CAREER: Cross-Boundary Program Analyses for Web Applications

职业：Web 应用程序的跨界程序分析

• 批准号: 2321444
• 负责人: Weihang Wang
• 金额: $ 50万
• 依托单位: University of Southern California
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-03-01 至 2026-08-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2321444&HistoricalAwards=false
• 关键词: CAREER; Cross; Boundary; Program; Analyses

Modern web applications are built atop the integration of programs written in diverse programming languages and distributed by multiple parties. While such a development model provides maximum modularity and flexibility, it raises unique challenges to traditional software-engineering principles. When web applications fail to behave as intended, developers often need to analyze code components written in various languages independently due to the lack of cross-language analysis support. Dynamically including source code from multiple parties makes it challenging to identify the root causes of errors because developers do not have access to third-party internals. Diverse languages and the use of third parties create technical boundaries that prevent web developers from obtaining a comprehensive understanding of the heterogeneous code on the client side. This project addresses the challenges of the technical boundaries existing in complex web applications and the creation of a scientific foundation for understanding, analyzing, and debugging web applications involving diverse languages and multiple parties. The project will support web-application reliability, increase web development productivity, and provide critical assurance for web users by shielding them from common web issues. The project plans to build a policy-specification language that enables web developers to compose specification policies to regulate many aspects of their code execution, such as enforcing control flow of critical events, securing web pages in the presence of unknown third-party services, and ensuring user experience. Based on these policies, novel program analyses and runtime techniques will be developed to expose possible violations (for problem identification) and automatic policy enforcement (for problem fixing), respectively. The policy specification and enforcement will provide assurance for web developers and enable them to control the code executed on their websites, which is lacking with current technologies. Approaches that support a cross-language analysis will be developed to handle interactions between diverse programming languages, including WebAssembly and JavaScript. Together, these activities will deepen the scientific understanding of the technical boundaries in complex web applications and create new program-analysis techniques to support more efficient web development.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

现代 Web 应用程序构建在以不同编程语言编写并由多方分发的程序集成之上。虽然这种开发模型提供了最大程度的模块化和灵活性，但它对传统软件工程原理提出了独特的挑战。当Web应用程序无法按预期运行时，由于缺乏跨语言分析支持，开发人员通常需要独立分析用各种语言编写的代码组件。动态包含来自多方的源代码使得识别错误的根本原因变得具有挑战性，因为开发人员无法访问第三方内部结构。不同的语言和第三方的使用造成了技术边界，阻碍了 Web 开发人员全面了解客户端的异构代码。该项目解决了复杂 Web 应用程序中存在的技术边界的挑战，并为理解、分析和调试涉及不同语言和多方的 Web 应用程序创建了科学基础。该项目将支持 Web 应用程序的可靠性，提高 Web 开发效率，并通过保护 Web 用户免受常见 Web 问题的影响，为 Web 用户提供关键保证。 该项目计划构建一种策略规范语言，使 Web 开发人员能够编写规范策略来规范其代码执行的许多方面，例如强制执行关键事件的控制流、在存在未知第三方服务的情况下保护网页以及保证用户体验。基于这些策略，将开发新颖的程序分析和运行时技术，以分别暴露可能的违规行为（用于问题识别）和自动策略执行（用于问题修复）。政策规范和执行将为网络开发人员提供保证，并使他们能够控制在其网站上执行的代码，而这是当前技术所缺乏的。将开发支持跨语言分析的方法来处理不同编程语言（包括 WebAssembly 和 JavaScript）之间的交互。这些活动将共同加深对复杂 Web 应用程序技术边界的科学理解，并创建新的程序分析技术来支持更高效的 Web 开发。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力评估进行评估，被认为值得支持。优点和更广泛的影响审查标准。