Staged information flow for javascript

Abstract

Modern websites are powered by JavaScript, a flexible dynamic scripting language that executes in client browsers. A common paradigm in such websites is to include third-party JavaScript code in the form of libraries or advertisements. If this code were malicious, it could read sensitive information from the page or write to the location bar, thus redirecting the user to a malicious page, from which the entire machine could be compromised. We present an information-flow based approach for inferring the effects that a piece of JavaScript has on the website in order to ensure that key security properties are not violated. To handle dynamically loaded and generated JavaScript, we propose a framework for staging information flow properties. Our framework propagates information flow through the currently known code in order to compute a minimal set of syntactic residual checks that are performed on the remaining code when it is dynamically loaded. We have implemented a prototype framework for staging information flow. We describe our techniques for handling some difficult features of JavaScript and evaluate our system's performance on a variety of large realworld websites. Our experiments show that static information flow is feasible and efficient for JavaScript, and that our technique allows the enforcement of information-flow policies with almost no run-time overhead.

An Empirical Study of Information Flows in Real-World JavaScript

“…To mitigate this threat we constructed tests in a way that increases the sensitive branch coverage. However, multiple paths [27] hybrid ✓ ✓ -Chugh et al [15] hybrid ✓ ✓ ✓ Tripp et al [47] hybrid ✓ --Chudnov & Naumann [14] dynamic ✓ ✓ NSU Hedin et al [25] dynamic ✓ ✓ NSU Bichhawat et al [11] dynamic ✓ ✓ PU Kerschbaumer et al [31] dynamic ✓ ✓ -Bauer et al [9] dynamic ✓ --De Groef et al [17] dynamic MOD MOD MOD Austin & Flanagan [6] dynamic MOD MOD MOD cannot be covered due to a variety of reasons, e.g., error cases that cannot be easily triggered or unfeasible execution paths. Despite these limitations, our study produces interesting insights about the kinds of flows that appear in real-world JavaScript programs and the cost-benefit tradeoff of information flow analysis.…”

“…Among the analyses that consider implicit flows, the majority stop or modify the program as soon as a hidden flow occurs. Information Flow Analysis for JavaScript Chugh et al propose a static-dynamic analysis that reports flows from code given to eval() to sensitive locations, such as the location bar of a site [15]. Austin and Flanagan address the problem of hidden implicit flows [4,5], as discussed in detail in Section 2.…”

Just-in-time static type checking for dynamic languages

“…Chugh et al's staged program analysis [6] performs static analysis on as much code as is possible at compile time, and then computes a set of remaining checks to be performed at run time. Hummingbird uses a related idea in which no static analysis is performed at compile time, but type checking is always done when methods are called.…”

JSConTest: Contract-Driven Testing and Path Effect Inference for JavaScript.

“…For example, Maffeis and coworkers [MMT09] achieve isolation properties between mashed-up scripts using filters, rewriting, and wrapping. Chugh and coworkers [CMJL09] present (among others) a dynamic information flow analysis based on wholesale rewriting. Yu and coworkers [YCIS07] perform rewriting guided by a security policy.…”