FlowGuard: Server-Side JavaScript with Information Flow Control
Willem De Groef · Lirias · 2013
High-performance,flexible and scalable JavaScript platforms are becoming popular for server-side application development. However, prevalent frameworks lack the necessary security support in order to provide sufficient protection against present-day threats. To close this gap, we designed and implemented FlowGuard, a JavaScript middle- ware platform on top of the popular Node.js framework. Our platform supports the enforcement of dynamic, stateful information flow policies on both the application-specific code and its third-party libraries. FlowGuard offers protection against malicious or buggy code coming from third-party suppliers or in-house developers – without the need for changes to the original source code, inline annotations or expensive deployment cycles.