Staged Information Flow for JavaScript
Ravi Chugh, Jeffrey A. Meister, Sorin Lerner, and Ranjit Jhala
PLDI 2009
[ paper
| slides
(video) ]
Modern websites are powered by JavaScript, a flexible dynamic
scripting language that executes in client browsers. A common
paradigm in such websites is to include third-party JavaScript code
in the form of libraries or advertisements. If this code were malicious,
it could read sensitive information from the page or write
to the location bar, thus redirecting the user to a malicious page,
from which the entire machine could be compromised.
We present
an information-flow based approach for inferring the effects that a
piece of JavaScript has on the website in order to ensure that key
security properties are not violated. To handle dynamically loaded
and generated JavaScript, we propose a framework for staging information
flow properties. Our framework propagates information
flow through the currently known code in order to compute a minimal
set of syntactic residual checks that are performed on the remaining
code when it is dynamically loaded.
We have implemented
a prototype framework for staging information flow. We describe
our techniques for handling some difficult features of JavaScript
and evaluate our system's performance on a variety of large real-world
websites. Our experiments show that static information flow
is feasible and efficient for JavaScript, and that our technique allows
the enforcement of information-flow policies with almost no
run-time overhead.