Secured Browser Plugin Code Package for Injection Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing browser plugins face security risks when injecting code into untrusted execution contexts, as this creates communication channels that can be intercepted or tampered with by untrusted web page code, compromising security and message integrity.
Innovation Solution
A secured code package for browser plugins is established, where a content script is executed first in a secure context, generating secrets and using encryption to secure message communication, ensuring that the injected code is executed before any web page code and deleting the script element to prevent secret leakage, thereby preventing unauthorized access and tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If browser plugins inject code directly into untrusted execution contexts to access certain browser parts, then the plugin can communicate with the injected code, but this creates communication channels that can be intercepted or tampered with by untrusted web page code
Solution Approach 1:
The code is segmented into trusted and untrusted execution contexts. The plugin code is injected into a secure context that is isolated from the untrusted web page context, creating a security boundary that prevents the web page from accessing or tampering with the plugin's communication channels while still allowing the plugin to access required browser parts through controlled APIs.
Solution Approach 2:
A secure context acts as an intermediary between the untrusted web page and the plugin's internal communication channels. The injected code runs in this secure context which mediates all communications, allowing the plugin to interact with the web page through controlled interfaces while preventing direct access to sensitive communication paths by untrusted code.
2Ease of operation
If the script element is kept in the DOM to maintain communication channels, then the plugin can communicate with injected code, but this exposes secrets to potential leakage by untrusted code
Solution Approach 1:
The script element is deleted from the DOM immediately after the injected code has been executed. This preliminary action ensures that the communication channels are established and the injected code runs with access to necessary secrets, but then the script element is removed to prevent any subsequent access or leakage of secrets by untrusted web page code.
Solution Approach 2:
The script element is treated as a temporary, disposable object that serves its purpose during code execution and then is discarded. The script element exists only briefly to inject and execute the plugin code, then is deleted from the DOM, ensuring that secrets associated with it do not persist and cannot be accessed by untrusted code later.
Data Source
AI summary
Systems, methods, and software can be used for securing injected codes of a browser plugin. One example of a method includes establishing a code package to be injected into a web page. The code package comprises at least one element, and the at least one element includes a first script to be executed before executing a code of the web page. The method further includes injecting the at least one element to the web page to execute the first script. The execution of the first script comprises generating a script element comprising one or more secrets. The method further comprises appending the script element to the web page and deleting the script element from the web page.