{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,13]],"date-time":"2026-06-13T05:39:13Z","timestamp":1781329153244,"version":"3.54.1"},"reference-count":60,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2016,7,19]],"date-time":"2016-07-19T00:00:00Z","timestamp":1468886400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"NSF","award":["CNS-13-18415"],"award-info":[{"award-number":["CNS-13-18415"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2016,8,5]]},"abstract":"<jats:p>Cross-Site Scripting (XSS) is one of the most common web application vulnerabilities. It is therefore sometimes referred to as the \u201cbuffer overflow of the web.\u201d Drawing a parallel from the current state of practice in preventing unauthorized native code execution (the typical goal in a code injection), we propose a script whitelisting approach to tame JavaScript-driven XSS attacks. Our scheme involves a transparent script interception layer placed in the browser\u2019s JavaScript engine. This layer is designed to detect every script that reaches the browser, from every possible route, and compare it to a list of valid scripts for the site or page being accessed; scripts not on the list are prevented from executing. To avoid the false positives caused by minor syntactic changes (e.g., due to dynamic code generation), our layer uses the concept of contextual fingerprints when comparing scripts.<\/jats:p>\n          <jats:p>Contextual fingerprints are identifiers that represent specific elements of a script and its execution context. Fingerprints can be easily enriched with new elements, if needed, to enhance the proposed method\u2019s robustness. The list can be populated by the website\u2019s administrators or a trusted third party. To verify our approach, we have developed a prototype and tested it successfully against an extensive array of attacks that were performed on more than 50 real-world vulnerable web applications. We measured the browsing performance overhead of the proposed solution on eight websites that make heavy use of JavaScript. Our mechanism imposed an average overhead of 11.1% on the execution time of the JavaScript engine. When measured as part of a full browsing session, and for all tested websites, the overhead introduced by our layer was less than 0.05%. When script elements are altered or new scripts are added on the server side, a new fingerprint generation phase is required. To examine the temporal aspect of contextual fingerprints, we performed a short-term and a long-term experiment based on the same websites. The former, showed that in a short period of time (10 days), for seven of eight websites, the majority of valid fingerprints stay the same (more than 92% on average). The latter, though, indicated that, in the long run, the number of fingerprints that do not change is reduced. Both experiments can be seen as one of the first attempts to study the feasibility of a whitelisting approach for the web.<\/jats:p>","DOI":"10.1145\/2939374","type":"journal-article","created":{"date-parts":[[2016,7,19]],"date-time":"2016-07-19T11:59:22Z","timestamp":1468929562000},"page":"1-31","source":"Crossref","is-referenced-by-count":17,"title":["How to Train Your Browser"],"prefix":"10.1145","volume":"19","author":[{"given":"Dimitris","family":"Mitropoulos","sequence":"first","affiliation":[{"name":"Columbia University, Amsterdam Avenue, NY"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Konstantinos","family":"Stroggylos","sequence":"additional","affiliation":[{"name":"Athens University of Economics and Business, Athens, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Diomidis","family":"Spinellis","sequence":"additional","affiliation":[{"name":"Athens University of Economics and Business, Athens, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Angelos D.","family":"Keromytis","sequence":"additional","affiliation":[{"name":"Columbia University, Amsterdam Avenue, NY"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2016,7,19]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420952"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1985793.1985871"},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the 2010 USENIX Conference on Web Application Development (WebApps\u201910)","author":"Athanasopoulos Elias","year":"2010","unstructured":"Elias Athanasopoulos , Vasilis Pappas , Antonis Krithinakis , Spyros Ligouras , Evangelos P. Markatos , and Thomas Karagiannis . 2010 . xjs: Practical xss prevention for web application development . In Proceedings of the 2010 USENIX Conference on Web Application Development (WebApps\u201910) . USENIX Association, Berkeley, CA, 13--13. Elias Athanasopoulos, Vasilis Pappas, Antonis Krithinakis, Spyros Ligouras, Evangelos P. Markatos, and Thomas Karagiannis. 