Eval begone!: semi-automated removal of eval from javascript programs

Abstract

Eval endows JavaScript developers with great power. It allows developers and end-users, by turning text into executable code, to seamlessly extend and customize the behavior of deployed applications as they are running. With great power comes great responsibility, though not in our experience. In previous work we demonstrated through a large corpus study that programmers wield that power in rather irresponsible and arbitrary ways. We showed that most calls to eval fall into a small number of very predictable patterns. We argued that those patterns could easily be recognized by an automated algorithm and that they could almost always be replaced with safer JavaScript idioms. In this paper we set out to validate our claim by designing and implementing a tool, which we call Evalorizer, that can assist programmers in getting rid of their unneeded evals. We use the tool to remove eval from a real-world website and validated our approach over logs taken from the top 100 websites with a success rate over 97% under an open world assumption.

References

1. Christopher Anderson and Sophia Drossopoulou. BabyJ: From object based to class based programming via types. Electr. Notes in Theor. Comput. Sci., 82 (7): 53--81, 2003. 10.1016/S1571-0661(04)80802--8.
2. Christopher Anderson and Paola Giannini. Type checking for JavaScript. Electr. Notes Theor. Comput. Sci., 138 (2): 37--58, 2005. 10.1016/j.entcs.2005.09.010.
3. Michael Bolin. Closure: The Definitive Guide. O'Reilly Series. O'Reilly Media, 2010. ISBN 9781449381875. URL http://books.google.ch/books?id=p7uyWPcVGZsC.
4. Ravi Chugh, Jeffrey A. Meister, Ranjit Jhala, and Sorin Lerner. Staged information flow for JavaScript. In Conference on Programming language design and implementation (PLDI), pages 50--62, 2009. 10.1145/1542476.1542483.
5. Andreas Dewald, Thorsten Holz, and Felix C. Freiling. ADSandbox: sandboxing JavaScript to fight malicious websites. In Proceedings of the Symposium on Applied Computing (SAC), 2010. 10.1145/1774088.1774482.
6. Manuel Egele, Peter Wurzinger, Christopher Kruegel, and Engin Kirda. Defending browsers against drive-by downloads: Mitigating heap-spraying code injection attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment, 2009. 10.1007/978--3--642-02918--9_6.
7. European Association for Standardizing Information and Communication Systems (ECMA). phECMA-262: ECMAScript Language Specification. Fifth edition, December 2009. URL http://www.ecma-international.org/publications/standards/Ecma-262.htm.
8. Michael Furr, Jong-hoon (David) An, and Jeffrey S. Foster. Profile-guided static typing for dynamic scripting languages. In Conference on Object-Oriented Programming Systems, Languages and Applications (OOPSLA), 2009. 10.1145/1640089.1640110.
9. S. Guarnieri and B. Livshits. Gatekeeper: Mostly static enforcement of security and reliability policies for JavaScript code. In USENIX Security Symposium, 2009. URL https://www.usenix.org/events/sec09/tech/full_papers/sec09_javascript.pdf.
10. Arjun Guha, Shriram Krishnamurthi, and Trevor Jim. Using static analysis for Ajax intrusion detection. In Conference on World wide web (WWW), 2009. 10.1145/1526709.1526785.
11. Arjun Guha, Claudiu Saftoiu, and Shriram Krishnamurthi. The essence of JavaScript. In European Conference on Object-Oriented Programming (ECOOP),2010. 10.1007/978--3--642--14107--2_7.
12. Dongseok Jang and Kwang-Moo Choe. Points-to analysis for JavaScript. In Proceedings of the Symposium on Applied Computing (SAC), 2009. 10.1145/1529282.1529711.
13. Simon Jensen, Anders Møller, and Peter Thiemann. Type analysis for JavaScript. In Symposium on Static Analysis (SAS), 2009. 10.1007/978--3--642-03237-0_17.
14. er}jensen-issta-2012Simon Holm Jensen, Peter A. Jonsson, and Anders Møller. Remedying the eval that men do. In Proceedings of the International Symposium on Software Testing and Analysis (ISSTA), 2012. 10.1145/2338965.2336758.
15. Sergio Maffeis, John C. Mitchell, and Ankur Taly. An operational semantics for JavaScript. In Symposium on Programming Languages and Systems (APLAS), 2008. 10.1007/978--3--540--89330--1_22.
16. Sergio Maffeis, John Mitchell, and Ankur Taly. Isolating JavaScript with filters, rewriting, and wrappers. In Computer Security -- ESORICS 2009, 2009. 10.1007/978--3--642-04444--1_31.
17. Floréal Morandat, Brandon Hill, Leo Osvald, and Jan Vitek. Evaluating the design of the R language. In European Conference on Object-Oriented Programming (ECOOP), 2012. 10.1007/978--3--642--31057--7_6.
18. Paruj Ratanaworabhan, Benjamin Livshits, and Benjamin Zorn. JSMeter: Comparing the behavior of JavaScript benchmarks with real web applications. In Conference on Web Application Development (WebApps), 2010. URL http://www.usenix.org/events/webapps10/tech/full_papers/Ratanaworabhan.pdf.
19. Gregor Richards, Sylvain Lesbrene, Brian Burg, and Jan Vitek. An analysis of the dynamic behavior of JavaScript programs. In Proceedings of the ACM Programming Language Design and Implementation Conference (PLDI), 2010. 10.1145/1806596.1806598.
20. Richards, Gal, Eich, and Vitek}oopsla11Gregor Richards, Andreas Gal, Brendan Eich, and Jan Vitek. Automated construction of JavaScript benchmarks. In Conference on Object-Oriented Programming Systems, Languages and Applications (OOPSLA), 2011. 10.1145/2048066.2048119.
21. Richards, Hammer, Burg, and Vitek}ecoop11Gregor Richards, Christian Hammer, Brian Burg, and Jan Vitek. The eval that men do: A large-scale study of the use of eval in JavaScript applications. In European Conference on Object-Oriented Programming (ECOOP), 2011. 10.1007/978--3--642--22655--7_4.
22. Konrad Rieck, Tammo Krueger, and Andreas Dewald. Cujo: Efficient detection and prevention of drive-by-download attacks. In Annual Computer Security Applications Conference (ACSAC), 2010. 10.1145/1920261.1920267.
23. Peter Thiemann. Towards a type system for analyzing JavaScript programs. In European Symposium on Programming (ESOP), 2005. 10.1007/978--3--540--31987-0_28.

Index Terms

• Software and its engineering

  • Software creation and management

    • Software post-development issues

      • Software reverse engineering

  • Software notations and tools

    • Development frameworks and environments