SAFE Formal Specification and Implementation of a Scalable Analysis - PowerPoint PPT Presentation

SAFE Formal Specification and Implementation of a Scalable Analysis Framework for ECMAscript PLRG@KAIST Hongki Lee , Sooncheol Won, Joonho Jin, Junhee Cho, and Sukyoung Ryu

Contents • Introduction • Big Picture • Formal Specification • Implementation • Active Research • Conclusion

Introduction

JavaScript • ECMAScript Language Specification • Prototype-based inheritance • Dynamic Features - eval function ,with statement • Security Vulnerability Issues - XSS

Previous Work • Under-documented • Not open to the public • Handwritten Parser & AST nodes • ECMAScript3 or Subset of Language • λ JS , TAJS, FBJS, Caja, Rhino, ...

SAFE • Well-documented • Open Source • Auto-generated Parser & AST nodes • Full ECMAScript5 ! t p m e t t a t s r fi y r e v e h T • Formal Specification with Implementation

Big Picture

Hoister Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer

Hoister Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer

Formal Specification

Levels of Representations • AST (Abstract Syntax Tree) - To analyze at code level • IR (Intermediate Representation) - To evaluate code • CFG (Control Flow Graph) - To trace control flows

IR Semantics

Translation Rule AST to IR IR to CFG

AST JavaScript var i; var sum = 0; var sum; for(var i = 1; i <= 10; i++) sum = 0; sum+= i; for(i = 1; i <= 10; i++) _<>_print(sum); sum+= i; _<>_print(sum); CFG IR Entry var i var sum sum = 0 i = 1 <>break<>1 : { while(i <= 10) { <>continue<>2 : sum = sum + i <>old<>3 = i <>new<>4 = <>Global<>toNumber(<>old<>3) i = <>new<>4 + 1 Exit ExitExc <>Global<>ignore = <>new<>4 }} <>Global<>ignore = <>Global<>print(sum)

Implementation

Implementation • Automated tools • Java and Scala - Java Libraries - Scala Pattern Matching • Pluggable

AST Refinement Hoister Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer

Hoister f(); function f() { x = 1 }; function f() { x = 1 }; var x; var x; f(); // x = 1 // x = 1 With Hoister, functions and variables are defined before use

Disambiguator var x = 0; var x_1 = 0; function g() { function g() { x; // x = ? var x_2; var x = 1; x_2; // x = ? } x_2 = 1; } Distinguish two ‘ x ’ variables

withRewriter An Empirical Study on the Rewritability of the with Statement in JavaScript - FOOL2011 var o = {x:1, y:2, z:3}; var o = {x:1, y:2, z:3}; o.p = {x:4, y:5, z:6}; o.p = {x:4, y:5, z:6}; with(o) { var $f_1 = o; with(o.p) { var $f_2 = ("o" in $f_1 ? x; $f_1.o : o).p; } ("x" in $f_2 ? } $f_2.x : ("x" in $f_1 ? $f_1.x : x));

Hoister Evaluating Code Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer

Active Research

Hoister Disambiguator withRewriter Interpreter Result JavaScript Parser AST AST2IR IR IR2CFG CFG CloneDetector CodeCoverage Analyzer Perform type-based analysis Calculate the ratio of tested code Detect clone code in AST level

Conclusion • The very first attempt to provide both formal specification and implementation • Pluggable framework • ECMAScript 5 • Open Source Project available at http://plrg.kaist.ac.kr/research/safe

Thank You!