Project

General

Profile

Feature #62

Parse CSS and JavaScript in Detection Engine

Added by Luke Murphey over 14 years ago. Updated about 14 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Scan Engine
Target version:
-
Start date:
04/08/2010
Due date:
% Done:

0%

Description

NSIA should incorporate a parser for JavaScript and CSS in order to improve the capability of the scanner. Below are the value-added analysis that the extended parsing would add:

CSS Parser

  • Identify bad CSS declarations
  • Identify content that is included via CSS

JavaScript/VBScript Parser

  • Identify attempts to instantiate objects (such as Shockwave Flash instances)
  • Could perform heuristics
  • Could identify bad JavaScript syntax

Related issues

Blocked by ThreatFactor NSIA - Feature #227: Ability for ThreatScripts to Add to URL Scan List Closed 11/05/2010 11/05/2010

History

#1 Updated by Luke Murphey over 14 years ago

For this to be done, a compiler grammar should be used to parse the content. The following projects could be used:

For JavaCC:

For ANTLR:

#2 Updated by Luke Murphey about 14 years ago

  • Category set to Scan Engine

Also available in: Atom PDF