Conference In: orcid
Efficient Static Vulnerability Analysis for JavaScript with Multiversion Dependency Graphs
Proceedings of the ACM on Programming Languages
— 2024 — ACM New York, NY, USA
Key information
Authors:
Published in
June 20, 2024
Abstract
While static analysis tools that rely on Code Property Graphs (CPGs) to detect security vulnerabilities have proven effective, deciding how much information to include in the graphs remains a challenge. Including less information can lead to a more scalable analysis but at the cost of reduced effectiveness in identifying vulnerability patterns, potentially resulting in classification errors. Conversely, more information in the graph allows for a more effective analysis but may affect scalability. For example, scalability issues have been recently highlighted in ODGen, the state-of-the-art CPG-based tool for detecting Node.js vulnerabilities. This paper examines a new point in the design space of CPGs for JavaScript vulnerability detection. We introduce the Multiversion Dependency Graph (MDG), a novel graph-based data structure that captures the state evolution of objects and their properties during program execution. Compared to the graphs used by ODGen, MDGs are significantly simpler without losing key information needed for vulnerability detection. We implemented Graph.js, a new MDG-based static vulnerability scanner specialized in analyzing npm packages and detecting taint-style and prototype pollution vulnerabilities. Our evaluation shows that Graph.js outperforms ODGen by significantly reducing both the false negatives and the analysis time. Additionally, we have identified 49 previously undiscovered vulnerabilities in npm packages.
Publication details
Authors in the community:
Mafalda Ferreira
ist181613
Miguel Alexandre Figueiredo Monteiro
ist192526
Tiago Luís de Oliveira Brito
ist172647
Miguel E. Coimbra
ist162460
Nuno Miguel Carvalho dos Santos
ist14261
Publication version
AM - Accepted manuscript
Publisher
ACM New York, NY, USA
Link to the publisher's version
https://dl.acm.org/doi/pdf/10.1145/3656394
Title of the publication container
Proceedings of the ACM on Programming Languages
Location of the conference
Copenhagen, Denmark
Conference date start
June 24, 2024
Conference date end
June 28, 2024
First page or article number
417
Last page
441
Volume
8
Issue
PLDI
ISSN
2475-1421
WoS (Web of Science)
Fields of Science and Technology (FOS)
computer-and-information-sciences - Computer and information sciences
Keywords
- Static Analysis
- JavaScript
- Vulnerability Detection
Publication language (ISO code)
eng - English
Rights type:
Open access
Creative Commons license
CC-BY - Attribution
Financing entity
Fundação para a Ciência e a Tecnologia
Title of the project, award or grant: INESC-ID
Funding Stream: Fundação para a Ciência e a Tecnologia (FCT) – R&D Units Base Funding Programme (UIDB)
Identifier for the funding entity: https://doi.org/10.13039/501100001871
Type of identifier of the funding entity: Crossref Funder
Number for the project, award or grant: UIDB/50021/2020
Financing entity
Fundação para a Ciência e a Tecnologia
Title of the project, award or grant: RIGA: Reasoning Over Indirect Discrimination
Funding Stream: Fundação para a Ciência e a Tecnologia (FCT) – R&D Projects (PTDC 2022 call)
Identifier for the funding entity: https://doi.org/10.13039/501100001871
Type of identifier of the funding entity: Crossref Funder
Number for the project, award or grant: 2022.03537.PTDC
Financing entity
IAPMEI – Agência para a Competitividade e Inovação, I.P.
Title of the project, award or grant: SmartRetail
Funding Stream: Recovery and Resilience Plan (PRR) / European Union – NextGenerationEU, through IAPMEI
Number for the project, award or grant: C6632206063-00466847
Financing entity
Carnegie Mellon University
Title of the project, award or grant: Future Enterprise Security Initiative (FutureEnterprise@CyLab)
Funding Stream: Carnegie Mellon CyLab – Future Enterprise Security Initiative (industry-sponsored research programme)
Identifier for the funding entity: http://dx.doi.org/10.13039/100008047
Type of identifier of the funding entity: Crossref Funder
Number for the project, award or grant: N/A