DXR JS Analysis
Requirements for DxR
- Must work with lastest version of ecmascript (6 as of this writing)
- Produce all symbols and locations
- Produce a call graph
Bonus Features
- Type Inference
Existing work:
See: <https://wiki.mozilla.org/Security/B2G/JavaScript_code_analysis>
Algorithms and Techniques
k-CFA
Anderson's Points-To Analysis
Use Analysis
CFA2
Inlining Eval
Removing the with Statement
Ways to get the AST
| Framework | ES6+ | Interface | Function References (Call Graph or Something) | Type Inference | Other Notes |
|---|---|---|---|---|---|
| JSWebTools | No | ||||
| Esprima | Partial | JS | |||
| Ternjs | No | JS or http+json | |||
| Doctorjs | No | JS | |||
| Safe | No | Java | |||
| JSAI | Coffee Script (from paper) | couldn't find code |
| Name | Interface | Compatible with Mozilla Parser API | Other Pros | Other Cons |
|---|---|---|---|---|
| Spidermonkey Reflect.parse | JS | Yes (by construction) | Full ES6 support | |
| Acorn.js | JS | yes | ||
| Sweet.js | JS | yes | support for macros | might be hard for the analysis |
| Esprima | JS | yes | Partial ES6 support |