Static Analysis for ECMAScript String Manipulation Programs

Abstract

In recent years, dynamic languages, such as JavaScript or Python, have been increasingly used in a wide range of fields and applications. Their tricky and misunderstood behaviors pose a great challenge for static analysis of these languages. A key aspect of any dynamic language program is the multiple usage of strings, since they can be implicitly converted to another type value, transformed by string-to-code primitives or used to access an object-property. Unfortunately, string analyses for dynamic languages still lack precision and do not take into account some important string features. In this scenario, more precise string analyses become a necessity. The goal of this paper is to place a first step for precisely handling dynamic language string features. In particular, we propose a new abstract domain approximating strings as finite state automata and an abstract interpretation-based static analysis for the most common string manipulating operations provided by the ECMAScript specification. The proposed analysis comes with a prototype static analyzer implementation for an imperative string manipulating language, allowing us to show and evaluate the improved precision of the proposed analysis.

Twinning Automata and Regular Expressions for String Static Analysis

“…The problem of statically analyzing strings has been already tackled in different contexts in the literature [2,8,13,14,16,25,29]. The original finite state automata abstract domain was defined in [8] in the context of dynamic languages, providing an automata-based abstract semantics for common ECMAScript string operations. The same abstract domain has been integrated also for defining a soundby-construction analysis for string-to-code statements [7].…”

“…Let C and A be complete lattices, a pair of monotone functions α : C → A and γ : Finite State Automata and Regular Expression Notation. We follow the notation reported in [8] for introducing finite state automata. A finite state automaton (FA) is a tuple A = Q, Σ, δ, q 0 , F , where Q is a finite set of states, q 0 ∈ Q is the initial state, Σ is a finite alphabet of symbols, δ ⊆ Q × Σ × Q is the transition relation and F ⊆ Q is the set of final states.…”

“…The Finite State Automata Abstract Domain. Here, we report the necessary notions about the finite state automata abstract domain presented in [8], over-approximating string properties as the minimum deterministic finite state automaton recognizing them. Given an alphabet Σ, the finite state automata domain is defined as Fa /≡ , Fa , Fa , Fa , Min(∅), Min(Σ * ) , where Fa /≡ is the quotient set of Fa w.r.t.…”

“…On the one hand, finite height string abstractions [16] are computable in a reasonable time, but precision is suddenly lost when using advanced string manipulations. On the other hand, more sophisticated abstractions (e.g., the ones reported in [8,14]) compute precise results but they require a huge, and sometimes unrealistic, computational cost, making such code intractable for these abstractions. A good representation of such abstractions is the finite state automata domain [8].…”

“…On the other hand, more sophisticated abstractions (e.g., the ones reported in [8,14]) compute precise results but they require a huge, and sometimes unrealistic, computational cost, making such code intractable for these abstractions. A good representation of such abstractions is the finite state automata domain [8]. Over-approximating strings into finite state automata has shown to increase string analysis accuracy in many scenarios, but it does not scale up to real world programs dealing with statically unknown inputs and long text manipulations.…”