You are what you include

摘要: JavaScript is used by web developers to enhance the interactivity of their sites, offload work users' browsers and improve sites' responsiveness user-friendliness, making pages feel behave like traditional desktop applications. An important feature JavaScript, ability combine multiple libraries from local remote sources into same page, under namespace. While this enables creation more advanced applications, it also allows for a malicious provider steal data other scripts page itself. Today, when include libraries, they trust that providers will not abuse power bestowed upon them.In paper, we report on large-scale crawl than three million top 10,000 Alexa identify relationships these sites with library providers. We show evolution inclusions over time develop set metrics in order assess maintenance-quality each provider, showing some cases, Internet could be successfully compromised determined attackers subsequently serve JavaScript. In process, four, previously unknown, types vulnerabilities use attack popular sites. Lastly, review proposed ways protecting application them may as effective thought.