Systems and methods for runtime content masking
Systems, methods, and non-transitory computer readable media including instructions for implementing a runtime virtual barrier for fine grained execution control are disclose. Implementing the runtime virtual barrier for fine grained execution control includes receiving, by an application capable of JavaScript execution, an executable code including an API invocation; intercepting, by a virtual barrier, the API invocation; determining that the API invocation is an invocation for a native API configured for subsequent execution in response to a trigger event; based on the determination that the API invocation is an invocation for a native API configured for subsequent execution, recording an invocation source identifier; and upon occurrence of the trigger event: retrieving the invocation source identifier; and influencing execution of the native API based on the invocation source identifier.
1 . A non-transitory computer readable medium containing instructions that when executed by at least one processor cause the at least one processor to perform cyber security operations for masking sensitive data, the operations comprising:
receiving for execution, code associated with displaying an unmasked version of sensitive data, wherein the unmasked version of the sensitive data is included in the code, retrieved from a server by executing the code, or computed at runtime as a result of executing the code; and
injecting, into an execution environment associated with the code, an agent configured to:
identify the unmasked version of the sensitive data based on an indicator;
access a Document Object Model (DOM) associated with the code;
identify, in the DOM, the unmasked version of the sensitive data;
replace in the DOM at least a portion of the unmasked version of the sensitive data with a mask, thereby generating a masked version of the sensitive data and concealing the at least a portion of the unmasked version of the sensitive data when content is displayed based on the code; and
if a request for the unmasked version of the sensitive data is detected, return the unmasked version of the sensitive data while maintaining the mask in the DOM.
2 . The non-transitory computer readable medium of claim 1 , wherein the agent is further configured to intercept a request to access the code and provide the unmasked version of the sensitive data in response to the request, thereby allowing access to the unmasked version of the sensitive data while preventing display of the at least a portion of the unmasked version of the sensitive data.
3 . The non-transitory computer readable medium of claim 1 , wherein the code is configured for execution by an application and the agent is configured to operate without changing application code associated with the application.
4 . The non-transitory computer readable medium of claim 1 , wherein the sensitive data is associated with at least one element associated with the code, and wherein identifying in the DOM the unmasked version of the sensitive data includes identifying the at least one element in the DOM.
5 . The non-transitory computer readable medium of claim 4 , wherein the at least one element includes a hypertext markup language (HTML) element.
6 . The non-transitory computer readable medium of claim 5 , wherein the at least one HTML element includes a <div> HTML element.
7 . The non-transitory computer readable medium of claim 4 , wherein the agent is further configured to store a value-object pair associated with the sensitive data and the at least one element, wherein returning the unmasked version of the sensitive data includes accessing the value-object pair.
8 . The non-transitory computer readable medium of claim 1 , wherein the sensitive data includes at least one of financial information, personal information, or business information.
9 . The non-transitory computer readable medium of claim 1 , wherein the sensitive data includes classified information.
10 . The non-transitory computer readable medium of claim 1 , wherein the sensitive data includes health information.
11 . The non-transitory computer readable medium of claim 1 , wherein the sensitive data includes educational information.
12 . The non-transitory computer readable medium of claim 1 , wherein the agent is injected into a top portion of the code.
13 . The non-transitory computer readable medium of claim 1 , wherein identifying the unmasked version of the sensitive data in the code includes scanning the code to detect the indicator, wherein the indicator includes a contextual character sequence associated with the sensitive data.
14 . The non-transitory computer readable medium of claim 13 , wherein identifying the unmasked version of the sensitive data in the code includes determining that the contextual character sequence satisfies a predefined format rule.
15 . The non-transitory computer readable medium of claim 13 , wherein identifying unmasked version of the sensitive data in the code includes determining that the contextual character sequence satisfies a predefined length rule.
16 . The non-transitory computer readable medium of claim 13 , wherein the contextual character sequence is configured to be displayed when the content is displayed.
17 . The non-transitory computer readable medium of claim 13 , wherein the contextual character sequence is configured to be withheld when the content is displayed.
18 . A method for performing cybersecurity operations for masking sensitive data, the method comprising:
receiving for execution, code associated with displaying an unmasked version of sensitive data, wherein the unmasked version of the sensitive data is included in the code, retrieved from a server by executing the code, or computed at runtime as a result of executing the code; and
injecting, into an execution environment associated with the code, an agent configured to:
identify the unmasked version of the sensitive data based on an indicator;
access a Document Object Model (DOM) associated with the code;
identify in the DOM the unmasked version of the sensitive data;
replace in the DOM at least a portion of the unmasked version of the sensitive data with a mask, thereby generating a masked version of the sensitive data and concealing the at least a portion of the unmasked version of the sensitive data when content is displayed based on the code; and
if a request for the unmasked version of the sensitive data is detected, return the unmasked version of the sensitive data while maintaining the mask in the DOM.
19 . The method of claim 18 , wherein the agent is further configured to intercept a request to access the code and provide the unmasked version of the sensitive data in response to the request, thereby allowing access to the sensitive data while preventing display of the at least a portion of the unmasked version of the sensitive data.
20 . A system for performing cybersecurity operations for masking sensitive data, the system comprising at least one processor configured to:
receive for execution, code associated with displaying an unmasked version of sensitive data, wherein the unmasked version of the sensitive data is included in the code, retrieved from a server by executing the code, or computed at runtime as a result of executing the code; and
inject, into an execution environment associated with the code, an agent configured to:
identify the unmasked version of the sensitive data based on an indicator;
access a Document Object Model (DOM) associated with the code;
identify in the DOM the unmasked version of the sensitive data;
replace in the DOM at least a portion of the unmasked version of the sensitive data with a mask, thereby generating a masked version of the sensitive data and concealing the at least a portion of the unmasked version of the sensitive data when content is displayed based on the code; and
if a request for the unmasked version of the sensitive data is detected, return the unmasked version of the sensitive data while maintaining the mask in the DOM.