A New Practical and Collaborative Defense Against XSS Attacks

Several remote attacks on the web today exploit the insecurity that comes with embedding untrusted data in trusted content. A specific type of cross site scripting (XSS) attack – reflected XSS attacks – are the most common of these, and plague even the most popular web sites today. Traditional defenses against these attacks rely on filtering user input, which was been shown to be quite difficult in practice. Filtering is entirely reactive to security threats, and more often than not, reacting to new exploits doesn’t happen. Current approaches are effective, but are often difficult to perform widespread implementation. We propose the concept of client-side tainting of user generated information. Tainted data is quarantined by a novel delimiter scheme which allows for flexible policy enforcement. We confirm that our approach, in addition to being simple to implement, requires only changes to the client browser and defends against over 2000 XSS attacks. We also analyze stored XSS attacks, and what we would need to alter in our approach to combat them as well.