Security model for a layout engine and scripting engine

Patent metadata

Field	Value
Publication number	US-9582479-B2
Application number	US-201414531974-A
Country	US
Kind code	B2
Filing date	Nov 3, 2014
Priority date	May 24, 2011
Publication date	Feb 28, 2017
Grant date	Feb 28, 2017

Abstract

Various embodiments provide an interface between a Web browser's layout engine and a scripting engine. The interface enables objects from the layout engine to be recognized by a memory manager in the scripting engine and interact in a streamlined, efficient manner. In accordance with one or more embodiments, the interface allows browser layout engine objects to be created as objects that are native to the scripting engine. Alternately or additionally, in some embodiments, the native objects are further configured to proxy functionality between the layout engine and the scripting engine.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
creating at least one layout engine object in a layout engine memory space;
creating at least one scripting language object in a scripting engine memory space;
creating a custom object that is configured to represent relationships between objects in the scripting engine memory space and objects in the layout engine memory space, the custom object comprising a pointer to the at least one scripting language object and a pointer to the at least one scripting language object, and the custom object providing a linkage between the at least one scripting language object, and the at least one layout engine object; and
using at least one security module to provide secure information transfer during access to the at least one layout engine object and the at least one scripting language object, the security module configured to enable controlled access to an Application Programming Interface (API) associated with a scripting language of the scripting engine.

2. The computer-implemented method of claim 1 , wherein using at least one security module comprises using a security module configured to enable at least one object to be returned, across one or more domains, to a calling system without divulging type system information associated with the at least one object.

3. The computer-implemented method of claim 1 , wherein using at least one security module comprises using a security module configured to enable restricted access to the API associated with a scripting language.

4. The computer-implemented method of claim 1 , wherein using at least one security module comprises using a security module configured to enable at least one sub-window proxy object to assert security policies associated with a primary window object associated with the at least one layout engine object.

5. The computer-implemented method of claim 1 , wherein using at least one security module comprises using a security module configured to enable marking a function as safe for access, independent of cross-domain access to the function.

6. The computer-implemented method of claim 1 , wherein using at least one security module comprises using a security module configured to enable bypassing security checks based, at least in part, on a determination of the information transfer occurring in a same domain.

7. The computer-implemented method of claim 1 , wherein using at least one security module comprises using a security module configured to enable configurable access to at least one property descriptor.

8. A computer program product comprising one or more computer-readable hardware storage devices comprising computer readable instructions which, when executed, implement:
a Web browser configured to enable rendering of a Web page, the Web browser being configured to create:
at least one layout engine object in a layout engine memory space;
at least one scripting language object in a scripting engine memory space;
a custom object that is configured to represent relationships between objects in the scripting engine memory space and objects in the layout engine memory space, the custom object comprising a pointer to the at least one scripting language object and a pointer to the at least one scripting language object, and the custom object providing a linkage between the at least one scripting language object and the at least one layout engine object; and

at least one security module configured to enable secure information transfer between the scripting engine memory space and the layout engine memory space.

9. The computer program product of claim 8 , wherein the at least one security module is configured to enable configurable access to at least one property descriptor.

10. The computer program product of claim 9 , wherein the at least one security module is further configured to configure the at least one property descriptor as mutable.

11. The computer program product of claim 8 , wherein the at least one security module is configured to enable secure cross-domain information transfer.

12. The computer program product of claim 8 , the at least one security module further configured to enable secure information transfer based, at least in part, on one or more interface definition language (IDL) files.

13. The computer program product of claim 12 , the one or more IDL files configured to include one or more attributes that enable control of security aspects associated with a property and/or an Application Programming Interface (API) associated with the at least one scripting language object.

14. The computer program product of claim 13 , the one or more attributes comprising at least one attribute configured to enable marking the property and/or API as being safe to access across multiple domains.

15. The computer program product of claim 12 , the one or more attributes comprising at least one attribute configured to enable control of visibility of the property and/or API, at least one attribute configured to control mutability of the property and/or API, and at least one attributed configured to control conditional access to the property and/or API.

16. The computer program product of claim 15 , the conditional access based, at least in part, on a domain accessing the property and/or API.

17. A computing device comprising:
one or more processors; and
one or more computer-readable storage media comprising computer readable instructions which, when executed upon the one or more processors, implement a method comprising:
creating at least one layout engine object in a layout engine memory space;
creating at least one scripting language object in a scripting engine memory space;
creating a custom object that is configured to represent relationships between objects in the scripting engine memory space and objects in the layout engine memory space, the custom object comprising a pointer to the at least one scripting language object and a pointer to the at least one scripting language object, and the custom object providing a linkage between the at least one scripting language object and the at least one layout engine object; and
using at least one security module to provide secure information transfer during access to the at least one layout engine object and the at least one scripting language object, the security module configured to enable controlled access to an Application Programming Interface (API) associated with a scripting language of the scripting engine.

18. The computing device of claim 17 , wherein using at least one security module comprises using a security module configured to enable at least one object to be returned, across one or more domains, to a calling system without divulging type system information associated with the at least one object.

19. The computing device of claim 17 , wherein the at least one security module is configured to enable configurable access to at least one property descriptor, wherein the at least one security module is further configured to configure the at least one property descriptor as mutable.

20. The computing device of claim 17 , the at least one security module further configured to enable secure information transfer based, at least in part, on one or more interface definition language (IDL) files configured to include one or more attributes that enable control of security aspects associated with a property and/or the API, the one or more attributes comprising at least one attribute configured to enable marking the property and/or the A

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Leithead Travis
• Rogers Justin E
• Pavlicic Miladin
• Man Curtis Cheng-Cheng
• Qu Yong
• Furtwangler Nathan J E
• Nourai Reza A
• Lucco Steven Edward

Classifications

• G06F9/45508

  Runtime interpretation or emulation, e g. emulator loops, bytecode interpretation · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title

• G06F9/541

  via adapters, e.g. between incompatible applications · CPC title

• G06F9/45512

  Command shells · CPC title

• G06F8/30

  Creation or generation of source code · CPC title