Brigadier: A Datalog-based IAST framework for Node.js Applications

Research output: Chapter in Book/Report/Conference proceedingConference paper

Abstract

The NODE.JS runtime, in combination with Node Package Manager (NPM), is a popular ecosystem for building server-side web applications. Both JavaScript's flexible and dynamic character and the vast amount of NPM libraries available can speed up the development of web applications. However, JavaScript and NODE.JS lack security mechanisms and abstractions. Despite the numerous language-based approaches proposed to protect JavaScript applications, no work supports application- level and business-level security properties. This means that in order to achieve both application-level and business-level security, developers are forced to rely on multiple different, unintegrated and incompatible tools and mechanisms. In this paper, we present BRIGADIER, an interactive security testing framework for NODE.JS applications that enables the specification of both application-level and business-level security policies. BRIGADIER provides developers with a Datalog-based policy specification language that features close interoperability with running JavaScript programs under test. Input JavaScript programs are instrumented to emit relevant application events sent to a Datalog engine resulting from the compilation of the policies. We exhibit BRIGADIER's expressiveness by implementing three case studies from the literature. We also assess BRIGADIER's performance overhead on server-side applications. In our benchmarks, we observed a slowdown factor ranging from ~1.2x to ~3x, which is acceptable for a testing scenario.
Original languageEnglish
Title of host publication2023 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)
Place of PublicationTaipa, Macau
PublisherIEEE
Pages509-521
Number of pages12
ISBN (Electronic)978-1-6654-5278-6
ISBN (Print)978-1-6654-5279-3
Publication statusPublished - 21 Mar 2023
Event30th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER 2023) - 28th Floor, Hotel Okura Macau, Macau SAR, China
Duration: 21 Mar 202324 Mar 2023
Conference number: 30
https://saner2023.must.edu.mo/index

Conference

Conference30th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER 2023)
Abbreviated titleSANER'23
CountryChina
CityMacau SAR
Period21/03/2324/03/23
Internet address

Cite this