Static analysis of event-driven Node.js JavaScript applications

Many JavaScript programs are written in an event-driven style. In particular, in server-side Node.js applications, operations involving sockets, streams, and files are typically performed in an asynchronous manner, where the execution of listeners is triggered by events. Several types of programming errors are specific to such event-based programs (e.g., unhandled events, and listeners that are registered too late). We present the event-based call graph, a program representation that can be used to detect bugs related to event handling. We have designed and implemented three analyses for constructing event-based call graphs. Our results show that these analyses are capable of detecting problems reported on StackOverflow. Moreover, we show that the number of false positives reported by the analysis on a suite of small Node.js applications is manageable. Categories and Subject Descriptors F3.2 [Semantics of Programming Languages]: Program Analysis Keywords event based-systems; static...

• Type: Journal
• Year: 2015
• Where: OOPSLA
• Authors: Magnus Madsen, Frank Tip, Ondrej Lhoták
• Keywords: OOPSLA 2015, Security Privacy