Method, system, and computer program product for avoiding cross-site scripting attacks

• US 8,112,799 B1
• Filed: 08/22/2006
• Issued: 02/07/2012
• Est. Priority Date: 08/24/2005
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Loiodice, Luca, Patterson, Justin William
• Primary Examiner(s): Truong, Thanhnga
• Application Number:
  US11/508,076
• Time in Patent Office: 1,995 Days
• Field of Search: 726 22- 26, 726 2- 3, 709/203, 709/227, 709/228, 709/219, 709223-226, 707/10, 715/700, 725/52, 370/464, 713/194
• US Class Current: 726/22
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A system and method for protecting a user against a cross-site scripting attack or other network attack that relies on scripting code embedded within a uniform resource locator (URL) are described. Validation software executing on a client computer system may intercept a URL in response to a user providing the URL to a web browser or other client application. The validation software may analyze the URL to determine whether the URL includes scripting code. If the URL includes scripting code then the validation software may block the client application from accessing the URL or may otherwise inhibit access to the URL.

Claims

1. A computer-implemented method for avoiding a network attack, the method comprising:

executing a client program in a client computer system, wherein the client program executes to;

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to detect whether the URL includes one or more of;

scripting code elements defined by a first scripting language;

keywords identifying scripting code; and

tags identifying scripting code;

inhibit access to the URL in response to determining that the URL includes scripting code.

2. The method of claim 1,

wherein said inhibiting access to the URL comprises automatically blocking access to the URL.

3. The method of claim 1,

wherein the keywords comprise keywords defined by a first markup language for identifying scripting code;

wherein the tags comprise tags defined by a first markup language for identifying scripting code.

4. The method of claim 1,

wherein said analyzing the URL to determine whether the URL includes scripting code comprises analyzing the URL to detect whether the URL includes one or more of:

hypertext markup language (HTML) keywords identifying scripting code; and

/or

hypertext markup language (HTML) tags identifying scripting code.

5. The method of claim 1,

wherein said receiving the URL comprises receiving the URL in response to user input specifying the URL.

6. The method of claim 1,

wherein said receiving the URL comprises intercepting the URL in response to user input providing the URL to a client application;

wherein said inhibiting access to the URL comprises inhibiting the client application from accessing the URL.

7. A computer-implemented method for avoiding a network attack, the method comprising:

executing a client program in a client computer system, wherein the client program executes to;

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to detect whether the URL includes scripting code elements defined by a first scripting language; and

inhibit access to the URL in response to determining that the URL includes scripting code;

wherein said inhibiting access to the URL comprises;

displaying information indicating that the URL includes scripting code;

receiving user input indicating whether to block or allow access to the URL;

and one of;

blocking access to the URL if the user input indicates to block access to the URL;

or

allowing access to the URL if the user input indicates to allow access to the URL.

8. A tangible, non-transitory computer-readable storage medium storing program instructions executable by a client computer system to:

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to detect whether the URL includes one or more of;

escape sequences for characters that do not need to be escaped;

keywords identifying scripting code; and

tags identifying scripting code;

inhibit access to the URL in response to determining that the URL includes scripting code.

9. The computer-readable storage medium of claim 8, wherein said inhibiting access to the URL comprises automatically blocking access to the URL.

10. The computer-readable storage medium of claim 8, wherein said inhibiting access to the URL comprises:

displaying information indicating that the URL includes scripting code;

receiving user input indicating whether to block or allow access to the URL;

and one of;

blocking access to the URL if the user input indicates to block access to the URL;

or

allowing access to the URL if the user input indicates to allow access to the URL.

11. The computer-readable storage medium of claim 8, wherein said receiving the URL comprises intercepting the URL in response to user input providing the URL to a client application;

wherein said inhibiting access to the URL comprises inhibiting the client application from accessing the URL.

12. A client computer system comprising:

one or more processors; and

memory storing program instructions;

wherein the program instructions are executable by the one or more processors to;

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to detect whether the URL includes one or more of;

scripting code elements defined by a first scripting language; and

keywords identifying scripting code; and

tags identifying scripting code;

inhibit access to the URL in response to determining that the URL includes scripting code.

13. The system of claim 12,

wherein said receiving the URL comprises intercepting the URL in response to user input providing the URL to a client application;

wherein said inhibiting access to the URL comprises inhibiting the client application from accessing the URL.

14. A computer-implemented method for avoiding a network attack, the method comprising:

executing a client program in a client computer system, wherein the client program executes to;

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to determine whether the URL includes one or more of;

HTML-reserved syntax that is used for introducing a script on a web page; and

keywords identifying scripting code; and

tags identifying scripting code;

inhibit access to the URL in response to determining that the URL includes scripting code.

15. A computer-implemented method for avoiding a network attack, the method comprising:

executing a client program in a client computer system, wherein the client program executes to;

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to detect whether the URL includes one or more of;

escape sequences for characters that do not need to be escaped; and

keywords identifying scripting code; and

tags identifying scripting code;

inhibit access to the URL in response to determining that the URL includes scripting code.

16. A tangible, non-transitory computer-readable storage medium storing program instructions executable by a client computer system to:

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to detect whether the URL includes one or more of;

scripting code elements defined by a first scripting language;

keywords identifying scripting code; and

tags identifying scripting code

inhibit access to the URL in response to determining that the URL includes scripting code.

17. A tangible, non-transitory computer-readable storage medium storing program instructions executable by a client computer system to:

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to determine whether the URL includesone or more of;

HTML-reserved syntax that is used for introducing a script on a web page;

keywords identifying scripting code; and

tags identifying scripting code;

inhibit access to the URL in response to determining that the URL includes scripting code.

18. A client computer system comprising:

one or more processors; and

memory storing program instructions;

wherein the program instructions are executable by the one or more processors to;

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to determine whether the URL includes one or more of;

HTML-reserved syntax that is used for introducing a script on a web page; and

keywords identifying scripting code; and

tags identifying scripting code;

inhibit access to the URL in response to determining that the URL includes scripting code.

19. A client computer system comprising:

one or more processors; and

memory storing program instructions;

wherein the program instructions are executable by the one or more processors to;

receive a uniform resource locator (URL) in a request to access the URL, wherein the URL references a server computer system;

in response to receiving the URL, automatically analyze the URL to determine whether the URL includes scripting code, wherein said analyzing comprises analyzing the URL to detect whether the URL includes one or more of;

escape sequences for characters that do not need to be escaped;

keywords identifying scripting code; and

tags identifying scripting code;

inhibit access to the URL in response to determining that the URL includes scripting code.