Verifying templates for dynamically generated web pages

Patent metadata

Field	Value
Publication number	US-9794280-B2
Application number	US-201514841594-A
Country	US
Kind code	B2
Filing date	Aug 31, 2015
Priority date	Aug 31, 2015
Publication date	Oct 17, 2017
Grant date	Oct 17, 2017

Abstract

A system and method for detecting encoding errors in a template used to generate a Web page. The template is analyzed using static analysis in a source code format, without rendering the Web page. A report can be generated including details on the detected errors and provide options on how to address the errors.

First claim

What is claimed is:

1. A method comprising:
storing a template in a source code format, wherein the template comprises instructions that can be dynamically executed to render a web page and the instructions include one or more locations where an input of data is to be received when a web page will be generated based on the template;
identifying a first location within the template;
determining, from among a plurality of possible encoding formats, a first encoding context for the first location, wherein the first encoding context comprises at least one encoding format that can be properly received at the first location; and
verifying, based on the template, whether an error would occur based on a first set of filters already existing at the first location and the first encoding context.

2. The method of claim 1 wherein the error comprises a cross-site scripting (XSS) error.

3. The method of claim 1 wherein the error comprises a double encoding error.

4. The method of claim 1 wherein the identifying using the template comprises analyzing the template in the source code format without rendering the template to create a first Web page.

5. The method of claim 1 wherein the identifying the first location and determining the first encoding context for the first location occurs using the source code format of the template.

6. The method of claim 1 further comprising
determining a second set of filters to be used at the first location if an error would occur based on the first set of filters.

7. The method of claim 6 wherein the determining the second set of filters to be used to address the first location comprises:
including the first set of filters already existing at the first location in the second set of filters; and
including a first filter in the second set of filters, wherein the first filter was not included in the first set of filters.

8. The method of claim 6 wherein the determining the second set of filters to be used at the first location comprises determining a first position in the template to insert the second set of filters.

9. The method of claim 1 wherein the first location comprises an input of weakly typed data.

10. The method of claim 1 wherein the first encoding context comprises Hypertext Markup Language (HTML).

11. The method of claim 1 wherein the first encoding context further comprises JavaScript.

12. The method of claim 1 wherein the template includes at least one request to a data resource located and defined separately from the template.

13. The method of claim 1 further comprising:
identifying a second location within the template;
determining a second encoding context for the second location, wherein the second encoding context comprises at least one encoding format that can be properly received at the second location;
verifying, based on the template, whether an error would occur based on a second set of filters already existing at the second location; and
determining a third set of filters to be used to address the second location if the error would occur based on the second set of filters.

14. The method of claim 13 wherein the first and second encoding contexts comprise different encoding contexts.

15. The method of claim 13 wherein the first and second encoding contexts comprise the same encoding context.

16. The method of claim 1 wherein the first set of filters comprises an empty set of filters.

17. The method of claim 1 further comprising:
determining a template language for the template; and
based on the template language, selecting a source code interpreter for identifying the first location.

18. A system for a software tool comprising:
one or more processors;
one or more computer-readable media carrying instructions which, when executed by the one or more processors, cause:
storing a template in a source code format, wherein the template comprises instructions that can be dynamically executed to render a web page and the instructions include one or more locations where an input of data is to be received when a web page will be generated based on the template;
identifying a first location within the template;
determining, from among a plurality of possible encoding formats, a first encoding context for the first location, wherein the first encoding context comprises at least one encoding format that can be properly received at the first location;
verifying, based on the template, whether an error would occur based on a first set of filters already existing at the first location and the first encoding context; and
determining a second set of filters to be used at the first location if an error would occur based on the first set of filters.

19. The system of claim 18 wherein the error comprises at least one or a cross-site scripting (XSS) error or a double encoding error.

20. The system of claim 18 wherein the identifying using the template comprises analyzing the template in the source code format without rendering the template to create a first Web page.

21. The method of claim 1 further comprising:
generating a natural language explanation of the error and providing one or more suggestions to rectify the error.

Assignees

• Linkedin Corp

Inventors

• SHAFIGULLIN Roman
• Kosuga Yuji
• Mani Arvind

Classifications

• G06F16/972

  Access to data in other repository systems, e.g. legacy data or dynamic Web page generation · CPC title

• G06F16/958

  Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking · CPC title

• G06F16/986

  Document structures and storage, e.g. HTML extensions · CPC title

• G06F40/186

  Templates · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title