A Protection Mechanism against Malicious HTML and JavaScript Code in Vulnerable Web Applications

Table 1

The JavaScript objects with serious security risks.

Category	Functionality	Object
Communication	Network communication, Cross-Document Messaging, Web Real-Time Communication	WebSocket, EventSource, XMLHttpRequest, postMessage, RTCPeerConnection, RTCDataChannel
Storage	Storage, File System API	localStorage, sessionStorage, indexedDB, openDatabase, requestFileSystem
Device	Hardware Device Access	getUserMedia, geolocation, vibrate, battery, connection
Interaction	Interaction with users (such as popups, desktop notifications, and full screen)	open (window.open), showModalDialog, showModelessDialog, alert, prompt, print, createPopup, Notification, requestFullscreen
Privilege	Special privileges (e.g., connecting to other applications) and High-Risk HTML5 APIs (e.g., executing the script in the background)	clipboardData, addFavorite, addPanel, setHomePage, AddSearchProvider, ActiveXObject, Worker, history, webkitCreateShadowRoot