Object Capabilities and Isolation of Untrusted Web Applications

Abstract

A growing number of current web sites combine active content (applications) from untrusted sources, as in so-called mashups. The objectcapability model provides an appealing approach for isolating untrusted content: if separate applications are provided disjoint capabilities, a sound objectcapability framework should prevent untrusted applications from interfering with each other, without preventing interaction with the user or the hosting page. In developing language-based foundations for isolation proofs based on object-capability concepts, we identify a more general notion of authority safety that also implies resource isolation. After proving that capability safety implies authority safety, we show the applicability of our framework for a specific class of mashups. In addition to proving that a JavaScript subset based on Google Caja is capability safe, we prove that a more expressive subset of JavaScript is authority safe, even though it is not based on the object-capability model.

Safe Wrappers and Sane Policies for Self Protecting JavaScript

“…This attack was already addressed in [25] where it is credited to Maffeis (see also [19]). It is also the basis of a recently described attack on ADsafe [18]. (This paper significantly extends the defence mechanism of [25] for this class of attack).…”

Secure multi-execution of web scripts: Theory and practice

“…Akhawe et al [2] focus on privilege separation in HTML5 web applications by utilizing standardized browser primitives in order to maintain a least privilege design. Maffeis et al [39] formalize the key mechanisms underlying these sandboxes and prove they can be used to create secure sandboxes. They also discuss several other existing proposals, and we point the reader to their paper for a more extensive discussion of work in this area.…”

Data-Confined HTML5 Applications

“…Another approach to interpose on all data communication channels is to do static analysis of the application source code [1,10,22,34]. However, static analysis methods have a high compatibility cost, because they cannot reason about code that uses dynamic constructs like eval, which are used pervasively in existing applications [38,39] and modern JavaScript libraries [28].…”

“…Second, client-side HTML5 applications (including browser extensions, HTML5 web applications and Windows 8 Metro applications) have numerous channels to communicate with distrusting principals, and no unified monitoring interface like the OS system call interface exists. Previous proposals include numerous mechanisms that limit cross-origin communication channels like the iframe sandbox [3], Content Security Policy [43], HTTP Strict Transport Security [26,29], web workers [27], code analysis [1,34], or code rewriting [10].As we explain in §2.3, none of these offer comprehensive mediation, and most of them are not easy to retrofit into existing applications at a low compatibility cost [49].…”