references.bib

@doctoralThesis{Steffens_2021,
    title={Understanding emerging client-Side web vulnerabilities using dynamic program analysis},
    author={Steffens, Marius},
    year={2021},
    type = {Dissertation, Saarland University},
    school = {Saarland University},
%    howpublished = {Saarland University},
%    doi={http://dx.doi.org/10.22028/D291-34462},
}

@article{ApplicationLayerDDoS,
  author={Xie, Yi and Yu, Shun-Zheng},
  journal={IEEE/ACM Transactions on Networking}, 
  title={Monitoring the Application-Layer DDoS Attacks for Popular Websites}, 
  year={2009},
  volume={17},
  number={1},
  pages={15-25},
%  doi={10.1109/TNET.2008.925628}
}

@inproceedings{JSinclusions,
    title = {You Are What You Include: Large-Scale Evaluation of Remote Javascript Inclusions},
    author = {Nikiforakis, Nick and Invernizzi, Luca and Kapravelos, Alexandros and Van Acker, Steven and Joosen, Wouter and Kruegel, Christopher and Piessens, Frank and Vigna, Giovanni},
    year = {2012},
    publisher = {Association for Computing Machinery},
    address = {New York, NY, USA},
    booktitle = {Proceedings of the 2012 ACM Conference on Computer and Communications Security},
    pages = {736-747},
    numpages = {12},
    location = {Raleigh, North Carolina, USA},
%    series = {CCS '12},
%    isbn = {9781450316514},
%    url = {https://doi.org/10.1145/2382196.2382274},
%    doi = {10.1145/2382196.2382274},
%    keywords = {javascript, trust, remote inclusions},
}

@inproceedings{ThirdPartyResources,
    title = {The Chain of Implicit Trust: An Analysis of the Web Third-Party Resources Loading},
    author = {Ikram, Muhammad and Masood, Rahat and Tyson, Gareth and Kaafar, Mohamed Ali and Loizon, Noha and Ensafi, Roya},
    year = {2019},
    publisher = {Association for Computing Machinery},
    address = {New York, NY, USA},
    booktitle = {The World Wide Web Conference},
    pages = {2851-2857},
    numpages = {7},
    location = {San Francisco, CA, USA},
%    series = {WWW '19},
%    isbn = {9781450366748},
%    url = {https://doi.org/10.1145/3308558.3313521},
%    doi = {10.1145/3308558.3313521},
}

@inproceedings{InBrowserDetection,
    author = {Arshad, Sajjad and Kharraz, Amin and Robertson, William},
    year = {2017},
    month = {05},
    pages = {441-459},
    title = {Include Me Out: In-Browser Detection of Malicious Third-Party Content Inclusions},
%    isbn = {978-3-662-54969-8},
%    doi = {10.1007/978-3-662-54970-4_26}
}

@inproceedings{Tranco,
    author = "{Le Pochat}, Victor and {Van Goethem}, Tom and Tajalizadehkhoob, Samaneh and Korczy\'{n}ski, Maciej and Joosen, Wouter",
    title = "Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation",
    booktitle = {Proceedings of the 26th Annual Network and Distributed System Security Symposium},
    year = 2019,
%    month = {2},
%    series = {NDSS 2019},
%    doi = {10.14722/ndss.2019.23386},
}

@inproceedings{ChromiumSecArchitecture,
  title = {The Security Architecture of the Chromium Browser},
  author = {Adam Barth and Charles Reis},
  year = {2009}
}


% Specifications

@techreport{ECMA262,
   author = "Shu-yu Guo and Michael Ficarra and Kevin Gibbons",
   title = "{ECMAScript Language Specification}",
   howpublished = {Ecma},
   type="{Specification}",
   year = {2022},
   month = {3},
   publisher = "{Ecma}",
   institution = "{Ecma}",
   url={https://tc39.es/ecma262/}
}

% ECMAScript releases:
% https://www.ecma-international.org/publications-and-standards/standards/ecma-262/

@techreport{ECMA262_edition1,
   author = "{Ecma International}",
   title = "{ECMAScript Language Specification, 1st edition}",
   howpublished = {Ecma International},
   type="{Specification}",
   pages = {1-2},
   year = {1997},
   month = {6},
%   publisher = "{Ecma International}",
%   institution = "{Ecma International}",
%   url={https://www.ecma-international.org/wp-content/uploads/ECMA-262_1st_edition_june_1997.pdf}
}

