{"id":1562,"date":"2016-11-29T01:55:10","date_gmt":"2016-11-29T01:55:10","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=1562"},"modified":"2016-11-29T01:57:29","modified_gmt":"2016-11-29T01:57:29","slug":"cspautogen-%e4%b8%80%e4%b8%aa%e8%87%aa%e5%8a%a8%e7%94%9f%e6%88%90%e5%b9%b6%e6%89%a7%e8%a1%8c%e5%86%85%e5%ae%b9%e5%ae%89%e5%85%a8%e7%ad%96%e7%95%a5%e7%9a%84%e9%bb%91%e7%9b%92%e7%b3%bb%e7%bb%9f","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=1562","title":{"rendered":"CSPAutoGen: \u4e00\u4e2a\u81ea\u52a8\u751f\u6210\u5e76\u6267\u884c\u5185\u5bb9\u5b89\u5168\u7b56\u7565\u7684\u9ed1\u76d2\u7cfb\u7edf"},"content":{"rendered":"

CSPAutoGen: \u4e00\u4e2a\u81ea\u52a8\u751f\u6210\u5e76\u6267\u884c\u5185\u5bb9\u5b89\u5168\u7b56\u7565\u7684\u9ed1\u76d2\u7cfb\u7edf<\/strong>
\n CSPAutoGen: Black-box Enforcement of Content Security<\/strong><\/p>\n

\u4f5c\u8005\uff1a\u6f58\u7fd4 \uff08\u7f8e\u56fd\u897f\u5317\u5927\u5b66\uff09
\n<\/p>\n

\u539f\u6587\u53d1\u8868\u5728ACM\u3000CCS 2016<\/p>\n

Content security policy (CSP) \u662f\u4e00\u9879\u57fa\u4e8e\u767d\u540d\u5355\u7684\uff0c\u4fdd\u62a4\u7528\u6237\u514d\u53d7XSS\u653b\u51fb\u7684\u673a\u5236\u3002\u76ee\u524d\u6240\u6709\u4e3b\u6d41\u6d4f\u89c8\u5668\u7686\u652f\u6301CSP\u3002CSP\u5141\u8bb8\u7f51\u7ad9\u5f00\u53d1\u8005\u5728\u6bcf\u4e2a\u9875\u9762\u4e0a\u5236\u5b9aCSP\u7b56\u7565\uff1a\u89c4\u5b9a\u4e00\u7ec4\u4fe1\u4efb\u7684JavaScript\u7684hosts\u6765\u4f5c\u4e3a\u8fd9\u4e2a\u9875\u9762JavaScript\u7684\u767d\u540d\u5355\u3002\u5f53\u8fd9\u4e2a\u9875\u9762\u5728\u7528\u6237\u6d4f\u89c8\u5668\u4e0a\u6e32\u67d3\u6267\u884c\u7684\u65f6\u5019\uff0c\u652f\u6301CSP\u7684\u6d4f\u89c8\u5668\u4f1a\u786e\u4fdd\u53ea\u6709\u6765\u81ea\u4e8e\u767d\u540d\u5355\u4e0a\u7684JavaScript\u80fd\u591f\u88ab\u6267\u884c\u3002\u540c\u65f6\uff0c\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0cCSP\u4f1a\u7981\u6b62\u6240\u6709\u7684inline script\u4ee5\u53caeval script\u3002\u7531\u4e8eCSP\u5141\u8bb8\u7528\u6237\u8bbe\u7f6e\u4e00\u4e9b\u201c\u975e\u5b89\u5168\u201d\u7684\u5173\u952e\u5b57(i.e., unsafe-inline and unsafe-eval) \u6765\u653e\u677e\u8fd9\u4e9b\u9650\u5236\uff0c\u56e0\u6b64CSP\u7684\u5b89\u5168\u6027\u4f1a\u53d7\u5230\u8fd9\u4e9b\u5173\u952e\u5b57\u7684\u4e25\u91cd\u5f71\u54cd\u3002<\/p>\n

