一句话：提出反馈驱动的静态数据流分析 Nodest，按需分析第三方模块，可扩展地检测 Node.js 应用的注入漏洞。
Node.js 常用于服务端 Web 开发，可直接访问文件系统、操作系统资源与数据库，却不提供沙箱等安全机制，注入漏洞在第三方模块中频繁出现。现有静态数据流分析难以扩展：小型应用常依赖大量第三方模块，全量分析代价过高。本文提出反馈驱动的静态分析 Nodest，核心思想是检测注入漏洞时并非所有第三方模块都需要分析：分析依据反馈按需深入相关模块，从而兼顾精度与可扩展性。在真实 Node.js 应用上，Nodest 在基准集中发现 63 条真正的污点流，而最先进的静态分析仅报告 3 条；它还能扩展到流行的 Web 框架 Express，并报告非平凡的注入漏洞。
Node.js provides the ability to write JavaScript programs for the server-side and has become a popular language for developing web applications. Node.js allows direct access to the underlying filesystem, operating system resources, and databases, but does not provide any security mechanism such as sandboxing of untrusted code, and injection vulnerabilities are now commonly reported in Node.js modules. Existing static dataflow analysis techniques do not scale to Node.js applications to find injection vulnerabilities because small Node.js web applications typically depend on many third-party modules. We present a new feedback-driven static analysis that scales well to detect injection vulnerabilities in Node.js applications. The key idea behind our new technique is that not all third-party modules need to be analyzed to detect an injection vulnerability. Results of running our analysis, Nodest, on real-world Node.js applications show that the technique scales to large applications and finds previously known as well as new vulnerabilities. In particular, Nodest finds 63 true positive taint flows in a set of our benchmarks, whereas a state-of-the-art static analysis reports 3 only. Moreover, our analysis scales to Express, the most popular Node.js web framework, and reports non-trivial injection vulnerabilities.
DOI 原文 ·
@inproceedings{paperbot5072,
title = {Nodest: feedback-driven static analysis of Node.js applications},
author = {Benjamin Barslev Nielsen and Behnaz Hassanshahi and François Gauthier},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3338933}
}