Securing the Tangled Web.
The article provides an overview of how cross-site scripting (XSS) vulnerabilities emerge and why it is so difficult to avoid the problem in real-world Web application software development. Topics discussed include the traditional advice to prevent XSS, the existing approaches to the prevention and...
| Publicado en: | Communications of the ACM Vol. 57; no. 9; pp. 38 - 48 |
|---|---|
| Autor principal: | |
| Formato: | Artículo |
| Publicado: |
Association for Computing Machinery
Sep2014
|
| Materias: | |
| Acceso en línea: | Ver este registro en EBSCOhost |
| fields | @attributes: recordID: 1 pdfLink: plink: https://search.ebscohost.com/login.aspx?direct=true&db=hlh&AN=97638726&site=ehost-live header: @attributes: shortDbName: hlh uiTerm: 97638726 longDbName: Humanities International Complete uiTag: AN controlInfo: bkinfo: jinfo: jid: 00010782 ACM jtl: Communications of the ACM issn: 00010782 maglogo: N pubinfo: dt: Sep2014 vid: 57 iid: 9 pid: 68 pub: Association for Computing Machinery artinfo: ui: 97638726 10.1145/2643134 ppf: 38 ppct: 10 formats: tig: atl: Securing the Tangled Web. aug: au: KERN, CHRISTOPH affil: Information Security Engineer, Google. su: Computer software development Web-based user interfaces Web design Computer viruses Computer networks Google Inc. sug: subj: Computer software development Web-based user interfaces Web design Computer viruses Computer networks Google Inc. ab: The article provides an overview of how cross-site scripting (XSS) vulnerabilities emerge and why it is so difficult to avoid the problem in real-world Web application software development. Topics discussed include the traditional advice to prevent XSS, the existing approaches to the prevention and detection of XSS, and the concept of strictly contextually auto-escaping template engines. Also discussed is an approach developed by Internet company Google to limit code that could potentially give rise to XSS vulnerabilities. pubtype: Periodical doctype: Article src: R language: English refInfo: copyright: @attributes: flag: Y dt: @attributes: year: 2014 holdings: @attributes: islocal: N |
|---|