JavaScript Control Flow Graph via Lambda-JS and CPS
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
JavaScript's dynamic typing and implicit behaviors make it challenging to detect bugs and vulnerabilities in software code, as variable types are not enforced, leading to complex and difficult-to-analyze runtime behaviors.
Innovation Solution
Constructing a control flow graph (CFG) for JavaScript software programs using lambda-JS semantics and continuation-passing style (CPS) models, followed by optimization and analysis to expose implicit behaviors, allowing for bug detection and validation through flow analysis, taint analysis, and symbolic execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If JavaScript's dynamic typing and implicit behaviors are used, then flexibility and ease of programming are improved, but code analysis difficulty and bug detection difficulty increase
Solution Approach 1:
The patent introduces an intermediary representation (IR) that serves as a mediator between the JavaScript source code and the control flow graph. This IR captures the dynamic typing and implicit behaviors explicitly, allowing static analysis tools to reason about JavaScript code without being hindered by its dynamic nature. The IR acts as a bridge that preserves JavaScript's flexibility while making the code amenable to static analysis.
Solution Approach 2:
The patent performs preliminary transformation of JavaScript code into an intermediary representation before constructing the control flow graph. This preliminary action captures implicit behaviors and dynamic typing characteristics in advance, converting them into explicit structures that can be easily analyzed. By doing this transformation beforehand, the patent eliminates the need for complex runtime analysis while preserving JavaScript's dynamic features.
2Speed
If JavaScript code is executed directly without transformation, then execution speed is maintained, but static analysis capability is lost
Solution Approach 1:
The patent segments the JavaScript code analysis process into distinct phases: code transformation to intermediary representation, control flow graph construction, and static analysis. This segmentation allows the original JavaScript code to remain unchanged for execution, while a transformed version is created specifically for analysis purposes. The segmentation ensures that execution speed is not impacted while enabling comprehensive static analysis capability.
Solution Approach 2:
The patent creates a copy of the JavaScript code in the form of an intermediary representation that is suitable for static analysis. This copy preserves the semantic meaning and control flow of the original code while making implicit behaviors explicit. The original code continues to execute at full speed, while the copied IR version enables reliable static analysis for bug detection and validation.
3Measurement precision
If control flow graph construction includes detailed implicit behavior transformation, then bug detection accuracy is improved, but processing time and computational complexity increase
Solution Approach 1:
The patent applies local quality by transforming only the necessary implicit behaviors into explicit forms in the intermediary representation, rather than transforming all possible aspects of the code. This selective transformation focuses on capturing the specific implicit behaviors that affect control flow and bug detection, while leaving other aspects unchanged. This approach achieves high bug detection accuracy without incurring excessive processing time or computational complexity.
Data Source
AI summary
A method includes constructing a lambda object-oriented scripting language (λJS) model for a software program written in JavaScript; converting the λJS model to a continuation-passing style (CPS) model for the software program; constructing a control flow graph (CFG) for the software program based on the CPS model; and optimizing the CPS model by merging a sequence of two or more “let” operations. The two or more “let” operations in the CPS model and are generated based on the λJS model, so that they are represented by a single node in the CFG.