公开(公告)号：US20170357810A1

公开(公告)日：2017-12-14

申请号：US15176963

申请日：2016-06-08

Applicant: salesforce.com, inc.

Inventor： Sergey GORBATY ,  Travis SAFFORD ,  Xiaoran WANG ,  Yoel GLUCK

IPC: G06F21/57 ,  G06F17/30

CPC classification number: G06F21/577 ,  G06F17/30312 ,  G06F2221/033

Abstract: During runtime of the software application, the runtime analysis framework may assign input tags to objects associated with the user requests. The input tags may identify the requests as potentially malicious and carry a security risk. The RTA framework then may assign sanitization tags to the objects identifying security checks performed on the objects during runtime. The RTA framework identifies output responses to the user requests that include the objects and compares the input tags assigned to the objects with any sanitization tags assigned to the objects. The RTA framework may identify the software application as susceptible to a security vulnerability when the input tags for the objects do not include corresponding sanitization tags.

公开(公告)号：US20190042762A1

公开(公告)日：2019-02-07

申请号：US16158098

申请日：2018-10-11

Applicant: salesforce.com, inc.

Inventor： Sergey GORBATY ,  Trav is SAFFORD ,  Xiaoran WANG ,  Yoel GLUCK

IPC: G06F21/57 ,  G06F17/30

CPC classification number: G06F21/577 ,  G06F16/22 ,  G06F2221/033

Abstract: During runtime of the software application, the runtime analysis framework may assign input tags to objects associated with the user requests. The input tags may identify the requests as potentially malicious and carry a security risk. The RTA framework then may assign sanitization tags to the objects identifying security checks performed on the objects during runtime. The RTA framework identifies output responses to the user requests that include the objects and compares the input tags assigned to the objects with any sanitization tags assigned to the objects. The RTA framework may identify the software application as susceptible to a security vulnerability when the input tags for the objects do not include corresponding sanitization tags.

公开(公告)号：US20180159832A1

公开(公告)日：2018-06-07

申请号：US15885472

申请日：2018-01-31

Applicant: salesforce.com, inc.

Inventor： Yoel GLUCK

IPC: H04L29/06 ,  H04L29/08 ,  G06F17/30

CPC classification number: H04L63/0428 ,  G06F17/30867 ,  G06F17/30991 ,  H04L63/0281 ,  H04L63/0471 ,  H04L63/0884 ,  H04L63/126 ,  H04L63/1416 ,  H04L67/28

Abstract: Methods and systems are provided for proxying data between an application server and a client device. One exemplary application system includes an application server to generate a virtual application and a proxy server coupled to the application server over a network to provide the virtual application to a client device. The proxy server receives input data from the client device and provides the input data to the application server, wherein the application server encodes the input data for an action in response to authenticating the proxy server and provides the data encoded for the action to the proxy server. The proxy server performs the action on the data and provides the result to the client device.

公开(公告)号：US20170034136A1

公开(公告)日：2017-02-02

申请号：US15289889

申请日：2016-10-10

Applicant: salesforce.com, inc.

Inventor： Yoel GLUCK

IPC: H04L29/06 ,  G06F17/30 ,  H04L29/08

CPC classification number: H04L63/0428 ,  G06F17/30867 ,  G06F17/30991 ,  H04L63/0281 ,  H04L63/0471 ,  H04L63/0884 ,  H04L63/126 ,  H04L63/1416 ,  H04L67/28

Abstract: Methods and systems are provided for proxying data between an application server and a client device. One exemplary application system includes an application server to generate a virtual application and a proxy server coupled to the application server over a network to provide the virtual application to a client device. The proxy server receives input data from the client device and provides the input data to the application server, wherein the application server encodes the input data for an action in response to authenticating the proxy server and provides the data encoded for the action to the proxy server. The proxy server performs the action on the data and provides the result to the client device.

Abstract translation: 提供方法和系统用于在应用程序服务器和客户端设备之间代理数据。 一个示例性应用系统包括：应用服务器，用于生成虚拟应用，以及通过网络耦合到应用服务器的代理服务器，以将虚拟应用提供给客户端设备。 代理服务器从客户端设备接收输入数据，并向应用服务器提供输入数据，其中响应于认证代理服务器，应用服务器对用于动作的输入数据进行编码，并向代理服务器提供针对动作编码的数据 。 代理服务器对数据执行操作，并将结果提供给客户端设备。