*** provides the ability to write JavaScript programs for the server-side and has become a popular language for developing web applications. *** allows direct access to the underlying filesystem, operating system reso...
详细信息
ISBN:
(纸本)9781450355728
*** provides the ability to write JavaScript programs for the server-side and has become a popular language for developing web applications. *** allows direct access to the underlying filesystem, operating system resources, and databases, but does not provide any security mechanism such as sandboxing of untrusted code, and injection vulnerabilities are now commonly reported in *** modules. Existing static dataflow analysis techniques do not scale to *** applications to find injection vulnerabilities because small *** web applications typically depend on many third-party modules. We present a new feedback-driven static analysis that scales well to detect injection vulnerabilities in *** applications. The key idea behind our new technique is that not all third-party modules need to be analyzed to detect an injection vulnerability. Results of running our analysis, nodeST, on real-world *** applications show that the technique scales to large applications and finds previously known as well as new vulnerabilities. In particular, nodeST finds 63 true positive taint flows in a set of our benchmarks, whereas a state-of-the-art static analysis reports 3 only. Moreover, our analysis scales to Express, the most popular *** web framework, and reports non-trivial injection vulnerabilities.
The paper discusses some features of the client and server implementation of a web application for visualization, analysis, and processing of spatial-temporal data using the react JavaScript library and the organizati...
详细信息
The existing methods of difference analysis cannot cope with event-driven codewell, since they explore only the input space for program input like integers and strings, but do not explore the event space for all possi...
详细信息
ISBN:
(纸本)9781450381048
The existing methods of difference analysis cannot cope with event-driven codewell, since they explore only the input space for program input like integers and strings, but do not explore the event space for all possible event sequences. This paper proposes a novel heuristic, as well as a tool called Diverjs, for performing difference analysis that copes well with both the input space and event space. To efficiently explore huge space, Diverjs prunes redundant event sequences based on Dynamic Partial Order Reduction (DPOR). Diverjs also stochastically switches two exploration heuristics: (1) one aims to increase code coverage, using shared variable information, derived from Write-Read (WR) set and dynamic taint analysis, (2) the other aims to guide the execution to the location of code changes, using the distance between the branch to be negated and the change. We conducted a preliminary experiment to evaluate the detection accuracy of program behavioral differences, and the efficiency of exploration by the number of paths. The result shows Diverjs outperformed the existing methods;Diverjs detected the differences with higher detection accuracy in fewer paths, which suggests our Diverjs's difference analysis is effective and efficient.
The backbone of *** is a single-threaded event loop, so computationally intensive tasks are bound to the performance of a single core. Modules with different architectures have been built to provide parallelism and sc...
详细信息
The backbone of *** is a single-threaded event loop, so computationally intensive tasks are bound to the performance of a single core. Modules with different architectures have been built to provide parallelism and scaling. However, their properties differ, making them appropriate for different cases. In order to assist software engineers in choosing the most appropriate module in the most efficient way, we perform an empirical study to investigate the modules' characteristics and functionality, taking into account system variances. Crucially, we present and apply an evaluation methodology focusing on four aspects: compute-intensive task execution, sharing data, communication and overhead. The results suggest that instance type (*** thread vs. *** process) is not enough to decide the most appropriate one. We find that modules with the highest performance in most cases can sacrifice other aspects, such as support and/or functionality and/or performance in fewer cases, while platform variances play a significant part.
暂无评论