CAREER: Cross-Boundary Program Analyses for Web Applications

职业：Web 应用程序的跨界程序分析

• 批准号: 2321444
• 负责人: Weihang Wang
• 金额: $ 50万
• 依托单位: University of Southern California
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-03-01 至 2026-08-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2321444&HistoricalAwards=false
• 关键词: CAREER; Cross; Boundary; Program; Analyses

Modern web applications are built atop the integration of programs written in diverse programming languages and distributed by multiple parties. While such a development model provides maximum modularity and flexibility, it raises unique challenges to traditional software-engineering principles. When web applications fail to behave as intended, developers often need to analyze code components written in various languages independently due to the lack of cross-language analysis support. Dynamically including source code from multiple parties makes it challenging to identify the root causes of errors because developers do not have access to third-party internals. Diverse languages and the use of third parties create technical boundaries that prevent web developers from obtaining a comprehensive understanding of the heterogeneous code on the client side. This project addresses the challenges of the technical boundaries existing in complex web applications and the creation of a scientific foundation for understanding, analyzing, and debugging web applications involving diverse languages and multiple parties. The project will support web-application reliability, increase web development productivity, and provide critical assurance for web users by shielding them from common web issues. The project plans to build a policy-specification language that enables web developers to compose specification policies to regulate many aspects of their code execution, such as enforcing control flow of critical events, securing web pages in the presence of unknown third-party services, and ensuring user experience. Based on these policies, novel program analyses and runtime techniques will be developed to expose possible violations (for problem identification) and automatic policy enforcement (for problem fixing), respectively. The policy specification and enforcement will provide assurance for web developers and enable them to control the code executed on their websites, which is lacking with current technologies. Approaches that support a cross-language analysis will be developed to handle interactions between diverse programming languages, including WebAssembly and JavaScript. Together, these activities will deepen the scientific understanding of the technical boundaries in complex web applications and create new program-analysis techniques to support more efficient web development.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

现代的Web应用程序是建立在以各种编程语言编写的程序集成的基础上，并由多方分发的。尽管这样的开发模型提供了最大的模块化和灵活性，但它为传统软件工程原则带来了独特的挑战。当Web应用程序无法按预期行事时，由于缺乏跨语言分析支持，开发人员通常需要独立地分析用各种语言编写的代码组件。动态地包括来自多个各方的源代码，因此确定错误的根本原因是一项挑战，因为开发人员无法访问第三方内部。各种语言和第三方的使用创造了技术界限，以阻止Web开发人员对客户端的异质代码获得全面的了解。该项目解决了复杂的Web应用程序中存在的技术边界的挑战，并为理解，分析和调试涉及多种语言和多个政党的Web应用程序创建了科学基础。该项目将支持Web应用可靠性，提高Web开发生产率，并通过屏蔽常见的Web问题为Web用户提供关键的保证。 该项目计划构建一种策略规格语言，使Web开发人员能够构成规范策略，以规范其代码执行的许多方面，例如执行关键事件的控制流，在存在未知的第三方服务的情况下确保网页确保网页并确保用户体验。基于这些策略，将开发新的计划分析和运行时技术，以分别暴露可能的违规行为（用于问题识别）和自动策略执行（用于解决问题）。策略规范和执行将为Web开发人员提供保证，并使他们能够控制其网站上执行的代码，而当前技术缺乏该代码。将开发支持跨语言分析的方法，以处理包括WebAssembly和JavaScript在内的各种编程语言之间的互动。这些活动共同加深了对复杂Web应用程序中技术边界的科学理解，并创建了新的程序分析技术来支持更有效的Web开发。该奖项反映了NSF的法定任务，并被认为是值得通过基金会的知识分子优点和更广泛影响的审查标准通过评估来进行评估的。