More Like this

1. CALLME: Call Graph Augmentation with Large Language Models for Javascript

   Wang, Michael; Pei, Kexin; Solar-Lezama, Armando (July 2025, COLM 2025)

   Building precise call graphs for Javascript programs is a fundamental build- ing block for many important software engineering and security applications such as bug detection, program repair, and refactoring. However, resolving dynamic calls using static analysis is challenging because it requires enumerating all possible values of both the object and the field. As a result, static call graph construction algorithms for Javascript ignore such dynamic calls, resulting in missed edges and a high false negative rate. We present a new approach, CALLME, that combines Language Models (LMs) with a custom static analyzer to address this challenge. Our key insight is in using LMs to incorporate additional modalities such as variable names, natural language documentation, and calling contexts, which are often sufficient to resolve dynamic property calls, but are difficult to incorporate in traditional static analysis. We implement our approach in CALLME and evaluate it on a dataset of call edges that are dependent on dynamic property accesses. CALLME achieves 80% accuracy and .79 F1, outperforming the state-of-the- art static analyzer by 30% and .60, respectively. To study the effectiveness of CALLME on downstream analysis tasks, we evaluate it on our manually curated dataset with 25 known Javascript vulnerabilities. CALLME can detect 24 vulnerabilities with only 3 false positives, whereas static analysis tools based on current call graph construction algorithms miss all of them. 

   more » « less
2. Do I really need all this work to find vulnerabilities, https://doi.org/10.1007/s10664-022-10179-6

   https://doi.org/https://doi.org/10.1007/s10664-022-10179-6  

   Elder, Sarah; Zahan, Nusrat; Shu, Rui; Metro, Monica; Kozarev, Valeri; Menzies, Tim; Williams, Laurie (August 2022, Empirical software engineering)

   Context: Applying vulnerability detection techniques is one of many tasks using the limited resources of a software project. Objective: The goal of this research is to assist managers and other decision- makers in making informed choices about the use of software vulnerability detection techniques through an empirical study of the efficiency and effectiveness of four techniques on a Java-based web application. Method: We apply four different categories of vulnerability detection techniques – systematic manual penetration testing (SMPT), exploratory manual penetration testing (EMPT), dynamic application security testing (DAST), and static application security testing (SAST) – to an open-source medical records system. Results: We found the most vulnerabilities using SAST. However, EMPT found more severe vulnerabilities. With each technique, we found unique vulnerabilities not found using the other techniques. The efficiency of manual techniques (EMPT, SMPT) was comparable to or better than the efficiency of automated techniques (DAST, SAST) in terms of Vulnerabilities per Hour (VpH). Conclusions: The vulnerability detection technique practitioners should select may vary based on the goals and available resources of the project. If the goal of an organization is to find “all” vulnerabilities in a project, they need to use as many techniques as their resources allow. 

   more » « less
3. An Exploratory Analysis of Mobile Security Tools

   Shahriar, Hossain; Talukder, Md Arabin; Islam, Md Saiful (October 2019, Conference on Cybersecurity Education, Research and Practice)

   The growing market of the mobile application is overtaking the web application. Mobile application development environment is open source, which attracts new inexperienced developers to gain hands on experience with application development. However, the security of data and vulnerable coding practice is an issue. Among all mobile Operating systems such as, iOS (by Apple), Android (by Google) and Blackberry (RIM), Android dominates the market. The majority of malicious mobile attacks take advantage of vulnerabilities in mobile applications, such as sensitive data leakage via the inadvertent or side channel, unsecured sensitive data storage, data transition and many others. Most of these vulnerabilities can be detected during mobile application analysis phase. In this paper, we explore vulnerability detection for static and dynamic analysis tools. We also suggest limitations of the tools and future directions such as the development of new plugins. 

   more » « less
4. Cosseter: GitHub Actions Permission Reduction Using Demand-Driven Static Analysis

   Tystahl, Greg; Ghebremichael, Jonah; Muralee, Siddharth; Cherupattamoolayil, Sourag; Bianchi, Antonio; Machiry, Aravind; Kapravelos, Alexandros; Enck, William (May 2026, IEEE Computer Society)

   Security vulnerabilities in GitHub Actions are increasingly leading to software supply chain attacks. In some instances, attackers have modified a project’s source code by crafting a malicious issue title. To mitigate such threats, GitHub introduced a permission system that allows project maintainers to customize the privilege granted to workflows and their jobs. Unfortunately, permission policy specification is a known hard problem across nearly all domains of computing, particularly when it is introduced after an ecosystem has been established. This paper proposes COSSETER, a static analysis tool designed to determine least-privilege permission policies for jobs within GitHub Actions workflow specifications. To achieve this goal, COSSETER overcomes state explosion challenges in static analysis of JavaScript Actions that result from packing and nuances in commonly used npm dependencies. We evaluated COSSETER using a dataset of manual permission annotations of JavaScript Actions used by industry tools and found that it has a comparable precision and recall. We further evaluate COSSETER at scale, studying the permission needs of 1,842 vulnerable workflows identified by prior work and extracting permission summaries for 8,353 JavaScript Actions. We find that COSSETER’s permission policy can reduce 76% of 1,274 high severity code injection vulnerabilities into medium, low, or no severity. In doing so, we demonstrate how COSSETER suggested permissions can provide a valuable defense against software supply chain attacks. 

   more » « less
5. What we eval in the shadows: a large-scale study of eval in R programs

   https://doi.org/10.1145/3485502  

   Goel, Aviral; Donat-Bouillud, Pierre; Křikava, Filip; Kirsch, Christoph M.; Vitek, Jan (October 2021, Proceedings of the ACM on Programming Languages)

   Most dynamic languages allow users to turn text into code using various functions, often named eval, with language-dependent semantics. The widespread use of these reflective functions hinders static analysis and prevents compilers from performing optimizations. This paper aims to provide a better sense of why programmers use eval. Understanding why eval is used in practice is key to finding ways to mitigate its negative impact. We have reasons to believe that reflective feature usage is language and application domain-specific; we focus on data science code written in R and compare our results to previous work that analyzed web programming in JavaScript. We analyze 49,296,059 calls to eval from 240,327 scripts extracted from 15,401 R packages. We find that eval is indeed in widespread use; R’s eval is more pervasive and arguably dangerous than what was previously reported for JavaScript. 

   more » « less