Web-mail跨站漏洞检测技术研究  

Research on Web-mail Cross-site Scripting Vulnerability Detection Technology

作　　者：Pradeep 方勇[1] 

机构地区：[1]四川大学电子信息学院,四川成都610064

出　　处：《信息安全与通信保密》2012年第2期60-62,66,共4页Information Security and Communications Privacy

摘　　要：Web程序通常在页面中嵌入使用JavaScrip脚本来实现检测动态客户端行为。这些脚本在用户浏览器的上下文中被执行。为了防范恶意的JavaScript脚本,浏览器可以使用一套沙盒机制,使脚本只能访问到自己所在网站域的资源。如果用户被诱骗至一个中间的、受信任的网站,然后从该网站下载恶意脚本,那么此套安全机制就失效了。文章呈现了一套Web邮件跨站代码检测系统模型,该模型能满足高效率、优性能下的完整代码测试需求。根据设计需求,文章实现了Web邮件跨站脚本检测系统。最后,对系统的测试结果表明:系统具有一定的可行性与实用性。Web applications often use JavaScript code embedded into web pages to support dynamic client-side behavior. This Script code is executed in the context of the user＇s web browser. To protect the user＇s environment from malicious JavaSeript code, browsers use a sand-boxing mechanism, and this mechanism limits the script to accessing the resources associated only with its original sites. If the user is lured to download malicious JavaScript code from an intermediate, trusted site, then the malicious script would grant a full access to all resources that belong to the trusted side. Web-mail presented in this paper could meet the full test code requirements under high efficiency and good performance. In this article the design of cross- site scripting web-mail detection system is described. Finally, the test on this system indicates its feasibility and practicability.

关 键 词：Web—mail 跨站漏洞 Vector脚本 HTML 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]