Setting default security features for use with web applications and extensions

• US 8,566,901 B2
• Filed: 03/06/2012
• Issued: 10/22/2013
• Est. Priority Date: 10/28/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Kay, Erik, Barth, Adam
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/413,396
• Publication Number:
  US 20130117807A1
• Time in Patent Office: 595 Days
• Field of Search: 726/1, 726/25, 713/168
• US Class Current: 726/1
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

According to one general aspect, a computer-implemented method for implementing default security features for web applications and browser extensions includes receiving a request to include a web application or a web browser extension in a digital marketplace. A determination is made if the web application or the web browser extension conforms to default security features, wherein the default security features include a prohibition against running in-line script on web pages. The web application or the browser extension is included in the digital marketplace if the web application or the browser extension conforms to the default security features.

Claims

1. A computer-implemented method for implementing default security features for applications, comprising:

receiving a request from a developer of a plurality of developers to include a web application or a browser extension in a digital marketplace, wherein the web application or the browser extension is packaged in a format for distribution via the digital marketplace;

determining if the web application or the browser extension conforms to default security features;

allowing the developer to override one of the default security features if the developer declares the override in the request and if the developer receives permission from a curator of the digital marketplace;

labeling the override with a risk level;

storing the override and the label in a database of a server;

including the web application or the browser extension in the digital marketplace if the web application or the browser extension conforms to the default security features; and

displaying a notification related to the override prior to allowing a user to download the web application or the browser extension from the digital marketplace.

2. The computer-implemented method of claim 1, wherein the default security features include a prohibition against running in-line script on web pages.

3. The computer-implemented method of claim 1, wherein the default security features include a limit on an ability of the web application or the browser extension to run a predetermined JavaScript function.

4. The computer-implemented method of claim 1, wherein the default security features apply to features of standard web technologies.

5. The computer-implemented method of claim 1, further comprising:

evaluating, using a set of criteria, a request from the developer to override one of the default security features.

6. The method of claim 1, wherein the default security feature is a restriction against a predetermined JavaScript function.

7. The computer-implemented method of claim 1, further comprising:

evaluating, using a set of criteria, a request from a developer to bypass the default security feature.

8. The computer-implemented method of claim 1, further comprising:

receiving, at the server, an explicit declaration of the override from the developer of the web application or the browser extension.

9. The computer-implemented method of claim 1, wherein the web application is a packaged web application that may be executed locally on a computing device without access to a network.

10. A non-transitory computer-readable storage medium having recorded and stored thereon instructions that, when executed by a processor of a computer system cause the computer system to:

receive a request, from a developer of a plurality of developers to include a web application or a browser extension in a digital marketplace, wherein the web application or the browser extension is packaged in a format for distribution via the digital marketplace;

determine if the web application or the browser extension conforms to default security features;

allow the developers to override one of the default security features if the developer declares the override in the request and if the developer receives permission from a curator of the digital marketplace;

label the override with a risk level;

store the override and the label in a database of server;

include the web application or the browser extension in the digital marketplace if the web application or the browser extension conforms to the default security features; and

display a notification related to the override prior to allowing user to download the web application or the browser extension from the digital marketplace.

11. The non-transitory computer-readable storage medium of claim 10, further comprising instructions that, when executed by a processor of a computer system cause the computer system to:

limit an ability of the web application or the browser extension to run a predetermined JavaScript function.

12. The non-transitory computer-readable storage medium of claim 10, further comprising instructions that, when executed by a processor of a computer system cause the computer system to:

evaluate the request from the developer to override one of the default security features.

13. A system comprising:

a memory configured to store executable code; and

a processing device operably coupled to the memory, the processor configured to execute the code to;

receive a request, from a developer of a plurality of developers, to include a web application or a browser extension in a digital marketplace, wherein the web application or the browser extension is packaged in a format for distribution via the digital marketplace;

determine if the web application or the browser extension conforms to default security features;

allow an override of one of the default security features if the override is declared in the request and if the developer receives permission from a curator of the digital marketplace;

label the override with a risk level;

store the override and the label in a database of a server;

include the web application or the browser extension in the digital marketplace if the web application or the browser extension conforms to the default security features; and

display a notification related to the override prior to allowing a user to download the web application or the browser extension from the digital marketplace.

14. The system of claim 13, wherein the default security features include a prohibition against running in-line script on web pages.

15. The system of claim 13, wherein the default security features include a limit on an ability of the web application or the browser extension to run a predetermined JavaScript function.

16. The system of claim 13, wherein the web application is a packaged web application that may be executed locally on a computing device without access to a network.