deDacota: toward preventing server-side XSS via automatic code and data separation

摘要: Web applications are constantly under attack. They popular, typically accessible from anywhere on the Internet, and they can be abused as malware delivery systems.Cross-site scripting flaws one of most common types vulnerabilities that leveraged to compromise a web application its users. A large set cross-site originates browser's confusion between data code. That is, untrusted input is sent clients' browser, where it then interpreted code executed. While new designed with separated start, legacy do not have luxury.This paper presents novel approach securing by automatically statically rewriting an so clearly in pages. This transformation protects users range server-side attacks. Moreover, separation efficiently enforced at run time via Content Security Policy enforcement mechanism available modern browsers.We implemented our tool, called deDacota, operates binary ASP.NET applications. We demonstrate six real-world tool able separate data, while keeping application's semantics unchanged.