Work

Extracting taint specifications for JavaScript libraries

Year: 2020

Type: conference-paper

Abstract: Modern JavaScript applications extensively depend on third-party libraries. Especially for the Node.js platform, vulnerabilities can have severe consequences to the security of applications, resulting in, e.g., cross-site scripting and command injection attacks. Existing static analysis tools that have been developed to automatically detect such issues are either too coarse-grained, looking only at package dependency structure while ignoring dataflow, or rely on manually written taint specifications for the most popular libraries to ensure analysis scalability.

Source: ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)

DOI: 10.1145/3377811.3380390

Authors: Cristian-Alexandru Staicu, Martin Toldam Torp, Max Schäfer, Anders Møller, Michael Pradel

Institutions: Technische Universität Darmstadt, Aarhus University, University of Stuttgart

Language: English

Topic: Web Application Security Vulnerabilities

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

Funders: European Commission, Deutsche Forschungsgemeinschaft, Bundesministerium für Bildung und Forschung, H2020 European Research Council

Awards: Automated Program Analysis for Advanced Web Applications, G434337789, G5990912325