@techreport{ECMA262_edition6,
   author = "{Ecma International}",
   title = "{ECMAScript Language Specification, 6th edition}",
   howpublished = {Ecma International},
   type="{Specification}",
   year = {2015},
   month = {6},
%   publisher = "{Ecma International}",
%   institution = "{Ecma International}",
%   url={https://www.ecma-international.org/wp-content/uploads/ECMA-262_6th_edition_june_2015.pdf}
}

@techreport{fetch,
   author = "Anne van Kesteren",
   title = "{Fetch}",
   howpublished = {WHATWG},
   type="{Living Standard}",
   year = {2022},
   month = {3},
   publisher = "{WHATWG}",
   institution = "{WHATWG}",
   url={https://fetch.spec.whatwg.org/}
}

@techreport{html,
   author = "Ian Hickson and Simon Pieters and Anne van Kesteren and Philip Jägenstedt and Domenic Denicola",
   title = "{HTML}",
   howpublished = {WHATWG},
   type="{Living Standard}",
   year = {2022},
   month = {4},
   publisher = "{WHATWG}",
   institution = "{WHATWG}",
   url={https://html.spec.whatwg.org/}
}

@techreport{dom,
   author = "Anne van Kesteren and Aryeh Gregor and Ms2ger",
   title = "{DOM}",
   howpublished = {WHATWG},
   type="{Living Standard}",
   year = {2022},
   month = {4},
   publisher = "{WHATWG}",
   institution = "{WHATWG}",
   url={https://dom.spec.whatwg.org/}
}

@techreport{crypto,
   author = "Daniel Huigens and Mark Watson and Ryan Sleevi",
   title = "{Web Cryptography API}",
   howpublished = {W3C},
   type="{Living Standard}",
   year = {2022},
   month = {3},
   publisher = "{W3C}",
   institution = "{W3C}",
   url={https://w3c.github.io/webcrypto/}
}

@techreport{webauthn,
   author = "Jeff Hodges and Michael B. Jones and Akshay Kumar and Emil Lundberg", % et. al
   title = "{Web Authentication: An API for accessing Public Key Credentials}",
   howpublished = {W3C},
   type="{Living Standard}",
   year = {2022},
   month = {4},
   publisher = "{W3C}",
   institution = "{W3C}",
   url={https://w3c.github.io/webauthn/}
}

@techreport{UpgradeInsecureRequests,
   author = "Mike West",
   title = "{Upgrade Insecure Requests}",
   howpublished = {W3C},
   type="{Living Standard}",
   year = {2022},
   month = {5},
   publisher = "{W3C}",
   institution = "{W3C}",
   url={https://w3c.github.io/webappsec-upgrade-insecure-requests/}
}


% RFCs

@misc{origin,
   author = {Adam Barth},
   title = {{The Web Origin Concept}},
   shorthand = {RFC6454},
   series = {Request for Comments},
   number = 6454,
   howpublished = {RFC 6454},
   publisher = {RFC Editor},
%   doi = {10.17487/RFC6454},
%   url = {https://www.rfc-editor.org/info/rfc6454},
   pagetotal = 20,
   year = 2011,
   month = 12,
}


% Online References

@online{PlaywrightPython,
    author = {Microsoft},
    title = {Playwright for Python},
    url = {https://github.com/microsoft/playwright-python},
    urldate = {2022-03-22}
}

@online{Electron,
    author = {{OpenJS Foundation}},
    title = {Electron},
    url = {https://www.electronjs.org/},
    urldate = {2022-04-24}
}

@online{ReactNative,
    author = {{Meta Platforms}},
    title = {React Native},
    url = {https://reactnative.dev/},
    urldate = {2022-04-24}
}

@online{NodeJS,
    author = {{OpenJS Foundation}},
    title = {Node.js},
    url = {https://nodejs.org/en/},
    urldate = {2022-04-24}
}

@online{V8,
    author = {Google},
    title = {V8},
    url = {https://v8.dev/},
    urldate = {2022-04-28}
}

