TY - CONF T1 - Defeating script injection attacks with browser-enforced embedded policies T2 - Proceedings of the 16th international conference on World Wide Web Y1 - 2007 A1 - Jim,Trevor A1 - Swamy,Nikhil A1 - Hicks, Michael W. KW - cross-site scripting KW - script injection KW - web application security AB - Web sites that accept and display content such as wiki articles or comments typically filter the content to prevent injected script code from running in browsers that view the site. The diversity of browser rendering algorithms and the desire to allow rich content make filtering quite difficult, however, and attacks such as the Samy and Yamanner worms have exploited filtering weaknesses. This paper proposes a simple alternative mechanism for preventing script injection called Browser-Enforced Embedded Policies (BEEP). The idea is that a web site can embed a policy in its pages that specifies which scripts are allowed to run. The browser, which knows exactly when it will run a script, can enforce this policy perfectly. We have added BEEP support to several browsers, and built tools to simplify adding policies to web applications. We found that supporting BEEP in browsers requires only small and localized modifications, modifying web applications requires minimal effort, and enforcing policies is generally lightweight. JA - Proceedings of the 16th international conference on World Wide Web T3 - WWW '07 PB - ACM CY - New York, NY, USA SN - 978-1-59593-654-7 UR - http://doi.acm.org/10.1145/1242572.1242654 M3 - 10.1145/1242572.1242654 ER -