1. Saving the World Wide Web from Vulnerable JavaScript International Symposium on Software Testing and Analysis (ISSTA 2011) Omer Tripp IBM Software Group omert@il.ibm.com Marco Pistoia IBM T. J. Watson Research Center pistoia@us.ibm.com Julian Dolby IBM T.J. Watson Research Center dolby@us.ibm.com Stephen Teilhet IBM Software Group steilhet@us.ibm.com Ryan Berg IBM Software Group ryan.berg@us.ibm.com www.research.ibm.com/labasec Salvatore Guarnieri IBM Software Group sguarni@us.ibm.com

2. JavaScript is present on many popular Web sites 1

3. 2

4. Consequences of Taint Violations Read and write access to saved data in cookies and local data stores Read and write access to data in the web page Key loggers Impersonation Phishing via page modifications or redirects 3

5. var el1 = document.getElementById("d1"); function foo() { var el2 = document.getElementById("d2"); function bar() { var el3 = new Element(); var s = encodeURIComponent(el2.innerText); document.write(s); el1.innerHTML = el2.innerText; document.location = el3.innerText; } bar(); } foo(); function baz(a, b) { a.f = document.URL; document.write(b.f); } var x = new Object(); baz(x, x); Getting data from the DOM Sanitizing some, but not all, of the data Writing untrusted data into web page Writing unchecked data to the web page 4

6. Motivation Sources, Sinks, and Sanitizers Taint Analysis Results 5

7. var el1 = document.getElementById("d1"); function foo() { var el2 = document.getElementById("d2"); function bar() { var el3 = new Element(); var s = encodeURIComponent(el2.innerText); document.write(s); el1.innerHTML = el2.innerText; document.location = el3.innerText; } bar(); } foo(); function baz(a, b) { a.f = document.URL; document.write(b.f); } var x = new Object(); baz(x, x); 6

8. var el1 = document.getElementById("d1"); function foo() { var el2 = document.getElementById("d2"); function bar() { var el3 = new Element(); var s = encodeURIComponent(el2.innerText); document.write(s); el1.innerHTML = el2.innerText; document.location = el3.innerText; } bar(); } foo(); function baz(a, b) { a.f = document.URL; document.write(b.f); } var x = new Object(); baz(x, x); 7

9. Rules A rule is a triple Not all sources are valid for all sinks, and not all sanitizers are valid for all sinks 8

10. Rules A rule is a triple Not all sources are valid for all sinks, and not all sanitizers are valid for all sinks Sources –Seeds of untrusted data –Field gets or returns of function calls –Ex: document.url 9

11. Rules A rule is a triple Not all sources are valid for all sinks, and not all sanitizers are valid for all sinks Sources –Seeds of untrusted data –Field gets or returns of function calls –Ex: document.url Sinks –Security critical operations –Field puts or parameters to function calls –Ex: element.innerHTML 10

12. Rules A rule is a triple Not all sources are valid for all sinks, and not all sanitizers are valid for all sinks Sources –Seeds of untrusted data –Field gets or returns of function calls –Ex: document.url Sinks –Security critical operations –Field puts or parameters to function calls –Ex: element.innerHTML Sanitizers –Marks flow as non-dangerous –Function calls –Ex: encodeURIComponent(str) 11

13. Motivation Sources, Sinks, and Sanitizers Taint Analysis Results 12

14. var a = "foo" + "bar"; var b = obj[a]; function F() { this.bar = document.url; } function G() { } G.prototype = new F(); var a = new G(); write(g.bar); function foo() { var y = 42; var bar = function() { write(y); } Complexities of JavaScript Reflective property access Prototype chain property lookup Lexical scoping Function pointers eval and its relatives var m = function()... var k = function(f) { f(); } k(m); 13 eval("document.write('evil')");

15. Demand Driven Taint Analysis The seeds are the assignments to sources or return values from sources The analysis proceeds by tainting variables Variables consist of triplets: –Static Single Assignment (SSA) variable ID –Method where SSA variable is defined –Access path –Ex: (v7, m, ) 14

16. Context Sensitive Taint Analysis Start from taint sources Propagate taint intra- procedurally through def- use Inter-procedurally propagate taint forward Resolve aliasing by using Andersen alias analysis Record constraints on call sites, recursively In the final constraint- propagation graph, detect paths between sources and sinks not intercepted by sanitizers m1() m2(p1, p2, p3) m3(q1, q2) 15

17. Analysis Example function foo(p1, p2) { p1.f = p2.f; } var a = new Object(); var b = new Object(); b.f = window.location.toString(); var c = new Object(); var d = new Object(); d.f = "safe"; foo(a, b); foo(c, d); document.write(a.f); // This is a taint violation document.write(c.f); // This is NOT a taint violation Since d.f is not tainted, c.f will not be tainted Install taint summary for foo: p2.f -> p1.f 16 Taint variable: (v2, foo, )

18. Motivation Sources, Sinks, and Sanitizers Taint Analysis Results 17

19. Data Sets Developed a micro-benchmark suite of about 150 test scripts Downloaded Web pages and ran Actarus on them 18

20. Real World Data Set Crawled portions of top Alexa Web sites and downloaded pages to disk Ran Actarus on a sample of the saved pages Ran on over 12,000 pages Successfully analyzed over 9,000 pages ~22% failure due to a 4 minute timeout 19

21. Findings Several vulnerable Web sites were found Duplicates of vulnerabilities were found on many pages from the same site Some exploits were found in third party code that was shared among several websites 40% true positive rate Vulnerabilities can be fixed with common sanitization routines 20

22. Findings SiteUnique True PositivesTotal True Positives A780 B412 C491 D713 E24 F1200 G11 H1114 I37 J13 K11 21

23. User Friendly Output Flows are highlighted and numbered in the source code JavaScript was pretty printed to improve readability and usefulness of line numbers 22

24. 23

25. Future Work Using string analysis to reduce false positives Make analysis modular so library code does not have to be reanalyzed 24

26. Thank You E-mail: sguarni@us.ibm.com 25