一句话：提出多版本依赖图 MDG 与 Graph.js 扫描器，在 npm 包漏洞检测中同时降低漏报与分析耗时。
基于代码属性图（CPG）的静态漏洞检测在图中信息量与可扩展性之间存在权衡：信息过少会导致漏洞模式识别能力下降与分类错误，信息过多则影响可扩展性，ODGen 等先进工具在 Node.js 漏洞检测中已暴露扩展性瓶颈。本文探索 JavaScript 漏洞检测的 CPG 设计空间新方案，提出多版本依赖图（MDG），一种刻画对象及其属性在执行过程中状态演化的图结构；相较 ODGen 使用的图，MDG 更简洁却保留漏洞检测所需的关键信息。作者实现了 Graph.js，一个面向 npm 包、检测污点式与原型污染漏洞的 MDG 静态扫描器。评估表明，Graph.js 相比 ODGen 显著减少假阴性并缩短分析时间，还发现了 49 个此前未知的 npm 包漏洞。
While static analysis tools that rely on Code Property Graphs (CPGs) to detect security vulnerabilities have proven effective, deciding how much information to include in the graphs remains a challenge. Including less information can lead to a more scalable analysis but at the cost of reduced effectiveness in identifying vulnerability patterns, potentially resulting in classification errors. Conversely, more information in the graph allows for a more effective analysis but may affect scalability. For example, scalability issues have been recently highlighted in ODGen, the state-of-the-art CPG-based tool for detecting Node.js vulnerabilities. This paper examines a new point in the design space of CPGs for JavaScript vulnerability detection. We introduce the Multiversion Dependency Graph (MDG), a novel graph-based data structure that captures the state evolution of objects and their properties during program execution. Compared to the graphs used by ODGen, MDGs are significantly simpler without losing key information needed for vulnerability detection. We implemented Graph.js, a new MDG-based static vulnerability scanner specialized in analyzing npm packages and detecting taint-style and prototype pollution vulnerabilities. Our evaluation shows that Graph.js outperforms ODGen by significantly reducing both the false negatives and the analysis time. Additionally, we have identified 49 previously undiscovered vulnerabilities in npm packages.
@article{paperbot2510,
title = {Efficient Static Vulnerability Analysis for JavaScript with Multiversion Dependency Graphs},
author = {Mafalda Ferreira and Miguel Monteiro and Tiago Brito and Miguel E. Coimbra and Nuno Santos and Limin Jia and José Fragoso Santos},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {PLDI},
year = {2024},
doi = {10.1145/3656394}
}