Authors:
Yi Wang
1
;
Tao Guo
2
;
Zhiwei Shi
2
and
Zhoujun Li
1
Affiliations:
1
Beihang University, China
;
2
China Information Technology Security Evaluation Center, China
Keyword(s):
Mashup, Html5, Sandbox, Web Workers, Web Application.
Related
Ontology
Subjects/Areas/Topics:
Access Control
;
Data Engineering
;
Databases and Data Security
;
Information and Systems Security
;
Internet Technology
;
Web Information Systems and Technologies
;
Web Programming
;
Web Security and Privacy
Abstract:
A growing trend of nowadays web sites is to combine active content (applications) from untrusted sources, as in so-called mashups, in order to provide more functionality and expressiveness. Due to the potential risk of leaking sensitive information to these third-party sources, it is urgent to provide a secure “sandbox” for playing the untrusted content and allow developers to apply flexible security policy at the same time. In this paper, we propose and implement a new safe framework to prevent untrusted applications from interfering with each other based on HTML5 technology. By creating a separated fake DOM environment in the background, developers can load untrusted content into the “sandbox” and apply their custom security policy in real window or server side when receiving script generated messages from it. The advantage is that it is very flexible as the security policy is also written in JavaScript and requires minimum learning efforts for web developers. The drawback is that
it is based on element “web workers” and method “postMessage” introduced in HTML5 and can’t be run in older browsers without these supports.
(More)