SAFE Formal Specification and Implementation of a Scalable Analysis - - PowerPoint PPT Presentation

▶
safe
SMART_READER_LITE
LIVE PREVIEW

SAFE Formal Specification and Implementation of a Scalable Analysis - - PowerPoint PPT Presentation

Sep 19, 2023 360 likes •632 views

SAFE Formal Specification and Implementation of a Scalable Analysis Framework for ECMAscript PLRG@KAIST Hongki Lee , Sooncheol Won, Joonho Jin, Junhee Cho, and Sukyoung Ryu Contents Introduction Big Picture Formal Specification

slide-1
SLIDE 1

SAFE

Formal Specification and Implementation of a Scalable Analysis Framework for ECMAscript

PLRG@KAIST Hongki Lee, Sooncheol Won, Joonho Jin, Junhee Cho, and Sukyoung Ryu

slide-2
SLIDE 2

Contents

  • Introduction
  • Big Picture
  • Formal Specification
  • Implementation
  • Active Research
  • Conclusion
slide-3
SLIDE 3

Introduction

slide-4
SLIDE 4

JavaScript

  • ECMAScript Language Specification
  • Prototype-based inheritance
  • Dynamic Features
  • eval function,with statement
  • Security

Vulnerability Issues

  • XSS
slide-5
SLIDE 5

Previous Work

  • Under-documented
  • Not open to the public
  • Handwritten Parser & AST nodes
  • ECMAScript3 or Subset of Language
  • λJS, TAJS, FBJS, Caja, Rhino, ...
slide-6
SLIDE 6

SAFE

  • Well-documented
  • Open Source
  • Auto-generated Parser & AST nodes
  • Full ECMAScript5
  • Formal Specification with Implementation

T h e v e r y fi r s t a t t e m p t !

slide-7
SLIDE 7

Big Picture

slide-8
SLIDE 8

JavaScript Parser AST withRewriter Disambiguator Hoister AST2IR IR IR2CFG CFG Interpreter Result CloneDetector CodeCoverage Analyzer

slide-9
SLIDE 9

JavaScript Parser AST withRewriter Disambiguator Hoister AST2IR IR IR2CFG CFG Interpreter Result CloneDetector CodeCoverage Analyzer

slide-10
SLIDE 10

Formal Specification

slide-11
SLIDE 11

Levels of Representations

  • AST (Abstract Syntax Tree)
  • To analyze at code level
  • IR (Intermediate Representation)
  • To evaluate code
  • CFG (Control Flow Graph)
  • To trace control flows
slide-12
SLIDE 12

IR Semantics

slide-13
SLIDE 13

Translation Rule

AST to IR IR to CFG

slide-14
SLIDE 14

var sum = 0; for(var i = 1; i <= 10; i++) sum+= i; _<>_print(sum); var i; var sum; sum = 0; for(i = 1; i <= 10; i++) sum+= i; _<>_print(sum);

Entry Exit ExitExc

JavaScript AST IR CFG

var i var sum sum = 0 i = 1 <>break<>1 : { while(i <= 10) { <>continue<>2 : sum = sum + i <>old<>3 = i <>new<>4 = <>Global<>toNumber(<>old<>3) i = <>new<>4 + 1 <>Global<>ignore = <>new<>4 }} <>Global<>ignore = <>Global<>print(sum)

slide-15
SLIDE 15

Implementation

slide-16
SLIDE 16

Implementation

  • Automated tools
  • Java and Scala
  • Java Libraries
  • Scala Pattern Matching
  • Pluggable
slide-17
SLIDE 17

AST Refinement

JavaScript Parser AST withRewriter Disambiguator Hoister AST2IR IR IR2CFG CFG Interpreter Result CloneDetector CodeCoverage Analyzer

slide-18
SLIDE 18

Hoister

f(); function f() { x = 1 }; var x; // x = 1 function f() { x = 1 }; var x; f(); // x = 1

With Hoister, functions and variables are defined before use

slide-19
SLIDE 19

Disambiguator

var x = 0; function g() { x; // x = ? var x = 1; } var x_1 = 0; function g() { var x_2; x_2; // x = ? x_2 = 1; }

Distinguish two ‘x’ variables

slide-20
SLIDE 20

withRewriter

var o = {x:1, y:2, z:3};

  • .p = {x:4, y:5, z:6};

with(o) { with(o.p) { x; } } var o = {x:1, y:2, z:3};

  • .p = {x:4, y:5, z:6};

var $f_1 = o; var $f_2 = ("o" in $f_1 ? $f_1.o : o).p; ("x" in $f_2 ? $f_2.x : ("x" in $f_1 ? $f_1.x : x));

An Empirical Study on the Rewritability

  • f the with Statement in JavaScript - FOOL2011
slide-21
SLIDE 21

Evaluating Code

JavaScript Parser AST withRewriter Disambiguator Hoister AST2IR IR IR2CFG CFG Interpreter Result CloneDetector CodeCoverage Analyzer

slide-22
SLIDE 22

Active Research

slide-23
SLIDE 23

Calculate the ratio of tested code Perform type-based analysis Detect clone code in AST level

JavaScript Parser AST withRewriter Disambiguator Hoister AST2IR IR IR2CFG CFG Interpreter Result CloneDetector CodeCoverage Analyzer

slide-24
SLIDE 24
  • The very first attempt to provide both

formal specification and implementation

  • Pluggable framework
  • ECMAScript 5
  • Open Source Project

available at http://plrg.kaist.ac.kr/research/safe

Conclusion

slide-25
SLIDE 25

Thank You!