{"title":"App Security with JSFlow","authors":"Daniel Hedin","doi":"10.1145/2897073.2897714","DOIUrl":null,"url":null,"abstract":"In the presence of attacker controlled code, popular protection mechanisms such as access control and taint tracking fail. We argue for the necessity of full information-flow control and present JSFlow, an information-flow aware interpreter for full ECMA-262(v.5). Previous work has shown that (hybrid) dynamic information-flow enforcement is a fruitful approach to enforcing secure information flow in the setting of web application. Those results naturally extend to hybrid mobile apps, with JSFlow deployed as a library.","PeriodicalId":296509,"journal":{"name":"2016 IEEE/ACM International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2016-05-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2016 IEEE/ACM International Conference on Mobile Software Engineering and Systems (MOBILESoft)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1145/2897073.2897714","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 0
Abstract
In the presence of attacker controlled code, popular protection mechanisms such as access control and taint tracking fail. We argue for the necessity of full information-flow control and present JSFlow, an information-flow aware interpreter for full ECMA-262(v.5). Previous work has shown that (hybrid) dynamic information-flow enforcement is a fruitful approach to enforcing secure information flow in the setting of web application. Those results naturally extend to hybrid mobile apps, with JSFlow deployed as a library.
京公网安备 11010802042870号
京ICP备2023020795号-1
分享
求助内容：
应助结果提醒方式：
扫码关注我们