2010. xjs: Practical xss prevention for web application development. In Proceedings of the 2010 USENIX Conference on Web Application Development (WebApps\u201910). USENIX Association, Berkeley, CA, 13--13."},{"key":"e_1_2_1_4_1","volume-title":"Proceedings of the 2nd Workshop on Web 2.0 Security & Privacy (W2SP).","author":"Athanasopoulos Elias","year":"2009","unstructured":"Elias Athanasopoulos , Vasilis Pappas , and Evangelos Markatos . 2009 . Code-injection attacks in browsers supporting policies . In Proceedings of the 2nd Workshop on Web 2.0 Security & Privacy (W2SP). Elias Athanasopoulos, Vasilis Pappas, and Evangelos Markatos. 2009. Code-injection attacks in browsers supporting policies. In Proceedings of the 2nd Workshop on Web 2.0 Security & Privacy (W2SP)."},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2009.3"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/1772690.1772701"},{"key":"e_1_2_1_7_1","volume-title":"Application Whitelisting: Panacea or Propaganda","author":"Beechey Jim","year":"2010","unstructured":"Jim Beechey . 2010 . Application Whitelisting: Panacea or Propaganda . http:\/\/www.sans.org\/reading-room\/whitepapers\/application\/application-whitelisting-panacea-propaganda-33599. (2010). Jim Beechey. 2010. Application Whitelisting: Panacea or Propaganda. http:\/\/www.sans.org\/reading-room\/whitepapers\/application\/application-whitelisting-panacea-propaganda-33599. (2010)."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1595696.1595711"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70542-0_2"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653713"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382275"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1987.232894"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2009.43"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516708"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.5555\/2818754.2818797"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1297846.1297891"},{"key":"e_1_2_1_17_1","volume-title":"Proceedings of the 16th Annual Network and Distributed System Security Symposium (NDSS)","author":"Gundy Matthew Van","year":"2009","unstructured":"Matthew Van Gundy and Hao Chen . 2009 . Noncespaces: Using randomization to enforce information flow tracking and thwart cross-site scripting attacks . In Proceedings of the 16th Annual Network and Distributed System Security Symposium (NDSS) . San Diego, CA. Matthew Van Gundy and Hao Chen. 2009. Noncespaces: Using randomization to enforce information flow tracking and thwart cross-site scripting attacks. In Proceedings of the 16th Annual Network and Distributed System Security Symposium (NDSS). San Diego, CA."},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382276"},{"key":"e_1_2_1_19_1","volume-title":"Proceedings of the 2012 USENIX Conference on Annual Technical Conference (USENIX ATC\u201912)","author":"Ingram Lon","year":"2012","unstructured":"Lon Ingram and Michael Walfish . 2012 . TreeHouse: JavaScript sandboxes to helpweb developers help themselves . In Proceedings of the 2012 USENIX Conference on Annual Technical Conference (USENIX ATC\u201912) . USENIX Association, Berkeley, CA, 13--13. Lon Ingram and Michael Walfish. 2012. TreeHouse: JavaScript sandboxes to helpweb developers help themselves. In Proceedings of the 2012 USENIX Conference on Annual Technical Conference (USENIX ATC\u201912). USENIX Association, Berkeley, CA, 13--13."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1242572.1242654"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660275"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1244002.1244071"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2008.36"},{"key":"e_1_2_1_24_1","volume-title":"Enterprise AJAX: Strategies for Building High Performance Web Applications","author":"Johnson David","unstructured":"David Johnson , Alexei White , and Andre Charland . 2007. Enterprise AJAX: Strategies for Building High Performance Web Applications . Prentice Hall PTR , Upper Saddle River, NJ. David Johnson, Alexei White, and Andre Charland. 2007. Enterprise AJAX: Strategies for Building High Performance Web Applications. Prentice Hall PTR, Upper Saddle River, NJ."},{"key":"e_1_2_1_25_1","unstructured":"Sammy Kamkar. 2005. Technical Explanation of The MySpace Worm. (2005). http:\/\/namb.la\/popular\/tech.html.  Sammy Kamkar. 2005. Technical Explanation of The MySpace Worm. (2005). http:\/\/namb.la\/popular\/tech.html."