ECOOP 2015
Sun 5 - Fri 10 July 2015 Prague, Czech Republic
Fri 10 Jul 2015 17:00 - 17:30 at Bohemia - Analysis II Chair(s): Francesco Logozzo

Dynamic languages, such as PHP and JavaScript, are wide-spread and heavily used. They provide dynamic features such as dynamic type system, virtual and dynamic method calls, dynamic includes, and built-in dynamic data structures. This makes it hard to create static analyses, e.g., for automatic error discovery. Yet exploiting errors in such programs, especially in web applications, can have significant impacts. In this paper, we present static analysis framework for PHP, automatically resolving features common to dynamic languages and thus reducing the complexity of defining new static analyses. In particular, the framework enables defining value and heap analyses for dynamic languages independently and composing them automatically and soundly. We used the framework to implement static taint analysis for finding security vulnerabilities. The analysis has revealed previously unknown security problems in real application. Comparing to existing state-of-the-art analysis tools for PHP, it has found more real problems with a lower false-positive rate.

Fri 10 Jul

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

17:00 - 18:30
Analysis IIResearch Track at Bohemia
Chair(s): Francesco Logozzo Facebook
17:00
30m
Talk
Framework for Static Analysis of PHP Applications
Research Track
David Hauzar Charles University in Prague, Jan Kofroň Charles University in Prague
17:30
30m
Talk
Adaptive Context-sensitive Analysis for JavaScript
Research Track
Shiyi Wei Virginia Tech, Barbara Ryder Virginia Tech
18:00
30m
Talk
Scalable and Precise Static Analysis of JavaScript Applications via Loop-Sensitivity
Research Track
Changhee Park KAIST, Sukyoung Ryu Korea Advanced Institute of Science and Technology