Pivot: Fast, Synchronous Mashup Isolation Using Generator Chains

Abstract

Abstract-Pivot is a new JavaScript isolation framework for web applications. Pivot uses iframes as its low-level isolation containers, but it uses code rewriting to implement synchronous cross-domain interfaces atop the asynchronous crossframe postMessage() primitive. Pivot layers a distributed scheduling abstraction across the frames, essentially treating each frame as a thread which can invoke RPCs that are serviced by external threads. By rewriting JavaScript call sites, Pivot can detect RPC invocations; Pivot exchanges RPC requests and responses via postMessage(), and it pauses and restarts frames using a novel rewriting technique that translates each frame's JavaScript code into a restartable generator function. By leveraging both iframes and rewriting, Pivot does not need to rewrite all code, providing an orderof-magnitude performance improvement over rewriting-only solutions. Compared to iframe-only approaches, Pivot provides synchronous RPC semantics, which developers typically prefer over asynchronous RPCs. Pivot also allows developers to use the full, unrestricted JavaScript language, including powerful statements like eval().

BreakApp: Automated, Flexible Application Compartmentalization

“…JavaScript Isolation In the case of JavaScript specifically, much effort has gone into client-side compartmentalization (e.g., execution isolation [33], object capabilities [34], sandboxing [53], [2] information flow control [52]). These works focused primarily on client-side, web-based setups which are different from our focus in many ways: isolation primitives (i.e., iframes), origin (i.e., explicit sources), threat model (i.e., no C/C++ modules; no valid access to "/etc/passwd"), compartment numbers (i.e., few), and developer effort (i.e., manual annotations or rewrite).…”

“…Further problems increase these risks. With popular modules averaging tens of thousands of lines of code, understanding the internals of a complex package and verifying that it will not behave in unintended ways [15], [33] are both extremely difficult tasks. The popularity of certain packages-dependedupon by thousands of other packages-allows vulnerabilities deep in the dependency graph to cause widespread difficulties [30], [23], [60].…”

Putting in all the stops: execution control for JavaScript

“…Pivot [39] isolates untrusted JavaScript into an iframe and rewrites the program to use generators, which allows blocking I/O between the iframe and the outside world. Stopify is not an isolation framework and implements blocking without generators or cps ( §3).…”

JaTE

“…Instead of propagating DOM changes, Mashic [17] and Pivot [23] provide a transparent, synchronous interface for cross-domain operations on top of postMessage, to support confinement of general-purpose code. Mashic rewrites all code to continuation-passing style, while Pivot uses Generators to achieve the same goal using minor rewriting.…”

“…• Frame-based isolation: The browser's SOP isolates code running in different frames, while providing a controlled means for communicating through the postMessage API. AdJail [34], Mashic [17] and Pivot [23] rely on this approach for isolation. MashupOS [42] also relies on frames and similar isolation mechanisms.…”