Context-Aware Escaping Engine for Multi-Tenant Page Rendering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing tools for fixing missing or incorrect escaping functions in HTML contexts do not account for non-HTML encoded elements, posing a risk in multi-tenant cloud-based systems where page rendering applications are used for web-based user interfaces.

Innovation Solution

A core engine is implemented to analyze pages and automatically insert the correct escaping functions into field references, using a combination of HTML and JavaScript escaping strategies, with a finite state machine to determine the output context and apply appropriate escaping functions, ensuring secure rendering across different coding environments.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing tools for fixing missing or incorrect escaping functions are used in HTML contexts, then HTML encoding is improved, but non-HTML encoded elements are not accounted for, creating security vulnerabilities

Engineering Contradiction:

ImprovesecurityVSAvoidencoding scheme coverage

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system dynamically changes the encoding parameter based on the detected output context. When HTML context is detected, HTML encoding is applied; when JavaScript context is detected, JavaScript encoding is applied. This allows the same escaping tool to adapt to different encoding schemes, improving both security and versatility.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

A context detection intermediary is introduced between the escaping function and the field reference. This intermediary analyzes the output context (HTML or JavaScript) and determines the appropriate encoding scheme to apply, ensuring that the correct escaping function is used for each context while maintaining a unified tool interface.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If manual review and approval of escaping function changes is implemented, then accuracy is improved, but processing time increases

Engineering Contradiction:

Improveescaping function accuracyVSAvoidpage processing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary automatic insertion of escaping functions based on context detection, then presents the changes to users for review and approval. This preliminary action allows the system to do the heavy lifting automatically while still allowing user verification, reducing overall processing time while maintaining accuracy through user approval.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements a feedback loop where users can review the automatically inserted escaping functions and provide approval or corrections. This feedback mechanism ensures accuracy by allowing user verification while the automated preliminary action reduces the time required compared to fully manual processes.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS10599755B2System and method for automatically inserting correct escaping functions for field references in a multi-tenant computing environment

Publication Date: 2020.03.24 SALESFORCE INC

AI summary

Methods and systems are provided for automatically correcting escaping functions in a module of page rendering code. The method includes: providing an HTML escaping schema and a script escaping schema; identifying a first character sequence having a first escaping function; determining whether the first character sequence is coded in HTML or coded as a scripted element; correcting the first escaping function using the HTML escaping schema if the first character sequence is coded in HTML; and correcting the first escaping function using the script escaping schema if the first character sequence is coded as a scripted element.