Charla José Santos (INRIA Sophia Antipolis Méditerranée)

Este martes 18 de noviembre, a las 16:00 en la Sala Smith, José Santos dictará una charla en el marco del grupo. A continuación los datos de la charla:

José Santos, INRIA Sophia Antipolis Méditerranée, INDES team
Título: Enforcing secure information flow in client-side Web applications.
Abstract:
In this presentation, we address the issue of enforcing confidentiality and integrity policies in the context of client-side Web applications. Since most Web applications are developed in the JavaScript programming language, we study static, dynamic, and hybrid enforcement mechanisms for securing information flow in Core JavaScript — a fragment of JavaScript that retains its defining features. Specifically, we propose:

1. a monitored semantics for dynamically enforcing secure information flow in Core JavaScript as well as a source-to-source transformation that inlines the proposed monitor,
2. a type system that statically checks whether or not a program abides by a given information flow policy, and
3. a hybrid type system that combines static and dynamic analyses in order to accept more secure programs than its fully static counterpart.

Most JavaScript programs are designed to be executed in a browser in the context of a Web page. These programs often interact with the Web page in which they are included via a large number of external APIs provided by the browser. The execution of these APIs usually takes place outside the perimeter of the language. Hence, any realistic analysis of client-side JavaScript must take into account possible interactions with external APIs. To this end, we present a general methodology for extending security monitors to take into account the possible invocation of arbitrary APIs and we apply this methodology to a representative fragment of the DOM Core Level 1 API that captures DOM-specific information flows.