Context-sensitive cross-site scripting prevention through input-encoded HTML parsing - Miranda, Carlos Miguel A. (College of Engineering, University of the Philippines Diliman, 2015)
Recent years have seen a widespread move towards rich web applications. Increasingly ubiquitous and cheap Internet access and the explosion of a variety of Internet-enabled devices made the Web browser a preferred platform for application development. One negative side effect of this trend is that security exploits in Web applications have also increased. A common vulnerability is the cross-site scripting (XSS) attack, an exploit which is enabled by a browser misinterpreting malicious input data as valid code. XSS attacks have proven particularly difficult to defend from, as there are a number of contexts within HTML documents where different sanitization schemes must be applied. This research explores a server-side, context-sensitive XSS sanitization scheme using a HTML document parser. Unsafe inputs encoded into a safe plain-text format and added into an intermediate HTML-compliant document. This document is then run through the parser, which automatically identifies the context and applies the appropriate sanitization, and then finally served to the client browser. Two implementation approaches were explored, first, by building on top of the Hericho HTML parser library, and second, by using a custom state-machine based streaming parser. Thsi study demonstrates that the proposed solution is feasible through both implementation approaches. The solution was applied to real, open-source web applications known to have vulnerabilities, and successfully sanitized XSS attack vectors in a context-sensitive manner. Furthermore, both implementations have shown reasonably low overhead - incurring around a 20% penalty in application throughput and report rate.