Purity analysis for JavaScript through abstract interpretation

Abstract

We present a static analysis for determining whether and to what extent functions in JavaScript programs are pure. To this end, the analysis classifies functions as pure functions, observers, or procedures. A function is pure if none of its executions generate or depend upon externally observable side effects. A function is an observer as soon as one of its executions depends on an external side effect, but none of its executions generate observable side effects. Otherwise, the function is classified as a procedure. Function executions and associated callers are found by traversing all reachable function execution contexts on the call stack at the point where an effect occurs. Our approach is based on a flow analysis that, in addition to computing traditional control and value flow, keeps track of read and write effects. To increase the precision of our purity analysis, we combine it with an intraprocedural analysis that determines freshness of variables and objects. We formalize the core aspects of our technique and discuss its implementation and results on common JavaScript benchmarks. Results show that our approach is capable of determining function purity in the presence of higher‐order functions, dynamic property expressions, and prototypal inheritance. When compared with existing purity analyses, we find that our approach is as precise or more precise than the existing analyses.

Deriving Static Security Testing from Runtime Security Protection for Web Applications

“…Setup We use JIPDA [34] as a configurable abstract interpreter to perform static analysis of JavaScript programs and abstractly execute policy code. We employed JIPDA because it is possible to steer the abstract interpreter for implementing our 2-phase approach, and it implements a version of the syntax and semantics presented in section 4.…”

“…That work presented js 0 , a core functional language that models a subset of JavaScript, and a static analysis that models the execution of js 0 programs as a flow graph from which information about control and value flow, and effects can be extracted. In this section, we present the syntax and semantics of js 0 based on its original specification in [34]. We focus on the relevant features to understand the contributions of this work and include the details on the components and operations of the abstract machine in appendix D.…”

“…We now elaborate on our two-phase abstract interpretation approach based on the calculus presented in prior work [34]. That work presented js 0 , a core functional language that models a subset of JavaScript, and a static analysis that models the execution of js 0 programs as a flow graph from which information about control and value flow, and effects can be extracted.…”

Effect-Driven Flow Analysis

“…Modf itself also uses AAM-style semantics for its small-step analysis of functions, which makes the comparison with the AAM analyzer justified and straightforward, the latter also on a technical level by maximizing code reuse. Applications of AAM are found in various domains, such as detecting function purity [18], performing symbolic execution for contracts [15], analyzing concurrent programs [14,23,24], determining function coupling [16], discovering security vulnerabilities [17] or performing malware analysis [11]. The approach used by Modf could improve the performance of such applications and other client analyses without impacting their precision.…”