},{"key":"e_1_2_1_26_1","volume-title":"Proceedings of the Network and Distributed System Security Symposium, NDSS 2011","author":"Kang Min Gyung","year":"2011","unstructured":"Min Gyung Kang , Stephen McCamant , Pongsin Poosankam , and Dawn Song . 2011 . DTA++: Dynamic taint analysis with targeted control-flow propagation . In Proceedings of the Network and Distributed System Security Symposium, NDSS 2011 , San Diego, California, USA, 6th February - 9th February 2011. Min Gyung Kang, Stephen McCamant, Pongsin Poosankam, and Dawn Song. 2011. DTA++: Dynamic taint analysis with targeted control-flow propagation. In Proceedings of the Network and Distributed System Security Symposium, NDSS 2011, San Diego, California, USA, 6th February - 9th February 2011."},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2009.15"},{"key":"e_1_2_1_28_1","volume-title":"A tale of the weaknesses of current client-side xss filtering. Presented at Black Hat Europe","author":"Lekies Sebastian","year":"2014","unstructured":"Sebastian Lekies , Ben Stock , and Martin Johns . 2014. A tale of the weaknesses of current client-side xss filtering. Presented at Black Hat Europe 2014 . Sebastian Lekies, Ben Stock, and Martin Johns. 2014. A tale of the weaknesses of current client-side xss filtering. Presented at Black Hat Europe 2014."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2009.33"},{"key":"e_1_2_1_30_1","unstructured":"Mozilla Developer Network (MDN). 2015. JavaScript Reference and Global Objects. (2015). https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/JavaScript\/Reference.  Mozilla Developer Network (MDN). 2015. JavaScript Reference and Global Objects. (2015). https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/JavaScript\/Reference."},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/1985793.1985870"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2009.5070522"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/2109205.2109208"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.36"},{"key":"e_1_2_1_35_1","unstructured":"Mark Samuel Miller. 2006. Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control. Ph.D. Dissertation. Johns Hopkins University Baltimore Maryland USA.  Mark Samuel Miller. 2006. Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control. Ph.D. Dissertation. Johns Hopkins University Baltimore Maryland USA."},{"key":"e_1_2_1_36_1","volume-title":"Taintless: Defeating taint-powered protection tachniques. Presented at Black Hat usa","author":"Naderi Abbas","year":"2014","unstructured":"Abbas Naderi , Mandana Bagheri , and Shahin Ramezany . 2014 . Taintless: Defeating taint-powered protection tachniques. Presented at Black Hat usa 2014. Abbas Naderi, Mandana Bagheri, and Shahin Ramezany. 2014. Taintless: Defeating taint-powered protection tachniques. Presented at Black Hat usa 2014."},{"key":"e_1_2_1_37_1","volume-title":"Proceedings of the 22nd Annual Computer Security Applications Conference (ACSAC'06)","author":"Nadji Yacin","year":"2006","unstructured":"Yacin Nadji , Prateek Saxena , and Dawn Song . 2006 . Document structure integrity: A robust basis for cross-site scripting defense . In Proceedings of the 22nd Annual Computer Security Applications Conference (ACSAC'06) . IEEE Computer Society, Washington, DC, 463--472. Yacin Nadji, Prateek Saxena, and Dawn Song. 2006. Document structure integrity: A robust basis for cross-site scripting defense. In Proceedings of the 22nd Annual Computer Security Applications Conference (ACSAC'06). IEEE Computer Society, Washington, DC, 463--472."},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/1377943.1377956"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382274"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455783"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2007.37"},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of the 2nd USENIX Conference on Web Application Development (WebApps\u201911)","author":"Papagiannis Ioannis","year":"2011","unstructured":"Ioannis Papagiannis , Matteo Migliavacca , and Peter Pietzuch . 2011 . PHP aspis: Using partial taint tracking to protect against injection attacks . In Proceedings of the 2nd USENIX Conference on Web Application Development (WebApps\u201911) . USENIX Association, Berkeley, CA, 2--2. Ioannis Papagiannis, Matteo Migliavacca, and Peter Pietzuch. 2011. PHP aspis: Using partial taint tracking to protect against injection attacks. In Proceedings of the 2nd USENIX Conference on Web Application Development (WebApps\u201911). USENIX Association, Berkeley, CA, 2--2."