The eval that men do: A large-scale study of the use of eval in javascript applications

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 6813 LNCS, Issue , 2011, Pages 52-78

  Richards, Gregor ^a   Hammer, Christian ^a   Burg, Brian ^b   Vitek, Jan ^a  

^a PURDUE UNIVERSITY   (United States)

^b UNIVERSITY OF WASHINGTON   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DYNAMIC BEHAVIORS; EXECUTABLE CODES; EXPRESSIVE POWER; JAVASCRIPT; WEB APPLICATION;

OBJECT ORIENTED PROGRAMMING; USER INTERFACES;

HIGH LEVEL LANGUAGES;

EID: 79961132987     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-22655-7_4     Document Type: Conference Paper

References (21)

1. Anderson, C., Drossopoulou, S.: BabyJ: From Object Based to Class Based Programming via Types. Electr. Notes in Theor. Comput. Sci. 82(7), 53-81 (2003)
2. Anderson, C., Giannini, P.: Type Checking for JavaScript. Electr. Notes Theor. Comput. Sci. 138(2), 37-58 (2005) (Pubitemid 41625696)
3. Christensen, A.S., Møller, A., Schwartzbach, M.I.: Precise Analysis of String Expressions. In: Cousot, R. (ed.) SAS 2003. LNCS, vol. 2694, pp. 1-18. Springer, Heidelberg (2003)
4. Chugh, R., Meister, JA., Jhala, R., Lerner, S.: Staged Information Flow for JavaScript. In: Conference on Programming Language Design and Implementation (PLDI), pp. 50-62 (2009)
5. Egele, M., Wurzinger, P., Kruegel, C., Kirda, E.: Defending Browsers against Drive-by Downloads: Mitigating Heap-Spraying Code Injection Attacks. In: Flegel, U., Bruschi, D. (eds.) DIMVA 2009. LNCS, vol. 5587, pp. 88-106. Springer, Heidelberg (2009)
6. European Association for Standardizing Information and Communication Systems (ECMA): ECMA-262: ECMAScript Language Specification. 5th edn. (December 2009)
7. Feinstein, B., Peck, D.: Caffeine Monkey: Automated Collection, Detection and Analysis of Malicious JavaScript. In: Black Hat USA 2007 (2007)
8. Guarnieri, S., Livshits, B.: Gatekeeper: Mostly Static Enforcement of Security and Reliability Policies for JavaScriptCode. In: USENIX Security Symposium, pp. 151-197 (2009)
9. Guha, A., Krishnamurthi, S., Jim, T.: Using Static Analysis for Ajax Intrusion Detection. In: Conference on World Wide Web (WWW), pp. 561-570 (2009)
10. Holkner, A., Harland, J.: Evaluating the Dynamic Behaviour of Python Applications. In: Proceedings of the Thirty-Second Australasian Conference on Computer Science, ACSC 2009, vol. 91, pp. 19-28. Australian Computer Society, Inc., Darlinghurst (2009)
11. Jang, D., Choe, K.M.: Points-to Analysis for JavaScript. In: Proceedings of the 2009 ACM Symposium on Applied Computing, SAC 2009, pp. 1930-1937. ACM, New York (2009)
12. Jang, D., Jhala, R., Lerner, S., Shacham, H.: An Empirical Study of Privacy-Violating In-formation Flows in JavaScript Web Applications. In: CCS 2010: Proceedings of the 17th ACM Conference on Computer and Communications Security, pp. 270-283. ACM, New York (2010)
13. Jensen, S.H., Møller, A., Thiemann, P.: Type Analysis for JavaScript. In: Palsberg, J., Su, Z. (eds.) SAS 2009. LNCS, vol. 5673, pp. 238-255. Springer, Heidelberg (2009)
14. Livshits, B., Whaley, J., Lam, M.S.: Reflection Analysis for Java. In: Yi, K. (ed.) APLAS 2005. LNCS, vol. 3780, pp. 139-160. Springer, Heidelberg (2005)
15. Maffeis, S., Mitchell, J.C., Taly, A.: Isolating JavaScript with Filters, Rewriting, and Wrap-pers. In: Backes, M., Ning, P. (eds.) ESORICS 2009. LNCS, vol. 5789, pp. 505-522. Springer, Heidelberg (2009)
16. McCarthy, J.: History of LISP. In: History of programming languages (HOPL) (1978)
17. Ratanaworabhan, P., Livshits, B., Zorn, B.: JSMeter: Comparing the Behavior of JavaScript Benchmarks with Real Web Applications. In: USENIX Conference on Web Application De-velopment (WebApps) (June 2010)
18. Richards, G., Lebresne, S., Burg, B., Vitek, J.: An Analysis of the Dynamic Behavior of JavaScript Programs. In: Programming Language Design and Implementation Conference, PLDI (2010)
19. Rieck, K., Krueger, T., Dewald, A.: Cujo: Efficient Detection and Prevention of Drive-by-Download Attacks. In: Annual Computer Security Applications Conference, ACSAC (2010)
20. Thiemann, P.: Towards aType System for Analyzing JavaScript Programs. In: Sagiv, M. (ed.) ESOP 2005. LNCS, vol. 3444, pp. 408-422. Springer, Heidelberg (2005) (Pubitemid 41274072)
21. Yue, C., Wang, H.: Characterizing Insecure JavaScript Practices on the Web. In: World Wide Web Conference, WWW (2009)