior a moving target that is particularly hard to capture. To tackle this problem, we propose a methodology for modularly extending sound JavaScript information flow monitors with a generic API. Hence, to verify whether an extended monitor complies with the proposed noninterference property requires only to prove that the API satisfies a predefined set of conditions. In order to illustrate the practicality of our methodology, we show how an information flow monitor-inlining compiler can take into account the invocation of arbitrary APIs, without changing the code or the proofs of the original compiler. We provide an implementation of such a compiler with an extension for handling a fragment of the DOM Core Level 1 API. Furthermore, our implementation supports the addition of monitor extensions for new APIs at runtime.
Fichier principal
Vignette du fichier
tgc-modular.pdf (612.77 Ko) Télécharger le fichier
Origine : Fichiers éditeurs autorisés sur une archive ouverte
Loading...

Dates et versions

hal-01247123 , version 1 (21-12-2015)

Licence

Copyright (Tous droits réservés)

Identifiants

  • HAL Id : hal-01247123 , version 1

Citer

José Fragoso Santos, Tamara Rezk, Ana Almeida Matos. Modular Monitor Extensions for Information Flow Security in JavaScript. Trustworthy Global Computing, 2015, Madrid, Spain. ⟨hal-01247123⟩
90 Consultations
130 Téléchargements

Partager

Gmail Facebook X LinkedIn More