JavaScript Instrumentation for Browser Security

It is well recognized that JavaScript can be exploited to launch browser-based security attacks. We propose to battle such attacks using program instrumentation. Untrusted JavaScript code goes through a rewriting process which identifies relevant operations, modifies questionable behaviors, and prompts the user (a web page viewer) for decisions on how to proceed when appropriate. Our solution is parametric with respect to the security policy—the policy is implemented separately from the rewriting, and the same rewriting process is carried out regardless of which policy is in use. [via]

http://www.docomolabsresearchers-usa.com/~dyu...