SPLASH: G: A Study of Call Graph Effectiveness for Framework-Based Web Applications

Advances in technology and the internet have made web applications an integral part of businesses, enabling them to thrive in increasingly competitive environments. However, this emergence of web applications has also led to the development of sophisticated cyber-threats. As a result, insecure web applications are now highly vulnerable to cyber-threats, like malware and cyber-attacks. An attack may break the functionality of the application, prevent website visitors from accessing it, and even compromise customers’ personal information. Based on a data generated from more than 15 million application security scans performed by different companies throughout 2021, researchers at NTT Application Security [6] found that half of all sites had at least one serious exploitable vulnerability throughout the year. Moreover, these web applications often use JavaScript (JS) to improve the interactivity and functionality of the websites. While, JS has powerful capabilities to interact with webpage documents and browser windows, it is also susceptible to many security attacks. Insecure engineering practices of using JS has the potential to introduce security vulnerabilities and greatly increase the risks of browser-based attacks [35]. Furthermore, today’s web applications routinely rely on sophisticated JS-based frameworks like React [5] and AngularJS [2] to take advantage of commonly-needed features like state management, synchronization, and navigation. Thus, a critical weakness of modern websites is that they are always at a risk of inheriting vulnerabilities from the third-party JS frameworks and libraries. For these kinds of applications, an effective defensive solution requires in-depth analysis of the codebase, such as static analysis. Static analysis-based tools are particularly useful for finding bugs and improving security because they reveal patterns that are otherwise not obvious from manually-drafted test cases. However, in order to be effective, many of these tools need a call graph that captures the calling relationships between the various functions in a program. Unfortunately, static call graph construction is plagued by undecidability, and JS makes the problem even worse due to its extensive use of dynamic language features that are hard to analyze. Several sophisticated JS static analyses [14, 15, 17, 30] have been developed over the years to handle the complex JS constructs, but they do not yet scale well to modern web frameworks. There are also a growing number of unsound but pragmatic call graph analyses designed specifically to provide useful results for real-world code bases [3, 11, 20, 23]. Though these techniques have proven effective in some domains, they can be highly unsound when analyzing framework-based applications [13], therebymissingmany edges, i.e., have low recall. These missing edges are of key concern for bug-finding and security analyses, as they can lead to false negatives like missed vulnerabilities. However, there has been no empirical study on this topic to date. This work quantitatively assesses the effectiveness of stateof-the-art call graph algorithms onmodern framework-based JS applications. Specifically, we aim to understand which JS features or constructs are most detrimental to the proposed call-graph approaches. Such data could be very useful in prioritizing research on how to effectively improve future analyzers for these applications.