Weakly sensitive analysis for JavaScript object‐manipulating programs

Abstract

While JavaScript programs have become pervasive in web applications, they remain hard to reason about. In this context, most static analyses for JavaScript programs require precise call graph information, since the presence of large numbers of spurious callees significantly deteriorates precision. One of the most challenging JavaScript features that complicate the inference of precise static call graph information is read/write accesses to object fields, the names of which are computed at runtime. JavaScript framework libraries often exploit this facility to build objects from other objects, as a way to simulate sophisticated high-level programming constructions. Such code patterns are difficult to analyze precisely, due to weak updates and limitations of unrolling techniques. In this paper, we observe that precise field origination relations can be inferred by locally reasoning about object copies, both regarding to the object and to the program structure, and we propose an abstraction that allows to separately reason about field read/write access patterns working on different fields and to carefully handle the sets of JavaScript object fields. We formalize and implement an analysis based on this technique. We evaluate the performance and precision of the analysis on the computation of call graph information for examples from jQuery tutorials. KEYWORDSabstract interpretation, JavaScript, object abstraction, static analysis, string abstraction, trace partitioning abstractionThe results in this paper are based in part on findings presented in the proceeding of APLAS'17. 840 FIGURE 1 A simplified excerpt from jQuery 1.7.2 and an example use case [Colour figure can be viewed at wileyonlinelibrary.com]One of the problematic JavaScript features that complicate the precise static call graph construction is read/write accesses to object fields, the names of which are computed at runtime. In JavaScript, an object has a set of fields, each of which consists of a name and value pair, and the field lookup and update operations take the value of an expression as an index that designates the field to read or write. JavaScript framework libraries often exploit this facility to build an object from another object by copying all the fields one by one (shallow copy) or by computing values using the fields in the source object (eg, to simulate accessor methods). To reason over such field copy or transformation patterns (for short, FCT patterns), analysis tools need to resolve precisely the fields of objects, and the relations among them.As an example, we consider the jQuery implementation of class inheritance using field copies of an object, as shown in Figure 1. To achieve that, function fix copies the fields of oE designated by the elements of array copy into array e. This copy of the fields of object oE takes place in the loop at lines 3-7. More generally, an FCT pattern boils down to an assignment of the form o1where v is a variable, o1 and o2 are two objects, f is a function over field names, and g is a function over values. ...

Static analysis with demand-driven value refinement

“…We compare TAJS VR with two existing state-of-the-art analysis tools: TAJS [Andreasen and Mùller 2014;Jensen et al 2009] and CompAbs [Ko et al 2017[Ko et al , 2019. TAJS is the base dataflow analysis upon which TAJS VR is built; it is designed for JavaScript type analysis but performs no value refinement.…”

“…For example, the approach taken by SAFE performs loop unrolling indiscriminately whenever the loop condition is determinate [Park and Ryu 2015], which is often unnecessary and may be costly. Another line of research attempts to address this problem by identifying specific syntactic patterns known to be particularly difficult to analyze and applying variations of trace partitioning to handle those patterns more precisely [Ko et al 2017[Ko et al , 2019Sridharan et al 2012].…”

“…1 ś where relational information connecting the property name of the read and write is essential to avoid crippling loss of precision. All three labelled read/write pairs are instances of a metaprogramming pattern called field copy or transformation (FCT) [Ko et al 2017[Ko et al , 2019, which consists of a property read operation x[a] and a property write operation y[b] = v where the property name b is a function of the property name a and the written value v is a function of the read value x [a]. This pattern is a generalization of the correlated read/write pattern [Sridharan et al 2012], which requires that the property names are strictly equal.…”

“…Analysis precision at dynamic property read and write operations is known to be critical for static analysis for JavaScript programs [Andreasen and Mùller 2014;Ko et al 2017Ko et al , 2019Sridharan et al 2012]. If the abstract values of the property names are imprecise, then a naive analysis will mix together the values of the different properties, which often causes a catastrophic loss of precision.…”

“…WALA [Sridharan et al 2012], SAFE LS A [Park and Ryu 2015], and TAJS [Andreasen and Mùller 2014] use context-sensitivity and loop-unrolling to attempt to obtain precise information about the property names, but fail to provide precise values of the variables methodName (at lines 4, 5, and 28) and key (at line 20). 3 The CompAbs analyzer [Ko et al 2017[Ko et al , 2019 takes a different approach that does not require precise tracking of the possible values of methodName and key. Instead, it attempts to syntactically identify correlated dynamic property reads and writes and applies trace partitioning [Rival and Mauborgne 2007] at the relevant property read operations.…”