CAREER: Cross-Boundary Program Analyses for Web Applications

职业：Web 应用程序的跨界程序分析

• 批准号: 2047980
• 负责人: Weihang Wang
• 金额: $ 50万
• 依托单位: SUNY at Buffalo
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-02-01 至 2023-04-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2047980&HistoricalAwards=false
• 关键词: CAREER; Cross; Boundary; Program; Analyses

Modern web applications are built atop the integration of programs written in diverse programming languages and distributed by multiple parties. While such a development model provides maximum modularity and flexibility, it raises unique challenges to traditional software-engineering principles. When web applications fail to behave as intended, developers often need to analyze code components written in various languages independently due to the lack of cross-language analysis support. Dynamically including source code from multiple parties makes it challenging to identify the root causes of errors because developers do not have access to third-party internals. Diverse languages and the use of third parties create technical boundaries that prevent web developers from obtaining a comprehensive understanding of the heterogeneous code on the client side. This project addresses the challenges of the technical boundaries existing in complex web applications and the creation of a scientific foundation for understanding, analyzing, and debugging web applications involving diverse languages and multiple parties. The project will support web-application reliability, increase web development productivity, and provide critical assurance for web users by shielding them from common web issues. The project plans to build a policy-specification language that enables web developers to compose specification policies to regulate many aspects of their code execution, such as enforcing control flow of critical events, securing web pages in the presence of unknown third-party services, and ensuring user experience. Based on these policies, novel program analyses and runtime techniques will be developed to expose possible violations (for problem identification) and automatic policy enforcement (for problem fixing), respectively. The policy specification and enforcement will provide assurance for web developers and enable them to control the code executed on their websites, which is lacking with current technologies. Approaches that support a cross-language analysis will be developed to handle interactions between diverse programming languages, including WebAssembly and JavaScript. Together, these activities will deepen the scientific understanding of the technical boundaries in complex web applications and create new program-analysis techniques to support more efficient web development.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

现代Web应用程序构建在集成以不同编程语言编写并由多方分发的程序之上。虽然这样的开发模型提供了最大的模块化和灵活性，但它对传统的软件工程原则提出了独特的挑战。当Web应用程序无法按预期运行时，由于缺乏跨语言分析支持，开发人员通常需要独立分析用各种语言编写的代码组件。动态地包含来自多方的源代码使得识别错误的根本原因变得很有挑战性，因为开发人员无法访问第三方内部。不同的语言和第三方的使用创造了技术界限，阻止了Web开发人员对客户端上的异构代码的全面理解。该项目解决了复杂Web应用程序中存在的技术边界的挑战，并为理解，分析和调试涉及不同语言和多方的Web应用程序创建了科学基础。该项目将支持网络应用程序的可靠性，提高网络开发生产力，并通过保护网络用户免受常见网络问题的影响，为他们提供关键保证。 该项目计划构建一种策略规范语言，使Web开发人员能够编写规范策略来规范其代码执行的许多方面，例如强制执行关键事件的控制流，在存在未知第三方服务的情况下保护网页，以及确保用户体验。基于这些策略，将开发新的程序分析和运行时技术，以分别暴露可能的违规行为（用于问题识别）和自动策略执行（用于问题修复）。政策规范和执行将为Web开发人员提供保证，使他们能够控制在其网站上执行的代码，这是当前技术所缺乏的。将开发支持跨语言分析的方法，以处理不同编程语言之间的交互，包括WebAssembly和JavaScript。这些活动将加深对复杂Web应用程序的技术边界的科学理解，并创建新的程序分析技术，以支持更高效的Web开发。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

项目成果

An Empirical Analysis of UI-Based Flaky Tests

• DOI: 10.1109/icse43902.2021.00141
• 发表时间: 2021-03
• 期刊: 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)
• 作者: Alan Romano;Zihe Song;Sampath Grandhi;Wei Yang;Weihang Wang

An Empirical Study of Bugs in WebAssembly Compilers

• DOI: 10.1109/ase51524.2021.9678776
• 发表时间: 2021-11
• 期刊: 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)
• 作者: Alan Romano;Xinyue Liu;Yonghwi Kwon;Weihang Wang

Hiding Critical Program Components via Ambiguous Translation

• DOI: 10.1145/3510003.3510139
• 发表时间: 2022-05
• 期刊: 2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE)
• 作者: Chi-Gon Jung;Doowon Kim;An Chen;Weihang Wang;Yunhui Zheng;K. H. Lee;Yonghwi Kwon

Wobfuscator: Obfuscating JavaScript Malware via Opportunistic Translation to WebAssembly

• DOI: 10.1109/sp46214.2022.9833626
• 发表时间: 2022-05
• 期刊: 2022 IEEE Symposium on Security and Privacy (SP)
• 作者: Alan Romano;Daniel Lehmann;Michael Pradel;Weihang Wang

Empowering Web Applications with WebAssembly: Are We There Yet?

使用 WebAssembly 增强 Web 应用程序的能力：我们做到了吗？

• DOI: 10.1109/ase51524.2021.9678831
• 发表时间: 2021
• 期刊: New Ideas and Emerging Results Track
• 作者: Wang, Weihang