Escudo para Aplicações Web contra injeção de Conteúdo através de Content Security Policy

Abstract

This MSc thesis topic focused on security was proposed by the company JScrambler which holds the product with the same name and in turn provides a complete JavaScript protection so- lution. This company, being aware of the progress in this area, found the security mechanism Content Security Policy an interesting tool that worth look into. Broadly speaking this tool li- mits the content to run in a website to the declared through CSP being that the attempt to content injection exceeding what was allowed will be blocked and reported to the server. Following this tool is the great workload required for its configuration and maintenance which requires proper attention to avoid more serious problems, such as downtime, which can be caused by a misconfiguration of policies or poor maintenance. That said, looking forward to solve this problem the creation of a solution was proposed to ease the workload by generating CSP policies through code analysis. On a first stage an analysis of the area that covered several of JavaScript protection methods in which the subject is inserted was made in order to understand their current status and evaluate the feasibility of the proposal. In this analysis a comparison between several existing tools in the areas of protection and code analysis and between tools for generation of CSP and the solution to be developed was conducted. The solution was proposed and planned their future development given all the research per- formed. The great advantage of it over the others tools is the full integration with the project that comes from the analysis of the code that will enable the generation of suitable and appropriate CSP policies. The project planning has taken into account the adoption of agile development metho- dology SCRUM with two week iterations and will be adopted in the next phase of the project, the conception phase of the proposed solution. It is intended that the solution to be developed will be successful and represents a breakthrough in the use of Content Security Policy as an added value in protecting from attacks content injection.