Securing resources from untrusted scripts behind firewalls

• US 7,444,678 B2
• Filed: 06/14/2004
• Issued: 10/28/2008
• Est. Priority Date: 10/28/2003
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: AOL LLC (Apollo Global Management, Inc.)
• Inventors: Whitmer, Ray, Dhurvasula, Harish
• Primary Examiner(s): Truong; Thanhnga B
• Application Number:
  US10/868,414
• Publication Number:
  US 20050091536A1
• Time in Patent Office: 1,597 Days
• Field of Search: 726 22- 25, 726/4, 713/170, 713/152, 713165-167
• US Class Current: 726/22
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine

Abstract

The invention provides a new mechanism which is used to protect all internal resources against requests from sandboxed scripts. In the preferred embodiment, the mechanism is implemented for SOAP calls by untrusted scripts. When an attempt is made to access a resource at a previously-unknown URI, the sandbox reads a file at that domain with declarations to determine whether access is permitted to the script. If the file is not found, the access is denied.

Claims

1. A method for protecting internal resources against an untrusted script originated from an external server, said script being executed in a security sandbox behind a network firewall, said method comprising the steps of:

responsive to said untrusted script requesting access to an internal resource at a request URI, said security sandbox loading a script control definition from a declaration file at the root directory of said request URI, said script control definition comprising allowable request types and script originations;

said security sand box validating said script control definition at said root directory;

if said request URI is not a subdirectory, allowing said untrusted script to access said internal resource only in response to operations comprising;

said security sandbox verifying that the type of request is allowed in said script control definition at said root directory;

said security sandbox verifying that the origination of said untrusted script is allowed in said script control definition at said root directory;

if said request URI is a subdirectory, allowing said untrusted script to access said internal resource only in response to operations comprising;

said security sandbox verifying that delegation is allowed in said script control definition at root directory;

only if delegation is allowed, said security sandbox loading a script control definition from a declaration file at said subdirectory of said request URI, said script control definition at said subdirectory comprising allowable request types and script originations;

said security sand box validating said script control definition at said subdirectory;

said security sandbox verifying that the type of request is allowed in said script control definition at said subdirectory;

said security sandbox verifying that the origination of said untrusted script is allowed in said script control definition at said subdirectory.

2. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said declaration file is not found at said root directory.

3. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said security box cannot validate said script control definition at said root directory.

4. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said type of request is not allowed in said script control definition at said root directory.

5. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said origination of request is not allowed in said script control definition at said root directory.

6. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said declaration file is not found at said subdirectory.

7. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said security box cannot validate said script control definition at said subdirectory.

8. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said type of request is not allowed in said script control definition at said subdirectory.

9. The method of claim 1, further comprising the step of:

said security sandbox denying said untrusted script to accept said internal resource when said origination of request is not allowed in said script control definition at said subdirectory.

10. The method of claim 1, wherein any type of request is allowed when “

any”

is specified as the type to be allowed in a declaration file.

11. The method of claim 1, wherein scripts from all origination are allowed when allowed originations are not specified in a declaration file.

12. The method of claim 1, wherein wildcard characters are used to specify originations from which scripts are allowed.

13. The method of claim 1, wherein said script control definitions are cached by said sandbox so that said script control definitions are only loaded once.

14. The method of claim 1, wherein said request URI specifies a SOAP request.

15. The method of claim 1, wherein said declaration files are of XML.