},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/1533057.1533067"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1007\/11663812_7"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/1281480.1281481"},{"key":"e_1_2_1_46_1","volume-title":"Restful Web Services","author":"Richardson Leonard","unstructured":"Leonard Richardson and Sam Ruby . 2007. Restful Web Services ( first ed.). O\u2019Reilly . Leonard Richardson and Sam Ruby. 2007. Restful Web Services (first ed.). O\u2019Reilly."},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2010.59"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2011.226"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.38"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046776"},{"key":"e_1_2_1_51_1","volume-title":"Proceedings of the 14th USENIX Security Symposium (SSYM\u201905)","author":"Sovarel Ana Nora","year":"2005","unstructured":"Ana Nora Sovarel , David Evans , and Nathanael Paul . 2005 . Where\u2019s the FEEB? The effectiveness of instruction set randomization . In Proceedings of the 14th USENIX Security Symposium (SSYM\u201905) . USENIX Association, Berkeley, CA, 10--10. Ana Nora Sovarel, David Evans, and Nathanael Paul. 2005. Where\u2019s the FEEB? The effectiveness of instruction set randomization. In Proceedings of the 14th USENIX Security Symposium (SSYM\u201905). USENIX Association, Berkeley, CA, 10--10."},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/1772690.1772784"},{"key":"e_1_2_1_53_1","volume-title":"23rd USENIX Security Symposium. USENIX Association","author":"Stock Ben","year":"2014","unstructured":"Ben Stock , Sebastian Lekies , Tobias Mueller , Patrick Spiegel , and Martin Johns . 2014 . Precise client-side protection against DOM-based cross-site scripting . In 23rd USENIX Security Symposium. USENIX Association , San Diego, CA, 655--670. Ben Stock, Sebastian Lekies, Tobias Mueller, Patrick Spiegel, and Martin Johns. 2014. Precise client-side protection against DOM-based cross-site scripting. In 23rd USENIX Security Symposium. USENIX Association, San Diego, CA, 655--670."},{"key":"e_1_2_1_54_1","unstructured":"D. Stuttard and M. Pinto. 2011. The Web Application Hacker\u2019s Handbook: Finding and Exploiting Security Flaws. Wiley New York NY.  D. Stuttard and M. Pinto. 2011. The Web Application Hacker\u2019s Handbook: Finding and Exploiting Security Flaws. Wiley New York NY."},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/2076732.2076775"},{"key":"e_1_2_1_56_1","volume-title":"Proceeding of the Network and Distributed System Security Symposium (NDSS)","author":"Vogt P.","unstructured":"P. Vogt , F. Nentwich , N. Jovanovic , E. Kirda , C. Kruegel , and G. Vigna . 2007. Cross-site scripting prevention with dynamic data tainting and static analysis . In Proceeding of the Network and Distributed System Security Symposium (NDSS) . San Diego, CA. P. Vogt, F. Nentwich, N. Jovanovic, E. Kirda, C. Kruegel, and G. Vigna. 2007. Cross-site scripting prevention with dynamic data tainting and static analysis. In Proceeding of the Network and Distributed System Security Symposium (NDSS). San Diego, CA."},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/586110.586145"},{"key":"e_1_2_1_58_1","volume-title":"24th USENIX Security Symposium. USENIX Association","author":"Weissbacher Michael","year":"2015","unstructured":"Michael Weissbacher , William Robertson , Engin Kirda , Christopher Kruegel , and Giovanni Vigna . 2015 . ZigZag: Automatically hardening web applications against client-side validation vulnerabilities . In 24th USENIX Security Symposium. USENIX Association , Washington, DC, 737--752. Michael Weissbacher, William Robertson, Engin Kirda, Christopher Kruegel, and Giovanni Vigna. 2015. ZigZag: Automatically hardening web applications against client-side validation vulnerabilities. In 24th USENIX Security Symposium. USENIX Association, Washington, DC, 737--752."},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/IWSESS.2009.5068456"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/1190216.1190252"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2939374","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2939374","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:55:56Z","timestamp":1750222556000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2939374"}},"subtitle":["Preventing XSS Attacks Using Contextual Script Fingerprints"],"short-title":[],"issued":{"date-parts":[[2016,7,19]]},"references-count":60,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2016,8,5]]}},"alternative-id":["10.1145\/2939374"],"URL":"https:\/\/doi.org\/10.1145\/2939374","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,7,19]]}}}