ER T: : J AV AVASCRIPT V ER CATION T OOL HAIN (P (POP OPL 18) - - PowerPoint PPT Presentation

▶
er t
SMART_READER_LITE
LIVE PREVIEW

ER T: : J AV AVASCRIPT V ER CATION T OOL HAIN (P (POP OPL 18) - - PowerPoint PPT Presentation

Mar 17, 2024 112 likes •390 views

L OG OGIC - BA BASED V ER ERIFIC IFICATIO ION OF OF J AV AVA S CR CRIPT P RO ROGRAMS PET PETAR R MA MAKSIMO IMOVI I IMPERIAL COLLEGE LONDON WITH J OS F RAGOSO S ANTOS , P HILIPPA G ARDNER , D AIVA N AUDINIEN , AND T HOMAS W

slide-1
SLIDE 1

LOG

OGIC-BA BASED VER ERIFIC IFICATIO ION OF OF

JAV

AVASCR CRIPT PRO ROGRAMS

PET PETAR R MA MAKSIMO IMOVIĆ IĆ

IMPERIAL COLLEGE LONDON

FORMAL METHODS MEET JAVASCRIPT

IMPERIAL, MARCH 2018

WITH JOSÉ FRAGOSO SANTOS, PHILIPPA GARDNER,

DAIVA NAUDŽIŪNIENĖ, AND THOMAS WOOD

slide-2
SLIDE 2

WHAT IS JAVERT?

JaVerT is a semi-automatic verification toolchain for JavaScript based on separation logic

WHAT IS ITS PURPOSE?

JaVerT is aimed at the specialist developer wanting rich, mechanically verified specifications of critical JavaScript code

JAVER

ERT:

: JAV

AVASCRIPT VER ERIFICA CATION TOOL OOLCHA HAIN (P

(POP OPL’ ’ 18)

slide-3
SLIDE 3

JAVER

ERT:

: THE

HE CHAL HALLENGE GES

SPECIFICATION CHALLENGE: To design specifications readable by developers

(S1) Abstractions that capture key JavaScript concepts Prototype inheritance, variable scoping, function closures Property iteration (for-in) (S2) Abstractions that hide JavaScript internals

VERIFICATION CHALLENGE:

To handle the complex nature of JavaScript without simplification

(V1) Complexity of JavaScript statements (V2) Fundamental dynamic behaviour of JavaScript Extensible objects, dynamic property access, dynamic function calls (V3) JavaScript internal functions

VALIDATION CHALLENGE

To understand what it means for the verification to be trusted

slide-4
SLIDE 4

JAVER

ERT:

: SPE

PECIFI FICATION CHAL HALLENGE GE

SPECIFICATION CHALLENGE: To design specifications readable by developers

(S1) Abstractions that capture key JavaScript concepts Prototype inheritance, variable scoping, function closures Property iteration (for-in) (S2) Abstractions that hide JavaScript internals

VERIFICATION CHALLENGE:

To handle the complex nature of JavaScript without simplification

(V1) Complexity of JavaScript statements (V2) Fundamental dynamic behaviour of JavaScript Extensible objects, dynamic property access, dynamic function calls (V3) JavaScript internal functions

VALIDATION CHALLENGE

To understand what it means for the verification to be trusted

slide-5
SLIDE 5

JAV

AVASCR CRIP IPT:

: KEY

EY-VAL ALUE MAP AP

slide-6
SLIDE 6

JAV

AVASCR CRIP IPT:

: KEY

EY-VAL ALUE MAP AP

BREAKING THE LIBRARY: 1/2

slide-7
SLIDE 7

JAV

AVASCR CRIP IPT:

: KEY

EY-VAL ALUE MAP AP

BREAKING THE LIBRARY: 2/2

slide-8
SLIDE 8

MAP OBJECTS

Must not contain get, put, and validKey

MAP.PROTOTYPE AND OBJECT.PROTOTYPE

Must not contain _contents as non-writable

PRO

ROTOTYPE SAF AFETY TY

  • Constructed objects cannot redefine properties that are to be found in their prototypes
  • Prototypes cannot have non-writable properties that are to be present in their instances
slide-9
SLIDE 9

