CAREER: Cross-Boundary Program Analyses for Web Applications

现代Web应用程序建立在以不同编程语言编写并由多方分发的程序集成的基础上。虽然这样的开发模型提供了最大的模块化和灵活性，但它对传统的软件工程原则提出了独特的挑战。当Web应用程序无法按预期运行时，由于缺乏跨语言分析支持，开发人员经常需要独立地分析用各种语言编写的代码组件。动态地包含来自多方的源代码使得识别错误的根本原因变得具有挑战性，因为开发人员无法访问第三方内部。不同的语言和第三方的使用形成了技术界限，使Web开发人员无法全面了解客户端的异类代码。该项目解决了复杂Web应用程序中存在的技术边界的挑战，并为理解、分析和调试涉及多种语言和多方的Web应用程序创建了科学基础。该项目将支持网络应用程序的可靠性，提高网络开发生产率，并通过保护网络用户免受常见网络问题的影响，为他们提供关键保证。该项目计划构建一种策略规范语言，使Web开发人员能够编写规范策略来规范其代码执行的许多方面，例如强制执行关键事件的控制流，在存在未知第三方服务的情况下保护网页，以及确保用户体验。基于这些策略，将开发新的程序分析和运行时技术，以分别暴露可能的违规(用于识别问题)和自动策略实施(用于修复问题)。策略规范和执行将为Web开发人员提供保证，并使他们能够控制在其网站上执行的代码，这是当前技术所缺乏的。将开发支持跨语言分析的方法，以处理不同编程语言之间的交互，包括WebAssembly和JavaScript。总之，这些活动将加深对复杂网络应用程序中技术边界的科学理解，并创建新的程序分析技术来支持更高效的网络开发。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Modern web applications are built atop the integration of programs written in diverse programming languages and distributed by multiple parties. While such a development model provides maximum modularity and flexibility, it raises unique challenges to traditional software-engineering principles. When web applications fail to behave as intended, developers often need to analyze code components written in various languages independently due to the lack of cross-language analysis support. Dynamically including source code from multiple parties makes it challenging to identify the root causes of errors because developers do not have access to third-party internals. Diverse languages and the use of third parties create technical boundaries that prevent web developers from obtaining a comprehensive understanding of the heterogeneous code on the client side. This project addresses the challenges of the technical boundaries existing in complex web applications and the creation of a scientific foundation for understanding, analyzing, and debugging web applications involving diverse languages and multiple parties. The project will support web-application reliability, increase web development productivity, and provide critical assurance for web users by shielding them from common web issues. The project plans to build a policy-specification language that enables web developers to compose specification policies to regulate many aspects of their code execution, such as enforcing control flow of critical events, securing web pages in the presence of unknown third-party services, and ensuring user experience. Based on these policies, novel program analyses and runtime techniques will be developed to expose possible violations (for problem identification) and automatic policy enforcement (for problem fixing), respectively. The policy specification and enforcement will provide assurance for web developers and enable them to control the code executed on their websites, which is lacking with current technologies. Approaches that support a cross-language analysis will be developed to handle interactions between diverse programming languages, including WebAssembly and JavaScript. Together, these activities will deepen the scientific understanding of the technical boundaries in complex web applications and create new program-analysis techniques to support more efficient web development.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.