Campus Event Calendar
Event Entry
New for: D1, D3, D4, D5
What and Who
JavaScript Isolation and Web Security
John C. Mitchell
Stanford University
SWS Colloquium
AG 1, AG 3, AG 4, AG 5, SWS, RG1, MMCI
MPI Audience
English
Note: We use this to send email in the morning.
Date, Time and Location
Monday, 4 May 2009
16:00
60 Minutes
E1 4
019
Saarbrücken
Abstract
Web sites that incorporate untrusted content may use browser-or
language-based methods to keep such content from maliciously altering
pages, stealing sensitive information, or causing other harm. We use
accepted methods from the study of programming languages to
investigate language-based methods for filtering and rewriting
JavaScript code, using Facebook's FBJS as a motivating example.
We explain the core problems by describing previously unknown
vulnerabilities and shortcomings, provide JavaScript code that
enforces provable isolation properties at run-time, and develop a
foundation for improved solutions based on an operational semantics of the full ECMA262 language. We also compare our results with the
techniques used in FBJS.
Joint work with Sergio Maffeis and Ankur Taly
language-based methods to keep such content from maliciously altering
pages, stealing sensitive information, or causing other harm. We use
accepted methods from the study of programming languages to
investigate language-based methods for filtering and rewriting
JavaScript code, using Facebook's FBJS as a motivating example.
We explain the core problems by describing previously unknown
vulnerabilities and shortcomings, provide JavaScript code that
enforces provable isolation properties at run-time, and develop a
foundation for improved solutions based on an operational semantics of the full ECMA262 language. We also compare our results with the
techniques used in FBJS.
Joint work with Sergio Maffeis and Ankur Taly
Contact
Michael Backes
--email hidden
passcode not visible
logged in users only
Tags, Category, Keywords and additional notes
JavaScript, Security, Web, Browser
Carina Schmitt, 05/11/2009 11:00
Carina Schmitt, 05/04/2009 10:47
Uwe Brahm, 05/04/2009 10:33 -- Created document.
Carina Schmitt, 05/04/2009 10:47
Uwe Brahm, 05/04/2009 10:33 -- Created document.