Protecting websites from cross-site scripting

Patent metadata

Field	Value
Publication number	US-9553865-B2
Application number	US-201514709003-A
Country	US
Kind code	B2
Filing date	May 11, 2015
Priority date	Oct 29, 2012
Publication date	Jan 24, 2017
Grant date	Jan 24, 2017

Abstract

Methods and systems for protecting websites from cross-site scripting are disclosed. A request for a web page comprising a web page element is received from a client. It is determined if the web page comprises a data integrity token for the web page element. It is also determined if a value of the data integrity token matches an expected value. If the web page comprises the data integrity token and if the value matches the expected value, the web page comprising the web page element is sent to the client. If the web page does not comprise the data integrity token or if the value does not match the expected value, a protective operation is performed.

First claim

What is claimed is:

1. A system, comprising:
one or more computers configured to implement a cross-site scripting filter system, wherein the cross-site scripting filter system comprises:
a web page rendering module configured to:
generate a request identifier corresponding to a request for a web page according to a technique to obscure prediction of the request identifier by an outside entity; and
generate an unfiltered web page based at least in part on the request, wherein the unfiltered web page comprises a protected web page element and an unprotected web page element, wherein the unfiltered web page comprises a data integrity token for the protected web page element, wherein a value of the data integrity token is calculated according to a checksum of at least the request identifier and at least a portion of the protected web page element, and wherein the data integrity token is added to the unfiltered web page via an application programming interface; and

a web server configured to:
generate a filtered web page based at least in part on the unfiltered web page, wherein the protected web page element is included in the filtered web page based at least in part on a determination that the protected web page element comprises the data integrity token and that the value of the data integrity token matches an expected value of the data integrity token, and wherein the filtered web page protects a client device from an effect of the unprotected web page element.

2. The system as recited in claim 1 , wherein the filtered web page protects the client device from the effect of the unprotected web page element based at least in part on a determination that the unprotected web page element does not comprise a different data integrity token or that a value of the different data integrity token does not match an expected value of the different data integrity token.

3. The system as recited in claim 1 , wherein instructions embedded with the unprotected web page element are escaped or removed in the filtered web page.

4. The system as recited in claim 1 , wherein the unprotected web page element is excluded from the filtered web page.

5. The system as recited in claim 1 , wherein access by the client device to the unprotected web page element is blocked.

6. The system as recited in claim 1 , wherein the web server is further configured to:
send the filtered web page to the client device, wherein at least a portion of the filtered web page is displayed on a display device associated with the client device.

7. The system as recited in claim 1 , wherein, in generating the filtered web page, the web server is further configured to invoke a filter module, wherein the web server is operated by a different business entity than the filter module, wherein the web server is further configured to generate the value of the checksum based on a secret key, and wherein the filter module is further configured to generate the expected value of the checksum based on the secret key.

8. A computer-implemented method, comprising:
generating a request identifier corresponding to a request for a web page according to a technique to obscure prediction of the request identifier by an outside entity;
generating an unfiltered web page based at least in part on the request, wherein the unfiltered web page comprises a protected element and an unprotected element, wherein the unfiltered web page comprises a data integrity token for the protected element, wherein a value of the data integrity token is calculated according to a checksum of at least the request identifier and at least a portion of the protected element; and
generating a filtered web page based at least in part on the unfiltered web page, wherein the protected element is included in the filtered web page based at least in part on a determination that the protected element comprises the data integrity token and that the value of the data integrity token matches an expected value of the data integrity token, and wherein the filtered web page comprises protection against the unprotected element.

9. The method as recited in claim 8 , wherein the filtered web page comprises protection against the unprotected element based at least in part on a determination that the unprotected element does not comprise a different data integrity token or that a value of the different data integrity token does not match an expected value of the different data integrity token.

10. The method as recited in claim 8 , wherein instructions embedded with the unprotected element are escaped or removed in the filtered web page.

11. The method as recited in claim 8 , wherein access by a client device to the unprotected element is blocked.

12. The method as recited in claim 8 , further comprising:
sending the filtered web page to a client device, wherein at least a portion of the filtered web page is displayed on a display device associated with the client device.

13. The method as recited in claim 8 , wherein the data integrity token is added to the protected element via an application programming interface before the request for the web page is received.

14. The method as recited in claim 8 , wherein the data integrity token is added to the protected element via an application programming interface after the request for the web page is received.

15. A system, comprising:
at least one processor; and
a memory coupled to the at least one processor, wherein the memory stores program instructions, wherein the program instructions are executable by the at least one processor to:
receive, from a client device, a request for a web page;
generate an unfiltered web page based at least in part on the request, wherein the unfiltered web page comprises a protected element and an unprotected element, wherein the unfiltered web page comprises a data integrity token for the protected element, wherein a value of the data integrity token is calculated according to a checksum of at least a portion of the protected element, and wherein the data integrity token is added to the unfiltered web page via an application programming interface; and
generate a filtered web page based at least in part on the unfiltered web page, wherein the protected element is included in the filtered web page based at least in part on a determination that the protected element comprises the data integrity token and that the value of the data integrity token matches an expected value of the data integrity token, and wherein the filtered web page comprises protection for the client device against the unprotected element.

16. The system as recited in claim 15 , wherein the program instructions are further executable by the at least one processor to:
generate a request identifier corresponding to the request for the web page according to a technique to obscure prediction of the request identifier by an outside entity;
wherein the value of the data integrity token is calculated according to a checksum of at least the request identifier and at least a portion of the protected element.

17. The system as recited in claim 15 , wherein the filtered web page comprises protection for the client device against the unprotected element based at least in part on a determination that the unprotected element does not comprise a different data integrity token or that a value of the different data integrity token does not match an expected value of the different data integrity token.

18. The system as recited in claim 15 , wherein instructions embedded with the unprotected element are escaped or removed in the

Assignees

• Amazon Tech Inc

Inventors

• Maher Brian Evan
• Joglekar Sachin Purushottam
• Johansson Jesper Mikael

Classifications

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L29/06

  Electricity · mapped topic

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title