Automatic Code and Data Separation of Web Application

摘要

Aspects of the subject disclosure are directed towards detecting instances within a web application where code and data are not separated, e.g., inline code in the application. One or more implementations automatically transform the web application into a transformed version where code and data are clearly separated, e.g., inline code is moved into external files. The transformation protects against a large class of cross-site scripting attacks.

主权项

1. A method comprising, statically analyzing a web application to detect when inline code is present, including performing static data flow analysis of the web application to approximate output of the web application, and parsing data representative of the approximated output to identify any inline code.