[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573768-105":53,"doc-detail-573768-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","autocsp-automatically-retrofitting-csp-to-web-applications","AutoCSP - Automatically Retrofitting CSP to Web Applications","","Web applications frequently handle sensitive user data, making them a prime target for cross-site scripting (XSS) attacks. Content Security Policy (CSP) can provide strong protection, but enabling it by default or manually crafting policies often breaks application behavior. AUTOCSP automates retrofitting CSP by using dynamic taint analysis to determine trusted content and modifying server-side code to emit pages with correct permissions. Evaluation on real-world applications shows effective protection with minimal functional disruption and negligible overhead.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/autocsp-automatically-retrofitting-csp-to-web-applications/573768/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/autocsp-automatically-retrofitting-csp-to-web-applications/573768.png","ImageObject",442,249,{"name":88,"@type":89},"Patrick","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-15","2026-10-14",true,{"@type":98,"interactionType":99,"userInteractionCount":73},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"Why is CSP difficult to deploy on existing web applications?","Question",{"text":108,"@type":109},"Simply enabling a default CSP can significantly change application behavior and disrupt functionality. Manually defining a policy is also time-consuming and error-prone.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How does AUTOCSP identify what content should be allowed by CSP?",{"text":113,"@type":109},"AUTOCSP uses dynamic taint tracking during execution to annotate dynamically generated HTML with taint information, then analyzes those pages to infer which elements come only from trusted sources.",{"name":115,"@type":106,"acceptedAnswer":116},"What impact does AUTOCSP have on real-world applications?",{"text":117,"@type":109},"The evaluation on seven real-world web applications indicates that AUTOCSP retrofits CSP effectively while keeping functionality unchanged or minimally affected, with negligible performance overhead and good cost-effectiveness.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},573768,1792047593,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":73,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":8,"language":135,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":61,"update_tm":139,"read_time":79},549758146520,"https://ap-avatar.wpscdn.com/avatar/80002397d8c0411e94?_k=1775819394049821470","AutoCSP: Automatically Retrofitting CSP to Web Applications  \nMattia Fazzini􀀃 , Prateek Saxenay , Alessandro Orso􀀃  \n􀀃 Georgia Institute of Technology, USA, fmfazzini, [orso](orsog@cc.gatech.edu)[g](orsog@cc.gatech.edu)[@cc.gatech.edu](orsog@cc.gatech.edu)[ ](orsog@cc.gatech.edu)y National University of Singapore, Singapore, [prateeks@comp.nus.edu.sg](prateeks@comp.nus.edu.sg)  \nAbstract—Web applications often handle sensitive user data, which makes them attractive targets for attacks such as crosssite scripting (XSS). Content security policy (CSP) is a contentrestriction mechanism, now supported by all major browsers, that offers thorough protection against XSS. Unfortunately, simply enabling CSP for a web application would affect the application's behavior and likely disrupt its functionality. To address this issue, we propose AUTOCSP, an automated technique for retrofitting CSP to web applications. AUTOCSP (1) leverages dynamic taint analysis to identify which content should be allowed to load on the dynamically-generated HTML pages of a web application and (2) automatically modifies the serverside code to generate such pages with the right permissions. Our evaluation, performed on a set of real-world web applications, shows that AUTOCSP can retrofit CSP effectively and efficiently.  \nI. INTRODUCTION  \nWeb applications are extraordinarily popular, easily accessible, and often handle personal, confidential, and even sensitive data. These characteristics, together with the widespread presence of vulnerabilities in such applications, make them an attractive target for attackers. Cross-site scripting (XSS) in particular, is one of the most commonly reported security vulnerabilities in web applications and often results in successful attacks, whose consequences range from website defacing to theft of sensitive information.  \nThe most common defense mechanisms against XSS are based on input filtering, which can be an effective approach, but is error prone and often results in an incomplete protection. Content security policy (CSP), conversely, is a content restrictions scheme that is currently supported by all major browsers [1] and offers comprehensive protection against XSS attacks. In fact, the popularity of CSP is increasing, and companies such as Facebook and GitHub have started to move CSP to production. In a nutshell, web developers can use a CSP header to provide, for an HTML page, a declarative whitelist policy that defines which content should be allowed to load on that page. Unfortunately, simply enabling a default CSP for a web application can dramatically affect the application's behavior and is likely to disrupt the application's functionality. On the other hand, manually defining a policy can be difficult and time consuming.  \nTo support an effective use of CSP, while both reducing developers' effort and preserving functionality, we propose AUTOCSP, an automated technique and tool for retrofitting CSP to web applications. Given a web application, AUTOCSP operates in four main phases. First, it marks as trusted all“known” values in the web application's server-side code (e.g., hard-coded values) and exercises the web application while performing positive dynamic taint tracking. The result of this  \nphase is a set of dynamically generated HTML pages whose content is annotated with taint information. Second, it analyzes the annotated HTML pages to identify which elements of these pages are trusted. Basically, the tainted elements are those that come only from trusted sources. Third, AUTOCSP uses the results of the previous analysis to infer a policy that would block potentially untrusted elements while allowing trusted elements to be loaded. Fourth, AUTOCSP automatically modifies the server-side code of the web application so that it generates web pages with the appropriate CSP.  \nTo assess the usefulness and practical applicability of AUTOCSP, we developed a prototype that implements our technique and used it to perform an empir","cbCaiv1q2ZDmxoLN","https://ap.wps.com/l/cbCaiv1q2ZDmxoLN","pdf",547758,"English","# Introduction\n# Background and Motivating Example\n## Cross-Site Scripting (XSS)","[{\"question\":\"Why is CSP difficult to deploy on existing web applications?\",\"answer\":\"Simply enabling a default CSP can significantly change application behavior and disrupt functionality. Manually defining a policy is also time-consuming and error-prone.\"},{\"question\":\"How does AUTOCSP identify what content should be allowed by CSP?\",\"answer\":\"AUTOCSP uses dynamic taint tracking during execution to annotate dynamically generated HTML with taint information, then analyzes those pages to infer which elements come only from trusted sources.\"},{\"question\":\"What impact does AUTOCSP have on real-world applications?\",\"answer\":\"The evaluation on seven real-world web applications indicates that AUTOCSP retrofits CSP effectively while keeping functionality unchanged or minimally affected, with negligible performance overhead and good cost-effectiveness.\"}]","AutoCSP - Automatically Retrofitting CSP to Web Applications | PDF",1791945578]