SAFE Formal Specification and Implementation of a Scalable Analysis Framework for ECMAscript PLRG@KAIST Hongki Lee , Sooncheol Won, Joonho Jin, Junhee Cho, and Sukyoung Ryu
Contents • Introduction • Big Picture • Formal Specification • Implementation • Active Research • Conclusion
Introduction
JavaScript • ECMAScript Language Specification • Prototype-based inheritance • Dynamic Features - eval function ,with statement • Security Vulnerability Issues - XSS
Previous Work • Under-documented • Not open to the public • Handwritten Parser & AST nodes • ECMAScript3 or Subset of Language • λ JS , TAJS, FBJS, Caja, Rhino, ...
SAFE • Well-documented • Open Source • Auto-generated Parser & AST nodes • Full ECMAScript5 ! t p m e t t a t s r fi y r e v e h T • Formal Specification with Implementation
Big Picture
Hoister Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer
Hoister Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer
Formal Specification
Levels of Representations • AST (Abstract Syntax Tree) - To analyze at code level • IR (Intermediate Representation) - To evaluate code • CFG (Control Flow Graph) - To trace control flows
IR Semantics
Translation Rule AST to IR IR to CFG
AST JavaScript var i; var sum = 0; var sum; for(var i = 1; i <= 10; i++) sum = 0; sum+= i; for(i = 1; i <= 10; i++) _<>_print(sum); sum+= i; _<>_print(sum); CFG IR Entry var i var sum sum = 0 i = 1 <>break<>1 : { while(i <= 10) { <>continue<>2 : sum = sum + i <>old<>3 = i <>new<>4 = <>Global<>toNumber(<>old<>3) i = <>new<>4 + 1 Exit ExitExc <>Global<>ignore = <>new<>4 }} <>Global<>ignore = <>Global<>print(sum)
Implementation
Implementation • Automated tools • Java and Scala - Java Libraries - Scala Pattern Matching • Pluggable
AST Refinement Hoister Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer
Hoister f(); function f() { x = 1 }; function f() { x = 1 }; var x; var x; f(); // x = 1 // x = 1 With Hoister, functions and variables are defined before use
Disambiguator var x = 0; var x_1 = 0; function g() { function g() { x; // x = ? var x_2; var x = 1; x_2; // x = ? } x_2 = 1; } Distinguish two ‘ x ’ variables
withRewriter An Empirical Study on the Rewritability of the with Statement in JavaScript - FOOL2011 var o = {x:1, y:2, z:3}; var o = {x:1, y:2, z:3}; o.p = {x:4, y:5, z:6}; o.p = {x:4, y:5, z:6}; with(o) { var $f_1 = o; with(o.p) { var $f_2 = ("o" in $f_1 ? x; $f_1.o : o).p; } ("x" in $f_2 ? } $f_2.x : ("x" in $f_1 ? $f_1.x : x));
Hoister Evaluating Code Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer
Active Research
Hoister Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer Perform type-based analysis Calculate the ratio of tested code Detect clone code in AST level
Conclusion • The very first attempt to provide both formal specification and implementation • Pluggable framework • ECMAScript 5 • Open Source Project available at http://plrg.kaist.ac.kr/research/safe
Thank You!
Recommend
More recommend
