Type-based dependency analysis for javascript

Authors:
Matthias Keil;Peter Thiemann
Affiliations:
University of Freiburg, Freiburg, Germany;University of Freiburg, Freiburg, Germany
Venue:
Proceedings of the Eighth ACM SIGPLAN workshop on Programming languages and analysis for security
Year:
2013

Citing 18
Cited 1

The SLam calculus: programming with secrecy and integrity

POPL '98 Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
A core calculus of dependency

Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
A sound type system for secure flow analysis

Journal of Computer Security
Certification of programs for secure information flow

Communications of the ACM
A lattice model of secure information flow

Communications of the ACM
Access Control in a Core Calculus of Dependency

Electronic Notes in Theoretical Computer Science (ENTCS)
Dytan: a generic dynamic taint analysis framework

Proceedings of the 2007 international symposium on Software testing and analysis
Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications

SP '08 Proceedings of the 2008 IEEE Symposium on Security and Privacy
Staged information flow for javascript

Proceedings of the 2009 ACM SIGPLAN conference on Programming language design and implementation
Tight Enforcement of Information-Release Policies for Dynamic Languages

CSF '09 Proceedings of the 2009 22nd IEEE Computer Security Foundations Symposium
Type Analysis for JavaScript

SAS '09 Proceedings of the 16th International Symposium on Static Analysis
The essence of javascript

ECOOP'10 Proceedings of the 24th European conference on Object-oriented programming
Information flow analysis for javascript

Proceedings of the 1st ACM SIGPLAN international workshop on Programming language and systems technologies for internet clients
SAILS: static analysis of information leakage with sample

Proceedings of the 27th Annual ACM Symposium on Applied Computing
Language-based information-flow security

IEEE Journal on Selected Areas in Communications
Remedying the eval that men do

Proceedings of the 2012 International Symposium on Software Testing and Analysis
Information-Flow Security for a Core of JavaScript

CSF '12 Proceedings of the 2012 IEEE 25th Computer Security Foundations Symposium
Towards fully automatic placement of security sanitizers and declassifiers

POPL '13 Proceedings of the 40th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages

Security Signature Inference for JavaScript-based Browser Addons

Proceedings of Annual IEEE/ACM International Symposium on Code Generation and Optimization

Quantified Score

Hi-index	0.00

Visualization

Abstract

Dependency analysis is a program analysis that determines potential data flow between program points. While it is not a security analysis per se, it is a viable basis for investigating data integrity, for ensuring confidentiality, and for guaranteeing sanitization. A noninterference property can be stated and proved for the dependency analysis. We have designed and implemented a dependency analysis for JavaScript. We formalize this analysis as an abstraction of a tainting semantics. We prove the correctness of the tainting semantics, the soundness of the abstraction, a noninterference property, and the termination of the analysis.