Defeating script injection attacks with browser-enforced embedded policies

TitleDefeating script injection attacks with browser-enforced embedded policies
Publication TypeConference Papers
Year of Publication2007
AuthorsJim T, Swamy N, Hicks MW
Conference NameProceedings of the 16th international conference on World Wide Web
Date Published2007///
Conference LocationNew York, NY, USA
ISBN Number978-1-59593-654-7
Keywordscross-site scripting, script injection, web application security

Web sites that accept and display content such as wiki articles or comments typically filter the content to prevent injected script code from running in browsers that view the site. The diversity of browser rendering algorithms and the desire to allow rich content make filtering quite difficult, however, and attacks such as the Samy and Yamanner worms have exploited filtering weaknesses. This paper proposes a simple alternative mechanism for preventing script injection called Browser-Enforced Embedded Policies (BEEP). The idea is that a web site can embed a policy in its pages that specifies which scripts are allowed to run. The browser, which knows exactly when it will run a script, can enforce this policy perfectly. We have added BEEP support to several browsers, and built tools to simplify adding policies to web applications. We found that supporting BEEP in browsers requires only small and localized modifications, modifying web applications requires minimal effort, and enforcing policies is generally lightweight.