A measurement study of insecure javascript practices on the web

摘要: JavaScript is an interpreted programming language most often used for enhancing webpage interactivity and functionality. It has powerful capabilities to interact with documents browser windows, however, it also opened the door many browser-based security attacks. Insecure engineering practices of using may not directly lead breaches, but they can create new attack vectors greatly increase risks In this article, we present first measurement study on insecure Web. Our focus inclusion dynamic generation, examine their severity nature 6,805 unique websites. results reveal that are common at various websites: (1) least 66.4p measured websites manifest including files from external domains into top-level webpages; (2) over 44.4p use dangerous eval() function dynamically generate execute code (3) in document.write() method innerHTML property much more popular than relatively secure technique creating script elements via DOM methods. analysis indicates safe alternatives these exist cases ought be adopted by website developers administrators reducing potential risks.