| [1] Barth A, Jackson C, Mitchell J C. Securing frame communication in browsers[C]//Proceedings of the 17th USENIX Security Symposium. San Jose, CA, USA,2008:17-30.[2] The World Wide Web Consortium (W3C).W3C editor's draft[EB/OL]. (2011-11-20)[2011-11-25]. http://dev.w3.org/html5 /postmsg/#dom-messageevent-source.[3] Alman B. jQuery postMessage: Cross-domain scripting goodness[EB/OL]. (2009-08-23)[2011-11-20]. http://benalman. com/projects/jquery-postmessage-plugin/.[4] Kinsey Φ S. Easy cross-site scripting using the easyXDM library[EB/OL].(2009-08-17)[2011-11-25]. http://www.codeproject.com/Articles/37622/Easy-Cross-site-Scripting-using-the-easyXDM-Library.[5] Matono A, Nakamura A, Kojima I. A mashup tool for cross-domain Web applications using HTML5[J]. Lecture Notes in Computer Science, 2011, 6612:382-385.[6] Ryck P D, Desmet L, Philippaerts P, et al. A security analysis of next generation Web standards[R/OL].Greece: European Network and Information Security Agency (ENISA), (2011-07-31)[2011-11-25]. http://www.enisa.europa.eu/activities/application-security/web-security/.[7] Hickson I. HTML living standard . USA:The Web Hypertext Application Technology Working Group, (2009-10-23)[2011-11-25]http://www.whatwg.org/specs/web-apps/current-work/multipage/web-messaging.html#crossDocumentMess ages.[8] Hanna S, Shin E C R, Akhawe D, et al. The emperor’s new APIs: on the (in)secure usage of new client-side primitives[C]//Proceedings of the 4th Web 2.0 Security and Privacy. Oakland, California, USA, 2010.[9] Saxena P, Hanna S, Poosankam P, et al. FLAX:systematic discovery of client-side validation vulnerabilities in rich Web applications[C]//Proceedings of the 17th Annual Network & Distributed System Security Symposium. San Diego, Califonia, USA, 2010.[10] Edwards D. Packer version 3.0[CP/OL]. (2007-04-01)[2011-11-20]. http://dean.edwards.name/weblog/2007/04/packer3/.[11] Heiderich M. HTML5 security cheatsheet[EB/OL].(2011-01-22)[2011-11-20].http://html5sec.org/. |
