DOM-Based XSS Vulnerability Detection via Feature Code Injection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for detecting DOM-based XSS vulnerabilities are inefficient as they require multiple attempts with different JavaScript codes, reducing vulnerability finding capability and detection efficiency, as they can only detect vulnerabilities when the feature JavaScript code is executed and uses the same grammar as the dynamic web page context.

Innovation Solution

A method and apparatus that obtain parameter-value pairs from a web page, replace parameter values with feature code containing malicious characters, convert page content into a DOM tree, and detect XSS vulnerabilities without triggering the feature code execution, allowing for efficient detection by searching for inserted feature code in the DOM tree.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional methods execute feature JavaScript code to detect DOM-based XSS vulnerabilities, then detection accuracy is improved, but detection efficiency deteriorates due to multiple attempts required

Engineering Contradiction:

Improvedetection accuracyVSAvoiddetection efficiency

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent performs preliminary actions by injecting feature code into parameter values before DOM manipulation occurs, and then detects the feature code in the resulting DOM tree. This approach eliminates the need for multiple execution attempts while maintaining high detection accuracy, as the feature code is placed in positions where it will definitely appear in the DOM tree if XSS vulnerability exists.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses feature code as a marker that is copied into the DOM tree through DOM manipulation operations. By detecting the presence of this copied feature code in the DOM tree, the system can identify XSS vulnerabilities without executing JavaScript code multiple times, thus improving detection efficiency while maintaining accuracy.

Inventive Principle:

Principle #26Copying

2Adaptability or versatility

If multiple types of feature JavaScript code are used to trigger execution, then vulnerability finding capability is improved, but detection efficiency deteriorates due to time required for each attempt

Engineering Contradiction:

Improvevulnerability finding capabilityVSAvoiddetection time

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The patent performs preliminary injection of feature code into parameter values before DOM manipulation occurs. This allows the detection system to identify XSS vulnerabilities by simply checking for the presence of feature code in the DOM tree, eliminating the need for multiple time-consuming execution attempts with different JavaScript code types.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent extracts the execution requirement from the detection process. Instead of executing JavaScript code to trigger vulnerability manifestation, the system extracts feature code into the DOM tree structure itself, allowing detection through simple string matching in the DOM tree without any JavaScript execution.

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If feature JavaScript code execution is triggered, then XSS vulnerability detection is possible, but detection scope deteriorates as it only works when grammar matches dynamic web page context

Engineering Contradiction:

Improvedetection reliabilityVSAvoiddetection scope

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent introduces feature code as an intermediary marker between the parameter injection and vulnerability detection. This mediator allows the system to detect XSS vulnerabilities by checking for the presence of feature code in the DOM tree, bypassing the need for JavaScript execution and grammar matching, thereby expanding detection scope to all DOM-based XSS cases.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9754113B2Method, apparatus, terminal and media for detecting document object model-based cross-site scripting attack vulnerability

Publication Date: 2017.09.05 TENCENT TECHNOLOGY (SHENZHEN) CO LTD

AI summary

Disclosed are a method and apparatus for detecting a document object model (DOM) based cross-site scripting (XSS) vulnerability, an apparatus thereof, and a terminal are provided. The method includes: obtaining a set of parameter-value pairs from an original web address of a web page, where the set of parameter-value pairs comprises at least one parameter-value pair; replacing a parameter value in a parameter-value pair with feature code, to form a test web address for the web page, where the feature code comprises malicious code that comprises a malicious character and is uniquely identified in a DOM tree of the web page; obtaining page content corresponding to the test web address; converting the page content, into the DOM tree; and detecting whether a XSS vulnerability exists in the parameter-value pair, based on the DOM tree and the feature code.