Declared origin policy
View Patent ↗A declared origin policy may be provided. First a plurality of records comprising addresses that an application is allowed to access may be received. The received plurality of records may be placed in a manifest. Then, a request containing an address may be received and compared to the plurality of records in the manifest. Access to the address may be allowed when one of the plurality of records in the manifest matches the address or when an ambiguity is encountered as to whether the one of the plurality of records in the manifest matches the address. Access to the address may be denied when none of the plurality of records in the manifest matches the address. Moreover, any request to change any of the plurality of records in the manifest may be denied when the application is updated, uninstalled, or reinstalled.
1. A method for providing a declared origin policy, the method comprising:
receiving a request containing an address, wherein receiving the request containing the address comprises receiving the request containing the address from an application that is requesting access to the address, wherein the application comprises at least one of the following: a script, a control used by a web page, and malicious code;
comparing the received address to a plurality of records in a manifest, the manifest specifying a rich internet application, at least one property of the rich internet application, and a startup website to load for the rich internet application;
allowing, by a computing device, access to the address when a one of the plurality of records in the manifest matches the address, the allowed address being denied cross site navigational privileges, wherein allowing access to the address when the one of the plurality of records in the manifest matches the address comprises considering at least one wild card in the plurality of records in the manifest when determining when the one of the plurality of records in the manifest matches the address, the at least one wild card being used in place of a port; and
denying, by the computing device, access to the address when none of the plurality of records in the manifest matches the address.
2. The method of claim 1 , wherein comparing the received address to the plurality of records in the manifest comprises comparing the received address to the plurality of records in the manifest wherein wildcards are used in representing a portion of the plurality of records.
3. The method of claim 1 , wherein allowing access to the address when the one of the plurality of records in the manifest matches the address comprises considering wild cards in the plurality of records in the manifest when determining when the one of the plurality of records in the manifest matches the address.
4. The method of claim 1 , wherein allowing access to the address when the one of the plurality of records in the manifest matches the address comprises considering the at least one wild card in the plurality of records in the manifest when determining when the one of the plurality of records in the manifest matches the address, the at least one wild card being used in place of a website name.
5. The method of claim 1 , wherein allowing access to the address when the one of the plurality of records in the manifest matches the address comprises considering the at least one wild card in the plurality of records in the manifest when determining when the one of the plurality of records in the manifest matches the address, the at least one wild card being used in place of a protocol.
6. The method of claim 1 , wherein denying access to the address when none of the plurality of records in the manifest matches the address comprises considering wild cards in the plurality of records in the manifest when determining when none of the plurality of records in the manifest matches the address.
7. The method of claim 1 , wherein denying access to the address when none of the plurality of records in the manifest matches the address comprises considering the at least one wild card in the plurality of records in the manifest when determining when none of the plurality of records in the manifest matches the address, the at least one wild card being used in place of a website name.
8. The method of claim 1 , wherein denying access to the address when none of the plurality of records in the manifest matches the address comprises considering the at least one wild card in the plurality of records in the manifest when determining when none of the plurality of records in the manifest matches the address, the at least one wild card being used in place of a protocol.
9. The method of claim 1 , wherein denying access to the address when none of the plurality of records in the manifest matches the address comprises considering the at least one wild card in the plurality of records in the manifest when determining when none of the plurality of records in the manifest matches the address, the at least one wild card being used in place of the port.
10. The method of claim 1 , further comprising denying any request to change any of the plurality of records in the manifest when an application is one of updated, uninstalled, and reinstalled.
11. The method of claim 1 , further comprising allowing access to the address when an ambiguity is encountered as to whether the one of the plurality of records in the manifest matches the address.
12. The method of claim 1 , further comprising:
receiving the plurality of records comprising addresses that an application is allowed to access; and
placing the received plurality of records in the manifest.
13. The method of claim 12 , wherein placing the received plurality of records in the manifest comprises placing the received plurality of records in the manifest wherein the manifest and the application reside on a same computing device.
14. A computer-readable storage device which stores a set of instructions which when executed performs a method for providing a declared origin policy, the method executed by the set of instructions comprising:
receiving a plurality of records comprising addresses that an application is allowed to access;
placing the received plurality of records in a manifest, wherein placing the received plurality of records in the manifest comprises placing the received plurality of records in the manifest wherein the manifest and the application reside on a same computing device, the manifest specifying the application, at least one property of the application, and a website to load for the application;
receiving a request containing an address, wherein receiving the request containing the address comprises receiving the request containing the address from an application that is requesting access to the address, wherein the application comprises at least one of the following: a script, a control used by a web page, and malicious code;
comparing the received address to the plurality of records in the manifest;
allowing access to the address when a one of the plurality of records in the manifest matches the address, the allowed address being restricted from cross site navigation, wherein allowing access to the address when the one of the plurality of records in the manifest matches the address comprises considering at least one wild card in the plurality of records in the manifest when determining when the one of the plurality of records in the manifest matches the address, the at least one wild card being used in place of a port;
allowing access to the address when an ambiguity is encountered as to whether the one of the plurality of records in the manifest matches the address;
denying access to the address when none of the plurality of records in the manifest matches the address; and
denying any request to change any of the plurality of records in the manifest when the application is one of updated, uninstalled, and reinstalled.
15. The computer-readable storage device of claim 14 , wherein denying access to the address when none of the plurality of records in the manifest matches the address comprises considering the at least one wild card in the plurality of records in the manifest when determining when none of the plurality of records in the manifest matches the address, the at least one wild card being used in place of at least one of the following: a website name, a protocol, and the port.
16. A system for providing a declared origin policy, the system comprising:
a memory storage; and
a processing unit coupled to the memory storage, wherein the processing unit is operative to:
receive a plurality of records comprising addresses that an application is allowed to access;
place the received plurality of records in a manifest, the manifest specifying a rich internet application, at least one property of the rich internet application, and a startup website to load for the rich internet application;
receive a request containing an address from the application that is requesting access to the address wherein the application comprises at least one of the following: a script, a control used by a web page, and malicious code;
compare the received address to the plurality of records in the manifest;
allow access to the address when a one of the plurality of records in the manifest matches the address wherein the processing unit being operative to allow access comprises the processing unit being operative to:
deny the allowed address cross site navigational privileges, and
consider at least one wild card in the plurality of records in the manifest when determining when the one of the plurality of records in the manifest matches the address, the at least one wild card being used in place of at least one of the following: a website name, a protocol, and a port;
allow access to the address when an ambiguity is encountered as to whether the one of the plurality of records in the manifest matches the address;
deny access to the address when none of the plurality of records in the manifest matches the address; and
deny any request to change any of the plurality of records in the manifest when the application is one of updated, uninstalled, and reinstalled.