Analysis of Hypertext Isolation Techniques for XSS Prevention

Modern websites and web applications commonly integrate third-party and user-generated content to enrich the user's experience. Developers of these applications are in need of a simple way to limit the capabilities of this less trusted, outsourced web content and thereby protect their users from cross-site scripting attacks. We summarize several recent proposals that enable developers to isolate untrusted hypertext, and could be used to define robust constraint environments that are enforceable by web browsers. A comparative analysis of these proposals is presented highlighting security, legacy browser compatibility and several other important qualities.

 @inproceedings{
  W2SP08:HypertextIsolation,
  author        = {Ter~Louw, Mike and Prithvi Bisht and V.N. Venkatakrishnan},
  crossref      = {W2SP08},
  title         = {Analysis of Hypertext Isolation Techniques for {XSS} Prevention}
}
@proceedings{
  W2SP08,
  location      = {Oakland, CA, USA},
  booktitle     = {Web 2.0 Security and Privacy 2008},
  month         = may,
  year          = {2008}
}