12 Angry Developers - A Qualitative Study on Developers' Struggles with CSP
Sebastian Roth, Lea Gröber, Michael Backes, Katharina Krombholz, Ben Stock
2021年份
22被引次数
8顶会引用
摘要
The Web has improved our ways of communicating, collaborating, teaching, and entertaining us and our fellow human beings. However, this cornerstone of our modern society is also one of the main targets of attacks, most prominently Cross-Site Scripting (XSS). A correctly crafted Content Security Policy (CSP) is capable of effectively mitigating the effect of those Cross-Site Scripting attacks. However, research has shown that the vast majority of all policies in the wild are trivially bypassable.
问问这篇 Paper
问问你的智能体。
Lune 读过与它相关的顶会 Paper，每个回答都会注明依据哪几篇。
引用它的顶会 Paper8
- Different Researchers, Different Results? Analyzing the Influence of Researcher Experience and Data Type During Qualitative Analysis of an Interview and Survey Study on Security AdviceAnna-Marie Ortloff, Matthias Fassl, Alexander Ponticello, Florin Martius 等CHI 2023 · 被引用 38 次
- Digital Disparities: A Comparative Web Measurement Study Across Economic BoundariesMasudul Hasan Masud Bhuiyan, Matteo Varvello, Cristian-Alexandru Staicu, Yasir ZakiWWW 2025 · 被引用 5 次
- Trust Me If You Can - How Usable Is Trusted Types In Practice?Sebastian Roth, Lea Gröber, Philipp Baus, Katharina Krombholz 等USENIX Security 2024 · 被引用 3 次
- It's like flossing your teeth: On the Importance and Challenges of Reproducible Builds for Software Supply Chain SecurityMarcel Fourné, Dominik Wermke, William Enck, Sascha Fahl 等S&P 2023
- BUIzz: Finding Policy Enforcement Bugs via Interaction Simulation on the Browser User InterfaceMingi Jung, Donggyu Kim, Mijung Kim, Seongil WiUSENIX Security 2026
相关 Paper
- CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security PolicyLukas Weichselbaum, Michele Spagnuolo, Sebastian Lekies, Artur JancCCS 2016 · 被引用 114 次
- CSPAutoGen: Black-box Enforcement of Content Security Policy upon Real-world WebsitesXiang Pan, Yinzhi Cao, Shuangping Liu, Yu Zhou 等CCS 2016 · 被引用 55 次
- CCSP: Controlled Relaxation of Content Security Policies by Runtime Policy CompositionStefano Calzavara, Alvise Rabitti, Michele BugliesiUSENIX Security 2017 · 被引用 15 次
- Code-Reuse Attacks for the Web: Breaking Cross-Site Scripting Mitigations via Script GadgetsSebastian Lekies, Krzysztof Kotowicz, Samuel Groß, Eduardo A. Vela Nava 等CCS 2017 · 被引用 62 次
- DiffCSP: Finding Browser Bugs in Content Security Policy Enforcement through Differential TestingSeongil Wi, Trung Tin Nguyen, Jihwan Kim, Ben Stock 等NDSS 2023
