Efficient module-level dynamic analysis for dynamic languages with module recontextualization
Nikos Vasilakis, Grigoris Ntousakis, Veit Heller, Martin C. Rinard
Abstract
Dynamic program analysis is a long-standing technique for obtaining information about program execution. We present module recontextualization, a new dynamic analysis approach that targets modern dynamic languages such as JavaScript and Racket, enabled by the fact that they feature a module-import mechanism that loads code at runtime as a string. This approach uses lightweight load-time code transformations that operate on the string representation of the module, as well as the context to which it is about to be bound, to insert developer-provided, analysis-specific code into the module before it is loaded. This code implements the dynamic analysis, enabling this approach to capture all interactions around the module in unmodified production language runtime environments. We implement this approach in two systems targeting the JavaScript and Racket ecosystems. Our evaluation shows that this approach can deliver order-of-magnitude performance improvements over state-of-the-art dynamic analysis systems while supporting a range of analyses, implemented on average in about 100 lines of code.
Ask about this paper
Your agent reads all of it.
Lune indexed this paper to the last equation, along with the top-tier papers that cite it. Ask a question and the answer quotes them.
Your agent calls
Luneget_paper_fulltext
Free to start. No credit card required.
Terminal
Install the CLIlune papers fulltext 1511a1cf-029f-4fd2-97d9-404ecb6d45c6Cited by top-tier papers2
- Preventing Dynamic Library Compromise on Node.js via RWX-Based Privilege ReductionNikos Vasilakis, Cristian-Alexandru Staicu, Grigoris Ntousakis, Konstantinos Kallas et al.CCS 2021 · 27 citations
- Towards Effective Static Type-Error Detection for PythonWonseok Oh, Hakjoo OhASE 2024 · 1 citation
Builds on5
- Small World with High Risks: A Study of Security Threats in the npm EcosystemMarkus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, Michael PradelUSENIX Security 2019 · 281 citations
- Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the WebTobias Lauinger, Abdelberi Chaabane, Sajjad Arshad, William Robertson et al.NDSS 2017 · 183 citations
- BreakApp: Automated, Flexible Application CompartmentalizationNikos Vasilakis, Ben Karel, Nick Roessler, Nathan Dautenhahn et al.NDSS 2018 · 66 citations
- A Sense of Time for JavaScript and Node.js: First-Class Timeouts as a Cure for Event Handler PoisoningJames C. Davis, Eric R. Williamson, Dongyoon LeeUSENIX Security 2018 · 54 citations
- Preventing Dynamic Library Compromise on Node.js via RWX-Based Privilege ReductionNikos Vasilakis, Cristian-Alexandru Staicu, Grigoris Ntousakis, Konstantinos Kallas et al.CCS 2021 · 27 citations
Related papers
- IRIDIUM: A Framework for Statically Optimizing JavaScript ProgramsMeetesh Kalpesh Mehta, Anirudh Garg, Aneeket Yadav, Manas ThakurOOPSLA 2026
- Best of Both Worlds: Effective Foreign Bridge Identification in V8 Embedders for Security AnalysisGeorgios Alexopoulos, Thodoris Sotiropoulos, Zhendong Su, Dimitris MitropoulosS&P 2026 · 1 citation
- Increasing the Responsiveness of Web Applications by Introducing Lazy LoadingAlexi Turcotte, Satyajit Gokhale, Frank TipASE 2023 · 3 citations
- Reducing Static Analysis Unsoundness with Approximate InterpretationMathias Rud Laursen, Wenyuan Xu, Anders MøllerPLDI 2024 · 5 citations
- Representing and Reasoning about Dynamic CodeJesse Bartels, Jon Stephens, Saumya DebrayASE 2020
