{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,12]],"date-time":"2025-03-12T04:28:14Z","timestamp":1741753694617,"version":"3.38.0"},"reference-count":39,"publisher":"SAGE Publications","issue":"1","license":[{"start":{"date-parts":[[2016,1,27]],"date-time":"2016-01-27T00:00:00Z","timestamp":1453852800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Computer Security"],"published-print":{"date-parts":[[2016,3,1]]},"abstract":"<jats:p> Mashups are a prevailing kind of web applications integrating external gadget APIs often written in the JavaScript programming language. Writing secure mashups is a challenging task due to the heterogeneity of existing gadget APIs, the privileges granted to gadgets during mashup executions, and JavaScript\u2019s highly dynamic environment. We propose a new compiler, called Mashic, for the automatic generation of secure JavaScript-based mashups from existing mashup code. The Mashic compiler can effortlessly be applied to existing mashups based on a wide-range of gadget APIs. It offers security and correctness guarantees. Security is achieved via the Same Origin Policy. Correctness is ensured in the presence of benign gadgets, that satisfy confidentiality and integrity constraints with regard to the integrator code. The compiler has been successfully applied to real world mashups based on Google maps, Bing maps, YouTube, and Zwibbler APIs. <\/jats:p>","DOI":"10.3233\/jcs-160542","type":"journal-article","created":{"date-parts":[[2016,3,4]],"date-time":"2016-03-04T14:39:37Z","timestamp":1457102377000},"page":"91-136","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":1,"title":["Mashic compiler: Mashup sandboxing based on inter-frame communication"],"prefix":"10.1177","volume":"24","author":[{"given":"Zhengqin","family":"Luo","sequence":"first","affiliation":[{"name":"Google Inc., Mountain View, USA"}]},{"given":"Jos\u00e9","family":"Fragoso Santos","sequence":"additional","affiliation":[{"name":"INRIA, Sophia-Antipolis, France"},{"name":"Imperial College London, London, UK"}]},{"given":"Ana","family":"Almeida Matos","sequence":"additional","affiliation":[{"name":"SQIG, Instituto de Telecomunica\u00e7\u00f5es, Lisbon, Portugal"},{"name":"Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisbon, Portugal"}]},{"given":"Tamara","family":"Rezk","sequence":"additional","affiliation":[{"name":"INRIA, Sophia-Antipolis, France"}]}],"member":"179","published-online":{"date-parts":[[2016,1,27]]},"reference":[{"key":"ref001","doi-asserted-by":"crossref","unstructured":"[1]D.\u00a0Akhawe, A.\u00a0Barth, P.E.\u00a0Lam, J.C.\u00a0Mitchell and D.\u00a0Song, Towards a formal foundation of web security, in: CSF, 2010, pp.\u00a0290\u2013304.","DOI":"10.1109\/CSF.2010.27"},{"key":"ref002","unstructured":"[2]A.\u00a0Barth, C.\u00a0Jackson and W.\u00a0Li, Attacks on JavaScript Mashup communication, in: W2SP2009, 2009."},{"key":"ref003","doi-asserted-by":"publisher","DOI":"10.1145\/1516046.1516066"},{"key":"ref004","unstructured":"[4]A.\u00a0Barth, J.\u00a0Weinberger and D.\u00a0Song, Cross-origin JavaScript capability leaks: Detection, exploitation, and defense, in: USENIX Security Symposium, 2009, pp.\u00a0187\u2013198."},{"key":"ref005","doi-asserted-by":"crossref","unstructured":"[5]P.\u00a0Bogle and B.\u00a0Liskov, Reducing cross domain call overhead using batched futures, in: OOPSLA, 1994.","DOI":"10.1145\/191080.191133"},{"key":"ref006","unstructured":"[6]A.\u00a0Bohannon and B.C.\u00a0Pierce, Featherweight Firefox: Formalizing the core of a web browser, in: Usenix Conference on Web Application Development (WebApps), 2010."},{"key":"ref007","doi-asserted-by":"publisher","DOI":"10.1016\/j.ic.2009.06.007"},{"key":"ref008","doi-asserted-by":"crossref","unstructured":"[8]S.\u00a0Crites, F.\u00a0Hsu and H.\u00a0Chen, OMash: Enabling secure web mashups via object abstractions, in: CCS, 2008, pp.