Instructing web clients to ignore scripts in specified portions of web pages

Abstract

A web client is controlled to actively ignore scripts in certain portions of a web document using control instructions in the form of a special pair of markup language “tags.” A tag pair of this type is defined by a first tag, and a second tag paired with the first tag to form the tag pair. Each of the first and second tags includes a same identifier, and the tag pair is adapted to be recognized by a browser interpreter to instruct the web client to ignore given information located with the tag pair. Thus, when a web document is received by a web client, it is parsed (by the interpreter) in the usual manner. Upon determining that the tag pair is present, the browser bypasses (ignores) given information (typically, a script) located with the tag pair. Bypassing the script reduces the possibility that the script can be used for malicious purposes, such as an XSS attack.

Having described our invention, what we now claim is as follows: 
     
         1 - 8 . (canceled) 
     
     
         9 . Apparatus, comprising:
 a processor;   computer memory holding computer program instructions that when executed by the processor perform a method to control a web client, the method comprising:
 receiving a web document, the web document including a first tag, and a second tag paired with the first tag to form a tag pair, each of the first and second tags including a same identifier, the tag pair being adapted to instruct the web client to ignore given information located with the tag pair; 
 parsing the web document; 
 determining if the tag pair is present; and 
 if the tag pair is present, bypassing the given information located within the tag pair. 
   
     
     
         10 . The apparatus as described in  claim 9  wherein the first tag provides a start ignore indication, and the second tag provides an end ignore indication. 
     
     
         11 . The apparatus as described in  claim 10  wherein the given information is a script. 
     
     
         12 . The apparatus as described in  claim 10  wherein given information includes one or more instructions that allow for an input. 
     
     
         13 . The apparatus as described in  claim 12  wherein the input is one of: a user input, and an external input. 
     
     
         14 . The apparatus as described in  claim 9  wherein the identifier is a data string that is generated dynamically each time the web document is provided from the server. 
     
     
         15 . The apparatus as described in  claim 9  wherein the first tag is defined as <ignorescripts:identifier> and the second tag is defined as </ignorescripts:identifier>. 
     
     
         16 . The apparatus as described in  claim 9  wherein the given information is a markup language element and the tag pair prevents an external script from accessing the markup language element. 
     
     
         17 . A computer program product in a computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method to control a web client, comprising:
 receiving a web document, the web document including a first tag, and a second tag paired with the first tag to form a tag pair, each of the first and second tags including a same identifier, the tag pair being adapted to instruct the web client to ignore given information located with the tag pair;   parsing the web document;   determining if the tag pair is present; and   if the tag pair is present, bypassing the given information located within the tag pair.   
     
     
         18 . The apparatus as described in  claim 17  wherein the first tag provides a start ignore indication, and the second tag provides an end ignore indication. 
     
     
         19 . The apparatus as described in  claim 18  wherein the given information is a script. 
     
     
         20 . The apparatus as described in  claim 18  wherein given information includes one or more instructions that allow for an input. 
     
     
         21 . The apparatus as described in  claim 20  wherein the input is one of: a user input, and an external input. 
     
     
         22 . The apparatus as described in  claim 17  wherein the identifier is a data string that is generated dynamically each time the web document is provided from the server. 
     
     
         23 . The apparatus as described in  claim 17  wherein the first tag is defined as <ignorescripts:identifier> and the second tag is defined as </ignorescripts:identifier>. 
     
     
         24 . The apparatus as described in  claim 17  wherein the given information is a markup language element and the tag pair prevents an external script from accessing the markup language element. 
     
     
         25 . Server apparatus, comprising:
 a processor;   computer memory;   a web application executed by the processor; and   computer program instructions executed by the processor to generate a web document, the web document including a first tag, and a second tag paired with the first tag to form a tag pair, each of the first and second tags including a same identifier, the tag pair being adapted to instruct a web client that receives the web document to ignore given information located with the tag pair.