基于约束分析的跨站脚本防御方法研究  

Research on cross-site scripting protection with constraint analysis

作　　者：章明[1] 施勇[1] 薛质[1] 

机构地区：[1]上海交通大学信息安全工程学院,上海200240

出　　处：《计算机工程与设计》2013年第4期1192-1196,共5页Computer Engineering and Design

基　　金：国家自然科学基金项目(61171173)

摘　　要：跨站脚本是一种针对web客户端的脚本注入攻击技术,在对现有防御思想研究的基础上,提出了一种客户端的防御算法,通过在JavaScript抽象语法树的基础上实施静态约束分析,建立敏感数据的约束系统,从而能准确地对污点进行动态追踪,有效阻止恶意脚本的执行。该模型提升了浏览器安全性,使其能防御跨站脚本攻击,并且无需修改服务器端的程序代码,具有很强的实用性和扩展性。Cross-site scripting is to inject script content in the user＇s browser through several attacks. A novel client-side ap- proach is proposed to prevent XSS attacks at the basis of existing research. Through a static constraint analysis based on Java Script abstract syntax tree, a constraint system for sensitive information is constructed, which can be used to dynamic tracking tainted data and successfully stop the execution of malicious script. This technique has good flexibility and scalability in that it improves the security of web browser, meanwhile, doesn＇t need to modify the server-side codes.

关 键 词：跨站脚本 浏览器安全 约束分析 污点追踪 信息流分析 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]