\u00a099\u2013108.","DOI":"10.1145\/1455770.1455784"},{"key":"ref009","unstructured":"[9]D.\u00a0Crockford, The <module> tag, 2010, available at: http:\/\/www.json.org."},{"key":"ref010","unstructured":"[10]D.\u00a0Crockford, ADsafe, 2011, available at: http:\/\/www.adsafe.org\/."},{"key":"ref011","unstructured":"[11]F.\u00a0De Keukelaere, S.\u00a0Bhola, M.\u00a0Steiner, S.\u00a0Chari and S.\u00a0Yoshihama, Smash: Secure component model for cross-domain mashups on unmodified browsers, in: WWW, 2008."},{"key":"ref012","unstructured":"[12]ECMA, ECMAScript language specification, Technical report, ECMA, 2009, available at: http:\/\/www.ecma-international.org\/."},{"key":"ref013","doi-asserted-by":"crossref","unstructured":"[13]P.\u00a0Efstathopoulos, M.\u00a0Krohn, S.\u00a0VanDeBogart, C.\u00a0Frey, D.\u00a0Ziegler, E.\u00a0Kohler, D.\u00a0Mazi\u00e8res, F.\u00a0Kaashoek and R.\u00a0Morris, Labels and event processes in the asbestos operating system, SIGOPS Oper. Syst. Rev. 39(5) (2005), 17\u201330.","DOI":"10.1145\/1095809.1095813"},{"key":"ref014","unstructured":"[14]Facebook Inc., Facebook JavaScript subset, 2011, available at: https:\/\/github.com\/facebook\/fbjs."},{"key":"ref015","doi-asserted-by":"crossref","unstructured":"[15]C.\u00a0Fournet, N.\u00a0Swamy, J.\u00a0Chen, P.\u00a0Dagand, P.\u00a0Strub and B.\u00a0Livshits, Fully abstract compilation to JavaScript, in: The 40th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL\u201913, 2013.","DOI":"10.1145\/2429069.2429114"},{"key":"ref016","doi-asserted-by":"crossref","unstructured":"[16]J.\u00a0Fragoso Santos and T.\u00a0Rezk, An information flow monitor-inlining compiler for securing a core of JavaScript, in: SEC, N.\u00a0Cuppens-Boulahia, F.\u00a0Cuppens, S.\u00a0Jajodia, A.A.\u00a0El Kalam and T.\u00a0Sans, eds, IFIP Advances in Information and Communication Technology, Vol.\u00a0428, Springer, 2014, pp.\u00a0278\u2013292, ISBN 978-3-642-55414-8.","DOI":"10.1007\/978-3-642-55415-5_23"},{"key":"ref017","unstructured":"[17]Google Inc., Google Caja project, 2011, available at: http:\/\/code.google.com\/p\/google-caja\/."},{"key":"ref018","doi-asserted-by":"publisher","DOI":"10.1145\/371880.371887"},{"key":"ref019","doi-asserted-by":"crossref","unstructured":"[19]D.\u00a0Hedin and A.\u00a0Sabelfeld, Information-flow security for a core of JavaScript, in: IEEE Computer Security Foundations Symposium, CSF 2012, 2012.","DOI":"10.1109\/CSF.2012.19"},{"key":"ref020","unstructured":"[20]I.\u00a0Hickson, HTML5, Technical report, W3C, May 2011."},{"key":"ref021","doi-asserted-by":"crossref","unstructured":"[21]A.\u00a0Ibrahim, Y.\u00a0Jiao, E.\u00a0Tilevich and W.R.\u00a0Cook, Remote batch invocation for compositional object services, in: ECOOP, 2009.","DOI":"10.1007\/978-3-642-03013-0_27"},{"key":"ref022","doi-asserted-by":"crossref","unstructured":"[22]C.\u00a0Jackson and H.J.\u00a0Wang, Subspace: Secure cross-domain communication for web mashups, in: WWW, 2007.","DOI":"10.1145\/1242572.1242655"},{"key":"ref023","doi-asserted-by":"crossref","unstructured":"[23]D.\u00a0Jang, R.\u00a0Jhala, S.\u00a0Lerner and H.\u00a0Shacham, An empirical study of privacy-violating information flows in JavaScript web applications, in: CCS, 2010.","DOI":"10.1145\/1866307.1866339"},{"key":"ref024","unstructured":"[24]A.\u00a0Le Hors, P.\u00a0Le Hegaret, G.\u00a0Nicol, J.\u00a0Robie, M.\u00a0Champion and S.\u00a0Byrne, Document Object Model (DOM) level 2 core specification, Technical report, W3C, November 2000."},{"key":"ref025","unstructured":"[25]F.\u00a0Loitsch, Scheme to JavaScript compilation, PhD thesis, Universit\u00e9 de Nice-Sophia Antipolis, March 2009."},{"key":"ref026","unstructured":"[26]M.T.\u00a0Louw, K.T.\u00a0Ganesh and V.N.\u00a0Venkatakrishnan, AdJail: Practical enforcement of confidentiality and integrity policies on web advertisements, in: USENIX Security Symposium, 2010."},{"key":"ref027","doi-asserted-by":"crossref","unstructured":"[27]Z.