HTML security gateway
View Patent ↗A technique allows a client computing system with a web browser to receive a web page in response to transmitting a request for content. The web page may include active content, html data and cascading style sheets (CSS). In embodiments, a gateway device may rewrite the web page dynamically by rewriting node identifiers and class names, removing and separating client-side scripts from html data and CSS data, and blocking or disabling execution of the client-side scripts if these scripts contain vulnerable code. A web page may be rewritten based on analysis information provided by a third-party or analyzed at the gateway device.
1. A non-transitory machine readable medium, on which are stored instructions, comprising instructions that when executed cause a machine to:
intercept a web page during transmission over a network;
split the web page into a first content file that is marked executable and a second content file that is marked non-executable; and
send the first content file and the second content file to a web browser,
wherein the first content file includes client-side instructions and the second content file includes hypertext markup text and style sheets.
2. The non-transitory machine readable medium of claim 1 , wherein the instructions stored on the machine readable medium further comprise instructions that when executed cause the machine to obfuscate the first content file and the second content file.
3. The non-transitory machine readable medium of claim 2 , wherein the obfuscated first content file comprises executable obfuscated content and the obfuscated second content file comprises non-executable obfuscated content.
4. The non-transitory machine readable medium of claim 3 , wherein the instructions stored on the machine readable medium that when executed cause the machine to obfuscate the first content file and the second content file further comprise instructions that when executed cause the machine to perform one or more of:
remove whitespaces in the executable obfuscated content,
rename function names and variable names in the executable obfuscated content, and
substitute keywords in the executable obfuscated content.
5. The non-transitory machine readable medium of claim 2 , wherein the instructions stored on the machine readable medium that when executed cause the machine to obfuscate the first content file and the second content file further comprise instructions that when executed cause the machine to replace node identifiers and name attributes with random text.
6. The non-transitory machine readable medium of claim 1 , wherein the instructions stored on the machine readable medium further comprise instructions that when executed cause the machine to add content security policy to the web page.
7. The non-transitory machine readable medium of claim 6 , wherein the instructions stored on the machine readable medium that when executed cause the machine to add content security policy to the web page further comprise instructions that when executed cause the machine to identify whitelisted domains for script libraries.
8. The non-transitory machine readable medium of claim 1 , wherein the instructions stored on the machine readable medium that when executed cause the machine to split the web page into a first content file that is marked executable and a second content file that is marked non-executable further comprise instructions that when executed cause the machine to identify the hypertext markup text and style sheets as non-executable content.
9. A computer system for web page security, comprising:
one or more processors; and
a memory coupled to the one or more processors, on which are stored instructions, comprising instructions that when executed cause one or more of the processors to:
intercept a web page during transmission over a network;
split the web page into a first content file that is marked executable and a second content file that is marked non-executable; and
send the first content file and the second content file to a web browser,
wherein the first content file includes client-side instructions and the second content file includes hypertext markup text and style sheets.
10. The computer system of claim 9 , wherein the instructions stored on the memory further comprise instructions that when executed cause the one or more processors to obfuscate the first content file and the second content file.
11. The computer system of claim 10 , wherein the obfuscated first content file comprises executable obfuscated content and the obfuscated second content file comprises non-executable obfuscated content.
12. The computer system of claim 10 , wherein the instructions stored on the memory that when executed cause the one or more processors to obfuscate the first content file and the second content file further comprise instructions that when executed cause the one or more processors to replace node identifiers and name attributes with random text.
13. The computer system of claim 9 , wherein the instructions stored on the memory that when executed cause the one or more processors to obfuscate the first content file and the second content file further comprise instructions that when executed cause the one or more processors to perform one or more of:
remove whitespaces in the first content file,
rename function names and variable names in the first content file, and
substitute keywords in the first content file.
14. The computer system of claim 9 , wherein the instructions stored on the memory further comprise instructions that when executed cause the one or more processors to add content security policy to the web page.
15. The computer system of claim 14 , wherein the instructions stored on the memory that when executed cause the one or more processors to add content security policy to the web page further comprise instructions that when executed cause the one or more processors to identify whitelisted domains for script libraries.
16. The computer system of claim 9 , wherein the instructions stored on the memory that when executed cause the one or more processors to split the web page into a first content file that is marked executable and a second content file that is marked non-executable further comprise instructions that when executed cause the one or more processors to identify the hypertext markup text and style sheets as non-executable content.
17. A computer system for web page security, comprising:
one or more processors; and
a memory coupled to the one or more processors, on which are stored instructions, comprising instructions that when executed cause one or more of the processors to:
transmit a request for a web page;
receive a rewritten web page in response to transmitting the request, wherein the rewritten web page includes a first content file that is marked executable and a second content file that is marked non-executable, wherein the first content file includes client-side instructions and the second content file includes hypertext markup text and style sheets, and wherein the first content file and the second content file are split from the web page;
inspect the rewritten web page for vulnerable content; and
parse the rewritten web page for display on a web browser.
18. The computer system of claim 17 , wherein the computer system is a client-side gateway device.
19. The computer system of claim 17 , wherein each of the first content file and the second content file includes obfuscated content.
20. The computer system of claim 17 , wherein the instructions stored on the memory further comprise instructions that when executed cause the one or more processors to inspect the rewritten web page for code injections and redirects to unauthorized domains.
21. The computer system of claim 20 , wherein the instructions stored on the memory further comprise instructions that when executed cause the one or more processors to replace the unauthorized domains with whitelisted domains.
22. A method for web page security, comprising:
intercepting a web page during transmission over a network;
splitting the web page into a first content file that is marked executable and a second content file that is marked non-executable; and
send the first content file and the second content file to a web browser,
wherein the first content file includes client-side instructions and the second content file includes hypertext markup text and style sheets.
23. The method of claim 22 , further comprising obfuscating the first content file and the second content file.
24. The method of claim 23 , wherein the obfuscated first content file comprises executable obfuscated content and the obfuscated second content file comprises non-executable obfuscated content.
25. The method of claim 23 , wherein obfuscating the first content file and the second content file comprises replacing node identifiers and name attributes with random text.