Abstract. We reduce JavaScript to a core calculus structured as a small-step operational semantics. We present several peculiarities of the language and show that our calculus models them. We explicate the desugaring process that turns JavaScript programs into ones in the core. We demonstrate faithfulness to JavaScript using real-world test suites. Finally, we illustrate utility by defining a security property, implementing it as a type system on the core, and extending it to the full language. The growing use of JavaScript has created whole new technical and business models of program construction and deployment. JavaScript is a feature-rich language with many quirks, and these quirks are often exploited by security and privacy attacks. This is especially true in cases where JavaScript has a familiar syntax but an unconventional semantics. Due to its popularity and shortcomings, companies and researchers have tried to tame JavaScript via program analyses [4, 9, 10, 13], sub-language [5, 7, 17] , and more. These works claim but do not demonstrate soundness, partly because we lack a tractable account of the language. The JavaScript standard [6] is capacious and informal, while one major formal semantics [15] is large, not amenable to conventional proof techniques, and inherits the standard's complexities, as we discuss in section 5. In contrast: -We present a core language, λ JS , that embodies JavaScript's essential features (sans eval). λ JS fits on three pages and lends itself well to proof techniques such as subject reduction. -We show that we can desugar JavaScript into λ JS . In particular, desugaring handles notorious JavaScript features such as this and with, so λ JS itself remains simple (and thus simplifies proofs that utilize it). -We mechanize both λ JS and desugaring. -To show compliance with reality, we successfully test λ JS and desugaring against the actual Mozilla JavaScript test suite. -Finally, we demonstrate the use of our semantics by building a safe subset of JavaScript. This application highlights how our partitioning of JavaScript into core and syntactic sugar lends structure to proofs. Our supplemental materials (full desugaring, tools, etc.) are available at
The CoLiS project takes a core calculus approach to the shell, not unlike λ JS REF .
The Essence of JavaScript
ArXiv
ArXiv
Computer Science