Static security evaluation of an industrial web application
JavaScript is the most popular programming language for web applications. Static analysis of JavaScript applications is highly challenging due to its dynamic language constructs and event-driven asynchronous executions, which also give rise to many security-related bugs. Several static analysis tools to detect such bugs exist, however, research has not yet reported much on the precision and scalability trade-off of these analyzers. As a further obstacle, JavaScript programs structured in Node.js modules need to be collected for analysis, but existing bundlers are either specific to their respective analysis tools or not particularly suitable for static analysis.
 In this paper we propose a novel approach to compare the precision, scalability and code coverage of two widely-used static analysis frameworks---WALA and SAFE---together with simplePack, which analyzer-agnostically bundles dependent modules, enabling a fair comparison. To appropriately evaluate the precision of the analyzers, we select all equivalent user object and variable references, and compute their properties' average points-to set sizes. Our evaluation indicates that SAFE provides higher precision and better code coverage at the cost of a somewhat lower scalability. Evaluating the simplePack bundler manifests that the static call graph of its bundle is more precise compared to the bundle produced by Browserify, one of the most popular module bundlers. Based on these results, we analyze the data flows of a hybrid app (JS & native) provided by an industrial partner via taint analysis. To that end we modeled the native (platform) functions of the app in a DSL for SAFE and extended its taint analysis to support tainted objects rather than only primitive type data. We show that there is potential for injection attacks, as tainted objects may reach the sink without being sanitized.