一句话：提出 API 加固范式，用安全 API 与编译期检查在大规模 Web 开发中消除基于 DOM 的 XSS。
跨站脚本（XSS）仍是互联网主要安全威胁，复杂 Web 应用仅靠代码审查和测试难以高置信度消除。本文介绍 Google 的安全设计工程实践——API 加固：用一组安全 API 替换易受 XSS 影响的原生 DOM API，并通过类型契约、校验与转义保证基于这些 API 的应用不存在 XSS。部署简单的编译期检查器，强制开发者只能通过加固 API 访问 DOM。为在数万工程师中推广且不显著影响生产力，作者提供严格工具链与咨询支持。两年部署的实证结果表明，该方法在 Google 庞大代码库中减少了 XSS 漏洞。
With tons of efforts spent on its mitigation, Cross-site scripting (XSS) remains one of the most prevalent security threats on the internet. Decades of exploitation and remediation demonstrated that code inspection and testing alone does not eliminate XSS vulnerabilities in complex web applications with a high degree of confidence. This paper introduces Google's secure-by-design engineering paradigm that effectively prevents DOM-based XSS vulnerabilities in large-scale web development. Our approach, named API hardening, enforces a series of company-wide secure coding practices. We provide a set of secure APIs to replace native DOM APIs that are prone to XSS vulnerabilities. Through a combination of type contracts and appropriate validation and escaping, the secure APIs ensure that applications based thereon are free of XSS vulnerabilities. We deploy a simple yet capable compile-time checker to guarantee that developers exclusively use our hardened APIs to interact with the DOM. We make various of efforts to scale this approach to tens of thousands of engineers without significant productivity impact. By offering rigorous tooling and consultant support, we help developers adopt the secure coding practices as seamlessly as possible. We present empirical results showing how API hardening has helped reduce the occurrences of XSS vulnerabilities in Google's enormous code base over the course of two-year deployment.
@inproceedings{WangBK21,
title = {If It’s Not Secure, It Should Not Compile: Preventing DOM-Based XSS in Large-Scale Web Development with API Hardening},
author = {Pei Wang and Julian Bangert and Christoph Kern},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00123}
}