Cross-Browser Rendering using Headless Server-Side Browsers

Abstract

Nowadays many different browsers are used to navigate the Web, ranging from the most well known, Internet Explorer, Chrome, Safari or Firefox to less well known browsers such as Opera. These browsers are typically proprietary to the companies they belong to, hence, differing in their operations, of particular interest to this dissertation, the processing of HTML, CSS and JavaScript files which leads to the generation of different web pages, resulting in slightly different user experiences. In order to homogenize the differences between browsers, the idea of cross browser testing and rendering has become a topic of research. Cross browser rendering is the ability to generate a user interface also known as a web page, according to the browser specified. This way developers may test with more ease how their code behaves under different execution environments. However this technology can be used for more than enabling a web developer to test their code, it can also be used to detect security breaches. As the Internet becomes an ever-growing, relevant de facto tool in communication flow for a wide range of areas, from entertainment to banking, it also becomes the target medium for cyber attacks to occur. Amongst the most harmful cyber attack in existence, of particular interest to this thesis are Client-side Injection attacks. One of the ways in which these types of attacks can be detected is by checking whether a webpages source code somehow varies from a "clean" version provided by the web host, which has undergone no local modifications. By leveraging cross browser rendering, it becomes possible to minimize errors in malicious code detection algorithms by eliminating the rendering differences inherent to each particular browser. As such, this dissertation intends to provide the basis for a tool which allows the identification and categorisation of differences between client-side web pages and the original server code which are considered harmless.