Web page and web browser protection against malicious injections

摘要

A method comprising: loading a web page in a web browser, wherein the web page comprises a call to an anti-injection client-side code; loading the anti-injection client-side code in the web browser; and executing the anti-injection client-side code in the web browser, to: (a) intercept an injection of a node into the DOM (Document Object Model) of the web page, (b) compare the injected node with a list, and (c) based on the comparison, permit or block execution of the injected code.

主权项

1. A method comprising:
operating a web server to receive a call to an anti-injection client-side code from a web browser, wherein the call is facilitated by a code segment in a web page loaded by the web browser; positioning the code segment immediately before a tag of the web page, to:
(a) cause the web browser to request the transmitting of the anti-injection client-side code after the web page has finished loading in the web browser, and(b) prevent interception of client-side code originally included in the web page; and transmitting the anti-injection client-side code from the web server to the web browser, wherein the anti-injection client-side code comprises instructions which, when executed by the web browser:
(i) intercept an injection of a node into the DOM (Document Object Model) of the web page,(ii) compare the injected node with a list, and(iii) based on the comparison, permit or block execution of the injected node in the web browser.