Intercepting and supervising calls to transformed operations and objects
In an embodiment, a method comprises intercepting a first set of instructions from a server computer that define one or more objects and one or more original operations that are based, at least in part, on the one or more objects; modifying the first set of instructions by adding one or more supervisor operations that are based, at least in part, on the one or more objects; transforming the one or more original operations to produce one or more transformed operations that are based, at least in part, on the one or more supervisor operations; rendering a second set of instructions which define the one or more supervisor operations and the one or more transformed operations; sending the second set of instructions to a remote client computer.
1. A computer system configured to improve security of client computers interacting with server computers through an intermediary computer, and comprising:
one or more processors;
one or more non-transitory storage media storing instructions which, when executed by the one or more processors, cause:
receiving a first set of instructions from a server computer;
sending, to a remote client computer, the first set of instructions and a second set of instructions that define one or more supervisor operations, which when executed by a runtime environment on the remote client computer, cause the runtime environment to:
generate one or more objects in a memory on the remote client computer; intercept a call to a particular object of the one or more objects in the memory on the remote client computer; send a set of telemetry data to a server computer indicating the particular object was referenced.
2. The computer system of claim 1 , wherein the one or more supervisor operations are configured to cause the runtime environment to determine the call to the particular object was made by a first operation.
3. The computer system of claim 2 , wherein the one or more supervisor operations are configured to cause the runtime environment to determine the first operation is allowed to reference the particular object.
4. The computer system of claim 3 , wherein the particular object is a second operation;
wherein the one or more supervisor operations are configured to cause the runtime environment to perform the second operation in response to the runtime environment determining that the first operation is allowed to reference the particular object.
5. The computer system of claim 4 , wherein the one or more supervisor operations are configured to cause the runtime environment to include, in the set of telemetry data, data indicating that the first operation was allowed to reference the particular object and that the second operation was performed.
6. The computer system of claim 3 , wherein the particular object is a second operation;
wherein the one or more supervisor operations are configured to cause the runtime environment to terminate the call without performing the second operation in response to the runtime environment determining that the first operation is not allowed to reference the particular object.
7. The computer system of claim 6 , wherein the one or more supervisor operations are configured to cause the runtime environment to include, in the set of telemetry data, data indicating that the first operation was not allowed to reference the particular object and that the call was terminated without performing the second operation.
8. The computer system of claim 2 , wherein a first identifier is assigned to the particular object;
wherein the one or more supervisor operations are configured to cause the runtime environment to assign a second identifier to the particular object and to include, in the set of telemetry data, data that indicates whether the first operation referenced the particular object by the first identifier or the second identifier.
9. The computer system of claim 1 , wherein a first alias is assigned to the particular object;
wherein the one or more supervisor operations are configured to cause the runtime environment to assign a second alias to the particular object and to include, in the set of telemetry data, data that indicates whether the call to the particular object was made using the first alias or the second alias.
10. The computer system of claim 1 , wherein the particular object is a first operation;
wherein the one or more supervisor operations are configured to cause the runtime environment to transform the first operation into a second operation and, in response to receiving the call to the particular object, to: perform the first operation and collect a first result; perform the second operation and collect a second result; determine whether the first result is equal to the second result.
11. The computer system of claim 10 , wherein the one or more supervisor operations are configured to cause the runtime environment, to include, in the set of telemetry data in response to determining that the first result is equal to the second result, data indicating that the first operation was successfully transformed into the second operation.
12. The computer system of claim 10 , wherein the one or more supervisor operations are configured to cause the runtime environment to include, in the set of telemetry data in response to determining that the first result is not equal to the second result, data indicating that the first operation was not successfully transformed into the second operation.