Improving web site security with data flow management

This dissertation describes two systems, Resin and BFlow, whose goal is to help Web developers build more secure Web sites. Resin and BFlow use data flow management to help reduce the security risks of using buggy or malicious code. Resin provides programmers with language-level mechanisms to track and manage the flow of data within the server. These mechanisms make it easy for programmers to catch server-side data flow bugs that result in security vulnerabilities, and prevent these bugs from being exploited. BFlow is a system that adds information flow control, a restrictive form of data flow management, both to the Web browser and to the interface between a browser and a server. BFlow makes it possible for a Web site to combine confidential data with untrusted JavaScript in its Web pages, without risking leaks of that data. This work makes a number of contributions. Resin introduces the idea of a data flow assertion and demonstrates how to build them using three language-level mechanisms, policy objects, data tracking, and filter objects. We built prototype implementations of Resin in both the PHP and Python runtimes. We adapt seven real off-the-shelf applications and implement 11 different security policies in Resin which thwart at least 27 real security vulnerabilities. BFlow introduces an information flow control model that fits the JavaScript communication mechanisms, and a system that maps that model to JavaScript’s existing isolation system. Together, these techniques allow untrusted JavaScript to read, compute with, and display confidential data without the risk of leaking that data, yet requires only minor changes to existing software. We built a prototype of the BFlow system and three different applications including a social networking application, a novel shared-data Web platform, and BFlogger, a third-party JavaScript platform similar to that of Blogger.com. We ported several untrusted JavaScript extensions from Blogger.com to BFlogger, and show that the extensions cannot leak data as they can in Blogger.com. Thesis Supervisor: Robert T. Morris Title: Associate Professor Thesis Supervisor: Nickolai Zeldovich Title: Assistant Professor