A Symbolic Execution Framework for JavaScript

By Prateek Saxena, Devdatta Akhawe, Steve Hanna, Feng Mao, Stephen McCamant, Dawn Song. IEEE Symposium on Security and Privacy, 2010

537 citations recorded by the source corpus.

As AJAX applications gain popularity, client-side JavaScript code is becoming increasingly complex. However, few automated vulnerability analysis tools for JavaScript exist. In this paper, we describe the first system for exploring the execution space of JavaScript code using symbolic execution. To handle JavaScript code’s complex use of string operations, we design a new language of string constraints and implement a solver for it. We build an automatic end-to-end tool, Kudzu, and apply it to the problem of finding client-side code injection vulnerabilities. In experiments on 18 live web applications, Kudzu automatically discovers 2 previously unknown vulnerabilities and 9 more that were previously found only with a manually-constructed test suite.

Subfields: Artificial Intelligence, Information Systems, Software

View Paper: https://www.semanticscholar.org/paper/1c0d90b7beddc0a589e6c74452ae70a1954d97b2

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Software

Citations in the corpus

Type test scripts for TypeScript testing (2017, background): “To this end, it may be possible to leverage previous work on symbolic execution for JavaScript from Kudzu [Saxena et al. 2010], Jalangi [Sen et al. 2013], or SymJS [Li et al. 2014].”
AppsPlayground: automatic security analysis of smartphone applications (2013, background): “Even projects developed around symbolic execution use random walks or fuzz testing to explore the GUI parts of the applications [25].”
An Empirical Evaluation of Using Large Language Models for Automated Unit Test Generation (2023, background): “Saxena et al. [73] present Kudzu, a tool that aims to ﬁnd injection vulnerabilities in client-side JavaScript applications by exploring an application’s input space.”
Jalangi: a selective record-replay and dynamic analysis framework for JavaScript (2013, methodology): “Dynamic analysis tools developed for JavaScript include tools for testing [3, 29], race detection [24], and security analysis [33].”
AppIntent: analyzing sensitive data transmission in android for privacy leakage detection (2013, methodology): “To the best of our knowledge, there are no efficient solutions to this problem, and most of the existing symbolic execution approaches for GUI apps sacrifice code coverage for performance by applying random scheduling strategy [38], exhaustively searching possibilities (to an upper bound of event se”
Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations (2014, methodology): “Our adversarial testing techniques for finding bugs in the client-side validation of server certificates can also be applied to the implementations of server-side validation of client certificates.”