Staged information flow for javascript

摘要: Modern websites are powered by JavaScript, a flexible dynamic scripting language that executes in client browsers. A common paradigm such is to include third-party JavaScript code the form of libraries or advertisements. If this were malicious, it could read sensitive information from page write location bar, thus redirecting user malicious page, which entire machine be compromised. We present an information-flow based approach for inferring effects piece has on website order ensure key security properties not violated. To handle dynamically loaded and generated we propose framework staging flow properties. Our propagates through currently known compute minimal set syntactic residual checks performed remaining when loaded. have implemented prototype flow. describe our techniques handling some difficult features evaluate system's performance variety large real-world websites. experiments show static feasible efficient technique allows enforcement policies with almost no run-time overhead.