一句话：提出支持 ES7 异步函数的动态污点分析框架 Augur，利用 VM 插桩实现高性能注入漏洞检测。
动态污点分析（DTA）常用于保护 JavaScript 应用免受注入漏洞影响，但既有工具大多不支持 ECMAScript 7 引入的 async/await 等异步语言特性。本文提出 Augur，一种面向 ES7 JavaScript 的高性能 DTA。它直接集成 VM 支持的公共稳定插桩 API，在 VM 内高效运行并能适应语言版本变化；同时扩展 DTA 的抽象机方法以处理异步函数调用。除检测注入漏洞外，Augur 还可配置以支持多种污点分析。作者在 20 个基准上评估，运行时开销中位数仅 1.77 倍，较先前最优方法性能中位数提升 298%。
Dynamic taint analysis (DTA) is a popular approach to help protect JavaScript applications against injection vulnerabilities. In 2016, the ECMAScript 7 JavaScript language standard introduced many language features that most existing DTA tools for JavaScript do not support, e.g., the async/await keywords for asynchronous programming. We present Augur, a high-performance dynamic taint analysis for ES7 JavaScript that leverages VM-supported instrumentation. Integrating directly with a public, stable instrumentation API gives Augur the ability to run with high performance inside the VM and remain resilient to language revisions. We extend the abstract-machine approach to DTA to handle asynchronous function calls. In addition to providing the classic DTA use case of injection vulnerability detection, Augur is highly configurable to support any type of taint analysis, making it useful outside of the security domain. We evaluated Augur on a set of 20 benchmarks, and observed a median runtime overhead of only 1.77 ×, a median performance improvement of 298% compared to the previous state-of-the-art.