Vulnerability Exposure Analysis for JavaScript

Introduction

The JavaScript programming language together with the Node.js framework constitute the foundation of modern web-based software. An essential part of this platform is the npm registry that contains millions of freely available third-party software libraries that provide common functionality.

Importance of Library Reuse

This massive reuse of libraries is essential to the productivity of software developers. However, the dependence on other people's libraries opens the door to security vulnerabilities that may have severe consequences for the applications and end users.

Need for Vulnerability Awareness

When new vulnerabilities are discovered, it is crucial that the programmers are informed. Existing tools only tell whether a program depends on libraries with vulnerabilities, but without precise information about how the vulnerable library code is being used. This results in an overwhelming amount of false positives and makes it extremely difficult for the programmers to investigate the possible consequences of the vulnerabilities.

PAW Project Overview

The ERC project PAW has delivered a range of novel program analysis techniques, most notably one that has the potential to alleviate this problem: The analysis tool JAM.

Capabilities of JAM

JAM is capable of automatically analyzing a given JavaScript program and can tell exactly which parts of the libraries are being used and where they are used. This capability enables programmers to make fast and correct decisions about how their programs are exposed to vulnerabilities and how to update their programs accordingly to prevent security incidents.

Proposed Project: PAWJAM

The proposed project, PAWJAM, aims to explore the commercial and innovative aspects of this program analysis tool. The objectives include:

1. Further developing the prototype implementation into a commercial product.
2. Performing more extensive evaluations of its effectiveness.
3. Engaging with potential users and industry partners.