JavaScript Security Analyzer

Asiakas

Ari Kesäniemi (NIXU). Contact <ari.kesaniemi@nixu.com> for more information.

Työn kuvaus

The purpose of the analyzer is to find vulnerabilities in dynamic web code. Typical target is to find DOM-based XSS vulnerabilities in jQuery code, but analysis must not be limited to only this combination (e.g. other libraries and HTML5 API should be considered).

The main focus of the tool is to identify a certain set of function calls in the source and perform data flow analysis for them to identify tainted data usage, e.g. considering callback functions, parameter passing and other non-trivial constructs.

The analyzer works as a static analysis tool and can be a stand-alone program. It must work cross-platform, but choice of implementation technology is not fixed. The system must employ a Mozilla JavaScript parsing library, e.g. Rhino.

Input for the analyzer is the Javascript code to be analyzed, in form of a set of files. As an optional feature there can be functionality to crawl or otherwise collect the necessary files over the network.

Toteutusympäristö

Will be decided upon project start.

Erityisvaatimukset

The team is expected to have the following skills:

• proficiency at the selected implementation language (e.g. Java or Scala)
• good understanding of JavaScript, AJAX and Web 2.0 UI frameworks
• basic understanding of compiler technology (syntax trees etc)
• basic understanding of functional programming or pattern matching

The team will get necessary induction for Web 2.0 security issues from Nixu.

Immateriaalioikeudet

Projekti toteutetaan laitoksen yleisen lisenssisopimuksen alaisuudessa.

Lisätietoja