Enhancing JavaScript with Transactions Mohan Dhawan †, Chung-chieh Shan ‡ and Vinod Ganapathy † † Department of Computer Science, Rutgers University ‡ School of Informatics and Computing, Indiana University November 24, 2015ECOOP 20121

Problem Web applications include third party content Examples: widgets, advertisements, libraries May contain untrusted, malicious JavaScript November 24, 2015ECOOP 20122

Example from nytimes.com Rogue third party advertisement Displayed image of fake virus scan Client security and privacy at risk November 24, 2015ECOOP 20123

Solution: Transcript Extend JavaScript to support Transactions Execute untrusted content speculatively Commit changes after policy enforcement Transaction Web Application November 24, 2015ECOOP 20124

Goal Protect the Web application from security violating actions of untrusted JavaScript Must handle arbitrary third party code written in JavaScript Including constructs such as eval, this, with. Must enforce powerful security policies Allow pop-ups from white-listed websites only. Dis-allow innerHTML in the context of host Web application. November 24, 2015ECOOP 20125

Contributions JavaScript transactions Speculative execution of unmodified third party JavaScript code Transaction suspend/resume Allow host Web application to mediate external actions like DOM and AJAX operations Speculative DOM updates November 24, 2015ECOOP 20126

Schematic use of Transcript // Web application code var tx = transaction{... // unmodified 3 rd party code... }; // Introspection block goes below /* policy enforcement code */ // validate actions of the transaction tx.commit(); //Rest of the Web application code Transaction Web Application November 24, 2015ECOOP 20127

Example: Untrusted code // Web application code var tx = transaction{ var image = document.createElement("img"); var url = " var params = document.cookie; image.src = url + "?cookie=" + params; document.body.appendChild(image);... Array.prototype.join = function() { return "evilString"; }; }; Transaction Web Application November 24, 2015ECOOP 20128

November 24, tx = transaction {... body.appendChild(image);... }; do {... tx = tx.resume();... } while(tx.isSuspended()); tx.commit(); Web application code … Rest of the Web application Transcript runtime system Introspection block Transcript Runtime 1 DOM TX R/W sets call stack 3 rd party Transaction object tx web app …… 13 Transcript clones the host’s DOM when the transaction starts. DOM orig DOM TX Clone 1 web app call stack 3 rd -party …… 12 web app On a transaction suspend, the Transcript runtime saves all the i) read write sets, ii) speculative DOM, and iii) stack frames till the nearest transaction delimiter to create a Transaction object … call stack 3 rd party 5 DOM TX R/W sets call stack 3 rd party Transaction object tx web app* Transcript runtime loads the saved read write sets and stack frames when the transaction resumes. resume … 4 web app* image + DOM TX DOM’ TX appendChild tx’s write set + Heap orig Heap new DOM’ TX DOM new In the introspection block, the host performs the action (appendChild) on behalf of the guest. November 24, 2015ECOOP 20129

Transaction suspend and resume Transaction Web Application var tx = transaction{... document.body.appendChild(image); }; do{ var rs = tx.getReadSet(), arg = tx.getArgs(); switch(tx.getCause()) { case "appendChild": if (arg[0].nodeName.match("IMG") && !rs.checkMembership(document,"cookie"))‏ obj.appendChild(arg[0]); break; }; /* end switch */ tx = tx.resume(); }while(tx.isSuspended()); if (!(arg[0].nodeName.match("IMG") && rs.checkMembership(document,"cookie"))‏ obj.appendChild(arg[0]); Policy November 24, 2015ECOOP

Read and Write Sets var tx = transaction{... Array.prototype.join = function() { return " evilString " ; }; }; /* Introspection Code */ var ws = tx.getWriteSet(); if(ws.checkMembership(Array.prototype, " * " ) { to_commit = false; } // Rest of the web application code Transaction Web Application var ws = tx.getWriteSet(); if(ws.checkMembership(Array.prototype, "*")){ to_commit = false; } Policy November 24, 2015ECOOP

