基于行为的Web邮箱系统XSS防范  

XSS prevention for Web email system based on behavior

作　　者：徐中原[1] 蒋华[1] 王鑫[1] 

机构地区：[1]桂林电子科技大学计算机科学与工程学院,广西桂林541004

出　　处：《计算机工程与设计》2014年第12期4136-4139,共4页Computer Engineering and Design

基　　金：国家自然科学基金重点项目(61262074)

摘　　要：当前XSS攻击是对Web邮箱系统的最大威胁之一,为更好保证邮箱系统的安全性,提出一种基于改进的污点分析算法的监测方法。对Web邮箱系统应用程序中的敏感数据进行标记,并对标记数据进行跟踪分析,防止敏感数据被发送到第三方URL的同时,防止将敏感数据在用户不知情的情况下发给同站点的其他用户。实验分析结果表明,该方法可以有效防止敏感数据被窃取,达到成功防御XSS攻击的目的。At present,the XSS attack is one of the biggest threats to the Web mail system.To better guarantee the security of E-mail system,a monitoring method based on the improved taint analysis algorithm was put forward.Sensitive data of Web E-mail system application were tagged,and the tag data points were tracked.The algorithm can prevent sensitive data from sending to the third party URL and other users in the site while the user is unwitting.Experimental analysis shows that the method can effectively prevent sensitive data from being stolen,so as to achieve the purpose of successfully defending XSS attacks.

关 键 词：污点分析 跨站脚本攻击 参数匹配 控制依赖 敏感信息 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]