@online{SpiderMonkey,
    author = {Mozilla},
    title = {SpiderMonkey},
    url = {https://spidermonkey.dev/},
    urldate = {2022-04-28}
}

@online{JavaScriptCore,
    author = {Apple},
    title = {JavaScriptCore},
    url = {https://trac.webkit.org/wiki/JavaScriptCore},
    urldate = {2022-04-28}
}

@online{XrayVisionDocs,
    author = {Mozilla},
    title = {Xray Vision},
    url = {https://firefox-source-docs.mozilla.org/dom/scriptSecurity/xray_vision.html},
    urldate = {2022-03-22}
}

@online{MozPolyfill,
    author = {Mozilla},
    title = {Polyfill},
    url = {https://developer.mozilla.org/en-US/docs/Glossary/Polyfill},
    urldate = {2022-04-22}
}

@online{RemyPolyfill,
    author = {Remy Sharp},
    title = {What is a Polyfill?},
    url = {https://remysharp.com/2010/10/08/what-is-a-polyfill},
    urldate = {2022-04-22}
}

@online{MozSameOriginPolicy,
    author = {Mozilla},
    title = {Same-origin policy},
    url = {https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy},
    urldate = {2022-04-24}
}

@online{MozCSP,
    author = {Mozilla},
    title = {Content Security Policy (CSP)},
    url = {https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP},
    urldate = {2022-04-29}
}

@online{MozGlobal,
    author = {Mozilla},
    title = {Global object},
    url = {https://developer.mozilla.org/en-US/docs/Glossary/Global_object},
    urldate = {2022-04-24}
}

@online{MozWindow,
    author = {Mozilla},
    title = {Global object},
    url = {https://developer.mozilla.org/en-US/docs/Web/API/Window},
    urldate = {2022-04-24}
}

@online{MozWebAPIs,
    author = {Mozilla},
    title = {Introduction to web APIs},
    url = {https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Client-side_web_APIs/Introduction},
    urldate = {2022-04-24}
}

@online{MozBrowserExtensions,
    author = {Mozilla},
    title = {Browser Extensions},
    url = {https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions},
    urldate = {2022-04-25}
}

@online{MozBrowserExtensionAPIs,
    author = {Mozilla},
    title = {Browser support for JavaScript APIs},
    url = {https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Browser_support_for_JavaScript_APIs},
    urldate = {2022-04-25}
}

@online{MozObjectPrototypes,
    author = {Mozilla},
    title = {Object prototypes},
    url = {https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Objects/Object_prototypes},
    urldate = {2022-04-25}
}

@online{MozObjectDefineProperty,
    author = {Mozilla},
    title = {Object.defineProperty()},
    url = {https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/defineProperty},
    urldate = {2022-04-28}
}

@online{MozVar,
    author = {Mozilla},
    title = {var},
    url = {https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/var},
    urldate = {2022-05-03}
}

@online{MozPushState,
    author = {Mozilla},
    title = {History.pushState()},
    url = {https://developer.mozilla.org/en-US/docs/Web/API/History/pushState},
    urldate = {2022-05-08}
}

@online{MozReplaceState,
    author = {Mozilla},
    title = {History.replaceState()},
    url = {https://developer.mozilla.org/en-US/docs/Web/API/History/replaceState},
    urldate = {2022-05-08}
}

@online{MozSRI,
    author = {Mozilla},
    title = {Subresource Integrity},
    url = {https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity},
    urldate = {2022-05-08}
}

@online{MozFFSandbox,
    author = {Mozilla},
    title = {Firefox Sandbox Architecture},
    url = {https://wiki.mozilla.org/Security/Sandbox/Process_model},
    urldate = {2022-05-11}
}

@online{TC39_general,
    author = {{Ecma International}},
    title = {TC39},
    url = {https://www.ecma-international.org/technical-committees/tc39/?tab=general},
    urldate = {2022-04-24}
}

@online{TC39_activities,
    author = {{Ecma International}},
    title = {TC39},
    url = {https://www.ecma-international.org/technical-committees/tc39/?tab=activities},
    urldate = {2022-04-24}
}

@online{EcmaStandards,
    author = {{Ecma International}},
    title = {Standards published by Ecma},
    url = {https://www.ecma-international.org/publications-and-standards/standards/?order=category},
    urldate = {2022-04-28}
}