WebMTD: Defeating Cross-Site Scripting Attacks Using Moving Target Defense

Code 9

Security check function using MutationObserver.

<script type="application/javascript">

var  runtimeId = "<?php echo ⁢$id4trustedBlocks

;?>";

var  events = onabort:true, onafterprint:

true, /*the rest is discarded*/

⁢

Function  validateNode(node)

if(node.nodeType == 1)

if(node.tagName == "SCRIPT" && (!node.

hasAttribute("runtimeId") || node.

getAttribute("runtimeId") != runtimeId))

node.type = nojscode;

else

for(var j = 0; j <  node.attributes.

length; j++)

if(events[node.attributes[j].name] &&

(!node.hasAttribute("runtimeId") ||

node.getAttribute("runtimeId") !=

runtimeId))

node.setAttribute(node.attributes[j

].name, null);

if(node.getAttribute("src") != null &&

(!node.hasAttribute("runtimeId") ||

node.getAttribute("runtimeId") !=

runtimeId))

node.setAttribute("src", null);

var  dom_observer = new  MutationObserver(

function(mutations)

mutations.forEach(( addedNodes ) =>

addedNodes.forEach(node =>

validateNode(node);)

)

);

var container = document.documentElement ||

document.body;

var  config = attributes: true, childList:⁢

true, characterData:  true,subtree:  true;

dom_observer.observe(container, config);

⁢

window.addEventListener(beforescriptexecute,

function(e)

return (e.target.hasAttribute("runtimeId")

&& e.target.getAttribute("runtimeId")==

runtimeId) ? e  :  e.preventDefault();

, true);

</script>