{"title":"应用安全与JSFlow","authors":"Daniel Hedin","doi":"10.1145/2897073.2897714","DOIUrl":null,"url":null,"abstract":"In the presence of attacker controlled code, popular protection mechanisms such as access control and taint tracking fail. We argue for the necessity of full information-flow control and present JSFlow, an information-flow aware interpreter for full ECMA-262(v.5). Previous work has shown that (hybrid) dynamic information-flow enforcement is a fruitful approach to enforcing secure information flow in the setting of web application. Those results naturally extend to hybrid mobile apps, with JSFlow deployed as a library.","PeriodicalId":296509,"journal":{"name":"2016 IEEE/ACM International Conference on Mobile Software Engineering and Systems (MOBILESoft)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2016-05-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":"{\"title\":\"App Security with JSFlow\",\"authors\":\"Daniel Hedin\",\"doi\":\"10.1145/2897073.2897714\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"In the presence of attacker controlled code, popular protection mechanisms such as access control and taint tracking fail. We argue for the necessity of full information-flow control and present JSFlow, an information-flow aware interpreter for full ECMA-262(v.5). Previous work has shown that (hybrid) dynamic information-flow enforcement is a fruitful approach to enforcing secure information flow in the setting of web application. Those results naturally extend to hybrid mobile apps, with JSFlow deployed as a library.\",\"PeriodicalId\":296509,\"journal\":{\"name\":\"2016 IEEE/ACM International Conference on Mobile Software Engineering and Systems (MOBILESoft)\",\"volume\":\"6 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2016-05-14\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"0\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"2016 IEEE/ACM International Conference on Mobile Software Engineering and Systems (MOBILESoft)\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1145/2897073.2897714\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"2016 IEEE/ACM International Conference on Mobile Software Engineering and Systems (MOBILESoft)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1145/2897073.2897714","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
In the presence of attacker controlled code, popular protection mechanisms such as access control and taint tracking fail. We argue for the necessity of full information-flow control and present JSFlow, an information-flow aware interpreter for full ECMA-262(v.5). Previous work has shown that (hybrid) dynamic information-flow enforcement is a fruitful approach to enforcing secure information flow in the setting of web application. Those results naturally extend to hybrid mobile apps, with JSFlow deployed as a library.
京公网安备 11010802042870号
京ICP备2023020795号-1
分享
求助内容：
应助结果提醒方式：
扫码关注我们
