View source for FlowSafe

==FlowSafe: Information Flow Security for the Browser==

The central idea is to improve the default browser security model, which is "stuck" since 1995 at the [https://developer.mozilla.org/En/Same_origin_policy_for_JavaScript Same-Origin Policy] with its underlying and conflicting [[DOM access control]] and [[JavaScript object-capability]] security layers.

We aim to do this without breaking the web, and indeed with measurable improvements to safety property enforcement and security policy expressiveness.

===Goals===

* Improve default cross-site script integrity (ads, analytics)
* Systematically enforce the Same-Origin Policy and better security policies by pervasive mediation
* Reduce existing "caps", DOM, and [[JavaScript]] engine patch-work / leaky reference monitor code
* Guarantee termination-insensitive non-interference for better confidentiality
* Explore timing and termination channel mitigations

===To-do===

Implement dynamic-only, fail-stop "no sensitive upgrade" or better, information flow security for JS, the DOM, and other parts of the browser. See [http://slang.soe.ucsc.edu/cormac/papers/plas09.pdf this paper] on part of the work.

# Add <code>JSTrustLabel</code> to the JS API, a union of <code>JSPrincipals</code> (trust labels replace principals)
# <code>JSScript</code> has a <code>JSTrustLabel</code>
# Interpreter <code>pc</code> has a <code>JSTrustLabel</code>
# Extend <code>JSExtendedClass</code> to delegate <code>typeof</code> so we can build <code>LabeledValue</code> wrappers for primitives
## Also need to rebox results of all primitive operators, e.g. <code>-x</code> for <code>x = new LabeledValue(42)</code> should be a <code>LabeledValue</code> instance, not the number <code>-42</code>
# Have [https://developer.mozilla.org/En/SpiderMonkey/Internals/Property_cache#Shape shapes] imply trust labels so that distinct origins get different shapes for standard objects, equivalent property list patterns, etc.
## So objects have trust labels because objects have shapes
## Beware shapeless objects (dense arrays, certain "host objects")
## Cormac's semantics requires labeled references too, another use-case for <code>LabeledValue</code>
# Add policy JS API that allows custom assignment, control flow branching, and input/output policy decision points -- does this mean SSA in one pass?
# Add shell functions for testing and write tests
# DOM, other host objects have trust labels
# Exceptions, etc.
# Declassify primitive TBD, defer for now

--[[User:Brendan|Brendan]] 01:43, 31 October 2009 (UTC)

===References===

[http://slang.soe.ucsc.edu/cormac/papers/plas09.pdf Efficient Purely-Dynamic Information Flow Analysis (PLAS '09)]