\u867d\u7136CSP\u88ab\u6240\u6709\u4e3b\u6d41\u6d4f\u89c8\u5668\u652f\u6301\uff0c\u4f46\u76ee\u524d\u7531\u4e8e\u90e8\u7f72\u6210\u672c\u592a\u9ad8\uff0c\u90e8\u7f72CSP\u7684\u7f51\u7ad9\u8fd8\u662f\u5c11\u6570\uff1a\u5728Alexa Top\u524d\u4e00\u767e\u4e07\u7684\u7f51\u7ad9\u4e2d\uff0c\u53ea\u670920\u4e2a\u7f51\u7ad9\u90e8\u7f72\u4e86CSP [1]\u3002 \u540c\u65f6\uff0c\u5728\u90e8\u7f72CSP\u7684\u7f51\u7ad9\u4e2d\uff0c\u5f88\u591a\u7f51\u7ad9\u90fd\u4f7f\u7528\u4e86\u201c\u975e\u5b89\u5168\u201d\u7684\u5173\u952e\u5b57\uff0c\u8fd9\u6837\u867d\u7136\u7f51\u7ad9\u80fd\u6b63\u5e38\u6267\u884c\uff0c\u4f46\u662fCSP\u7684\u5b89\u5168\u6027\u5374\u88ab\u964d\u81f3\u6700\u4f4e\uff1a\u653b\u51fb\u8005\u53ef\u4ee5\u7528\u5f88\u591a\u79cd\u65b9\u5f0f\u8f7b\u677e\u7ed5\u8fc7CSP\u6765\u5b9e\u65bdXSS\u653b\u51fb\u3002\u4e3e\u4f8b\u6765\u8bf4\uff0c\u201c\u975e\u5b89\u5168\u201d\u5173\u952e\u5b57unsafe-inline\u88ab\u5f88\u591a\u7f51\u7ad9\u5199\u8fdb\u4e86CSP\u7b56\u7565\u91cc\uff0c\u8fd9\u6837\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u6ce8\u5165\u6076\u610f\u7684inline script\u6765\u5b9e\u65bdXSS\u653b\u51fb\uff0c\u5374\u6ca1\u6709\u8fdd\u53cdCSP\u7684\u7b56\u7565\uff0c\u56e0\u6b64\u5b8c\u5168\u7ed5\u8fc7\u4e86CSP\u7684\u9632\u5fa1\u3002<\/p>\n

\u4e3a\u4e86\u8ba9\u66f4\u591a\u7684\u7f51\u7ad9\u80fd\u591f\u5229\u7528CSP\u6765\u63d0\u9ad8\u5b89\u5168\u6027\uff0c\u5e76\u51cf\u5c11CSP\u7b56\u7565\u914d\u7f6e\u7684\u9519\u8bef\uff0c\u6211\u4eec\u63d0\u51fa\u4e86\u4e00\u4e2a\u9ed1\u76d2\u7cfb\u7edfCSPAutoGen, \u5b83\u8fd0\u884c\u5728\u7f51\u7ad9\u7684Web Application Firewall (WAF)\u4e0a\uff0c\u80fd\u591f\u901a\u8fc7\u5b9e\u65f6\u6539\u5199\u7f51\u9875\u7684\u65b9\u5f0f\u6765\u81ea\u52a8\u4e3a\u8be5\u7f51\u7ad9\u90e8\u7f72CSP\u3002\u5177\u4f53\u6765\u8bf4\uff0cCSPAutoGen\u8fd0\u884c\u5728\u4e09\u4e2a\u9636\u6bb5\u4e0b\uff1atraining phase, rewriting\u00a0phase \u4ee5\u53ca runtime phase\u3002 \u5728\u90e8\u7f72CSPAutoGen\u5230\u76ee\u6807\u7f51\u7ad9\u4e4b\u524d\uff0cCSPAutoGen\u9700\u8981\u8fd0\u884c\u5728training phase\u6765\u4ea7\u751f\u76ee\u6807\u7f51\u7ad9\u7684\u6a21\u7248\uff1b\u63a5\u4e0b\u6765\uff0cCSPAutoGen\u53ef\u4ee5\u88ab\u90e8\u7f72\u5728\u76ee\u6807\u7f51\u7ad9\u7684WAF\u4e0a\u6765\u4fdd\u62a4\u8be5\u7f51\u7ad9\u7684\u7528\u6237\uff1a\u5b83\u901a\u8fc7\u5b9e\u65f6\u4fee\u6539\u8f93\u51fa\u7f51\u9875\u7684\u65b9\u5f0f\uff0c\u6765\u4ea7\u751f\u90e8\u7f72\u4e86CSP\u7f51\u9875\u3002\u8be5\u7f51\u9875\u4e0a\u6240\u6709\u6b63\u5e38\u7684JavaScript\u90fd\u4f1a\u88ab\u4fdd\u5b58\u4e14\u5728\u5ba2\u6237\u7aef\u6b63\u786e\u6267\u884c\uff1b\u5f53\u4fee\u6539\u540e\u7684\u7f51\u9875\u88ab\u4f20\u8f93\u5230\u5ba2\u6237\u7aef\u5e76\u88ab\u6d4f\u89c8\u5668\u6e32\u67d3\u65f6\uff0cCSPAutoGen\u8fdb\u5165runtime phase\u3002\u5728\u8fd9\u4e2a\u9636\u6bb5, CSPAutoGen\u80fd\u4fdd\u8bc1\u6240\u6709\u5728\u5ba2\u6237\u7aef\u4ea7\u751f\u7684JavaScript\u90fd\u80fd\u88ab\u5b9e\u65f6\u6b63\u786e\u5904\u7406\u3002<\/p>\n

