HTML FILTER FOR PREVENTION OF CROSS SITE SCRIPTING ATTACKS

• US 20090292983A1
• Filed: 12/01/2008
• Published: 11/26/2009
• Est. Priority Date: 11/30/2007
• Status: Abandoned Application

• Current Assignee: Fox Interactive Media Incorporated (The Walt Disney Company)
• Original Assignee: Fox Interactive Media Incorporated (The Walt Disney Company)
• Inventors: Kaminsky, Dan, Anand, Kunal
• Application Number:
  US12/325,357
• Publication Number:
  US 20090292983A1
• Time in Patent Office: Days
• US Class Current: 715/234
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow

Abstract

An HTML filter is described that converts HTML tags into HTML object and associated param tags. In an exemplary embodiment, the present HTML filter also validates existing object tags so that they may render in at least one, and optionally all, major browsers. In another exemplary embodiment, the presently described HTML filter also serves as a configurable whitelist for rich media (through controlling particular attributes, e.g., “classid”, in the object tag and affiliated param tags).

Claims

1. A method for modifying hypertext markup language to prevent cross site scripting attacks, comprising:

providing a filter for said hypertext markup language, wherein said filter acts on hypertext markup language tags and converts said tags into hypertext markup language object tags and associated parameter tags to prevent cross site scripting attacks.

2. A method in accordance with claim 1, wherein said hypertext markup language filter also validates existing object tags so that they are configured to render in a plurality of browsers.

3. A method in accordance with claim 1, wherein said hypertext markup language filter further acts as a configurable whitelist for rich media.

4. A method in accordance with claim 3, wherein said hypertext markup language filter controls particular attributes in the object tag and affiliated parameter tags to provide said whitelist.

5. A method in accordance with claim 4, wherein said hypertext markup language filter controls “

classid”

attributes in the object tag and affiliated parameter tags.

6. A method in accordance with claim 2, wherein said hypertext markup language filter acts as a configurable whitelist for rich media.

7. A method in accordance with claim 6, wherein said hypertext markup language filter controls particular attributes in the object tag and affiliated parameter tags to provide said whitelist.

8. A method in accordance with claim 7, wherein said hypertext markup language filter controls “

classid”

attributes in the object tag and affiliated parameter tags.