1. Gatekeeper : Mostly Static Enforcement of Security & Reliability Policies for JavaScript Code Ben Livshits Salvatore Guarnieri

2. Widgets are everywhere Widget sources (web and desktop):  Live web widgets  Google/IG web widgets  Vista Sidebar desktop widgets  … Lots of widget producers Various levels of quality and trust A web widget is a portable chunk of code that can be installed and executed within any separate HTML-based web page by an end user without requiring additional compilation. They are derived from the idea of code reuse. Other terms used to describe web widgets include: gadget, badge, module, webjit, capsule, snippet, mini and flake. Web widgets usually but not always use DHTML, JavaScript, or Adobe Flash.HTMLcompilationcode reuseDHTMLJavaScriptAdobe Flash A web widget is a portable chunk of code that can be installed and executed within any separate HTML-based web page by an end user without requiring additional compilation. They are derived from the idea of code reuse. Other terms used to describe web widgets include: gadget, badge, module, webjit, capsule, snippet, mini and flake. Web widgets usually but not always use DHTML, JavaScript, or Adobe Flash.HTMLcompilationcode reuseDHTMLJavaScriptAdobe Flash

3. M OTIVATION & P ROJECT G OALS

4. Widget host is interested in ensuring widget security and quality Bad widgets: host is blamed Widget checking eliminates issues for users Static analysis advantage: all paths, no overhead, detect early

5. Gatekeeper: Protecting the Widget Host

6. Gatekeeper Contributions Propose a statically analyzable subset JavaScript SAFE Propose the first points-to analysis for JavaScript Formulate 9 security and reliability policies using Datalog. – restricting widget capabilities – making sure built-in objects are not modified – preventing code injection attempts, etc. Evaluation on 8,000+ publicly available JavaScript widgets – Live.com – Vista Sidebar, and – Google We flag a total of 1,341 policy violations spanning 684 widgets, with 113 false positives affecting only two widgets.

7. T ECHNIQUES

8. Basic Approach Represent the program as a database of facts – Normalize the JavaScript program AST – Introduce temporaries as necessary – Store facts in a compressed form Query this database using Datalog – This is how all analyses are implemented – Implement a points-to analysis to reason about the program heap – A very declarative, extensible approach – Propose 9 different analyses/policies

9. Gatekeeper Architecture

10. Enemies of Static Analysis 10 var x = new Object(); x[a+b] =...; var x = new Object(); x[a+b] =...;

11. Start with Entire JavaScript… 11 EcmaScript-262

12. Remove eval & Friends… 12 EcmaScript 262 - eval - setTimeout - setInterval - Function - with - arguments array - [innerHtml] ----------------------- = JavaScript GK - eval - setTimeout - setInterval - Function - with - arguments array - [innerHtml] ----------------------- = JavaScript GK

13. Remove Unresolved Array Accesses… 13 EcmaScript 262 JavaScript GK - non-const array access a[x+y] -------------------------------- = JavaScript SAFE - non-const array access a[x+y] -------------------------------- = JavaScript SAFE

14. Now, this is Amenable to Analysis! 14 EcmaScript 262 JavaScript GK JavaScript SAFE s ::= // assignments v1=v2 v = bot return v // calls v = new v0(v1,…,vn) v=v0(vthis,v1,…,vn) // heap v1=v2.f v1.f=v2 // declarations v=function(v1,…,vn){s} JavaScript SAFE s ::= // assignments v1=v2 v = bot return v // calls v = new v0(v1,…,vn) v=v0(vthis,v1,…,vn) // heap v1=v2.f v1.f=v2 // declarations v=function(v1,…,vn){s}

15. Two language subsets: JavaScript SAFE and JavaScript GK JavaScript SAFE – can analyze fully statically without resorting to runtime checks JavaScript GK – need basic instrumentation to prevent runtime code instroduction

16. JavaScript Language Features

17. TODO: discussion of 1) prototypes and 2) safe reflection

18. Analysis Process 18 JavaScript AST IR Normalizer Output to Datalog BDDBDDB solver Analysis Results Datalog analysis rules

19. Converting JavaScript Statements to Facts 19

20. Pointer Analysis Inference Rules 20

21. E XPERIMENTAL R ESULTS

22. Widget Corpus Collected by scraping widget galleries 22

23. Language Subsets in Practice 23

24. Policies for Widget Security & Reliability

25. Query Results 1,210 violations total 25 QueryLive [2,714]Sidebar [4,501]Google [1,171] Alert 8728781 Frozen Violation 311419 document.write 5175158 Location change 5919230 Totals 154768288

26. Conclusions Static analysis for JavaScript Technique: points-to analysis Focus: analyzing widgets We feel that static analysis of JavaScript is a key building block for enabling an environment in which code from different parties can safely co-exist and interact