ConScript

1. ConScript Specifying and Enforcing Fine-Grained Security Policies for JavaScript in the Browser Leo Meyerovich UC Berkeley Benjamin Livshits Microsoft Research

3. Complications Benign but buggy: who is to blame? Code constantly evolving How do we maintain quality? Downright malicious Prototype hijacking

4. Developer’s Dilemma

5. Only Allow eval of JSON • Idea for a policy: • Parse input strings instead of running them • Use ConScript to adviseeval calls • AspectJ advice for Java • How to do advice in JavaScript? • No classes to speak of eval(“([{‘hello’: ‘Oakland’}, 2010])”) void aroundcallWindow::eval (String s) { … } eval(“(xhr.open(‘evil.com’);)”)

6. Advising Calls is Tricky ConScript approach • Deep advice for complete mediation • Implemented within the browser for efficiency and reliability = function allowJSON() { … } window.eval heap stack function allowJSON window object eval document window eval x function eval y z … frames[0] frame object eval

7. Example of Applying Advice in ConScript 1. <SCRIPTSRC=”facebook.js"POLICY=" 2. var substr = String.prototype.substring; 3. var parse = JSON.parse; 4. around(window.eval, 5. function(oldEval, str) { 6. var str2 = uCall(str, substr, 1, 7. str.length - 1); 8. var res = parse(str2); 9. if (res) return res; 10. else throw "eval only for JSON"; 11. } );">

8. Contributions of ConScript

9. A case for aspects in browser • Implementation Correctnesschecking Expressiveness Real-world Evaluation

10. Advising JavaScript Functions in IE8 around(paint, withBoundChecks); dog.draw(); fish.display(); heap stack function withBoundChecks fish ... ... display ... dog function paint draw

11. This is Just the Beginning… • Not just JavaScript functions • native JavaScript calls: Math.round, … • DOM calls: document.getElementById, … • Not just functions… • script introduction • … • Optimizations • Blessing • Auto-blessing

12. A case for aspects in browser Correctnesschecking • Type system Expressiveness Real-world Evaluation

13. Policies are Easy to Get Wrong toString redefinition! 1. 2. 3. 4. 5. 6. 7. 8. 9. var okOrigin={"http://www.google.com":true}; around(window.postMessage, function (post, msg, target) { if (!okOrigin[target]) { throw’err’; } else { return post.call(this, msg, target); } }); Function.prototype poisoning! Object.prototype poisoning!

14. How Do We Enforce Policy Correctness? Application code Policy code Modify the JavaScript interpreter introduce uCall, hasProp, and toPrimitive disable eval Propose a type system to enforce correct use of these primitives disable with, … • Unperturbed usage of legacy code • Disallow arguments.caller to avoid stack inspection (disallowed by ES5’s strict mode)

15. Policy Type System Reference isolation • o does not leak through poisoning if f is a field • ML-like type system • Uses security labels to denote privilege levels • Enforces access path integrity and reference isolation Access path integrity for function calls • o.f remains unpoisoned if T in v : T is not poisoned

16. A case for aspects in browser Correctnesschecking Expressiveness • Policies Real-world Evaluation

17. ConScript Policies • 17 hand-written policies • Diverse: based on literature, bugs, and anti-patterns • Short: wrote new HTML tags with only a few lines of code • 2 automatic policy generators • Using runtime analysis • Using static analysis

18. Paper presents 17 ConScript Policies around(document.createElement, function (c : K, tag : U) { var elt : U = uCall(document, c, tag); if (elt.nodeName == "IFRAME") throw ’err’; else return elt; });

19. Generating Intrusion Detection Policies ConScript instrumentation Observed method calls eval new Function(“string”) postMessage XDomainRequest xmlHttpRequest … ConScript enforcement

20. Enforcing C# Access Modifiers function File () { … } File.construct = … File.open = … … class File { public File () { … } private open () { … } … Script# compiler C# JavaScript policy generator around(File, pubEntryPoint); around(File.construct, pubEntryPoint); around(File.open, privCall); ConScript

21. A case for aspects in browser Correctnesschecking Expressiveness Real-world Evaluation • Evaluation

22. Experimental Evaluation

23. DoCoMo Policy Enforcement Overhead H. Kikuchi, D. Yu, A. Chander, H. Inamura, and I. Serikov, “JavaScript instrumentation in practice,” 2008

24. File Size Increase for Blacklisting Policy

25. Conclusions

26. QUESTIONS?

27. Mediating DOM Functions window.postMessage IE8 libraries(HTML, Networking, …) JavaScript interpreter postMessage deep aspects advice dispatch 0xff34e5 0xff34e5 arguments: “hello”, “evil.com” off 0xff34e5 around(window.postMessage, off ); [not found] frame2.postMessage

28. Resuming Calls • function (eval, str) { if (ok(str)) { • bless(); • return eval(str); • } else throw ‘exn’; } • 3. function (eval, str) { if (ok(str)) return eval(str); • else { curse(); throw ‘exn’; }} function foo () { } function foo () { } advice on advice off function advice1 (foo2) { if (ok()) { foo2(); } else throw ‘exn’; } function advice2 (foo2) { if (ok()) { bless(); foo2(); } else throw ‘exn’; } bless() temporarily disables advice for next call

29. Optimizing the Critical Path function foo () { } function foo () { } advice off advice on advice on function advice3 (foo2) { if (ok()) foo2(); else { curse(); throw ‘exn’; } } function advice2 (foo2) { if (ok()) { bless(); foo2(); } else throw ‘exn’; } • calling advice turns advice off for next call • curse()enables advice for next call