{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:43:27Z","timestamp":1785512607760,"version":"3.56.0"},"publisher-location":"New York, NY, USA","reference-count":32,"publisher":"ACM","license":[{"start":{"date-parts":[[2012,10,16]],"date-time":"2012-10-16T00:00:00Z","timestamp":1350345600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2012,10,16]]},"DOI":"10.1145\/2382196.2382274","type":"proceedings-article","created":{"date-parts":[[2012,10,15]],"date-time":"2012-10-15T17:13:12Z","timestamp":1350321192000},"page":"736-747","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":191,"title":["You are what you include"],"prefix":"10.1145","author":[{"given":"Nick","family":"Nikiforakis","sequence":"first","affiliation":[{"name":"KU Leuven, Leuven, Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Luca","family":"Invernizzi","sequence":"additional","affiliation":[{"name":"University of California, Santa Barbara, Santa Barbara, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alexandros","family":"Kapravelos","sequence":"additional","affiliation":[{"name":"University of California, Santa Barbara, Santa Barbara, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Steven","family":"Van Acker","sequence":"additional","affiliation":[{"name":"KU Leuven, Leuven, Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wouter","family":"Joosen","sequence":"additional","affiliation":[{"name":"KU Leuven, Leuven, Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Christopher","family":"Kruegel","sequence":"additional","affiliation":[{"name":"University of California, Santa Barbara, Santa Barbara, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Frank","family":"Piessens","sequence":"additional","affiliation":[{"name":"KU Leuven, Leuven, Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Giovanni","family":"Vigna","sequence":"additional","affiliation":[{"name":"University of California, Santa Barbara, Santa Barbara, CA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2012,10,16]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Apache.org. https:\/\/blogs.apache.org\/infra\/entry\/apache_org_04_09_2010.  Apache.org. https:\/\/blogs.apache.org\/infra\/entry\/apache_org_04_09_2010."},{"key":"e_1_3_2_1_2_1","unstructured":"Qtip compromised. https:\/\/github.com\/Craga89\/qTip2\/issues\/286.  Qtip compromised. https:\/\/github.com\/Craga89\/qTip2\/issues\/286."},{"key":"e_1_3_2_1_3_1","unstructured":"SSL Labs Server Rating Guide. https:\/\/www.ssllabs.com\/downloads\/SSL_Server_Rating_Guide_2009.pdf.  SSL Labs Server Rating Guide. https:\/\/www.ssllabs.com\/downloads\/SSL_Server_Rating_Guide_2009.pdf."},{"key":"e_1_3_2_1_4_1","unstructured":"Wayback Machine. http:\/\/archive.org.  Wayback Machine. http:\/\/archive.org."},{"key":"e_1_3_2_1_5_1","unstructured":"Alexa - Top sites on the Web. http:\/\/www.alexa.com\/topsites.  Alexa - Top sites on the Web. http:\/\/www.alexa.com\/topsites."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/1755688.1755706"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382275"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.15"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2076732.2076774"},{"key":"e_1_3_2_1_10_1","unstructured":"I. Hickson and D. Hyatt. HTML 5 Working Draft - The sandbox Attribute. http:\/\/www.w3.org\/TR\/html5\/the-iframe-element.html#attr-iframe-sandbox June 2010.  I. Hickson and D. Hyatt. HTML 5 Working Draft - The sandbox Attribute. http:\/\/www.w3.org\/TR\/html5\/the-iframe-element.html#attr-iframe-sandbox June 2010."},{"key":"e_1_3_2_1_11_1","unstructured":"S. Hisao. Tiny HTTP Proxy in Python. http:\/\/www.okisoft.co.jp\/esc\/python\/proxy\/.  S. Hisao. Tiny HTTP Proxy in Python. http:\/\/www.okisoft.co.jp\/esc\/python\/proxy\/."},{"key":"e_1_3_2_1_12_1","unstructured":"P. C. Industry. (Approved Scanning Vendor) Program Guide. https:\/\/www.pcisecuritystandards.org\/pdfs\/asv_program_guide_v1.0.pdf.  P. C. Industry. (Approved Scanning Vendor) Program Guide. https:\/\/www.pcisecuritystandards.org\/pdfs\/asv_program_guide_v1.0.pdf."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2011.28"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.48"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-27937-9_17"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.36"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14577-3_15"},{"key":"e_1_3_2_1_18_1","unstructured":"OWASP. \"cross-site scripting (xss)\". https:\/\/www.owasp.org\/index.php\/XSS.  OWASP. \"cross-site scripting (xss)\". https:\/\/www.owasp.org\/index.php\/XSS."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1533057.1533067"},{"key":"e_1_3_2_1_20_1","first-page":"3","volume-title":"Proceedings of the 2010 USENIX conference on Web application development, WebApps'10","author":"Ratanaworabhan P.","year":"2010","unstructured":"P. Ratanaworabhan , B. Livshits , and B. G. Zorn . JSMeter: comparing the behavior of JavaScript benchmarks with real web applications . In Proceedings of the 2010 USENIX conference on Web application development, WebApps'10 , pages 3 -- 3 , Berkeley, CA, USA , 2010 . USENIX Association. P. Ratanaworabhan, B. Livshits, and B. G. Zorn. JSMeter: comparing the behavior of JavaScript benchmarks with real web applications. In Proceedings of the 2010 USENIX conference on Web application development, WebApps'10, pages 3--3, Berkeley, CA, USA, 2010. USENIX Association."