Taming the dynamic behavior of JavaScript

JavaScript is widely used in Web applications because of its flexibility and dynamic characteristics. However, the latter (e.g., runtime code generation and dynamic object behavior) pose challenges for program understanding, security, etc. We have designed the JavaScript Blended Analysis Framework, a program analysis framework that combines dynamic and static analyses. JSBAF expands the capability of static analysis for the dynamically generated code and variadic functions. We also present a novel context-sensitive points-to analysis that more precisely models JavaScript objects. Empirical results on popular JavaScript websites show that our analyses are substantially more accurate than existing approaches.