JavaScript Control Flow Graph for Bug Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

JavaScript's dynamic typing and implicit behaviors make it challenging to detect bugs and vulnerabilities in software code, as variable types are not enforced, leading to complex and hard-to-debug runtime behaviors.

Innovation Solution

Constructing a control flow graph (CFG) for JavaScript software programs using desugaring to λJS and continuation-passing style (CPS) models, followed by flow analysis, taint analysis, and symbolic execution to identify and validate execution paths and variable access, thereby making implicit behaviors explicit and detectable.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If JavaScript's dynamic typing and implicit behaviors are used, then code flexibility and adaptability are improved, but bug detection difficulty and reliability deteriorate

Engineering Contradiction:

Improvecode flexibilityVSAvoidbug detection capability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a control flow graph as an intermediary representation between the JavaScript source code and the analysis tools. This CFG mediates the implicit behaviors by explicitly modeling control flow, allowing static analysis tools to detect bugs while preserving the flexibility of dynamic typing. The CFG serves as a bridge that translates implicit runtime behaviors into explicit graph structures suitable for analysis.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent creates a copy of the JavaScript program's control flow structure through desugaring to λJS and constructing a CFG. This copy preserves the essential control flow relationships while making implicit behaviors explicit, enabling analysis without modifying the original flexible JavaScript code. The CFG is a structural copy that reveals hidden control paths.

Inventive Principle:

Principle #26Copying

2Ease of operation

If variable types are not enforced in JavaScript, then ease of operation and adaptability are improved, but measurement precision and reliability deteriorate

Engineering Contradiction:

Improvevariable reassignment flexibilityVSAvoidvariable type tracking accuracy

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The patent segments the analysis process into distinct phases: parsing, desugaring to λJS, constructing the CFG, and performing flow analysis. This segmentation allows each phase to handle specific aspects of type tracking independently, improving precision without restricting the flexibility of variable reassignment in the original JavaScript code. The CFG nodes can track type information through segmented analysis passes.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent changes the representation parameters from implicit JavaScript variable types to explicit CFG node annotations. By transforming the type information into a different representation format (CFG annotations rather than JavaScript type checks), the system maintains ease of operation while improving measurement precision through systematic type tracking across control flow edges.

Inventive Principle:

Principle #35Parameter changes

3Device complexity

If implicit behaviors are left unexplicit, then device complexity is reduced, but difficulty of detecting and measuring increases

Engineering Contradiction:

Improvecode structure simplicityVSAvoidruntime behavior detection

Core Design Contradiction:

Device complexityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent performs preliminary action by constructing the control flow graph before executing the analysis. By pre-processing the JavaScript code into a CFG representation, the system prepares explicit control flow information in advance, making it easier to detect runtime behaviors without adding complexity to the execution process. The CFG is built once during static analysis, then reused for multiple detection tasks.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent adds another dimension by transforming the 1D linear JavaScript code into a 2D graphical control flow graph representation. This dimensional transformation makes implicit control flows visible and detectable, converting hidden runtime behaviors into explicit visual paths that can be systematically analyzed and measured.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Data Source

PatentUS8875109B2Tracking variables in javascript software using a control flow graph

Publication Date: 2014.10.28 FUJITSU LTD

AI summary

This disclosure generally relates to analyzing and validating computer software written in an object-oriented scripting language such as JavaScript. The analyzing and validating method comprises marking a variable in source code of a software program written in an object-oriented scripting language such as JavaScript; marking one or more locations in the source code of the software program; constructing a control flow graph (CFG) for the software program; and tracking the marked variable through the CFG by determining a path in the CFG that leads from a first node corresponding to the marked variable to one of the marked locations in the source code of the software program. In an embodiment, the variable is marked in source code using a keyword.