25 September 2009

Sergio Maffeis talks about Isolating JavaScript with Filters, Rewriting, and Wrappers

Orsay, Bat I, 1st floor,
MSR-INRIA Joint Centre

Isolating JavaScript with Filters, Rewriting, and Wrappers
Sergio Maffeis
Imperial College, London

We study methods that allow web sites to safely combine JavaSCript from untrusted sources. If implemented properly, filters can prevent dangerous code from loading into the execution environment, while rewriting allows greater expressiveness by inserting run-time checks. Wrapping properties of the execution environment can prevent misuse without requiring changes to imported JavaSCript. Using a formal semantics for the ECMA 262-3 standard language, we prove security properties of a subset of JavaScript, comparable in expressiveness to Facebook FBJS, obtained by combining three isolation mechanisms. The isolation guarantees of the three mechanisms are interdependent, with rewriting and wrapper functions relying on the absence of JavaScript constructs eliminated by language filters