Webby

The web browser is now the platform on which rich, dynamic, flexible applications are delivered to hundreds of millions of users. The software development and deployment model has fundamental differences from conventional desktop development. We have ongoing projects in the JavaScript and web-browser space aimed at making client-side web applications more secure, composable, robust. The two projects described below are both fruitful collaborations with Microsoft Research.

Userscripts and browser extensions are both immensely popular mechanisms by which third parties alter the behavior of web pages or the browser itself in ways never anticipated by the original content developers. The mechanisms by which these extension hook into the underlying code base are brittle, awkward, and difficult to reason about. We have developed more robust mechanisms inspired by aspect-oriented programming that require small but efficient additions to the JavaScript implementation. We are also investigating techniques for ensuring that multiple third-party extensions can be added in ways that either compose or detect extensions conflicts in a sensible manner.

As an extremely dynamic language, JavaScript is a difficult language on which to perform sound static analysis. Yet security analyses require sound information about pointers and control flow in JavaScript, particularly for sandboxing widgets hosted inside a larger web page. We have looked at pointer analysis, and in particular incremental pointer analysis (important since new JavaScript is often downloaded into a running page), with security-relevant uses.

Current contacts: Ben Lerner, Salvatore Guarnieri, Dan Grossman, Ben Livshits (Microsoft Research)