一句话：提出并实现面向 Node.js 应用的基于代码的漏洞检测工具，并通过案例研究总结实现挑战。
随着 Node.js 凭借其庞大的可复用包生态成为最流行的应用运行环境之一，已知漏洞在开源与工业软件中普遍存在。论文提出并实现了一种面向 Node.js 应用的可行且基于代码的漏洞检测工具，目标是在代码层面识别易受攻击的用法，而不仅依赖包版本或元数据。作者通过案例研究总结了在实现该 Node.js 漏洞代码检测器过程中遇到的挑战，涉及 JavaScript 动态特性、依赖生态复杂性和漏洞模式建模等问题。摘要未给出具体检测精度、召回率或大规模评估结果，其贡献主要在于工具实现可行性论证以及面向实践的问题归纳，为后续 Node.js 安全分析与漏洞检测研究提供经验参考。
With one of the largest available collection of reusable packages, the JavaScript runtime environment Node.js is one of the most popular programming application. With recent work showing evidence that known vulnerabilities are prevalent in both open source and industrial software, we propose and implement a viable code-based vulnerability detection tool for Node.js applications. Our case study lists the challenges encountered while implementing our Node.js vulnerable code detector.
DOI 原文 ·
@inproceedings{paperbot5950,
title = {Code-based vulnerability detection in Node.js applications},
author = {Bodin Chinthanet and Serena Elisa Ponta and Henrik Plate and Antonino Sabetta and Raula Gaikovina Kula and Takashi Ishio and Kenichi Matsumoto},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3421838}
}