Efficient dynamic access analysis using JavaScript proxies

Abstract

JSConTest introduced the notions of effect monitoring and dynamic effect inference for JavaScript. It enables the description of effects with path specifications resembling regular expressions. It is implemented by an offline source code transformation. To overcome the limitations of the JSConTest implementation, we redesigned and reimplemented effect monitoring by taking advantange of JavaScript proxies. Our new design avoids all drawbacks of the prior implementation. It guarantees full interposition; it is not restricted to a subset of JavaScript; it is self-maintaining; and its scalability to large programs is significantly better than with JSConTest. The improved scalability has two sources. First, the reimplementation is significantly faster than the original, transformation-based implementation. Second, the reimplementation relies on the fly-weight pattern and on trace reduction to conserve memory. Only the combination of these techniques enables monitoring and inference for large programs.

Declarative Policies for Capability Control

“…Recent research [7] explores the addition of such a feature to existing languages, and contract systems have been implemented using membrane-like constructs [19,31]. In addition, membranes have been used to equip Javascript objects with contracts for path-based access control for method invocation [32].…”

On the Proxy Identity Crisis

“…Proxies implement contracts in Racket [6] and in JavaScript [3,5]. Contracts impose restrictions that the programmer regards as preconditions for the correct execution of a program.…”

“…This approach preserves the previous behavior and retains the possibility to distinguish proxies from target objects in library code implementing proxy abstractions. However, it would require the application code to be transformed (at run time to support eval), which is not feasible in an application like access control [5] that must work with unmodified foreign code.…”

“…However, there are abstractions that require such a test. For example, our implementation of access permissions [5] extracts the current permission from a proxy to construct a new proxy with an updated permission. This improves the efficiency of the implementation, which would otherwise generate long chains of proxy objects.…”

“…A proxy, or wrapper, is an object that mediates access to an arbitrary target object. Proxies are widely used to perform resource management, access remote objects, impose access control [1,5], restrict the functionality of an object [6], or to enhance the interface of an object. Ideally, a proxy is not distinguishable from other objects so that running a program with an interposed proxy should lead to the same outcome as running the program with the target object, unless the proxy imposes restrictions.…”