检索结果-南通市图书馆

CSRF protection in javascript frameworks and the security of javascript applications

High-Confidence Computing 2021年第2期1卷 7-13页

作者： Ksenia Peguero Xiuzhen Cheng Department of Computer Science George Washington UniversityWashington D.C.USA School of Computer Science and Technology Shandong UniversityChina

With javascript being the most popular programming language on the web,several new javascript frameworks are released every year.A well designed framework may help developers create secure *** goal of our study is to understand how framework developers can best protect applications developed using their *** this work we studied how cross-site request forgery vulnerability is mitigated in several server-side javascript frameworks:***,***,***,***,and *** then analyzed open source applications developed with these frameworks using open source and custom written tools for automated static analysis and identified the percentage of protected applications for each *** correlated our analysis results to the implementation levels of mitigating controls in each framework and performed statistical analysis of our results to ensure no other confounding factors were *** on the received outcomes we provide recommendations for framework developers on how to create frameworks that produce secure applications.

关键词： javascript security Web security Web frameworks Framework analysis Cross-site request forgery

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Electrolint and security of electron applications

引用

High-Confidence Computing 2021年第2期1卷 14-25页

作者： Ksenia Peguero Xiuzhen Cheng Department of Computer Science George Washington UniversityWashingtonD.C.USA School of Computer Science and Technology Shandong UniversityChina

javascript applications today are not limited to just client-side web applications and server-side code powered by *** became the standard for desktop application development with the emergence and popularity of the Electron *** the features of client-side and server-side applications,the Electron applications possess a completely different security *** attacks typical for front-end applications can now be escalated to the back-end attacks,for example,making a cross-site scripting result in a remote code execution on the user’s *** goal of our study is to analyze the typical security vulnerabilities of an Electron application,study common mitigation controls,and propose new remediation solutions that are easy to implement for *** this study we analyze security vulnerabilities in over a hundred open source Electron applications using automated and manual static *** explore the mitigation controls existing in the Electron framework,and propose changes to the framework that will prevent many of the common *** on these results,we develop an IDE plugin for Electron applications that automatically suggests remediations to common security defects within a developer’s work environment,thus shifting the fixing of a vulnerability to earlier in the software development life *** show the effectiveness of the IDE plugin by applying the plugin’s suggestions to the analyzed open source applications and demonstrating that they stop being exploitable after the applied fix.

关键词： javascript security Web security Desktop security Framework analysis Electron framework Static analysis

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

欢迎您,

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

请选择保存的检索档案：

请选择收藏分类：

通借通还

欢迎您,

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：