11:00 - 11:30

• TypeDevil: Dynamic Type Inconsistency Analysis for JavaScript

  Dynamic languages, such as JavaScript, give programmers the freedom to ignore types, and enable them to write concise code in short time. Despite this freedom, many programs follow implicit type rules, for example, that a function has a particular signature or that a property has a particular type. Violations of such implicit type rules often correlate with problems in the program. This paper presents Type Devil, a mostly dynamic analysis that warns developers about inconsistent types. The key idea is to assign a set of observed types to each variable, property, and function, to merge types based in their structure, and to warn developers about variables, properties, and functions that have inconsistent types. To deal with the pervasiveness of polymorphic behavior in real-world JavaScript programs, we present a set of techniques to remove spurious warnings and to merge related warnings. Applying Type Devil to widely used benchmark suites and real-world web applications reveals 15 problematic type inconsistencies, including correctness problems, performance problems, and dangerous coding practices.

   

  Preprint available:

Michael Pradel; Parker Schuh; Koushik Sen

University of California at Berkeley, USA

11:30 - 12:00

• Detecting Inconsistencies in JavaScript MVC Applications

  Higher demands for more reliable and maintainable JavaScript-based web applications have led to the recent development of MVC (Model-View-Controller) frameworks. One of the main advantages of using these frameworks is that they abstract out DOM API method calls, which are one of the leading causes of web application faults, due to their often complicated interaction patterns. However, MVC frameworks are susceptible to inconsistencies between the identifiers and types of variables and functions used throughout the application. In response to this problem, we introduce a formal consistency model for web applications made using MVC frameworks. We propose an approach – called Aurebesh – that automatically detects inconsistencies in such applications. We evaluate Aurebesh by conducting a fault injection experiment and by running it on real applications. Our results show that Aurebesh is accurate, with an overall recall of 96.1% and a precision of 100%. It is also useful in detecting bugs, allowing us to find 15 real-world bugs in applications built on Angular JS, a popular MVC framework.

   

  Preprint available:

Frolin Ocariza; Karthik Pattabiraman; Ali Mesbah

University of British Columbia, Canada

12:00 - 12:30

• AutoCSP: Automatically Retrofitting CSP to Web Applications

  Web applications often handle sensitive user data, which makes them attractive targets for attacks such as cross-site scripting (XSS). Content security policy (CSP) is a content-restriction mechanism, now supported by all major browsers, that offers thorough protection against XSS. Unfortunately, simply enabling CSP for a web application would affect the application's behavior and likely disrupt its functionality. To address this issue, we propose AutoCSP, an automated technique for retrofitting CSP to web applications. AutoCSP (1) leverages dynamic taint analysis to identify which content should be allowed to load on the dynamically-generated HTML pages of a web application and (2) automatically modifies the server-side code to generate such pages with the right permissions. Our evaluation, performed on a set of real-world web applications, shows that AutoCSP can retrofit CSP effectively and efficiently.

   

  Preprint available:

Mattia Fazzini; Prateek Saxena; Alessandro Orso

Georgia Institute of Technology, USA; National University of Singapore, Singapore