Mining Node.js Vulnerabilities via Object Dependence Graph and Query presented at USENIX Security 2022

by Song Kang,

Tags: Web Security I: Vulnerabilities

URL : https://www.usenix.org/system/files/sec22-li-song.pdf

Summary : Node.js is a popular non-browser JavaScript platform that provides useful but sometimes also vulnerable packages. On one hand, prior works have proposed many program analysis-based approaches to detect Node.js vulnerabilities, such as command injection and prototype pollution, but they are specific to individual vulnerability and do not generalize to a wide range of vulnerabilities on Node.js. On the other hand, prior works on C/C++ and PHP have proposed graph query-based approaches, such as Code Property Graph (CPG), to efficiently mine vulnerabilities, but they are not directly applicable to JavaScript due to the language's extensive use of dynamic features.