Preventive information flow control through a mechanism of split addresses
Deepak Subramanian, Guillaume Hiet, Christophe Bidan · 2016
The security of the web-browser and JavaScript is pivotal in today's world. The potency of information flow control in the context of JavaScript is quite appealing. In this paper, we propose a new secure information flow control model specifically designed for JavaScript. In our approach, we augment the standard symbol table with a mechanism that replaces the reference address for secret values based on the current execution stack. This mechanism also ensures that the secret is stored in a dedicated memory location that can only be accessed by the internal JIT compiler thereby protecting the variable from any unintended leakage or modification by a malicious JavaScript.