Modular call graph construction for security scanning of Node.js applications

TY - GEN

T1 - Modular call graph construction for security scanning of Node.js applications

AU - Nielsen, Benjamin Barslev

AU - Torp, Martin Toldam

AU - Møller, Anders

N1 - Publisher Copyright: © 2021 ACM.

PY - 2021/7

Y1 - 2021/7

N2 - Most of the code in typical Node.js applications comes from third-party libraries that consist of a large number of interdependent modules. Because of the dynamic features of JavaScript, it is difficult to obtain detailed information about the module dependencies, which is vital for reasoning about the potential consequences of security vulnerabilities in libraries, and for many other software development tasks. The underlying challenge is how to construct precise call graphs that capture the connectivity between functions in the modules. In this work we present a novel approach to call graph construction for Node.js applications that is modular, taking into account the modular structure of Node.js applications, and sufficiently accurate and efficient to be practically useful. We demonstrate experimentally that the constructed call graphs are useful for security scanning, reducing the number of false positives by 81% compared to npm audit and with zero false negatives. Compared to js-callgraph, the call graph construction is significantly more accurate and efficient. The experiments also show that the analysis time is reduced substantially when reusing modular call graphs.

AB - Most of the code in typical Node.js applications comes from third-party libraries that consist of a large number of interdependent modules. Because of the dynamic features of JavaScript, it is difficult to obtain detailed information about the module dependencies, which is vital for reasoning about the potential consequences of security vulnerabilities in libraries, and for many other software development tasks. The underlying challenge is how to construct precise call graphs that capture the connectivity between functions in the modules. In this work we present a novel approach to call graph construction for Node.js applications that is modular, taking into account the modular structure of Node.js applications, and sufficiently accurate and efficient to be practically useful. We demonstrate experimentally that the constructed call graphs are useful for security scanning, reducing the number of false positives by 81% compared to npm audit and with zero false negatives. Compared to js-callgraph, the call graph construction is significantly more accurate and efficient. The experiments also show that the analysis time is reduced substantially when reusing modular call graphs.

KW - JavaScript

KW - Modularity

KW - Static analysis

UR - http://www.scopus.com/inward/record.url?scp=85111422140&partnerID=8YFLogxK

U2 - 10.1145/3460319.3464836

DO - 10.1145/3460319.3464836

M3 - Article in proceedings

AN - SCOPUS:85111422140

T3 - Proceedings of the ACM SIGSOFT International Symposium on the Foundations of Software Engineering

SP - 29

EP - 41

BT - ISSTA 2021 - Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis

A2 - Cadar, Cristian

A2 - Zhang, Xiangyu

PB - Association for Computing Machinery

T2 - 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2021

Y2 - 11 July 2021 through 17 July 2021

ER -