CSPAutoGen\u62e5\u6709\u4ee5\u4e0b\u51e0\u4e2a\u7279\u70b9\uff0c\u9996\u5148\uff0c\u4f5c\u4e3a\u4e00\u4e2a\u9ed1\u76d2\u7cfb\u7edf\uff0c\u5b83\u4e0d\u9700\u8981\u670d\u52a1\u5668\u7aef\u4ee3\u7801\u7684\u6539\u53d8\uff0c\u4e0d\u4f1a\u589e\u52a0\u7f51\u7ad9\u5f00\u53d1\u4eba\u5458\u8d1f\u62c5\uff1b\u5176\u6b21\uff0cCSPAutoGen\u901a\u8fc7\u4e00\u4e2a\u521b\u65b0\u7684\u6a21\u7248\u673a\u5236\uff0c\u80fd\u591f\u51c6\u786e\u5339\u914d\u5230\u672a\u77e5\u7684JavaScript\uff1b \u7136\u540e\uff0c\u901a\u8fc7\u82e5\u5e72\u6838\u5fc3\u6280\u672f\uff0cCSPAutoGen\u80fd\u591f\u6b63\u786e\u7684\u5c06\u6240\u6709\u7c7b\u578b\u7684script\u90fd\u8f6c\u5316\u4e3aCSP\u53ef\u517c\u5bb9\u7684\uff1a\u6b63\u5e38\u7684JavaScript\u4f1a\u88ab\u6267\u884c\uff0c\u6076\u610f\u7684JavaScript\u4f1a\u88ab\u7981\u6b62\u3002\u8fd9\u6837\uff0cCSPAutoGen\u8bbe\u7f6e\u7684\u7b56\u7565\u4e2d\uff0c\u4e0d\u9700\u8981\u4f7f\u7528\u4efb\u4f55\u201c\u975e\u5b89\u5168\u201d\u7684\u5173\u952e\u5b57\uff0c\u8fd8\u80fd\u4fdd\u8bc1\u90e8\u7f72\u8fc7CSP\u7684\u9875\u9762\u6b63\u5e38\u6267\u884c\uff0c\u4e0d\u4f1a\u51fa\u73b0\u517c\u5bb9\u95ee\u9898 (i.e., \u6b63\u5e38\u7684JavaScript\u88abCSP\u7981\u6389)\u3002<\/p>\n

\u901a\u8fc7\u6211\u4eec\u7684\u8be6\u5c3d\u7684\u6d4b\u8bd5\u8bc4\u4f30\uff0cCSPAutoGen\u80fd\u591f\u548cAlexa Top 50\u7f51\u7ad9\u517c\u5bb9\u3002\u5176\u4ea7\u751f\u7684\u989d\u5916\u8fd0\u884c\u5f00\u9500\u662f\u53ef\u4ee5\u63a5\u53d7\u7684(9.1%)\uff0c\u4e14\u8fd9\u90e8\u5206\u5f00\u9500\u53ef\u4ee5\u901a\u8fc7\u9009\u62e9\u66f4\u5feb\u6377\u7684DOM\u89e3\u6790\u5668\u6765\u8fdb\u4e00\u6b65\u964d\u4f4e\u3002\u5177\u4f53\u7ec6\u8282\u8bf7\u53c2\u89c1\u539f\u6587\u00a0[2]\u3002<\/p>\n

 <\/p>\n

References:<\/strong><\/p>\n

    \n
  1. M. Weissbacher, T. Lauinger, and W. Robertson. Why is CSP Failing? Trends and Challenges in CSP Adoption. in RAID. 2014.<\/li>\n<\/ol>\n
      \n
    1. X. Pan, Y. Cao, S. Liu, Y. Zhou, Y. Chen and T. Zhou, CSPAutoGen: Black-box Enforcement of Content Security, in CCS, 2016<\/li>\n<\/ol>\n

      Xiang Pan<\/strong><\/p>\n

      Xiang\u00a0pan is a 6th year computer science PhD student at Northwestern University, advised by professor Yan Chen. Xiang received his B.S. degree in Computer Science from Nanjing University, Nanjing, China in 2011. Before majoring Computer Science, I studied Education Science in Nanjing University from 2006 to 2008.<\/p>\n

      Xiang\u2019s research projects cover a wide range of topics, ranging from web security, SDN security, Android security and credit card security. \u00a0In the past five years, he has published six papers in the field of security and privacy, among which he has served as the first author of two papers published in top-tier conferences (i.e., NDSS and CCS); another paper won the best paper award and has been featured by more than 30 media outlets; two projects he built have been adopted\u00a0by two large companies.<\/p>\n","protected":false},"excerpt":{"rendered":"

      CSPAutoGen: \u4e00\u4e2a\u81ea\u52a8\u751f\u6210\u5e76\u6267\u884c\u5185\u5bb9\u5b89\u5168\u7b56\u7565\u7684\u9ed1\u76d2\u7cfb\u7edf CSPAutoGen: Black… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1562","post","type-post","status-publish","format-standard","hentry","category-research"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1562"}],"version-history":[{"count":4,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1562\/revisions"}],"predecessor-version":[{"id":1566,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1562\/revisions\/1566"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1562"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}