Gradual Typing Embedded Securely In Javascript
POPL '14: The 41st Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages San Diego California USA January, 2014(2014)
摘要
JavaScript's flexible semantics makes writing correct code hard and writing secure code extremely difficult. To address the former problem, various forms of gradual typing have been proposed, such as Closure and TypeScript. However, supporting all common programming idioms is not easy; for example, TypeScript deliberately gives up type soundness for programming convenience. In this paper, we propose a gradual type system and implementation techniques that provide important safety and security guarantees.We present TS star, a gradual type system and source-to-source compiler for JavaScript. In contrast to prior gradual type systems, TS star features full runtime reflection over three kinds of types: (1) simple types for higher-order functions, recursive datatypes and dictionary-based extensible records; (2) the type any, for dynamically type-safe TS star expressions; and (3) the type un, for untrusted, potentially malicious JavaScript contexts in which TS star is embedded. After type-checking, the compiler instruments the program with various checks to ensure the type safety of TS star despite its interactions with arbitrary JavaScript contexts, which are free to use eval, stack walks, prototype customizations, and other offensive features. The proof of our main theorem employs a form of type-preserving compilation, wherein we prove all the runtime invariants of the translation of TS star to JavaScript by showing that translated programs are well-typed in JS(star), a previously proposed dependently typed language for proving functional correctness of JavaScript programs.We describe a prototype compiler, a secure runtime, and sample applications for TS star. Our examples illustrate how web security patterns that developers currently program in JavaScript (with much difficulty and still with dubious results) can instead be programmed naturally in TS star, retaining a flavor of idiomatic JavaScript, while providing strong safety guarantees by virtue of typing.
更多查看译文
关键词
type systems,language-based security,compilers
AI 理解论文
溯源树
样例
生成溯源树,研究论文发展脉络