Static analysis of event-driven Node.js JavaScript applications

JavaScript (JS) transpilers translate JS programs from a higher grammar standard to a lower one, which are widely used to ensure the compatibility of JS features in software (e.g., browsers). However, JS transpilers can have bugs that lead to unintended behavior in the translated JS programs. Existing JS program generation approaches could not test JS transpilers effectively since it is hard to generate a large number of valid JS programs in specific grammar standards. In this paper, we propose TransFuzz, a grammar-guided mutation approach to find JS transpiler bugs.The key insight of TransFuzz is to generate syntax-specific JS programs by mutating the abstract syntax trees (ASTs) of JS programs with the guidance of the specific grammar. First, Trans- Fuzz parses JS programs collected from open-source platforms into ASTs to obtain subtrees and leaf nodes containing specific JS syntax. Then, a grammar-guided approach is developed in TransFuzz to mutate the ASTs of the given JS programs guided by different versions of JS grammar standards. In addition, mutation operations could introduce grammatical errors. To improve the correctness of the mutated ASTs, TransFuzz develops heuristic-based correction rules to correct reference errors, type errors, and syntax errors in the mutated ASTs. After correction, the mutated ASTs are converted to the corresponding JS programs. Finally, based on differential testing, TransFuzz utilizes the generated JS programs to detect JS transpiler bugs.Our evaluation shows that TransFuzz significantly outperforms existing JS program generation approaches by triggering 47.82%-385.71% more JS transpiler bugs. Within ten months, we have reported 73 bugs on two popular JS transpilers babel and swc, of which 58 have been confirmed.

Static analysis of JavaScript has proven useful for a variety of purposes, including optimization, error checking, security auditing, program refactoring, and more. We propose a technique called type refinement that can improve the precision of such static analyses for JavaScript without any discernible performance impact. Refinement is a known technique that uses the conditions in branch guards to refine the analysis information propagated along each branch path. The key insight of this paper is to recognize that JavaScript semantics include many implicit conditional checks on types, and that performing type refinement on these implicit checks provides significant benefit for analysis precision.

JavaScript has been recognized as one of the most widely used script languages. Optimizations of JavaScript engines on mainstream web browsers enable efficient execution of JavaScript programs on CPUs. However, running JavaScript applications on emerging heterogeneous architectures that feature massively parallel hardware such as GPUs has not been well studied.This paper proposes a framework for flexible mapping of JavaScript onto heterogeneous systems that have both CPUs and GPUs. The framework includes a frontend compiler, a construct library and a runtime system. JavaScript programs written with high-level constructs are compiled to GPU binary code and scheduled to GPUs by the runtime. Experiments show that the proposed framework achieves up to 26.8x speedup executing JavaScript applications on parallel GPUs over a mainstream web browser that runs on CPUs.

JavaScript is a language that is widely-used for both web- based and standalone applications such as those in the upcoming Windows 8 operating system. Analysis of JavaScript has long been known to be challenging due to its dynamic nature. On top of that, most JavaScript applications rely on large and complex libraries and frameworks, often written in a combination of JavaScript and native code such as C and C++. Stubs have been commonly employed as a partial specification mechanism to address the library problem; however, they are tedious to write, incomplete, and occasionally incorrect. However, the manner in which library code is used within applications often sheds light on what library APIs return or consume as parameters. In this paper, we propose a technique which combines pointer analysis with use analysis to handle many challenges posed by large JavaScript libraries. Our approach enables a variety of applications, ranging from call graph discovery to auto-complete to supporting runtime optimizations. Our techniques have been implemented and empirically validated on a set of 25 Windows 8 JavaScript applications, averaging 1,587 lines of code, demonstrating a combination of scalability and precision.

