Hybrid JavaScript Security Testing for DOM-Based XSS

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for JavaScript security testing are inadequate in identifying client-side vulnerabilities, particularly DOM-based Cross Site Scripting (XSS), due to their inability to effectively analyze dynamic and evolving document object model (DOM) states within complex web applications.

Innovation Solution

A hybrid approach combining static and dynamic analysis techniques, utilizing a headless browser and JavaScript execution engine to simulate user interactions, generate bytecode, and apply custom rules to detect vulnerabilities by examining DOM mutations and data flows, thereby reducing false positives and identifying executable JavaScript threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If static analysis is used to analyze JavaScript code, then analysis speed is improved, but the ability to detect dynamic DOM-based vulnerabilities deteriorates

Engineering Contradiction:

Improveanalysis speedVSAvoidvulnerability detection capability

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The patent combines static analysis and dynamic analysis into a hybrid approach. The static analysis component quickly scans JavaScript source code to identify potential vulnerabilities, while the dynamic analysis component executes the code in a controlled environment to verify actual security issues. This merging allows the system to maintain high analysis speed while improving vulnerability detection accuracy, particularly for DOM-based XSS vulnerabilities that require runtime behavior observation.

Inventive Principle:

Principle #5Merging (Combining)

2Reliability

If dynamic analysis is used to execute JavaScript code, then vulnerability detection capability is improved, but analysis speed and resource consumption deteriorate

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidanalysis speed

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The patent applies preliminary action by first performing static analysis on JavaScript code to identify suspicious patterns and potential vulnerabilities before executing dynamic analysis. This preliminary identification allows the system to focus dynamic analysis only on high-risk code segments, significantly reducing the overall analysis time and resource consumption while maintaining high vulnerability detection capability.

Inventive Principle:

Principle #10Preliminary action

3Ease of operation

If traditional security testing methods are used, then ease of operation is maintained, but the ability to identify client-side vulnerabilities deteriorates

Engineering Contradiction:

Improveease of operationVSAvoidvulnerability identification accuracy

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The patent introduces an intermediary component that acts as a bridge between traditional security testing methods and advanced static/dynamic analysis techniques. This intermediary layer processes and enriches test data, applies sophisticated analysis algorithms, and presents results in a format compatible with existing security workflows. This allows the system to maintain ease of operation for users while significantly improving vulnerability identification accuracy through advanced analysis capabilities.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10637881B2Javascript security testing

Publication Date: 2020.04.28 MICRO FOCUS LLC

AI summary

In one example in accordance with the present disclosure, a method may include receiving an initial document object model (DOM) corresponding to an HTML page structure including a plurality of executable JavaScript code and simulating user interaction with an executable JavaScript code belonging to the plurality in the HTML page structure. The method may include adjusting the initial DOM based on the simulated user interaction, generating byte code corresponding to the adjust DOM and analyzing the byte code using a set of static rules.