Vulnerability Exposure Analysis for JavaScript

Project Information

PAWJAM

Grant agreement ID: 101112763

DOI

10.3030/101112763

Project closed

EC signature date 28 February 2023

Start date 1 July 2023

End date 31 December 2024

Funded under

• European Research Council (ERC)

Total cost

No data

EU contribution

€ 150 000,00

Coordinated by

AARHUS UNIVERSITET
Denmark

Periodic Reporting for period 1 - PAWJAM (Vulnerability Exposure Analysis for JavaScript)

Reporting period: 2023-07-01 to 2024-12-31

Summary of the context and overall objectives of the project

Typical modern Node.js application consists of hundreds of JavaScript files, with more than 90% of the code coming from such third-party libraries. Reuse of high-quality libraries is thus an important factor in software development. Most libraries, especially the most popular ones, are continuously improved, and new versions are released frequently. However, dependence on other people’s libraries opens the door to security vulnerabilities and programming errors that may exist deeply inside the libraries and have severe consequences to the applications and end users, and breaking changes in new versions often cause problems for the application developers.
The objectives of this project are to further explore the scientific results achieved in the ERC CoG project “Automated Program Analysis for Advanced Web Applications” (PAW) and bring them closer to practical use.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

In the PAWJAM project, we have continued the development of the program analyses from PAW, focusing on automated techniques for discovering how vulnerabilities in third-party libraries can affect application code, and we have performed an initial market analysis to explore the innovative aspects towards commercialization.

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

The main results of the project are: (1) We have performed a large experiment to investigate the potential of the JAM analysis tool in vulnerability exposure analysis, which has led to improvements of the analysis technique and confirmed that the expressiveness is appropriate for practical use. (2) We have developed the new program analysis tool JELLY based on the experiences from the JAM research tool. The JELLY analysis tool is Open Source and now forms the backbone of a commercial product. (3) The initial market analysis has provided insights into the commercial potential of the research results and has led to the creation of a startup company.