graphjs - MDG-based static vulnerability scanner specialized

项目说明

Efficient Static Analysis for Ja with Multi Dependency Graphs

Mafalda Ferreira, Miguel Monteiro, Tiago Brito, Miguel E. Coimbra, Nuno Santos, Limin Jia, and José Fragoso
Santos. 2024. Efficient Static Analysis for Ja with Multi Dependency Graphs.

Artifact e

The Artifact E folder contains all the necessary instructions and scripts used to reproduce the results and the figures from the original paper.

[//]: ![DOI]()

Team

Main Contributors

<table style="width: 80%; margin-left: auto; margin-right: auto;">
<tr>
<td style="text-align: center; width: 25%"><img src=" height="100px"/></td>
<td style="text-align: center; width: 25%"><img src=" height="100px"/></td>
<td style="text-align: center; width: 25%"><img src=" height="100px"/></td>
<td style="text-align: center; width: 25%"><img src=" height="100px"/></td>
</tr>
<tr>
<td style="text-align: center"><a href=" Ferreira</a></td>
<td style="text-align: center"><a href=" Fragoso Santos</a></td>
<td style="text-align: center"><a href=" Marques</a></td>
<td style="text-align: center"><a href=" Santos</a></td>
</tr>
</table>

#### Collaborators

Tiago Brito

Miguel Coimbra

Limin Jia

Miguel Monteiro

---

Graph.js: A Static Scanner for _npm_ packages

Graph.js is a static scanner specialized in analyzing _npm_
packages and detecting taint-style and prototype pollution .

Its execution flow is composed of two phases: graph construction
and graph queries. In the first phase, Graph.js builds a
Multi Dependency Graph (MDG) of the program to be analyzed.
This graph-based data structure coalesces into the same
representation the abstract syntax tree, control flow graph, and
data dependency graph. This phase has two outputs:
1. Graph output: nodes and edges in .cs.
2. Graph metrics: graph_stats.json

In the second phase, Graph.js imports the graph to a Neo4j graph
database, and executes graph queries, written in Cypher, to capture
code patterns, e.g. data dependency paths connecting
unreliable sources to dangerous sinks.

Currently, Graph.js detects four types of : prototype

pollution (CWE-1321), OS command injection (CWE-78),
arbitrary code execution (CWE-94), and path tra (CWE-22).

---

Installation

Graph.js generates a graph using Node and uses Neo4j to query the graph. <br>
It can be executed locally, or in a Docker container (easier and more robust setup).

Using Docker

#### Requirements:

Python3

Docker

Build the Docker container by running the command:

Run locally

#### Requirements:

Node (I' v18+).

Neo4j v5. Instructions:

Set up the local en by running the command:

---

Usage

Using Docker

Graph.js provides a command-line interface. Run it with -h for a short description.

To run Graph.js, run the command:

Run locally

Graph.js provides a command-line interface. Run it with -h for a short description.

To run Graph.js, run the command:

---
By default, all the results are stored in a *graphjs-results* folder, in the root of the project, with the following structure:

---

Reusability

Graph.js code is designed to enable straightforward usage by others, and can be easily adapted to accommodate
new scenarios. As described before, Graph.js is composed of two phases: graph construction and graph queries.
The graph construction code is located in the graphjs/parser/src folder, and the most relevant files are organized as follows:

The code referring to the MDG construction algorithm is located
in src/traverse/dependency, where the file structures/dependency_trackers.ts
contains the rules and structures referred in the paper.
The MDG is intended to be generic, so all the building steps can be
adapted to new scenarios by creating new types of nodes and edges.

The code for the queries is in located in the graphjs/detection`
folder. The queries are entirely customizable, so, it is possible not
only modify the existing queries but also to create new queries that
search for new and different patterns in the graph.

Generate only the graph

Execute inside the *parser* folder

#### Program options

| Description | Flag | Default | Required | Requires |
|--------------------------------------------------------------|:-------------------:|:--------------------:|------------|------------|
| Ja file to be analyzed | -f <filename> | - | Yes | - |
| Location of the configuration file | -c <filename> | _'../config.json'_ | No | - |
| Location of the normalized file | -o <filename> | - | No | - |
| Location of the graph output directory (csv and s) | -g <directory> | _'src/graphs/'_ | No | - |
| Output the graph cs | --csv | _false_ | No | - |
| Output the graph figure | --graph | _false_ | No | - |
| Set array of structures to ignore in graph figure | --i=[AST, CFG...] | _[]_ | No | _graph_ |
| Set array of functions to ignore in graph figure | --if=[...] | _[]_ | No | _graph_ |
| Show the code in each statement in graph figure | --sc | _false_ | No | _graph_ |
| Silent mode (not ) | --silent | _false_ | No | - |

---

Publications and Open-Source Repositories

The de of Graph.js relates to additional research performed by this group.

#### 1. Study of Ja Static Analysis Tools for Detection in Node.js Packages
This work comprises an empirical study of static code analysis tools for detecting in Node.js code.
We created a curated dataset of 957 Node.js code , characterized and annotated by analyzing the information contained in _npm_ ad reports.

The dataset is a here.

The publication associated with this work is:

<a href=" Dataset [1]</a>: Tiago Brito, Mafalda Ferreira, Miguel Monteiro, Pedro Lopes, Miguel Barros, José Fragoso Santos, Nuno Santos:

*"Study of Ja Static Analysis Tools for Detection in Node.js Packages"*,
in *IEEE Transactions on Reliability 2023 (ToR 2023)*.

#### 2. RuleKeeper: GDPR-Aware Personal Data Compliance for Web Frameworks
In this work we de a prototype of RuleKeeper, a GDPR-aware policy compliance system for web frameworks.
RuleKeeper uses Graph.js to automatically check for the presence of GDPR compliance bugs in Node.js servers.

The prototype is a here.

The publication associated with this work is:

<a href="RuleKeeper</a>:

Mafalda Ferreira, Tiago Brito, José Fragoso Santos, Nuno Santos:
*"RuleKeeper: GDPR-Aware Personal Data Compliance for Web Frameworks"*,
in *Proceedings of 44th IEEE Symposium on Security and Privacy (S&P’23)*, 2023.

项目信息

开发语言：TypeScript

Star 数：27

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕MDG-based static vulnerability scanner specialized in analyzing npm packages and detecting taint-style and prototype pollution vulnerabilities. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。