Abstract: Data Leakage is an important cause of Web sandbox escape.Namely,unauthorized programs can access sensitive data of system.The existed security analysis methods of Web application are not applicable to detect data leakage of Web sandboxes.In this paper,a Web sandbox test method was proposed to detect Web sandbox data leakage.Based on the model of JavaScript object,first,the method uses depth-first strategy to traversal native objects of browser and gets the collection of directly access object.Then,the method designs sensitive-point oriented test algorithm of encapsulated objects and gets the collection of indirectly access object.Next,the method designs data leakage test algorithm of multiple applications and gets the possible communication paths of programs.Finally,the method compares the test results and the specification of tested web sandbox to detect data leakage.This paper designed and implemented a Web sandbox test system (WSTS),and tested the different versions of ADsafe.The experimental results show that the method has good ability to detect data leakage of Web sandbox.

Key words: Web sandbox,JavaScript,Data leakage,Testing method