Gradual typing embedded securely in JavaScript

Abstract

JavaScript's flexible semantics makes writing correct code hard and writing secure code extremely difficult. To address the former problem, various forms of gradual typing have been proposed, such as Closure and TypeScript. However, supporting all common programming idioms is not easy; for example, TypeScript deliberately gives up type soundness for programming convenience. In this paper, we propose a gradual type system and implementation techniques that provide important safety and security guarantees. We present TS# , a gradual type system and source-to-source compiler for JavaScript. In contrast to prior gradual type systems, TS# features full runtime reflection over three kinds of types: (1) simple types for higher-order functions, recursive datatypes and dictionary-based extensible records; (2) the type any, for dynamically type-safe TS# expressions; and (3) the type un, for untrusted, potentially malicious JavaScript contexts in which TS# is embedded. After type-checking, the compiler instruments the program with various checks to ensure the type safety of TS# despite its interactions with arbitrary JavaScript contexts, which are free to use eval, stack walks, prototype customizations, and other offensive features. The proof of our main theorem employs a form of type-preserving compilation, wherein we prove all the runtime invariants of the translation of TS# to JavaScript by showing that translated programs are well-typed in JS# , a previously proposed dependently typed language for proving functional correctness of JavaScript programs. We describe a prototype compiler, a secure runtime, and sample applications for TS#. Our examples illustrate how web security patterns that developers currently program in JavaScript (with much difficulty and still with dubious results) can instead be programmed naturally in TS#, retaining a flavor of idiomatic JavaScript, while providing strong safety guarantees by virtue of typing.

Optimizing and evaluating transient gradual typing

“…Several strategies have been used to implement runtime type checking for gradually typed languages, and these strategies are appropriate for different target languages and design goals. The traditional approach in the research literature is to insert casts during translation at the site of every implicit conversion between typed and dynamic code [Allende et al 2013a;Siek and Taha 2006;Swamy et al 2014;Tobin-Hochstadt and Felleisen 2006]. At runtime, these casts ensure that values correspond to their expected static type.…”

“…Gradual typing enables programmers to gradually evolve their programs from the flexibility of dynamic typing to the security of static typing [Siek and Taha 2006;Tobin-Hochstadt and Felleisen 2006]. Over the last decade, gradual typing has been of great interest to both the research community [Ahmed et al 2011;Allende et al 2013a;Rastogi et al 2012;Ren et al 2013;Siek et al 2015b;Swamy et al 2014;Takikawa et al 2012], and to industry, which has introduced several languages with elements of gradual typing, such as TypeScript [Microsoft 2012], Flow [Facebook 2014], and Dart [Google 2011]. Many existing gradually typed languages operate by translating a surface language program into a dynamically typed language by erasing types.…”

On the Content Security Policy Violations due to the Same-Origin Policy

“…Programmatically, one could prevent other scripts from modifying document.domain by making a script run first in a page [20]. The first script that runs on the page would be: A parent page can also indirectly disable origin relaxation in iframes by sandboxing them.…”

Types from data: making structured data first-class citizens in F#

“…A number of other advanced type system features could be used to tackle the problem discussed in this paper. The Ur [2] language has a rich system for working with records; metaprogramming [6,19] and multi-stage programming [25] could be used to generate code for the provided types; and gradual typing [20,22] can add typing to existing dynamic languages. As far as we are aware, none of these systems have been used to provide the same level of integration with XML, CSV and JSON.…”