SOME BASIC ABSTRACTIONS:

JAV

AVASCR CRIP IPT:

: KEY

EY-VAL ALUE MAP AP SPE PECIFI FICATION

JSObject(o) = JSObjectWithProto(o, pr) = (o, “@proto”) -> Object.prototype * (o, “@class) -> “Object” * (o, “@extensible”) -> true (o, “@proto”) -> pr * (o, “@class) -> “Object” * (o, “@extensible”) -> true DataProp(o, p, v) = (o, p) -> [ “d”, v, true, true, true ] FunctionObject(o, id, sc) = (o, “@body”) -> id * (o, “@scope”) -> sc * ...

slide-10
SLIDE 10

WHAT DOES IT MEAN TO BE A MAP?

Map (m, mp, kvs) = JSObjectWithProto(m, mp) * (m, "get") -> None * (m, "put") -> None * (m, "validKey") -> None * DataProp(m, "_contents", c) * JSObject(c) * KVPairs(c, kvs) * emptyFields(c | first(kvs))

JAV

AVASCR CRIP IPT:

: KEY

EY-VAL ALUE MAP AP SPE PECIFI FICATION

DETAIL:

KVPairs(c, kvs) captures the key-value pairs of c.

slide-11
SLIDE 11

WHAT DOES IT MEAN TO BE A MAP PROTOTYPE?

MapProto (mp) = JSObject(mp) * (mp, "_contents") -> None) * DataProp(mp, "get", gf) * FunctionObject(gf, “get”, g_sc) * DataProp(mp, "put", pf) * FunctionObject(pf, “put”, p_sc) * DataProp(mp, "validKey", vkf) * FunctionObject(vkf, “validKey”, vk_sc)

CAVEAT: The definition of MapProto cannot be part of the Map predicate

because of shared resource. All maps share the same prototype.

JAV

AVASCR CRIP IPT:

: KEY

EY-VAL ALUE MAP AP SPE PECIFI FICATION

slide-12
SLIDE 12

SPECIFICATION OF THE GET FUNCTION

[ Map(this, mp, kvs) * MapProto(mp) * !(k in first(kvs)) * ValidKey(k) * ObjProto() ] get(k) [ Precondition * (ret = null) ] [ Map(this, mp, kvs) * MapProto(mp) * (k, v) in kvs * ObjProto() ] get(k) [ Precondition * (ret = v) ]

JAV

AVASCR CRIP IPT:

: KEY

EY-VAL ALUE MAP AP SPE PECIFI FICATION

slide-13
SLIDE 13

JAVER

ERT:

: THE

HE CHAL HALLENGE GES

SPECIFICATION CHALLENGE: To design specifications readable by developers

(S1) Abstractions that capture key JavaScript concepts Prototype inheritance, variable scoping, function closures Property iteration (for-in) (S2) Abstractions that hide JavaScript internals

VERIFICATION CHALLENGE:

To handle the complex nature of JavaScript without simplification

(V1) Complexity of JavaScript statements (V2) Fundamental dynamic behaviour of JavaScript Extensible objects, dynamic property access, dynamic function calls (V3) JavaScript internal functions

VALIDATION CHALLENGE

To understand what it means for the verification to be trusted

slide-14
SLIDE 14

ANNOTATED JS PROGRAMS JS PROGRAMS JS-2-JSIL

COMPILER

JS-2-JSIL

LOGIC TRANSLATOR

JSIL PROGRAMS JSIL LOGIC ANNOTATIONS JSIL LOGIC SPECS

OF JS INTERNAL FUNCTIONS

JSIL VERIFY

J A V E R T: JAVASCRIPT VERIFICATION TOOLCHAIN

ANNOTATED JSIL PROGRAMS

Yes / No

JAVER

ERT:

