Skip to content
Scalable Analysis Framework for ECMAScript
Branch: master
Clone or download
MaxSchlueter and jhnaldo 1. Add escape and unescape methods
2. Mark more functions as not yet implemented
Latest commit e6c6ec9 Aug 7, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
bin 1. Updated Scala 2.12.3. -> 2.12.6. 2. Re-organized tests. 3. Support… Mar 25, 2019
doc 1. Updated Scala 2.12.3. -> 2.12.6. 2. Re-organized tests. 3. Support… Mar 25, 2019
lib 1. Updated Scala 2.12.3. -> 2.12.6. 2. Re-organized tests. 3. Support… Mar 25, 2019
project 1. Refactored abstract domains based on Scala dependent object type (… Feb 6, 2018
src 1. Add escape and unescape methods May 8, 2019
tests Add base testcase and uncomment test262 tests that pass now for Array… May 8, 2019
.gitignore 1. Refactored abstract domains based on Scala dependent object type (… Feb 6, 2018
.jvmopts 1. Updated Scala 2.12.3. -> 2.12.6. 2. Re-organized tests. 3. Support… Mar 25, 2019
LICENSE
README.rst 1. Added a two-step heap abstraction (global/local) for optimization.… Sep 3, 2017
build.sbt 1. Updated Scala 2.12.3. -> 2.12.6. 2. Re-organized tests. 3. Support… Mar 25, 2019
config.json
timestamp Added a timestamp file for checking copyright notices Oct 10, 2016

README.rst

Scalable Analysis Framework for ECMAScript (SAFE) Version 2.0

Introduction

Copyright (c) 2016, KAIST

SAFE 2.0 is a scalable and pluggable analysis framework for JavaScript web applications developed by the Programming Language Research Group at KAIST:

http://plrg.kaist.ac.kr

Older versions are still available at the SAFE1.0 branch.

For more information, please check out our user manual.

Requirements

We assume you are using an operating system with a Unix-style shell (for example, Mac OS X, Linux, or Cygwin on Windows). Assuming SAFE_HOME points to the SAFE directory, you will need to have access to the following:

In your shell startup script, add $SAFE_HOME/bin to your path. The shell scripts in this directory are Bash scripts. To run them, you must have Bash accessible in /bin/bash.

Installation

Type sbt compile and then sbt test in the SAFE directory to make sure that your installation successfully finishes the tests.

Once you have built the framework, you can call it from any directory, on any JavaScript file, simply by typing one of available commands at a command line. You can see the available commands by typing:

safe

or with more explanation:

safe help

Some of the available commands are as follows:

  • parse: parses a JavaScript file.
  • astRewrite: rewrites a JavaScript AST via Hoister, Disambiguator, and WithRewriter.
  • compile: translates a JavaScript file to a SAFE intermediate representation.
  • cfgBuild: builds a control flow graph for a JavaScript file.
  • analyze: analyzes static properties of JavaScript expressions in a given file.

Changes from SAFE 1.0

  • SAFE 2.0 has been tested using Test262, the official ECMAScript (ECMA-262) conformance suite.
  • SAFE 2.0 now uses sbt instead of ant to build SAFE.
  • SAFE 2.0 now provides an HTML-based debugger for its analyzer.
  • Most Java source files are replaced by Scala code and the only Java source code remained is the generated parser code.
  • Several components from SAFE 1.0 may not be integrated into SAFE 2.0. Such components include interpreter, concolic testing, clone detector, clone refactoring, TypeScript support, Web API misuse detector, and several abstract domains like the string automata domain.

SAFE 2.0 Roadmap

  • SAFE 2.0 will make monthly updates.
  • The next update will include a SAFE document, browser benchmarks, and more Test262 tests.
  • We plan to support some missing features from SAFE 1.0 incrementally such as a bug detector, DOM modeling, and jQuery analysis.
  • SAFE 2.0 is aimed to be a playground for advanced research in JavaScript web applications. Thus, we intentionally designed it to be light-weight.
  • Future versions of SAFE 2.0 will address various analysis techniques, dynamic features of web applications, event handling, modeling framework, compositional analysis, and selective sensitivity among others.

Publications

Details of the SAFE framework are available in our papers:

Users

SAFE has been used by:

Authors

The current developers of SAFE 2.0 are as follows:

and the following people have contributed to the source code:

You can’t perform that action at this time.