Sciweavers

WWW
2010
ACM

Object views: fine-grained sharing in browsers

14 years 5 months ago
Object views: fine-grained sharing in browsers
Browsers do not currently support the secure sharing of JavaScript objects between principals. We present this problem as the need for object views, which are consistent and controllable versions of objects. Multiple views can be made for the same object and customized for the recipients. We implement object views with a JavaScript library that wraps shared objects and interposes on all access attempts. The security challenge is to fully mediate access to objects shared through a view and prevent privilege escalation. We discuss how object views can be deployed in two settings: sameorigin sharing with rewriting-based JavaScript isolation systems like Google Caja, and inter-origin sharing between browser frames over a message-passing channel. To facilitate simple document sharing, we build a policy system for declaratively defining policies for document object views. Notably, our document policy system makes it possible to hide elements without breaking document structure invariants. ...
Leo A. Meyerovich, Adrienne Porter Felt, Mark S. M
Added 14 May 2010
Updated 14 May 2010
Type Conference
Year 2010
Where WWW
Authors Leo A. Meyerovich, Adrienne Porter Felt, Mark S. Miller
Comments (0)