Patent ID: 9231975
Filing Date: 2016-01-05
CPC Classification: G06F,H04L

Claim Text:
1. A computer-implemented method for inhibiting cross-site scripting (XSS) attacks, the method being executed by one or more processors and comprising: receiving, by the one or more processors, a computer-readable document, the computer-readable document providing a content security policy (CSP) for a website and an extension to the CSP, the CSP specifying one or more allowed script checksums, each allowed script checksum being associated with a script that is allowed to be executed, the extension comprising a templating mechanism and a script check-summing scheme, the templating mechanism comprising a value list and one or more script templates defining a format of a script syntax that supports a use of insertion marks in place of data values that are to be applied during script execution by a web browser, the script check-summing scheme indicating which respective scripts are allowed to be executed by the website and the extension requiring a comparison of script checksums before the respective scripts can be executed; receiving, by the one or more processors, the one or more script templates and the value list; calculating, by the one or more processors and based on a cryptographic hash function algorithm associated with the one or more script templates, an expected script checksum for each script template of the one or more script templates to provide respective one or more expected script checksums; comparing, by the one or more processors, the one or more expected script checksums to the one or more allowed script checksums; and determining, by the one or more processors, that at least one expected script checksum matches an allowed script checksum of the one or more allowed script checksums, and in response, executing a respective script that corresponds to the at least one expected script checksum.