},{"key":"e_1_3_2_1_21_1","first-page":"61","volume-title":"OSDI '06: Proceedings of the 7th symposium on Operating Systems Design and Implementation","author":"Reis C.","year":"2006","unstructured":"C. Reis , J. Dunagan , H. J. Wang , O. Dubrovsky , and S. Esmeir . BrowserShield: vulnerability-driven filtering of dynamic HTML . In OSDI '06: Proceedings of the 7th symposium on Operating Systems Design and Implementation , pages 61 -- 74 , Berkeley, CA, USA , 2006 . USENIX Association. C. Reis, J. Dunagan, H. J. Wang, O. Dubrovsky, and S. Esmeir. BrowserShield: vulnerability-driven filtering of dynamic HTML. In OSDI '06: Proceedings of the 7th symposium on Operating Systems Design and Implementation, pages 61--74, Berkeley, CA, USA, 2006. USENIX Association."},{"key":"e_1_3_2_1_22_1","first-page":"52","volume-title":"Proceedings of the 25th European conference on Object-oriented programming, ECOOP'11","author":"Richards G.","year":"2011","unstructured":"G. Richards , C. Hammer , B. Burg , and J. Vitek . The eval that men do: A large-scale study of the use of eval in javascript applications . In Proceedings of the 25th European conference on Object-oriented programming, ECOOP'11 , pages 52 -- 78 , Berlin, Heidelberg , 2011 . Springer-Verlag. G. Richards, C. Hammer, B. Burg, and J. Vitek. The eval that men do: A large-scale study of the use of eval in javascript applications. In Proceedings of the 25th European conference on Object-oriented programming, ECOOP'11, pages 52--78, Berlin, Heidelberg, 2011. Springer-Verlag."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1806596.1806598"},{"key":"e_1_3_2_1_24_1","unstructured":"D. Ross. IE8 Security Part IV: The XSS Filter. http:\/\/blogs.msdn.com\/b\/ie\/archive\/2008\/07\/02\/ie8-security-part-iv-the-xss-filter.aspx.  D. Ross. IE8 Security Part IV: The XSS Filter. http:\/\/blogs.msdn.com\/b\/ie\/archive\/2008\/07\/02\/ie8-security-part-iv-the-xss-filter.aspx."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1772690.1772784"},{"key":"e_1_3_2_1_26_1","volume-title":"Proceedings of the 19th USENIX Security Symposium","author":"Ter Louw M.","year":"2010","unstructured":"M. Ter Louw , K. T. Ganesh , and V. Venkatakrishnan . AdJail: Practical Enforcement of Confidentiality and Integrity Policies on Web Advertisements . In Proceedings of the 19th USENIX Security Symposium , Aug. 2010 . M. Ter Louw, K. T. Ganesh, and V. Venkatakrishnan. AdJail: Practical Enforcement of Confidentiality and Integrity Policies on Web Advertisements. In Proceedings of the 19th USENIX Security Symposium, Aug. 2010."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2076732.2076775"},{"key":"e_1_3_2_1_28_1","first-page":"5","volume-title":"Proceedings of the 2nd conference on Steps to Reducing Unwanted Traffic on the Internet -","volume":"2","author":"Wang Y.-M.","year":"2006","unstructured":"Y.-M. Wang , D. Beck , J. Wang , C. Verbowski , and B. Daniels . Strider typo-patrol: discovery and analysis of systematic typo-squatting . In Proceedings of the 2nd conference on Steps to Reducing Unwanted Traffic on the Internet - Volume 2 , SRUTI'06, pages 5 -- 5 , Berkeley, CA, USA , 2006 . USENIX Association. Y.-M. Wang, D. Beck, J. Wang, C. Verbowski, and B. Daniels. Strider typo-patrol: discovery and analysis of systematic typo-squatting. In Proceedings of the 2nd conference on Steps to Reducing Unwanted Traffic on the Internet - Volume 2, SRUTI'06, pages 5--5, Berkeley, CA, USA, 2006. USENIX Association."},{"key":"e_1_3_2_1_29_1","unstructured":"XSSed j Cross Site Scripting (XSS) attacks information and archive.  XSSed j Cross Site Scripting (XSS) attacks information and archive."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/1526709.1526838"},{"key":"e_1_3_2_1_31_1","unstructured":"K. Zetter. Google Hack Attack Was Ultra Sophisticated New Details Show. http:\/\/www.wired.com\/threatlevel\/2010\/01\/operation-aurora\/.  K. Zetter. Google Hack Attack Was Ultra Sophisticated New Details Show. http:\/\/www.wired.com\/threatlevel\/2010\/01\/operation-aurora\/."},{"key":"e_1_3_2_1_32_1","unstructured":"Zone-H: Unrestricted information. http:\/\/zone-h.org\/.  Zone-H: Unrestricted information. http:\/\/zone-h.org\/."}],"event":{"name":"CCS'12: the ACM Conference on Computer and Communications Security","location":"Raleigh North Carolina USA","acronym":"CCS'12","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2012 ACM conference on Computer and communications security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2382196.2382274","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2382196.2382274","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T09:34:48Z","timestamp":1750239288000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2382196.2382274"}},"subtitle":["large-scale evaluation of remote javascript inclusions"],"short-title":[],"issued":{"date-parts":[[2012,10,16]]},"references-count":32,"alternative-id":["10.1145\/2382196.2382274","10.1145\/2382196"],"URL":"https:\/\/doi.org\/10.1145\/2382196.2382274","relation":{},"subject":[],"published":{"date-parts":[[2012,10,16]]},"assertion":[{"value":"2012-10-16","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}