Persistent Test Identities for Cross-Feature XSS Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting and preventing encoding errors, particularly stored XSS errors, on feature-rich websites is challenging due to their complex nature and the difficulty in identifying errors that span multiple features, leading to security vulnerabilities and usability issues.
Innovation Solution
A system that uses dynamic code analysis and automated testing with test identities to detect encoding errors, including reflected and stored XSS errors, by reusing existing tests and modifying attributes to simulate injection scenarios, allowing for robust detection and reporting of errors across multiple features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional testing methods are used for each feature independently, then testing overhead is high and custom tests must be created for each feature, but encoding errors spanning multiple features cannot be detected
Solution Approach 1:
The patent creates persistent test identities that can be reused across multiple features and testing scenarios. Instead of creating separate tests for each feature, a single test identity can be used to test multiple features, reducing testing overhead while maintaining comprehensive coverage for detecting encoding errors across feature boundaries.
Solution Approach 2:
The patent merges multiple testing efforts into a unified framework by using persistent test identities that span across different features. This consolidation allows the system to detect encoding errors that occur across multiple features without requiring separate testing infrastructure for each feature, thereby reducing overall testing complexity.
2Adaptability or versatility
If features are developed by different developers or teams, then feature richness is improved, but coordination and error detection across features become difficult
Solution Approach 1:
The patent introduces persistent test identities as intermediaries that facilitate communication and error detection across features developed by different teams. These test identities act as a common reference point that allows different developers to coordinate their testing efforts and detect encoding errors that span multiple features, even when those features were developed independently.
3Reliability
If stored XSS errors are detected, then security is improved, but the errors are difficult to detect because they span multiple pages or features
Solution Approach 1:
The patent employs preliminary action by using persistent test identities to proactively detect stored XSS errors before they can affect production systems. The test identities are established in advance and used to systematically test multiple features and pages, allowing the detection of stored XSS errors that would otherwise be difficult to find due to their distributed nature across multiple features.
Data Source
AI summary
A system and method for dynamically scanning one or more features on a Website. The system allows detecting of stored scripting errors, where an attack or injection occurs on a page or feature that results in executing malicious code by another page or feature. The system uses stored test identities and allows testing reuse.