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.
\n
\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.
\n
\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.
\n
\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

Since NPL only earns income by selling services to customers wanting ‘first-hand’ calibrations, the value (economic benefit) created by the ‘fanout’ is missing from NPL’s revenue. The first part of this document develops an economic model for the value created when using measurement for conformity testing. This model shows how measurement information creates value by reducing mistakes (fewer “false positives” and “false negatives”) in conformity testing. The second part of this document introduces calibration as a perturbation on top of these measurement activities. Moreover, there can be value created from this reduction in uncertainty, which is where the services of NPL and the calibration laboratories play a key role. Previous studies have explored the economic loss from making type-1 errors (“false positives”) and type-2 errors (“false negatives”) in the context of conformance testing. However, such studies do not treat the conditional probabilities of making type-1 and type-2 errors as “choice variables” that are under control of a decision maker. By treating these conditional probabilities as exogenous, they do not internalise the trade-off between type-1 and type-2 errors. In this paper, we address this gap in the literature by endogenizing the conditional probability of a type-1 error (α) and the probability of a type-2 error (β). The decision maker tries to minimise the total cost incurred due to these errors, subject to the trade-off that exists between them. This is an economics study that borrows a little from metrology as opposed to a study by engineers that borrows a little from economics. Firstly, our analysis gives formulae for the relative uncertainty of the measurement process (σ) and a lower bound for the scrap rate (τ) as functions of the conditional probabilities for type-1 and type-2 errors (α and β). Secondly, this analysis yields a formula for the economic benefit created by using ‘first-hand’ calibrations to reduce the uncertainty of the measurement process. Hence, this document provides the mathematics behind a ‘calculator’ giving an estimate of the benefit from ‘first-hand’ calibrations based on assumptions about the parameters. Finally, this model will really come to life once we have estimates of the core parameters from a forthcoming measurement survey.

The numbers and sizes of JavaScript applications are ever growing but static analysis techniques for analyzing large-scale JavaScript applications are not yet ready in a scalable and precise manner. Even when building complex software like compilers and operating systems in JavaScript, developers do not get much benefits from existing static analyzers, which suffer from mutually intermingled problems of scalability and imprecision. In this paper, we present Loop-Sensitive Analysis (LSA) that improves the analysis scalability by enhancing the analysis precision in loops. LSA distinguishes loop iterations as many as needed by automatically choosing loop unrolling numbers during analysis. We formalize LSA in the abstract interpretation framework and prove its soundness and precision theorems using Coq. We evaluate our implementation of LSA using the analysis results of main web pages in the 5 most popular websites and those of the programs that use top 5 JavaScript libraries, and show that it outperforms the state-of-the-art JavaScript static analyzers in terms of analysis scalability. Our mechanization and implementation of LSA are both publicly available.

As software vulnerabilities have surged, efforts to discover them have increased. The syntactic and semantic information of a program is required to detect vulnerabilities. Each information can be represented as a graph, such as Abstract Syntax Tree and Program Dependency Graph. In this paper, the program representations were extracted using various static analysis tools, including Clang Static Analyzer, Joern, and SVF, and compared using Graph Neural Networks to select the appropriate representations for vulnerability detection in C/C++. From the comparison, PDG shows the best performance among the multiple representations. This result indicates a suitable program representation and a tool for vulnerability detection that can be utilized in research utilizing graph neural networks.

Broadening the concept of bipolar disorder: what should be done in the face of uncertainty?

Several different types of detectors, software, and hardware designs are employed in instruments used to monitor radioactive content of freight shipments in order to detect illicit trafficking of nuclear materials. The instruments can be container monitors, hand-held radiation detectors, mobile analysis systems, or fixed radiation portal monitors. However, within the various groupings (e.g., portal monitors), all instruments are expected to solve the same problem, that is, to detect and identify any radioactive material present according to the prescribed investigative procedure or CONOPS. The best way to compare the performance of different instruments is with a numerical score or Figure of Merit (FOM). The FOM must quantify the performance of the instrument with respect to true positives (TP), false positives (FP), and false negatives (FN). The minimization of FN for certain radionuclides (e.g., uranium and plutonium or other Special Nuclear Material (SNM)) is more important than the minimization of FN for non-threat nuclides (e.g., low level NORM). In a similar way, the minimization of FP for SNM is more important than falsely reporting the common NORM nuclides which represent no threat. System performance depends on the measurement detail (e.g., transit speed through a portal, measurement time in general, amount and distribution of NORM), therefore the test conditions should also be included in the statement of the FOM. The FOM is expected to vary significantly with the above measurement details. A FOM has been developed based on the number of true positives (TP), the number of false important positives (FIP), the number of FP, the number of true positives for SNM (TPSNM), and the number of false positives for SNM (FPSNM). This formula rates the overall performance with extra weight given to FP and FN for SNM. Examples will be shown for testing of portal monitors.

