Abstract: Concerning DOM XSS (Document Object Model (DOM)-based Cross Site Scripting (XSS)) vulnerability detection in Web client, a detection algorithm for DOM XSS vulnerability based on dynamic taint analysis was proposed. By constructing DOM model and modifying Firefox SpiderMonkey script engine, a dynamic taint analysis method based on the bytecode was used to detect DOM XSS vulnerabilities. First, taint data was marked by extending the attribute of the DOM object class and modifying the string encoding format of SpiderMonkey. Then, the execution route of the bytecode was traversed to generate the tainted data set. After that, all the output points which might trigger DOM XSS attacks were monitored to determine whether the application contained the DOM XSS vulnerabilities. In the experiment, a DOM XSS vulnerability detection system containing a crawler was designed and implemented. The experimental results show that the proposed algorithm can effectively detect the DOM XSS vulnerabilities, and the detection rate is about 92%.

Key words: dynamic taint analysis, source, sink, execution route

摘要： 针对Web客户端中基于文档对象模型的跨站脚本攻击(DOM XSS)漏洞检测问题,提出一种基于动态污点分析的DOM XSS漏洞检测算法。通过构造DOM模型和修改Firefox SpiderMonkey脚本引擎,利用动态的、基于bytecode的污点分析方法实现了DOM XSS漏洞的检测。对DOM对象类属性的扩展和SpiderMonkey字符串编码格式的修改可以完成污点数据标记;遍历JavaScript指令代码bytecode的执行路径,获得污点传播路径,实现污点数据集的生成;监控所有可能会触发DOM XSS攻击的输出点,实现DOM XSS漏洞的判定。在此基础上,利用爬虫程序设计并实现了一个互联网DOM XSS漏洞检测系统。实验结果表明,所提算法能有效检测网页存在的DOM XSS漏洞,其检测率可达92%。

关键词: 动态污点分析, 注入点, 输出点, 执行路径