Paper Info
Title
JSFlow: tracking information flow in JavaScript and its APIs
Abstract
JavaScript drives the evolution of the web into a powerful application platform. Increasingly, web applications combine services from different providers. The script inclusion mechanism routinely turns barebone web pages into full-fledged services built up from third-party code. Such code provides a range of facilities from helper utilities (such as jQuery) to readily available services (such as Google Analytics and Tynt). Script inclusion poses a challenge of ensuring that the integrated third-party code respects security and privacy. This paper presents JSFlow, a security-enhanced JavaScript interpreter for fine-grained tracking of information flow. We show how to resolve practical challenges for enforcing information-flow policies for the full JavaScript language, as well as tracking information in the presence of libraries, as provided by browser APIs. The interpreter is itself written in JavaScript, which enables deployment as a browser extension. Our experiments with the extension provide in-depth understanding of information manipulation by third-party scripts such as Google Analytics. We find that different sites intended to provide similar services effectuate rather different security policies for the user's sensitive information: some ensure it does not leave the browser, others share it with the originating server, while yet others freely propagate it to third parties.
Year
DOI
Venue
2014
10.1145/2554850.2554909
SAC
Keywords
Field
DocType
dynamic analysis,information flow,information flow controls,interpreters,javascript
World Wide Web,Web page,Computer science,Unobtrusive JavaScript,Cross-site scripting,Web application,Analytics,Rich Internet application,Scripting language,JavaScript
Conference
Citations 
PageRank 
References 
68
1.48
29
Authors
4
Name
Order
Citations
PageRank
Daniel Hedin128511.91
Arnar Birgisson21617.30
Luciano Bello3993.26
Andrei Sabelfeld42692121.16