Brigadier: A Datalog-based IAST framework for Node.js Applications

Research output: Chapter in Book/Report/Conference proceedingConference paperResearch

Abstract

The NODE.JS runtime, in combination with Node Package Manager (NPM), is a popular ecosystem for building server-side web applications. Both JavaScript's flexible and dynamic character and the vast amount of NPM libraries available can speed up the development of web applications. However, JavaScript and NODE.JS lack security mechanisms and abstractions. Despite the numerous language-based approaches proposed to protect JavaScript applications, no work supports application- level and business-level security properties. This means that in order to achieve both application-level and business-level security, developers are forced to rely on multiple different, unintegrated and incompatible tools and mechanisms. In this paper, we present BRIGADIER, an interactive security testing framework for NODE.JS applications that enables the specification of both application-level and business-level security policies. BRIGADIER provides developers with a Datalog-based policy specification language that features close interoperability with running JavaScript programs under test. Input JavaScript programs are instrumented to emit relevant application events sent to a Datalog engine resulting from the compilation of the policies. We exhibit BRIGADIER's expressiveness by implementing three case studies from the literature. We also assess BRIGADIER's performance overhead on server-side applications. In our benchmarks, we observed a slowdown factor ranging from ~1.2x to ~3x, which is acceptable for a testing scenario.
Original languageEnglish
Title of host publication2023 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)
EditorsTao Zhang, Xin Xia, Nicole Novielli
Place of PublicationTaipa, Macau
PublisherIEEE
Pages509-521
Number of pages13
ISBN (Electronic)978-1-6654-5278-6
ISBN (Print)978-1-6654-5279-3
DOIs
Publication statusPublished - 21 Mar 2023
Event30th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER 2023) - 28th Floor, Hotel Okura Macau, Macau SAR, China
Duration: 21 Mar 202324 Mar 2023
Conference number: 30
https://saner2023.must.edu.mo/index

Publication series

NameProceedings - 2023 IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER 2023

Conference

Conference30th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER 2023)
Abbreviated titleSANER'23
Country/TerritoryChina
CityMacau SAR
Period21/03/2324/03/23
Internet address

Bibliographical note

Publisher Copyright:
© 2023 IEEE.

Copyright:
Copyright 2023 Elsevier B.V., All rights reserved.

Fingerprint

Dive into the research topics of 'Brigadier: A Datalog-based IAST framework for Node.js Applications'. Together they form a unique fingerprint.

Cite this