Method and device for defending DOM-Based-XSS vulnerability and client

Abstract

The invention provides a method and device for defending a document object model based cross site scripting (DOM-Based-XSS) vulnerability and a client. The method comprises the steps of: parsing a tree structure of a current page DOM; before a data hypertext markup language (HTML) text is loaded, checking a request field related to the DOM tree in a hypertext transfer protocol; and if the requestfield comprises a first category of character strings, carrying out filtering or escaping on the first category of character strings. According to the invention, at a moment before the data HTML textis loaded, the request field in the hypertext transfer protocol is verified, so that verification on a uniform resource locator (URL) can be comprehensively and efficiently implemented; the DOM-Based-XSS vulnerability is repaired; and the method and the device have a full-site defense effect and are helpful for controlling the online service increment DOM-Based-XSS vulnerability and preventing newDOM-Based-XSS vulnerability.

Description

technical field [0001] The invention belongs to the technical field of network security protection, and in particular relates to a document object model-based cross-site script vulnerability defense method, device and client. Background technique [0002] Cross Site Scripting (Cross Site Scripting, often abbreviated as XSS) is a vulnerability in which the web application does not effectively filter or escape the data input by the user, so that the attacker can display the constructed malicious data on the page. The method of utilization is that malicious attackers insert malicious JavaScript codes into web pages. When users browse the web pages, the JavaScript codes embedded in the web pages will be executed, thereby achieving the purpose of maliciously attacking normal users. Depending on the triggering of XSS vulnerabilities in different scenarios, attackers stealing cookie information, implementing worm propagation, and phishing attacks will bring the most significant har...

AI Technical Summary

Problems solved by technology

At present, quite a few web vulnerability scanners in the industry can support DOM-Based-XSS scanning and discovery of online web services, and some excellent web application firewalls can also effectively intercept and defend against DOM-Based-XSS vulnerabilities, but There are still some special scenarios that will invalidate the mainstream scanning and defense methods. Therefore, a more lightweight and non-affecting normal business method is adopted to defend against DOM-Based-XSS vulnerabilities. When hackers attack and exploit the above-mentioned vulnerabilities discovered It is of great significance for the improvement of web application and business security to allow the business side to perceive in real time

Images