Upload
silvia-rich
View
216
Download
0
Embed Size (px)
Citation preview
The Essence of JavaScript
Arjun Guha, Claudiu Saftoiu, and Shriram Krishnamurthi
2
"JavaScript has much in common with Scheme […] Because of this deep similarity …"
( )
3
function bar(x) { return function() { var x = x; return x; };}
var f = bar(200);f() 200
function bar(x) { return function() { var x = x; return x; };}
var f = bar(200);f() undefined
4
var x = 0;var y = 900;
function baz(obj) { with (obj) { x = y; }}
baz({ y: 100 });x 100
var myObj = { x : 0 };baz(myObj);x 100myObj.x 900
Is JavaScript Even Lexically Scoped?
5
"JavaScript has much in common with Scheme […] Because of this deep similarity …"
No help to researchers studying Web security, building JavaScript analyses, etc.
6
Bad
Arjun Guha, Claudiu Saftoiu, and Shriram Krishnamurthi
weirdness
7
nytimes.com is a JavaScript mashup
<script lang="javascript" src="http://ad.doubleclick.net/..."><script lang="javascript" src="http://ad.linkstorms.com/...">
8
function safeLookup(obj, fd) { if (fd === "eval") { throw "cannot access eval"; } else { return obj[fd]; }}
window["ev" + "al"] window["eval"] vulnerability
safeLookup(window, "ev" + "al") safeLookup(window, "eval") * exception
Malicious 3rd party code
ADsafe / Caja / Facebook JavaScript Syntactic Checks +
Inserted Runtime Checks
Runtime Safety Check
“Sanitized” 3rd party code
BUGGY
9
How can we reason about JavaScript?
• The JavaScript standard (ECMA-262). 200 pages of prose and pseudocode.
• Maffeis, Mitchell, and Taly. An Operational Semantics for JavaScript. 70 pages of semantics.
We need a tractable semantics
10
11
12
13
14
The Essence of JavaScript:Functions, Prototype-Based Objects, State,
Control Operators, and Primitives
15
Thank You!
Questions?
16
What about the bad parts?
Thanks, Emery Berger
17
In practice most development effort goes into the “noise” that researchers abstract � �away […]. [M]inimalistic subsets give rise to a nice and simple formalization, whereas language implementers actually need help formalizing the rough edges of the language, not the beautiful and clean subset.
Erik Meijer.Confessions of a Used Programming Language Salesman.
OOPSLA 2007.
18
What about the bad parts?scope objects, with, switch, return, var, continue, for, do-while, for-in, implicit type conversions, function statements, named function expressions, function objects, "constructors", new-expressions, sparse "arrays", this keyword, toString(), valueOf(), variable-arity, Function.caller, Function.callee, the standard library, etc.
syntactic sugar
Thanks, Emery Berger
We implement desugaring (1,000 LOC)
19
Desugaring is Compositional*
desugar(e1 + e2) = C [ desugar(e1), desugar(e2) ]
desugar(obj[field]) = C [ desugar(obj), desugar(field) ]
etc.
program context, inserted by desugaring
*except for with statements
20
JavaScript program λJS programdesugar
Chrome,Firefox,Rhino
100LOCinterpreter
(Desugaring is Total) For all JavaScript programs e, is desugar(e) defined?
(Desugar Commutes with Eval) For all JavaScript programs e, does desugar(JS-eval(e)) = λJS-eval(desugar(e))?
theiranswer
ouranswer
21
Syntactic Form Occurrences (approx.)
with blocks 15
var statements 500
try blocks 20
if and switch statements 90
functions 200
typeof and instanceof 35
new expressions 50
Math library functions 15
5,400 lines of the Mozilla JavaScript test suite:
22
/* if F, G are inverse functions and x==y, this should return 1 */function match(x, y, F, G) { switch (x) { case F(G(y)): return 1; default: return 0; }}
test_case("A", match(17, f(fInverse(17)), f, fInverse)), 1);test_case("B", match(17, 2000, f, fInverse), 0);test_case("C", match(1, 1, Math.exp, Math.log), 1);test_case("D", match(1, 200, Math.exp, Math.log), 0);test_case("E", match(1, 1, Math.sin, Math.cos), 1);
23
$ ./test_firefox.sh tests/Statements/switch-001.jsBUGNUMBER: (none)STATUS: Testing the switch statement PASSED! Section A of test PASSED! Section B of test PASSED! Section C of test PASSED! Section D of test PASSED! Section E of test
$ ./test_lambdajs.sh tests/Statements/switch-001.jsBUGNUMBER: (none)STATUS: Testing the switch statement PASSED! Section A of test PASSED! Section B of test PASSED! Section C of test PASSED! Section D of test PASSED! Section E of test
Our semantics produces exactly the same result
24
Syntactic Form Occurrences (approx.)
with blocks 15
var statements 500
try blocks 20
if and switch statements 90
functions 200
typeof and instanceof 35
new expressions 50
Math library functions 15
5,400 lines of the Mozilla JavaScript test suite:
scalable strategy: add more tests
equivalent under diff
25
Recent JavaScript Research
• Staged Information Flow for JavaScript. PLDI’09.• GateKeeper. USENIX’09.• Static Analysis for Ajax Intrusion Detection.
WWW’09.• Type Analysis for JavaScript. SAS’09.• Object Views: Fine-Grained Sharing in
Browsers. WWW’10.• …
Proofs?desugar to λJS
do proofs for λJS
build tools for λJS
26
function safeLookup(obj, fd) { if (fd === "eval") { throw "cannot access eval"; } else { return obj[fd]; }}
function safeLookup(obj, fd) { if (fd === "eval") { throw "cannot access eval"; } else { return obj[fd.toString()]; }}
Implicit call in JavaScriptExplicit call in λJS
badObj ={toString:
function () {return "eval"}}
window[badObj] safeLookup(window, badObj) window[badObj.toString()] window[(function () return "eval")()] window["eval"]
27
Conclusion
• λJS is tractable and good for soundness proofs
• desugar is executable, so semantics-based tools can handle real source
• Used in Typed JavaScript, flow analyses, security type systems (JS source lang. too big, too implicit)
• λJS sets a new semantics standard: testing