资源描述：
《Architectural Principles for Safe Web Programs》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。
1、ArchitecturalPrinciplesforSafeWebProgramsCharlesReis,StevenD.Gribble,andHenryM.Levyfcreis,gribble,levyg@cs.washington.eduDepartmentofComputerScienceandEngineeringUniversityofWashingtonAbstracttime,sobrowserswouldenforceextensiblepoliciesonthebehaviorof
2、webprograms.Webcontentismigratingawayfromsimplehyper-Today'swebbrowsersarefarfromthisidealvision,linkeddocumentstowardsadiversesetofprogramshowever,andtheydonotprovideasafeenvironmentthatexecutewithinthewebbrowser.Unfortunately,forrunningcodefromtheweb
3、.Therehasbeenmuchmodernbrowsersdonotprovideasafeenvironmentrecentattentiontowebsecuritythreats,frombrowserforrunningthesewebprograms.Inthispaper,weexploits[17,18]tocross-sitescriptingattacks[15]toshowhowcurrentwebsecuritythreatsaresymptomsDNSrebinding[
4、13].Thesethreatsaresymptomaticoffourkeyproblemsinsupportingwebprograms:offourfundamentalproblemsthatbecomeclearwhenvagueprogramboundaries,unwantedcode,pooriso-viewingthewebasacollectionofprograms:lation,andinconsistentsecuritypolicies.Inresponse,weintr
5、oduceabstractionsforwebprogramsandpro-Can'tidentifyprogramboundaries
6、Awebpro-graminstances,andwepresentasetofarchitecturalgramcomprisesmorethanasingledocument,principlestoaddressthesefundamentalproblems.yetitisdiculttosaywhereitsboundariesare.Current
7、browsersusethenotionoforigin,whichweargueisbothinappropriateandinsecure.1IntroductionCan'tpreventunwantedcode
8、ItiscurrentlyModernbrowsersmustcontendwithacomplexanddiculttodistinguishwebprogramcodefromhazardousweb.Webcontenthasbeenmigratingdata.Asacon
9、sequence,webdeveloperswhoin-awayfromsimplehyperlinkeddocumentstowardsategratecontentfrommultiplesourcesriskgivingdiversesetofprogramsdesignedtoexecutewithinadversariescontrolovertheirprograms.thebrowser.Thankstonewmechanismsandcod-Can'tisolateprograms
10、inthebrowser
11、Sepa-ingtechniques,theseprogramsincreasinglyresem-ratewebprogramscaninterferewitheachotherbletheirdesktopcounterparts:theyhaveinteractiveincriticalways,makingitunsafetovisittrusteduserinterfaces,theycomposewithotherprograms
