Practical blended taint analysis for JavaScript
Practical blended taint analysis for JavaScript
复制标题
JavaScript 实用混合污点分析
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
B. Ryder
中科院分区：
文献类型：
--
作者：
Shiyi Wei;B. Ryder
JavaScript由于其灵活性和动态功能而被广泛用于Web应用程序。但是，后者对旨在寻找安全漏洞的静态分析构成了挑战（例如，污点分析）。我们介绍了混合污点分析，这是对JavaScript的通用分析框架的实例化，以说明合并的动态/静态分析方法如何通过在运行时收集生成的代码和其他信息来处理动态功能。在与两个纯静态污染分析的经验比较中，我们在Alexa的12个流行网站上提取的JavaScript基准代码上表明，混合污点分析更具扩展性和精确性。我们的结果表明，混合污点分析在6个网站中发现了13条独特的违规行为。相比之下，每个静态分析都确定了不到这些违规的一半。此外，鉴于10分钟的合理时间预算，两个静态分析均遇到了他们无法分析的网页，有时有时很明显。案例研究证明了与纯静态分析相比，混合污染分析解决方案的质量。
JavaScript is widely used in Web applications because of its flexibility and dynamic features. However, the latter pose challenges to static analyses aimed at finding security vulnerabilities, (e.g., taint analysis). We present blended taint analysis, an instantiation of our general-purpose analysis framework for JavaScript, to illustrate how a combined dynamic/static analysis approach can deal with dynamic features by collecting generated code and other information at runtime. In empirical comparisons with two pure static taint analyses, we show blended taint analysis to be both more scalable and precise on JavaScript benchmark codes extracted from 12 popular websites at alexa. Our results show that blended taint analysis discovered 13 unique violations in 6 of the websites. In contrast, each of the static analyses identified less than half of these violations. Moreover, given a reasonable time budget of 10 minutes, both static analyses encountered webpages they could not analyze, sometimes significantly many such pages. Case studies demonstrate the quality of the blended taint analysis solution in comparison to that of pure static analysis.