: OVE

VERALL ST STRUCTURE

JS LOGIC ANNOTATIONS

JSIL VERIFICATION INFRASTRUCTURE

slide-15
SLIDE 15

JS PROGRAMS JS-2-JSIL

COMPILER

JS-2-JSIL

LOGIC TRANSLATOR

JSIL PROGRAMS JSIL LOGIC ANNOTATIONS JSIL LOGIC SPECS

OF JS INTERNAL FUNCTIONS

JSIL VERIFY

J A V E R T: JAVASCRIPT VERIFICATION TOOLCHAIN

Yes / No

(V (V1) 1) COM

OMPLEXITY OF OF JAV AVASCR CRIP IPT STAT TATEMENTS

JS LOGIC ANNOTATIONS

JSIL VERIFICATION INFRASTRUCTURE

ANNOTATED JS PROGRAMS ANNOTATED JSIL PROGRAMS

slide-16
SLIDE 16

ANNOTATED JS PROGRAMS JS PROGRAMS JS-2-JSIL

COMPILER

JS-2-JSIL

LOGIC TRANSLATOR

JSIL PROGRAMS JSIL LOGIC ANNOTATIONS

J A V E R T: JAVASCRIPT VERIFICATION TOOLCHAIN

(V (V2) 2) FUN

UNDAMENTAL DYN YNAMIC BEH EHAVIOUR OF OF JAV AVASCR CRIP IPT

JS LOGIC ANNOTATIONS

JSIL VERIFICATION INFRASTRUCTURE

JSIL VERIFY

Yes / No

JSIL LOGIC SPECS

OF JS INTERNAL FUNCTIONS

ANNOTATED JSIL PROGRAMS

slide-17
SLIDE 17

ANNOTATED JS PROGRAMS JS PROGRAMS JS-2-JSIL

COMPILER

JS-2-JSIL

LOGIC TRANSLATOR

JSIL PROGRAMS JSIL LOGIC ANNOTATIONS

J A V E R T: JAVASCRIPT VERIFICATION TOOLCHAIN

ANNOTATED JSIL PROGRAMS

(V (V3) 3) JAV

AVASCR CRIP IPT INT NTERNA NAL FUN UNCTIONS

JS LOGIC ANNOTATIONS

JSIL VERIFICATION INFRASTRUCTURE

JSIL LOGIC SPECS

OF JS INTERNAL FUNCTIONS

JSIL VERIFY

Yes / No

slide-18
SLIDE 18

ANNOTATED JS PROGRAMS JS PROGRAMS JS-2-JSIL

COMPILER

JS-2-JSIL

LOGIC TRANSLATOR

JSIL PROGRAMS JSIL LOGIC ANNOTATIONS JSIL LOGIC SPECS

OF JS INTERNAL FUNCTIONS

JSIL VERIFY

Tested against ECMAScript Test262 test suite Proven correct JSIL Logic proven sound Satisfied by JSIL reference implementations

J A V E R T: JAVASCRIPT VERIFICATION TOOLCHAIN

ANNOTATED JSIL PROGRAMS

Yes / No

JAVER

ERT:

T: TRUS

RUSTED VER ERIFICATION

JS LOGIC ANNOTATIONS

JSIL VERIFICATION INFRASTRUCTURE

PROPER

VALIDATION

Fragment proven correct Follows the standard line-by-line

slide-19
SLIDE 19

THA

HAT WE WENT NT WE WELL…

OUR SPECIFICATION OF MAP.GET FAILED – HOW CAN WE FIND THE ERROR?

