{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:37:24Z","timestamp":1791459444714,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":27,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,10,30]],"date-time":"2020-10-30T00:00:00Z","timestamp":1604016000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,10,30]]},"DOI":"10.1145\/3372297.3417267","type":"proceedings-article","created":{"date-parts":[[2020,11,2]],"date-time":"2020-11-02T18:27:02Z","timestamp":1604341622000},"page":"493-505","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":21,"title":["PMForce: Systematically Analyzing postMessage Handlers at Scale"],"prefix":"10.1145","author":[{"given":"Marius","family":"Steffens","sequence":"first","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbruecken, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ben","family":"Stock","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbruecken, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,11,2]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"Ahmed Elsobky. 2018. Unleashing an Ultimate XSS Polyglot. https:\/\/github.com\/0xsobky\/HackVault\/wiki\/Unleashing-an-Ultimate-XSS-Polyglot. (2018). [accessed 06-Apr-2020].  Ahmed Elsobky. 2018. Unleashing an Ultimate XSS Polyglot. https:\/\/github.com\/0xsobky\/HackVault\/wiki\/Unleashing-an-Ultimate-XSS-Polyglot. (2018). [accessed 06-Apr-2020]."},{"key":"e_1_3_2_2_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1516046.1516066"},{"key":"e_1_3_2_2_3_1","unstructured":"blukat29. 2020. regex-crossword-solver. https:\/\/github.com\/blukat29\/regex-crossword-solver. (2020). [accessed 06-Apr-2020].  blukat29. 2020. regex-crossword-solver. https:\/\/github.com\/blukat29\/regex-crossword-solver. (2020). [accessed 06-Apr-2020]."},{"key":"e_1_3_2_2_4_1","volume-title":"et almbox","author":"Cadar Cristian","year":"2008"},{"key":"e_1_3_2_2_5_1","unstructured":"Google. 2020. Chrome DevTools Protocol. https:\/\/chromedevtools.github.io\/devtools-protocol\/. (2020). [accessed 06-Apr-2020].  Google. 2020. Chrome DevTools Protocol. https:\/\/chromedevtools.github.io\/devtools-protocol\/. (2020). [accessed 06-Apr-2020]."},{"key":"e_1_3_2_2_6_1","volume-title":"International Conference on Security and Privacy in Communication Systems.","author":"Hu Xunchao","year":"2017"},{"key":"e_1_3_2_2_7_1","volume-title":"Yonghwi Kwon, Yunhui Zheng, Xiangyu Zhang, and Dongyan Xu.","author":"Kim Kyungtae","year":"2017"},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.48"},{"key":"e_1_3_2_2_9_1","doi-asserted-by":"crossref","unstructured":"Sebastian Lekies Ben Stock and Martin Johns. 2013. 25 million flows later: Large-scale detection of DOM-based XSS. In CCS.  Sebastian Lekies Ben Stock and Martin Johns. 2013. 25 million flows later: Large-scale detection of DOM-based XSS. In CCS.","DOI":"10.1145\/2508859.2516703"},{"key":"e_1_3_2_2_10_1","unstructured":"Guodong Li Esben Andreasen and Indradeep Ghosh. 2014. SymJS: automatic symbolic testing of JavaScript web applications. In FSE.  Guodong Li Esben Andreasen and Indradeep Ghosh. 2014. SymJS: automatic symbolic testing of JavaScript web applications. In FSE."},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3092282.3092295"},{"key":"e_1_3_2_2_12_1","unstructured":"Felix Maier. 2020. Iroh. https:\/\/github.com\/maierfelix\/Iroh. (2020). [accessed 06-Apr-2020].  Felix Maier. 2020. Iroh. https:\/\/github.com\/maierfelix\/Iroh. (2020). [accessed 06-Apr-2020]."},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"crossref","unstructured":"William Melicher Anupam Das Mahmood Sharif Lujo Bauer and Limin Jia. 2018. Riding out domsday: Towards detecting and preventing dom cross-site scripting. In NDSS.  William Melicher Anupam Das Mahmood Sharif Lujo Bauer and Limin Jia. 2018. Riding out domsday: Towards detecting and preventing dom cross-site scripting. In NDSS.","DOI":"10.14722\/ndss.2018.23309"},{"key":"e_1_3_2_2_14_1","unstructured":"Mozilla Developer Network. 2020 a. Symbol. https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/JavaScript\/Reference\/Global_Objects\/Symbol. (2020). [accessed 06-Apr-2020].  Mozilla Developer Network. 