InvisiType: Object-Oriented Security Policies

Many modern software platforms today, including browsers, middle-ware server architectures, cell phone operating systems, web application engines, support third-party software extensions. This paper proposes InvisiType, an object-oriented approach that enables platform developers to efficiently enforce fine-grain safety checks on third-party extensions without requiring their cooperation. This allows us to harness the true power of third-party software by giving it access to sensitive data while ensuring that it does not leak data. In this approach, a platform developer encapsulates all safety checks in a policy class and selectively subjects objects at risk to these policies. The run-time enforces these policies simply by changing the types of these objects dynamically. It uses the virtual method dispatch mechanism to substitute the original methods and operations with code laced with safety checks efficiently. The run-time hides the type changes from the application code so the original code can run unmodified. We have incorporated the notion of InvisiType into the Python language. We have applied the technique to 4 real-world Python web applications totaling 156,000 lines of code. InvisiType policies greatly enhance the security of the web applications, including MoinMoin, a popular, 94,000-line Wiki Engine. MoinMoin has a large number of third-party extensions, which makes security enforcement important. With less than 150 lines of Python code, we found 16 security bugs in MoinMoin. This represents a significant reduction in developers’ effort from a previous proposal, Flume, which required 1,000 lines of C++ code and modifications to 1,000 lines of Python code. Our InvisiType policies successfully found 19 cross-site scripting vulnerabilities and 6 access control errors in total. The overhead of applying the policies is less than 4 percent, indicating that the technique is practical. General Terms Security, Design, Programming Language