对多种Web语言嵌套的跨站过滤分析  

Analysis on XSS Nested in a Variety of Web Language

作　　者：李鑫[1] 周安民[1] 周妍 蒲伟 

机构地区：[1]四川大学电子信息学院信息安全研究所,四川成都610065 [2]四川信息安全测评中心,四川成都610065

出　　处：《信息安全与通信保密》2012年第8期103-105,共3页Information Security and Communications Privacy

摘　　要：由于网站服务的应用广泛性,跨站攻击已经上升为互联网中数量最多的攻击手段,对跨站代码的过滤已经成为各个网站的重中之重。网站要对跨站进行过滤就要充分了解跨站产生的机理,并且要理解数据代码在Web应用程序中的解析过程。这两点只是基本的要素,要想尽可能完全地过滤跨站代码,就要进一步针对各种语言解析模块之间的关系,研究和分析在各种模块互相嵌套下跨站的复杂性才行,这样根据各种情况才能得到降低跨站威胁的有效措施。For the wide application of Web services, XSS attack rises to the largest number of Internet attack, and the filtering of cross-site code has becomes the most priority for each Website. To implement cross-site filtering, it is necessary for Website to fully understand the mechanism of cross-site and the parsing process of data code in the Web application, and these two are just basic elements. For the as-possible-as completion of cross-site code filtering, it is necessary to further study and analyze the relationship between parsing modules of various languages, including the complexity of XSS nested in a variety of modules, So an effective measure could be achieved and the threat of cross- site under various circumstances be reduced.

关 键 词：跨站 代码解析过程 Web语言互相嵌套 

分 类 号：TP393.09[自动化与计算机技术—计算机应用技术]