2020 a. Symbol. https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/JavaScript\/Reference\/Global_Objects\/Symbol. (2020). [accessed 06-Apr-2020]."},{"key":"e_1_3_2_2_15_1","unstructured":"Mozilla Developer Network. 2020 b. The structured clone algorithm. https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Web_Workers_API\/Structured_clone_algorithm. (2020). [accessed 06-Apr-2020].  Mozilla Developer Network. 2020 b. The structured clone algorithm. https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Web_Workers_API\/Structured_clone_algorithm. (2020). [accessed 06-Apr-2020]."},{"key":"e_1_3_2_2_16_1","unstructured":"OWASP. 2020 a. Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet. https:\/\/owasp.org\/www-project-cheat-sheets\/cheatsheets\/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet#double-submit-cookie. (2020). [accessed 06-Apr-2020].  OWASP. 2020 a. Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet. https:\/\/owasp.org\/www-project-cheat-sheets\/cheatsheets\/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet#double-submit-cookie. (2020). [accessed 06-Apr-2020]."},{"key":"e_1_3_2_2_17_1","unstructured":"OWASP. 2020 b. Session fixation. https:\/\/owasp.org\/www-community\/attacks\/Session_fixation. (2020). [accessed 06-Apr-2020].  OWASP. 2020 b. Session fixation. https:\/\/owasp.org\/www-community\/attacks\/Session_fixation. (2020). [accessed 06-Apr-2020]."},{"key":"e_1_3_2_2_18_1","volume-title":"Samaneh Tajalizadehkhoob, Maciej Korczy'nski, and Wouter Joosen.","author":"Pochat Victor Le","year":"2019"},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.38"},{"key":"e_1_3_2_2_20_1","volume-title":"FLAX: Systematic Discovery of Client-side Validation Vulnerabilities in Rich Web Applications. In NDSS.","author":"Saxena Prateek","year":"2010"},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.49"},{"key":"e_1_3_2_2_23_1","unstructured":"Sooel Son and Vitaly Shmatikov. 2013. The Postman Always Rings Twice: Attacking and Defending postMessage in HTML5 Websites. In NDSS.  Sooel Son and Vitaly Shmatikov. 2013. The Postman Always Rings Twice: Attacking and Defending postMessage in HTML5 Websites. In NDSS."},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"crossref","unstructured":"Marius Steffens Christian Rossow Martin Johns and Ben Stock. 2019. Don't Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild.. In NDSS.  Marius Steffens Christian Rossow Martin Johns and Ben Stock. 2019. Don't Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild.. In NDSS.","DOI":"10.14722\/ndss.2019.23009"},{"key":"e_1_3_2_2_25_1","unstructured":"Ben Stock Martin Johns Marius Steffens and Michael Backes. 2017. How the Web Tangled Itself: Uncovering the History of Client-Side Web (In)Security. In USENIX Security.  Ben Stock Martin Johns Marius Steffens and Michael Backes. 2017. How the Web Tangled Itself: Uncovering the History of Client-Side Web (In)Security. In USENIX Security."},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"crossref","unstructured":"Minh-Thai Trinh Duc-Hiep Chu and Joxan Jaffar. 2014. S3: A symbolic string solver for vulnerability detection in web applications. In CCS.  Minh-Thai Trinh Duc-Hiep Chu and Joxan Jaffar. 2014. S3: A symbolic string solver for vulnerability detection in web applications. In CCS.","DOI":"10.1145\/2660267.2660372"},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491411.2491456"}],"event":{"name":"CCS '20: 2020 ACM SIGSAC Conference on Computer and Communications Security","location":"Virtual Event USA","acronym":"CCS '20","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3417267","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3372297.3417267","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:01:31Z","timestamp":1750197691000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3417267"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,30]]},"references-count":27,"alternative-id":["10.1145\/3372297.3417267","10.1145\/3372297"],"URL":"https:\/\/doi.org\/10.1145\/3372297.3417267","relation":{},"subject":[],"published":{"date-parts":[[2020,10,30]]},"assertion":[{"value":"2020-11-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}