Archive for September 12th, 2008

I just stumbled upon a post by Lori MacVittie, Why it's so hard to secure JavaScript.
I found it interesting because it voices the (frustrated) opinion of an important Web Application Firewall vendor, F5, about something I've been reasoning for some years :)
She essentially admits scripting languages are such a mess to secure at the semantic level («Hey Giorgio, why doesn't NoScript just strip out malicious scripts and leave the rest my page alone?»), especially from an external node (like a firewall) which does not actually parse the code:

I am not aware of any security solution that currently parses out JavaScript before it's delivered to the client. If there are any out there, I'd love to hear about them.

Well, WebCleaner comes to mind.
Also NoScript's Anti-XSS filters actually parse cross-site request fragments through SpiderMonkey, mainly to reduce false positives by acting on syntactically valid JS only.

But she obviously means something different: a device placed outside the browser, parsing JavaScript and performing sandboxed behavioral analysis.
The latter is the true challenge here, but building such a toy might be not impossible, especially since the best JavaScript implementations out there, Mozilla's SpiderMonkey/TraceMonkey and Google's V8 are open-source and embeddable. However, performance penalties aside (most of the scripts should be parsed and possibly compiled and executed at least twice), you would loose a very important decision factor: browser context, i.e. DOM, cookies, authenticated sessions, navigation history and so on.
Unless they imagine to stuff a "twin" of your browser inside your firewall, sort of a proxy based on Gecko+SpiderMonkey or WebKit+V8 and acting as a guinea pig just before the "real" navigation happens...
But for the time being,

That's why browser add-ons like NoScript are so popular. JavaScript security today is binary: allow or deny. Period. There's no real in between. There is no JavaScript proxy that parses and rejects malicious script, no solution that proactively scans JavaScript for code-based exploits, no external answer to the problem. That means we have to rely on the browser developers to not only write a good browser with all the bells and whistles we like, but for security, as well.

Bad Behavior has blocked 786 access attempts in the last 7 days.