Pp. 177–186 of the Proceedings

Next: Abstract

A User's and Programmer's View of the New JavaScript Security Model

Vinod Anupam, Alain Mayer
Bell Laboratories, Lucent Technologies
600 Mountain Avenue
Murray Hill, NJ 07974
{anupam,dmk,alain}@bell-labs.com

• Abstract
• Introduction
• Brief Introduction to JavaScript
• Overview of our Security Model
  • Security Policy and Access Control
  • Management of Trust
• The End User's View
  • Signed JavaScript
• The JavaScript Programmer's View
  • Domain and URL Based Trust Management
  • Fine-Grained Trust Management via SetPrivate
• Security Code Layers and Hardening of the Mozilla Layer
  • Finding the Subject Origin URL
  • Finding the Object Origin URL
• Our Implementation
  • Overview
  • Policy Lookup
  • Property and External Interface Policies
  • Access Control List (ACL) Support
  • setPrivate, unsetPrivate
  • Hierarchy of Tests: ``Hedging Your Bets''
  • User Interface Changes
• Summary and Outlook
• References
• About this document ...