Remedying the eval that men do

Jensen, Simon Holm; Jönsson, Peter; Möller, Anders

doi:10.1145/2338965.2336758

Cited by 86 publications

(74 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, given the number of files with at least one of these features in systems like Moodle, it is not possible to assume, in general, that normal user code will not make use of these features. Another option may be to apply static, or hybrid static/dynamic analysis techniques, to try to transform the code into more easily analyzed static code with fewer evals [9,13,17].…”

Section: The Eval Expressionmentioning

confidence: 99%

An empirical study of PHP feature usage: a static analysis perspective

Hills

Klint

Vinju

2013

Proceedings of the 2013 International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

PHP is one of the most popular languages for server-side application development. The language is highly dynamic, providing programmers with a large amount of flexibility. However, these dynamic features also have a cost, making it difficult to apply traditional static analysis techniques used in standard code analysis and transformation tools. As part of our work on creating analysis tools for PHP, we have conducted a study over a significant corpus of open-source PHP systems, looking at the sizes of actual PHP programs, which features of PHP are actually used, how often dynamic features appear, and how distributed these features are across the files that make up a PHP website. We have also looked at whether uses of these dynamic features are truly dynamic or are, in some cases, statically understandable, allowing us to identify specific patterns of use which can then be taken into account to build more precise tools. We believe this work will be of interest to creators of analysis tools for PHP, and that the methodology we present can be leveraged for other dynamic languages with similar features.

show abstract

Section: The Eval Expressionmentioning

confidence: 99%

An empirical study of PHP feature usage: a static analysis perspective

Hills

Klint

Vinju

2013

Proceedings of the 2013 International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

show abstract

“…Furthermore, we believe that many of the remaining uses are unlikely to be refactored by the developers. The reason is that even though several techniques for removing some usages of eval have been proposed years ago [12], [11] and the risks of this function are widely documented [4], [9], using eval unnecessarily is still widespread.…”

Section: B Rq2: Usagesmentioning

confidence: 99%

A Study of Node.js Using Injection Vulnerabilities

Srivastava¹,

Pandey²,

Khan³

2018

IJARCSSE

View full text Add to dashboard Cite

Abstract-The Node.js community has prompt the making of numerous applications, for example, server-side web applications and work area applications. Not at all like client side JavaScript code, Node.js applications can collaborate uninhibitedly with the working framework without the advantages of a security sandbox. The mind boggling exchange between Node.js modules prompts unobtrusive infusion vulnerabilities being presented crosswise over module limits. This paper displays a substantial scale consider crosswise over 235,850 Node.js modules to investigate such vulnerabilities. We demonstrate that infusion vulnerabilities are predominant practically speaking, both due to eval, which was already examined for program code, and because of the effective executive API presented in Node.js. Our investigation demonstrates that a great many modules might be helpless against charge infusion assaults and that notwithstanding for prominent undertakings it requires long investment to settle the issue.

show abstract

“…The closest related work to JSAI is the JavaScript static analyzer TAJS by Jensen et al [32,33,34]. While TAJS is intended to be a sound analysis of the entire JavaScript language (sans dynamic code injection), it does not possess any of the characteristics of JSAI described in Section 1.…”

Section: Related Workmentioning

confidence: 99%

JSAI: a static analysis platform for JavaScript

Kashyap

Dewey

Kuefner

et al. 2014

Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering

134

View full text Add to dashboard Cite

JavaScript is used everywhere from the browser to the server, including desktops and mobile devices. However, the current state of the art in JavaScript static analysis lags far behind that of other languages such as C and Java. Our goal is to help remedy this lack. We describe JSAI, a formally specified, robust abstract interpreter for JavaScript. JSAI uses novel abstract domains to compute a reduced product of type inference, pointer analysis, control-flow analysis, string analysis, and integer and boolean constant propagation. Part of JSAI's novelty is user-configurable analysis sensitivity, i.e., context-, path-, and heap-sensitivity. JSAI is designed to be provably sound with respect to a specific concrete semantics for JavaScript, which has been extensively tested against a commercial JavaScript implementation.We provide a comprehensive evaluation of JSAI's performance and precision using an extensive benchmark suite, including real-world JavaScript applications, machine generated JavaScript code via Emscripten, and browser addons. We use JSAI's configurability to evaluate a large number of analysis sensitivities (some well-known, some novel) and observe some surprising results that go against common wisdom. These results highlight the usefulness of a configurable analysis platform such as JSAI.

show abstract

Remedying the eval that men do

Cited by 86 publications

References 22 publications

An empirical study of PHP feature usage: a static analysis perspective

An empirical study of PHP feature usage: a static analysis perspective

A Study of Node.js Using Injection Vulnerabilities

JSAI: a static analysis platform for JavaScript

Contact Info

Product

Resources

About