Automatic Modeling of Opaque Code for JavaScript Static Analysis
Automatic Modeling of Opaque Code for JavaScript Static Analysis
复制标题
用于 JavaScript 静态分析的不透明代码自动建模
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Sukyoung Ryu
中科院分区：
文献类型：
--
作者：
Joonyoung Park;Alexander Jordan;Sukyoung Ryu
静态程序分析在分析库代码时经常遇到问题。大多数真实世界的程序都密集地使用库函数，并且库函数通常是用不同的语言编写的。例如，JavaScript程序的静态分析需要分析在主机环境中实现的标准内置库。分析这种不透明代码的一种常见方法是分析开发人员构建提供代码语义的模型。模型可以手动构建，这是耗时且容易出错的，也可以自动构建，这可能会限制应用程序到不同的语言或分析器。在本文中，我们提出了一种新的机制来支持自动建模的不透明代码，这是适用于各种语言和分析器。对于一个给定的静态分析，我们的方法自动计算分析结果的不透明代码通过动态测试在静态分析。通过使用测试技术，该机制并不能保证程序行为的合理过度近似。然而，它是全自动的，在不透明代码的大小方面是可伸缩的，并且提供比传统的过度近似方法更精确的结果。我们的评估表明，虽然不透明代码中的所有功能都可以（或应该）使用我们的技术自动建模，但大量的JavaScript内置函数比现有的手动模型更精确地近似。
Static program analysis often encounters problems in analyzing library code. Most real-world programs use library functions intensively, and library functions are usually written in different languages. For example, static analysis of JavaScript programs requires analysis of the standard built-in library implemented in host environments. A common approach to analyze such opaque code is for analysis developers to build models that provide the semantics of the code. Models can be built either manually, which is time consuming and error prone, or automatically, which may limit application to different languages or analyzers. In this paper, we present a novel mechanism to support automatic modeling of opaque code, which is applicable to various languages and analyzers. For a given static analysis, our approach automatically computes analysis results of opaque code via dynamic testing during static analysis. By using testing techniques, the mechanism does not guarantee sound over-approximation of program behaviors in general. However, it is fully automatic, is scalable in terms of the size of opaque code, and provides more precise results than conventional over-approximation approaches. Our evaluation shows that although not all functionalities in opaque code can (or should) be modeled automatically using our technique, a large number of JavaScript built-in functions are approximated soundly yet more precisely than existing manual models.