§ We assume that JaVerT is working correctly § The specifications seem reasonable, there is no obvious error § Lifting meaningful error messages from JSIL to JavaScript is difficult § JaVerT’s debugging proof trace for this example is 346,786 lines long

We cannot expect the developer to go through the proof trace. We need a more robust approach.

slide-20
SLIDE 20

COS

OSETTE:

: SYM

YMBOLIC TES ESTING FO FOR JAV AVASCR CRIP IPT

EXTENDED JS PROGRAMS JS-2-JSIL

COMPILER

EXTENDED JSIL PROGRAMS ROSETTE

IMPLEMENTATIONS OF INTERNAL/BUILT-IN FUNCTIONS

ROSETTE JSIL SYMBOLIC INTERPRETER Yes (up to a bound) or Counter-model

Rosette: solver-aided programming language (first-order logic) § JS and JSIL extended with simple constructs for creating/reasoning about symbolic values § JSIL concrete interpreter written in Rosette § Concrete interpreter carefully written so that Rosette’s solver-aided constructs are lifted,

  • btaining a JSIL symbolic interpreter

§ JSIL symbolic execution formalised and proven sound; absence of false positives proven (joint work with Julian Dolby, IBM)

slide-21
SLIDE 21

COS

OSETTE:

: SIM

IMPLE SYM YMBOLIC TES EST FO FOR MAP AP.GE GET

var k = __s;

/* let k be a symbolic string */

var v = __n;

/* let v be a symbolic number */

var m = new Map();

/* let m be an empty key-value map */

if validKey(k) {

/* let k be a valid key */

m.put(k, v);

/* put the key-value pair (k, v) in the map */

var w = m.get(k);

/* get the value corresponding to the key k */

assert(v = w);

/* that value must equal the one that we put */

}

slide-22
SLIDE 22

JAV

AVASCR CRIP IPT:

: KEY

EY-VAL ALUE MAP AP REV EVISI SITED ED

BREAKING THE LIBRARY: 3/3

slide-23
SLIDE 23

MAP OBJECTS

Must not contain get, put, and validKey

MAP.PROTOTYPE AND OBJECT.PROTOTYPE

Must not contain _contents as non-writable

MAP CONTENTS

Must not contain hasOwnProperty as non-writable

PRO

ROTOTYPE SAF AFETY TY REV EVISI SITED ED

  • Constructed objects cannot redefine properties that are to be found in their prototypes
  • Prototypes cannot have non-writable properties that are to be present in their instances
slide-24
SLIDE 24

WHAT DOES IT MEAN TO BE A MAP?

Map (m, mp, kvs) := JSObjectWithProto(m, mp) * (m, "get") -> None * (m, "put") -> None * (m, "validKey") -> None * DataProp(m, "_contents", c) * JSObject(c) * (c, "hasOwnProperty") -> None * KVPairs(c, kvs) * emptyFields(c | first(kvs) U "hasOwnProperty")

JAV

AVASCR CRIP IPT:

: KEY

EY-VAL ALUE MAP AP SPE PECIFI FICATION REV EVISI SITED ED

DETAIL:

KVPairs(c, kvs) captures the key-value pairs of c.

slide-25
SLIDE 25

JAVER

ERT:

: SUM

UMMARY

SPECIFICATION CHALLENGES

(S1) Abstractions capturing key JavaScript concepts

Prototype inheritance, variable scoping, function closures Property iteration (for-in)

(S2) Abstractions that hide JavaScript internals

VERIFICATION CHALLENGES

(V1) Complexity of JavaScript statements (V2) Fundamental dynamic behaviour of JavaScript (V3) Internal functions

CAVEAT: No higher-order reasoning yet VALIDATION CHALLENGES

Correctness of JS-2-JSIL Correctness of assertion translation Soundness of JSIL Logic Correctness of specifications for internal functions

slide-26
SLIDE 26

JAVER

ERT:

: FUR

URTHER VER ERIFIED ED EXA XAMPLES

ID GENERATOR: function closures PRIORITY QUEUE: library based on a real-world Node.js library BINARY SEARCH TREES: set reasoning INSERTION SORT: list reasoning TEST262 EXAMPLES: complex JS statements (switch, try/catch/finally)

slide-27
SLIDE 27

FUT

UTUR URE:

: THE

HE JAVER ERT

T ECO

COSYSTEM

DOM SSL Logic

JS Types JS Infer Higher-order JaVerT JaVerT + DOM

APLAS’16

JSCert

POPL’14

JaVerT

POPL’18

Web API client testing Debugging JaVerT specifications JS Logic

POPL’12

Cosette