Staicu, Cristian-Alexandru (2020)
Enhancing the Security and Privacy of Full-Stack JavaScript Web Applications.
Technische Universität Darmstadt
doi: 10.25534/tuprints-00011808
Dissertation, Erstveröffentlichung
Kurzbeschreibung (Abstract)
Web applications are the most important gateway to the Internet. Billions of users are relying on them every day and trusting them with their most sensitive data. Therefore, ensuring the security and privacy of web applications is of paramount importance. Traditionally, the server-side code of websites was written in languages such as PHP or Java for which security issues are well studied and understood. Recently, however, full-stack JavaScript web applications emerged, which have both their client-side and server-side code written in this language. We hypothesize that there are several unique properties of full-stack JavaScript web applications that pose a serious challenge for the security analysts: the new threat model for JavaScript, the excessive code reuse, the prevalence of code transformations, and the existence of complex full-stack threats. In this dissertation, we support this thesis by performing several in-depth studies of the JavaScript ecosystem and by proposing multiple improvements to the state-of-the art practices. First, we discuss two types of security vulnerabilities that are aggravated by the new threat model: injections and regular-expression denial of service. Second, we show that excessive code reuse in the JavaScript ecosystem increases the chance of relying on malicious or vulnerable code. Third, we provide evidence that code transformations are widespread and that full-stack threats exist. Finally, we propose several improvements for techniques aimed at hardening web applications: cost-effective consideration of implicit flows, the extraction of taint specification for third-party libraries, and pragmatic program analysis for defending against injections. The problem of securing full-stack JavaScript web applications is far from settled, but we hope that the current dissertation serves as motivation for future work to consider this increasingly important class of applications. In particular, we argue for holistic approaches that consider full-stack and cross-library information flows.
| Typ des Eintrags: | Dissertation | ||||
|---|---|---|---|---|---|
| Erschienen: | 2020 | ||||
| Autor(en): | Staicu, Cristian-Alexandru | ||||
| Art des Eintrags: | Erstveröffentlichung | ||||
| Titel: | Enhancing the Security and Privacy of Full-Stack JavaScript Web Applications | ||||
| Sprache: | Englisch | ||||
| Referenten: | Salvaneschi, Prof. Dr. Guido ; Pradel, Prof. Dr. Michael ; Sabelfeld, Prof. Dr. Andrei | ||||
| Publikationsjahr: | 18 März 2020 | ||||
| Ort: | Darmstadt | ||||
| Datum der mündlichen Prüfung: | 18 März 2020 | ||||
| DOI: | 10.25534/tuprints-00011808 | ||||
| URL / URN: | https://tuprints.ulb.tu-darmstadt.de/11808 | ||||
| Kurzbeschreibung (Abstract): | Web applications are the most important gateway to the Internet. Billions of users are relying on them every day and trusting them with their most sensitive data. Therefore, ensuring the security and privacy of web applications is of paramount importance. Traditionally, the server-side code of websites was written in languages such as PHP or Java for which security issues are well studied and understood. Recently, however, full-stack JavaScript web applications emerged, which have both their client-side and server-side code written in this language. We hypothesize that there are several unique properties of full-stack JavaScript web applications that pose a serious challenge for the security analysts: the new threat model for JavaScript, the excessive code reuse, the prevalence of code transformations, and the existence of complex full-stack threats. In this dissertation, we support this thesis by performing several in-depth studies of the JavaScript ecosystem and by proposing multiple improvements to the state-of-the art practices. First, we discuss two types of security vulnerabilities that are aggravated by the new threat model: injections and regular-expression denial of service. Second, we show that excessive code reuse in the JavaScript ecosystem increases the chance of relying on malicious or vulnerable code. Third, we provide evidence that code transformations are widespread and that full-stack threats exist. Finally, we propose several improvements for techniques aimed at hardening web applications: cost-effective consideration of implicit flows, the extraction of taint specification for third-party libraries, and pragmatic program analysis for defending against injections. The problem of securing full-stack JavaScript web applications is far from settled, but we hope that the current dissertation serves as motivation for future work to consider this increasingly important class of applications. In particular, we argue for holistic approaches that consider full-stack and cross-library information flows. |
||||
| Alternatives oder übersetztes Abstract: |
|
||||
| URN: | urn:nbn:de:tuda-tuprints-118087 | ||||
| Sachgruppe der Dewey Dezimalklassifikatin (DDC): | 000 Allgemeines, Informatik, Informationswissenschaft > 004 Informatik | ||||
| Fachbereich(e)/-gebiet(e): | 20 Fachbereich Informatik 20 Fachbereich Informatik > SOLA - Software Lab |
||||
| Hinterlegungsdatum: | 01 Jul 2020 08:14 | ||||
| Letzte Änderung: | 07 Jul 2020 07:18 | ||||
| PPN: | |||||
| Referenten: | Salvaneschi, Prof. Dr. Guido ; Pradel, Prof. Dr. Michael ; Sabelfeld, Prof. Dr. Andrei | ||||
| Datum der mündlichen Prüfung / Verteidigung / mdl. Prüfung: | 18 März 2020 | ||||
| Export: | |||||
| Suche nach Titel in: | TUfind oder in Google | ||||
 |
Frage zum Eintrag |
Optionen (nur für Redakteure)
 |
Redaktionelle Details anzeigen |
Drucken
Impressum