ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices
summary
Presents ScriptProtect, a lightweight protection suite that defends websites from unsafe third‑party JavaScript by intercepting event handlers and script APIs, integrating with Content Security Policy, and providing a runtime sandbox that rewrites or blocks risky third‑party behavior. Includes a configuration tool and reporting pipeline for deployment; evaluated on ~4,000 sites with about 4% breakage and better compatibility than naive CSP while blocking many cross‑site scripting vectors.
AI-written summary · about
chapters (9)
- 0:00ScriptProtect intro
- 3:31Third-party JS risks
- 9:08Design goals
- 15:11Integrating ScriptProtect
- 21:23Implementation challenges
- 26:08Compatibility testing
- 30:19Performance vs security
- 33:10Case studies
- 37:05Future work & conclusion
related talks
17mContent Security Policy: The application security Swiss Army Knife
43mRestricting the scripts, you're ...
58mFixing XSS with Content Security Policy
46mContent Security Policies: Let's Break Stuff
32mWhat is CSP and Why Haven't You Applied it Yet
24mTowards a post-XSS world.
40mContent Security Policy to the Rescue
56mThird Party Scripts