（南京大學計算機軟件新技術國家重點實驗室  南京 210093）

（南京大學計算機科學與技術系  南京 210093）

 

摘  要　本文通過利用瀏覽器的通用實現慣例以及腳本執行條件的研究，結合傳統的Taint技術，從對不可信內容進行執行干擾的角度入手，探索了一種基于服務器端的對抗XSS腳本攻擊的新的方法，該方法能夠有效的防御已知和未知的XSS攻擊形式，而且實驗證明在性能上也比較令人滿意。

關鍵詞　跨站腳本攻擊，瀏覽器實現慣例，Taint，不可信內容，執行干擾

FANG Yi

(State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing 210093)

(Department of Computer Science & Technology, Nanjing University，Nanjing 210093)

 

Abstract This paper addresses some most common kinds of XSS issues with traditional information tracking technologies as well as some common rules of the implementation of web browsers and some basic conditions with which an injected script segment can be successfully executed. What differentiates this paper from traditional taint-based XSS solutions is that it proposes a novel way to make the untrusted content harmless instead of the filtering methods and it turns to be an effective method to defend unknown XSS attacks.

Keywords XSS, Browser Implementation Rules, Information Tracking, Untrusted Content, Execution Corruption