Transpiler-Based Security Scanner for TypeScript Vulnerability Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Software code written in less established programming languages, such as TypeScript, often lacks support for automated security vulnerability scanning, leading to costly and time-consuming manual reviews, which can result in delays and increased exposure to security risks.

Innovation Solution

Converting source code from an unsupported language into a supported language, like JavaScript, using a transpiler, and creating a map to associate vulnerabilities detected in the converted code back to their original locations, enabling efficient scanning and identification of security flaws.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual review is used to scan code in unsupported languages, then security vulnerabilities can be detected, but the process becomes time-consuming and expensive

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidreview time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent introduces an intermediary translation layer that converts code from unsupported languages (TypeScript, CoffeeScript, Dart) into JavaScript, which can then be scanned by existing vulnerability scanners. This mediator enables automated scanning without requiring manual review, resolving the contradiction between detection reliability and time efficiency.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary translation of the source code into a supported language before vulnerability scanning occurs. By pre-converting the code to JavaScript and maintaining mapping information, the system enables subsequent automated scanning to be both reliable and efficient, eliminating the need for time-consuming manual review.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If automated scanning is used for unsupported languages, then scanning efficiency improves, but vulnerability detection accuracy deteriorates due to lack of direct scanner support

Engineering Contradiction:

Improvescanning efficiencyVSAvoidvulnerability detection accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The translation intermediary preserves semantic equivalence between the original code and translated code while maintaining detailed mapping information. This allows automated scanners to work efficiently on the translated JavaScript code while the mapping ensures accurate identification of vulnerabilities in the original source code, maintaining both productivity and measurement precision.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system replaces the need for language-specific scanner mechanisms with a universal JavaScript scanner. By substituting the mechanical scanning process with a translation-based approach, the system achieves high scanning efficiency while maintaining accuracy through the preservation of code semantics and mapping relationships.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Adaptability or versatility

If code translation is performed, then scanner compatibility improves, but system complexity increases due to mapping and transpilation requirements

Engineering Contradiction:

Improvelanguage compatibilityVSAvoidsystem architecture complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system achieves universality by using JavaScript as a common target language for translating multiple source languages. This single translation target provides multi-functionality, allowing the same vulnerability scanner to handle code from TypeScript, CoffeeScript, Dart, and other languages, thereby improving adaptability without proportionally increasing complexity.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system creates a copied version of the original code in JavaScript with preserved semantic structure and maintains mapping relationships. This copying approach enables scanner compatibility while managing complexity through the use of established translation tools and standardized mapping formats rather than requiring complex custom integration.

Inventive Principle:

Principle #26Copying

4Loss of information

If transpilation mapping is created, then vulnerability source identification improves, but processing overhead increases

Engineering Contradiction:

Improvevulnerability location informationVSAvoidprocessing resources

Core Design Contradiction:

Loss of informationVSUse of energy by moving object

Solution Approach 1:

The system extracts only the essential mapping information needed for vulnerability location identification, rather than preserving all possible code transformation details. This selective extraction maintains sufficient information to trace vulnerabilities back to their source while minimizing processing overhead and resource consumption.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system performs partial translation and mapping only for the portions of code that are relevant to vulnerability scanning, rather than fully translating and mapping entire codebases. This partial action approach maintains adequate vulnerability location information while reducing unnecessary processing overhead.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS10872156B2Typescript security scanner

Publication Date: 2020.12.22 JPMORGAN CHASE BANK NA

AI summary

A method of scanning software code to identify security flaws or risks and reporting those flaws or risks to a software developer or other interested party, where the software code is written in a language for which a vulnerability scanner is not available.