![](https://csdnimg.cn/release/download_crawler_static/12153733/bgd.jpg)
GUIDELINES ON ACTIVE CONTENT AND MOBILE CODE
Language Interpretation—Code versus Data: At one time, the security risks associated
with the use of computers were relatively straightforward. Instructions were distinct from the
data on which they operated, and some hardware could even distinguish internally between
instructions and data (e.g., using separate memory banks). Over the years, the situation
changed; tools emerged to facilitate application development in higher-level languages in lieu
of machine languages, generic applications appeared, hardware processing speeds increased
dramatically, and, in many situations, the divide between code and data completely vanished.
One example of the merging of code and data is a script. Scripts are data files or portions of
data files that will be processed by an interpreter or a just-in-time (JIT) compiler. An interpreter
processes commands from a script and executes those commands directly. Without a script,
such commands would be supplied by a source file and converted into object code (i.e., native
machine instructions) by a compiler—preserving the separation of code and data. Many
scripting languages are intended to be embedded in data, using reserved characters or
keywords (e.g., "<” and “if” in JavaScript) to distinguish instructions from data. Interpretive
languages range from lists of simple macro-type commands to complete programming
languages. Rather than execute commands directly, a JIT compiler will compile the
commands into machine code. By caching the commands and their associated machine
code, a JIT compiler can greatly improve the performance of an interpreted language.
With the arrival of the Web came the desire to make static pages more dynamic by using
interpreters throughout the system architecture. Today, most data files contain instructions
that aid in the presentation or use of the data. Interpreters are ubiquitous: spreadsheet
formulas, database query languages, word processing macros, and script interpreters are not
only embedded in Web browsers and servers, but also are used as standalone development
tools to forge applications from existing program components.
While these technology improvements facilitate computer use, they also can involve serious
risks, which are often not readily apparent. Many of these risks are associated with passing
disguised commands (e.g., using special characters) or unexpected commands to an
interpreter. A program that uses an interpreter to process unfiltered user-supplied information
may be fed a string containing special characters that appears to be legitimate data, but will
instead be treated as a parameter for or extension of an intended command, or as a new
unintended command sequence. Injecting commands into a vulnerable application for
execution is known as a command injection attack. For instance, many web pages take user
input directly to compose a SQL database query; through specially crafted input, exploit code
can be inserted, resulting in a SQL injection attack. Some applications use multiple
interpreters in tandem, passing the output of one directly into another, which further
compounds the problem, since a harmful operation may be brought about and executed
unobtrusively along the way.
2.1 Browser Anatomy
Browser is the generic term used to refer to software that lets individuals view pages from various
sources, including Web servers on the Internet, which make up the World Wide Web. Firefox and
Internet Explorer are two popular Web browsers that aid in navigating text, graphics, hyperlinks, audio,
video, and other multimedia information and services on the Web. Although Web browsers support a
number of protocols, such as the File Transfer Protocol [
FTP], they rely mainly on a simple, request-
response communications protocol, HTTP [
HTTP], for Web access. The browser requests information
from a specific Web site by sending a method request to the Web server conveying the Universal
Resource Identifier (URI) of the desired resource (e.g., the Uniform Resource Locator (URL) of a Web
page), client information, and content handling capabilities. Appendix A contains a brief summary of the
2-3