JavaScript is a highly dynamic language that imposes few constraints on types. Forexample, the shape of any object can be changed during program execution, and functions can be called with any number of arguments, regardless how many are declared. Similarly, event-driven programming in JavaScript is intrinsically dynamic and untyped: events are identified by free-form strings, and listener functions for these events can be added or removed dynamically. JavaScript applications also rarely crash: for example, accessing a non-existent property evaluates to undefined rather than causing a runtime error. All of these features limit the facts that can be learned by applying a traditional program analysis to a single application. In this thesis, we explore the question: it is possible to leverage the size of the JavaScriptopen source ecosystem to data mine and then statistically analyze program patterns, to compensate for the limitations of a traditional analysis over a single codebase and more effectively determine API usages? Through the various works presented here, we develop lightweight static analyses, run them over over a large amount of code to mine application-independent code patterns and then amalgamate the results. In particular, we show that we can mine API usages and use this data to both identify bug patterns and model intended API usage, in the context of event-based programming and the more general problem of object-property accesses. We also use API usage patterns as seed input to a feedback-directed test generator and explore how this set of real-world argument values improves the effectiveness of the generated tests.--Author's abstract

A JavaScript array object is just like any other kind of object except that it has a property named length that is automatically updated. The array object may have other property names such as non-numeric strings and string representations of negative integers. A conventional array is an array that has a property named length and the names of all other properties are (string representation of) positive integers. This paper presents a conventionality analysis of array objects in JavaScript programs. The analysis provides useful information for program development and understanding since any non-conventional use of an array could indicate a potential programming error unless it is intended by the programmer. The analysis is built upon a novel abstract string domain that captures array index information more precisely than the existing ones. Our experiments on a set of 98 benchmark programs show that arrays are used in a conventional way in 95% of the benchmark programs.

Transactional Memory (TM) has attracted considerable attention because it promises to increase programmer productivity by making it easier to write correct parallel programs. To maintain correctness in the face of concurrency, detecting conflicts among simultaneously running transactions is an essential element. Hardware signatures have been proposed as an area-efficient mechanism for conflict detection. A signature can summarize an unbounded amount of addresses and misses no conflicts, but could falsely declare conflicts even when no true conflict exists (false positives) due to aliasing and occupancy. Previous signature designs assume that false positives are destructive to performance and attempt to reduce the total number of false positives. In this paper, we show that some false positives can be helpful to performance by triggering the early abortion of a transaction which would encounter a true conflict later anyway. Based on this observation, we propose an adaptive grain signature to improve performance by dynamically changing the range of address keys based on the history. With the use of adaptive grain signatures, we can increase the number of performance-friendly false positives as well as decrease the number of performance-destructive false positives.

Static program analyzers (SPA) are interactive tools that enhance program understanding by answering queries about programs. An SPA parses source programs and builds a so-called program knowledge base (PKB) that enables automatic processing of program queries. An SPA design method described in this paper consists of steps during which we (1) identify, a class of program queries we wish to answer, (2) model program information that is required to resolve queries, (3) define physical representation for programs, based on the concept of a hybrid PKB, and (4) implement other SPA components such as a front-end and user interface. Generally, queries related to global properties of programs are best handled if we store program information in a relational database. On the other hand, detailed queries are best supported if we represent programs as attributed syntax trees. A hybrid PKB described in this paper integrates these two program representations. Our notation for specifying a hybrid PKB forms a basis for a generation system that automates some of the routine, but time consuming, tasks involved in implementation of programming tools. >

Block programming has been suggested as a way of engaging young learners with the foundations of programming and computational thinking in a syntax-free manner. Indeed, syntax errors—which form one of two broad categories of errors in programming, the other one being logic errors—are omitted while block programming. However, this does not mean that errors are omitted at large in such environments. In this exploratory case study of a learning environment for early programming (Kodetu), we explored errors in block programming of middle school students ( N = 123), using log files drawn from a block-based online. Analyzing 1033 failed executions, we found that errors may be driven by either learners’ knowledge and behavior, or by the learning environment design. The rate of error types was not associated with the learners’ and contextual variables examined, with the exception of task complexity (as defined by SOLO taxonomy). Our findings highlight the importance of learning from errors and of learning environment design.