\u00a0Luo and T.\u00a0Rezk, Mashic compiler: Sandboxing using inter-frame communication, in: IEEE Computer Security Foundations Symposium, CSF 2012, 2012.","DOI":"10.1109\/CSF.2012.22"},{"key":"ref028","doi-asserted-by":"crossref","unstructured":"[28]S.\u00a0Maffeis, J.C.\u00a0Mitchell and A.\u00a0Taly, An operational semantics for JavaScript, in: APLAS, LNCS, Vol.\u00a05356, 2008, pp.\u00a0307\u2013325.","DOI":"10.1007\/978-3-540-89330-1_22"},{"key":"ref029","doi-asserted-by":"crossref","unstructured":"[29]S.\u00a0Maffeis, J.C.\u00a0Mitchell and A.\u00a0Taly, Object capabilities and isolation of untrusted web applications, in: IEEE Security and Privacy, 2010.","DOI":"10.1109\/SP.2010.16"},{"key":"ref030","doi-asserted-by":"crossref","unstructured":"[30]S.\u00a0Maffeis and A.\u00a0Taly, Language-based isolation of untrusted JavaScript, in: CSF, IEEE, 2009, pp.\u00a077\u201391.","DOI":"10.1109\/CSF.2009.11"},{"key":"ref031","doi-asserted-by":"crossref","unstructured":"[31]N.\u00a0Nikiforakis, L.\u00a0Invernizzi, A.\u00a0Kapravelos, S.\u00a0Van Acker, W.\u00a0Joosen, C.\u00a0Kruegel, F.\u00a0Piessens and G.\u00a0Vigna, You are what you include: Large-scale evaluation of remote JavaScript inclusions, in: Proceedings of the 2012 ACM Conference on Computer and Communications Security, CCS\u201912, 2012.","DOI":"10.1145\/2382196.2382274"},{"key":"ref032","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-140504"},{"key":"ref033","doi-asserted-by":"crossref","unstructured":"[33]A.\u00a0Sabelfeld and A.C.\u00a0Myers, Language-based information-flow security, IEEE Journal on Selected Areas in Communications 21(1) (2006), 5\u201319.","DOI":"10.1109\/JSAC.2002.806121"},{"key":"ref034","unstructured":"[34]A.\u00a0Sabelfeld and A.C.\u00a0Myers, A model for delimited information release, in: Software Security \u2013 Theories and Systems, Second Mext-NSF-JSPS International Symposium, ISSS 2003, Tokyo, Japan, 4\u20136 November 2003, Revised Papers, LNCS, 2004, pp.\u00a0174\u2013191."},{"key":"ref035","unstructured":"[35]The Mashic compiler website, available at: http:\/\/www-sop.inria.fr\/indes\/mashic\/."},{"key":"ref036","doi-asserted-by":"publisher","DOI":"10.1109\/35.565655"},{"key":"ref037","doi-asserted-by":"crossref","unstructured":"[37]H.J.\u00a0Wang, X.\u00a0Fan, J.\u00a0Howell and C.\u00a0Jackson, Protection and communication abstractions for web browsers in MashupOS, in: SOSP\u201907, 2007, pp.\u00a01\u201316, ISBN 978-1-59593-591-5.","DOI":"10.1145\/1294261.1294263"},{"key":"ref038","doi-asserted-by":"crossref","unstructured":"[38]C.\u00a0Yue and H.\u00a0Wang, A measurement study of insecure JavaScript practices on the web, ACM Trans. Web 7(2) (2013), Article No.\u00a07.","DOI":"10.1145\/2460383.2460386"},{"key":"ref039","unstructured":"[39]N.\u00a0Zeldovich, S.\u00a0Boyd-Wickizer, E.\u00a0Kohler and D.\u00a0Mazi\u00e8res, Making information flow explicit in histar, in: Proceedings of the 7th USENIX Symposium on Operating Systems Design and Implementation, OSDI\u201906, Vol.\u00a07, 2006."}],"container-title":["Journal of Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-160542","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.3233\/JCS-160542","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-160542","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,11]],"date-time":"2025-03-11T09:18:03Z","timestamp":1741684683000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.3233\/JCS-160542"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,1,27]]},"references-count":39,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2016,3,1]]}},"alternative-id":["10.3233\/JCS-160542"],"URL":"https:\/\/doi.org\/10.3233\/jcs-160542","relation":{},"ISSN":["0926-227X","1875-8924"],"issn-type":[{"type":"print","value":"0926-227X"},{"type":"electronic","value":"1875-8924"}],"subject":[],"published":{"date-parts":[[2016,1,27]]}}}