Gluing var tx = transaction{... document.write(‘<script src= “newcode.js”> ’) ; }; // Introspection block // Rest of the web application code Transaction Web Application November 24, 2015ECOOP

Implementation Prototype implementation in Firefox 3.7a4 Added new JavaScript features transaction keyword and Transaction object Modified SpiderMonkey op-codes to Log all object accesses Suspend on DOM / AJAX calls Added speculative execution support for DOM operations Re-direct all node accesses to the cloned copy November 24, 2015ECOOP

Evaluation Goals Study applicability of Transcript in isolating real guest code Measure performance impact on guest code and micro- benchmarks Demonstrate graceful recovery in presence of malicious and buggy guests Methodology Isolated the guest code in a Web application using transactions Introspection block for each transaction enforced a number of general and domain specific policies November 24, November 24, 2015ECOOP

Applicability of Transcript Applied Transcript on five JavaScript widgets and applications Stand-alone and library based No difference in behavior and functionality November 24, BenchmarksPolicies JS MenuNo network or cookie access Picture PuzzleDisallow attaching key event handlers Spell Checker No XMLHttpRequest if cookies were read GreyBox iframes to whitelisted URLs only Color Picker No innerHTML in host’s context November 24, 2015ECOOP

Performance - Application benchmarks November 24, Overhead = 0.16s November 24, 2015ECOOP

Performance – Microbenchmarks (Function calls) November 24, MicroBenchmarkOverhead Native Functions eval(“if (true) true; false;”)6.87x fn.call(this, i)1.89x External Operations getElementById(“checkbox”)6.78x createElement(“div”)3.69x addEventListener(“click”, clk, false)26.51x dispatchEvent(evt)1.20x document.write(“ x = 1; ”)2.01x document.write(“ Hi ”)1.26x November 24, 2015ECOOP

Performance – Microbenchmarks (JavaScript Events) November 24, Average overhead of just 94μs per event. Event nameOverhead NormalizedRaw delay(µs) Drag event ( drag ) 1.71x97 Keyboard event ( keypress ) 1.16x150 Message event ( message ) 1.17x85 Mouse event ( click ) 1.54x86 Mouse event ( mouseover ) 2.05x88 Mutation event ( DOMAttrModified ) 2.14x88 UI Event ( overflow ) 1.97x61 November 24, 2015ECOOP

Recovery Clickjacking November 24, document.write(` Goto Amazon ');... document.write(` Goto Amazon '); November 24, 2015ECOOP

Related Work Staged information flow in JavaScript: PLDI'09 hybrid framework for JavaScript with the aim of protecting Web applications from untrusted code Conscript: S&P'10 aspect-oriented framework to specify and enforce fine- grained security policies for Web applications AdJail: Security'10 isolation mechanism to protect Web application content from malicious advertisements Caja, FBJS, AdSafe, etc. November 24, 2015ECOOP

Conclusion Transcript implements JavaScript transactions to provide isolation and recovery Suspend operations that break isolation Resume operation if web application allows Enforcement of powerful security policies All data reads / writes are recorded Ability to inspect reads / writes before commit No restriction or changes to third party code November 24, 2015ECOOP

Questions ? November 24, 2015ECOOP

Event handler wrapper generation November 24, 2015ECOOP var tx = transaction{... node.addEventListener(“click”, handler, false); }; // Introspection block tx_handler = function(evt) { evt_tx = transaction { handler(evt); } iblock_func(evt_tx); } evt_tx = transaction { handler(evt); } var tx = transaction{... node.addEventListener(“click”, tx_handler, false); }; // Introspection block

A complete example November 24, (function () { var to_commit = true, e = eval; // indirect eval var tx = transaction{e(getFunctionBody(menu)); }; do {... tx = tx.resume(); } while(tx.isSuspended()); if(to_commit) tx.commit(); )(); November 24, 2015 ECOOP