Defeating script injection attacks with browser-enforced embedded policies
Static detection of security vulnerabilities in scripting languages