Combining String Abstract Domains for JavaScript Analysis: An Evaluation

Abstract

Strings play a central role in JavaScript and similar scripting languages. Owing to dynamic features such as the eval function and dynamic property access, precise string analysis is a prerequisite for automated reasoning about practically any kind of runtime property. Although the literature presents a considerable number of abstract domains for capturing and representing specific aspect of strings, we are not aware of tools that allow flexible combination of string abstract domains. Indeed, support for string analysis is often confined to a single, dedicated string domain. In this paper we describe a framework that allows us to combine multiple string abstract domains for the analysis of JavaScript programs. It is implemented as an extension of SAFE, an open-source static analysis tool. We investigate different combinations of abstract domains that capture various aspects of strings. Our evaluation suggests that a combination of few, simple abstract domains suffice to outperform the precision of state-of-the-art static analysis tools for JavaScript.

A Novel Approach to String Constraint Solving

“…Amadini et al [19] provided an evaluation on the combination via direct product of different string abstract domains in order to improve the precision of JavaScript static analysis. In [13] this combination is achieved via reduced product by using the set of regular languages as a reference domain for the other string domains.…”

Static Value Analysis of Python Programs by Abstract Interpretation

“…Although we believe that our design is sound and scalable, it currently employs some very naive abstractions with respect to the state of the art. Our almost-concrete string abstraction could be replaced with the complex abstractions designed by Amadini et al for JavaScript [2]. Likewise, object abstractions have been studied extensively, especially for the analysis of Java, and we could replace our simple allocation-site abstraction based on recency abstraction [4] with more efficient ones, such as object-sensitive abstractions [24].…”

“…We first consider non-relational abstractions: each variable is assigned an abstract value in Val representing a set of possible concrete values. Following [14], we abstract separately each type of values in its abstract domain, while their product Val can represent sets of heterogeneous values: [2], will be considered in future work. We can use any non-relational domain for Num , and our implementation uses integer and float intervals.…”

“…The major part of these analyzers target solely statically typed languages, such as C, Java, or C#. With the rise of web applications, the static analysis of JavaScript programs has started to gain some attention [2,14,15]. The more dynamic nature of the language makes this task challenging.…”

Static analysis with demand-driven value refinement

“…Several research tools, including TAJS [Jensen et al 2009], WALA [Sridharan et al 2012], SAFE [Lee et al 2012], and JSAI [Kashyap et al 2014], have been developed in recent years to address this challenge. A notable trend is that analysis precision is being increased in many directions, including high degrees of context sensitivity [Andreasen and Mùller 2014], aggressive loop unrolling [Park and Ryu 2015], and sophisticated abstract domains for strings [Amadini et al 2017;Madsen and Andreasen 2014;Park et al 2016], to enable analysis of real-world JavaScript programs.…”