Systems and methods for determining compliance of references in a website

• US 9,251,282 B2
• Filed: 06/21/2010
• Issued: 02/02/2016
• Est. Priority Date: 06/21/2010
• Status: Active Grant

• Current Assignee: Rapid7 (Rapid7, Inc.)
• Original Assignee: Rapid7 (Rapid7, Inc.)
• Inventors: Loder, Chad
• Primary Examiner(s): NANO, SARGON N
• Application Number:
  US12/819,510
• Publication Number:
  US 20110314152A1
• Time in Patent Office: 2,052 Days
• Field of Search: 709/203, 709/212, 709/216, 709/217, 709/219, 709/224, 709/225, 709/226, 726/1, 726/2, 726/22, 726/26
• US Class Current: 1/1
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links

Abstract

Systems and methods of determining compliance of content in a website or web application are disclosed. The systems and methods comprise a compliance tool to retrieve data associated with website or web application content. The compliance tool can scan the data to determine references to network locations. The compliance tool can compare the references to one or more approval rules to determine whether the references comply with the approval rules. A report can be compiled and outputted that indicates which references comply and which references do not comply with the approval rules. A user can have the option to add non-complying references to an approved list. The compliance tool can further remove non-complying references from the website or web application data and/or register non-complying references with a firewall.

Claims

1. A method of determining compliance of content in a website or web application, the method comprising:

receiving a request to scan a website or a web application comprising a reference to a network location, wherein the request is received from a responsible entity of the website or web application;

scanning the website or the web application;

identifying, by a processor, the reference to the network location based on scanning the website or the web application;

determining that the reference to the network location is not contained in a list of approved references to network locations;

determining whether the reference to the network location complies with rules, wherein the rules comprises a compliance with valid domains, a compliance with valid universal resource locators (URLs), compliance with valid JavaScript links, compliance with valid URL patterns, compliance with valid file extensions, compliance with valid file types, possession of signed security keys from an approved certificate authority, and at least one rule based on a hierarchical structure within an entity;

scanning content of the network location accessible via the reference;

determining, based on the scan of the content, whether the network location includes malicious content, the malicious content comprising at least one of spyware, malware, or a virus;

in response to the network location including malicious content;

reporting, to the responsible entity of the website or that web application, that the reference to the network location is associated with malicious content; and

in response to the network location not including malicious content;

adding the reference to the network location to the list of approved references to network locations.

2. The method of claim 1, the method further comprising:

providing a report indentifying that that the network location does not include malicious content, wherein providing the report comprises displaying the report in a graphical user interface (GUI).

3. The method of claim 1, the method further comprising:

receiving, prior to adding the reference, a request to add the reference to the network location to the list of approved references to network locations.

4. The method of claim 1, the method further comprising:

analyzing the content of the network location that is accessible via the reference;

determining, based on the analyzing, that the network location includes malicious content; and

removing the reference to the network location from the website or web application.

5. The method of claim 1, the method further comprising:

analyzing the content of the network location that is accessible via the reference;

determining, based on the analyzing, that the network location includes malicious content; and

removing the reference to the network location from the list of approved references to network locations.

6. The method of claim 1, the method further comprising:

publishing the website or web application if the reference to the network location complies with the one or more approval rules.

7. The method of claim 1, wherein scanning the website or the web application comprises traversing the website or web application, analyzing source code of the website or web application, or analyzing compiled binary code or bytecode of the website or web application.

8. The method of claim 1, the method further comprising:

retrieving the content of the network location.

9. A non-transitory computer readable storage medium embodying instructions for causing a processor to perform a method comprising:

receiving a request to scan a website or a web application comprising a reference to a network location, wherein the request is received from a responsible entity of the website or web application;

scanning the website or the web application;

identifying, by a processor, the reference to the network location based on scanning the website or the web application;

determining that the reference to the network location is not contained in a list of approved references to network locations;

determining whether the reference to the network location complies with rules, wherein the rules comprises a compliance with valid domains, a compliance with valid universal resource locators (URLs), compliance with valid JavaScript links, compliance with valid URL patterns, compliance with valid file extensions, compliance with valid file types, possession of signed security keys from an approved certificate authority, and at least one rule based on a hierarchical structure within an entity;

scanning content of the network location accessible via the reference;

determining, based on the scan of the content, whether the network location includes malicious content, the malicious content comprising at least one of spyware, malware, or a virus;

in response to the network location including malicious content;

reporting, to the responsible entity of the website or that web application, that the reference to the network location is associated with malicious content; and

in response to the network location not including malicious content;

adding the reference to the network location to the list of approved references to network locations.

10. The non-transitory computer readable storage medium of claim 9, the method further comprising:

providing a report identifying that the network location does not include malicious content, wherein providing the report comprises displaying the report in a graphical user interface (GUI).

11. The non-transitory computer readable storage medium of claim 9, the method further comprising:

receiving, prior to adding the reference, a request to add the reference to the network location to the list of approved references to network locations.

12. The non-transitory computer readable storage medium of claim 9, the method further comprising:

analyzing the content of the network location that is accessible via the reference;

determining, based on the analyzing, that the network location includes malicious content; and

removing the reference to the network location from the website or web application.

13. The non-transitory computer readable storage medium of claim 9, the method further comprising:

publishing the website or web application if the reference to the network location complies with the one or more approval rules.

14. The non-transitory computer readable storage medium of claim 9, wherein scanning the website or the web application comprises traversing the website or web application, analyzing source code of the website or web application, or analyzing compiled binary code or bytecode of the website or web application.

15. The non-transitory computer readable storage medium of claim 9, the method further comprising:

retrieving the content of the network location.

16. A system for determining compliance of content in a website or web application, comprising:

a processor; and

a computer readable storage medium coupled to the processor and comprising instructions for causing the processor to perform a method comprising;

receiving a request to scan a website or a web application comprising a reference to a network location, wherein the request is received from a responsible entity of the website or web application;

scanning the website or the web application;

identifying, by the processor, the reference to the network location based on scanning the website or the web application;

determining that the reference to the network location is not contained in a list of approved references to network locations;

determining whether the reference to the network location complies with rules, wherein the rules comprises a compliance with valid domains, a compliance with valid universal resource locators (URLs), compliance with valid JavaScript links, compliance with valid URL patterns, compliance with valid file extensions, compliance with valid file types, possession of signed security keys from an approved certificate authority, and at least one rule based on a hierarchical structure within an entity;

scanning content of the network location accessible via the reference;

determining, based on the scan of the content, whether the network location includes malicious content, the malicious content comprising at least one of spyware, malware, or a virus;

in response to the network location including malicious content;

reporting, to the responsible entity of the website or that web application, that the reference to the network location is associated with malicious content; and

in response to the network location not including malicious content;

adding the reference to the network location to the list of approved references to network locations.

17. The system of claim 16, the method further comprising:

providing a report identifying that the network location does not include malicious content, wherein providing the report comprises displaying the report in a graphical user interface (GUI).

18. The system of claim 16, the method further comprising:

receiving, prior to adding the reference, a request to add the reference to the network location to the list of approved references to network locations.

19. The system of claim 16, the method further comprising:

analyzing the content of the network location that is accessible via the reference;

determining, based on the analyzing, that the network location includes malicious content; and

removing the reference to the network location from the website or web application.

20. The system of claim 16, the method further comprising:

publishing the website or web application if the reference to the network location complies with one or more approval rules.

21. The system of claim 16, wherein scanning the website or the web application comprises traversing the website or web application, analyzing source code of the website or web application, or analyzing compiled binary code or bytecode of the website or web application.

22. The system of claim 16, the method further comprising:

retrieving the content of the network location.