A program is defined to be noninterferent if its outputs cannot be influenced by inputs at a
higher security level than their own. Various researchers have demonstrated how this …

JavaScript has become a central technology of the web, but it is also the source of many
security problems, including cross-site scripting attacks and malicious advertising code …

This paper seeks to answer fundamental questions about trade-offs between static and
dynamic security analysis. It has been previously shown that flow-sensitive static information …

The dynamic nature of JavaScript web applications has given rise to the possibility of privacy
violating information flows. We present an empirical study of the prevalence of such flows on …

Tracking information flow in dynamic languages remains an important and intricate problem.
This paper makes substantial headway toward understanding the main challenges and …

We present FlowFox, the first fully functional web browser that implements a precise and
general information flow control mechanism for web scripts based on the technique of …

Abstract Information-flow control tracks how information propagates through the program
during execution to make sure that the program handles the information securely. Secure …

A key challenge in dynamic information flow analysis is handling implicit flows, where code
conditional on a private variable updates a public variable x. The naive approach of …

The class of Cross-site Scripting (XSS) vulnerabilities is the most prevalent security problem
in the field of Web applications. One of the main attack vectors used in connection with XSS …

We present Relational Hoare Type Theory (RHTT), a novel language and verification system
capable of expressing and verifying rich information flow and access control policies via …