Write a Blog >>
ICSE 2020
Wed 24 June - Thu 16 July 2020
Sat 11 Jul 2020 16:35 - 16:47 at Baekje - A28-Android and Web Testing Chair(s): Reyhaneh Jabbarvand

Modern JavaScript applications extensively depend on third-party libraries. Especially for the Node.js platform, vulnerabilities can have severe consequences to the security of applications, resulting in, for example, cross-site scripting and command-line injection vulnerabilities. Existing static analysis tools that have been developed to detect such issues automatically are either too coarse, looking only at package dependency structure while ignoring dataflow, or rely on manually-written taint specifications for the most popular libraries to ensure analysis scalability. In this work, we propose a technique for automatically extracting taint specifications for JavaScript libraries, based on a dynamic analysis that leverages the existing test suites of the libraries and their available clients in the npm repository. Due to the dynamic nature of JavaScript, mapping observations from dynamic analysis to taint specifications that fit into a static analysis is nontrivial. Our main insight is that this challenge can be addressed by a combination of an access path mechanism to name entry and exit points and the use of membranes around the libraries of interest. We show that our approach is effective at inferring useful taint specifications at scale. Our prototype tool automatically extracts 146 additional taint sinks and 7,840 propagation summaries spanning 1,393 npm modules. By integrating the extracted specifications in a commercial, state-of-the-art static analysis, 136 new alerts are produced, many of which correspond to likely security vulnerabilities. Moreover, many important specifications that were originally manually written are among the ones that our tool can now extract automatically.

Sat 11 Jul
Times are displayed in time zone: (UTC) Coordinated Universal Time change

16:05 - 17:05: Paper Presentations - A28-Android and Web Testing at Baekje
Chair(s): Reyhaneh JabbarvandUniversity of Illinois Urbana-Champaign
Demonstrations16:05 - 16:08
Farnaz BehrangGeorgia Tech, Alessandro OrsoGeorgia Tech
icse-2020-papers16:08 - 16:20
Katherine HoughGeorge Mason University, Gebrehiwet Biyane WelearegaiUniversity of Potsdam, Germany, Christian HammerUniversity of Potsdam, A: Jonathan BellNortheastern University
icse-2020-papers16:20 - 16:32
Abdulaziz AlshaybanUniversity of California, Irvine, Iftekhar AhmedUniversity of California at Irvine, USA, Sam MalekUniversity of California, Irvine
Demonstrations16:32 - 16:35
Alan RomanoUniversity at Buffalo, SUNY, Weihang WangUniversity at Buffalo, SUNY
icse-2020-papers16:35 - 16:47
Cristian-Alexandru StaicuTU Darmstadt, Martin Toldam TorpAarhus University, Max SchaeferGitHub, Inc., Anders MøllerAarhus University, Michael PradelUniversity of Stuttgart
Pre-print Media Attached
icse-2020-papers16:47 - 16:59
I Luk KimPurdue University, Yunhui ZhengIBM T.J. Watson Research Center, Hogun ParkPurdue University, Weihang WangUniversity at Buffalo, SUNY, Wei YouRenmin University of China, Yousra AaferPurdue University, Xiangyu ZhangPurdue University