Scalable Analysis Framework for ECMAScript
Switch branches/tags
Clone or download
jhnaldo 1. Refactored abstract domains based on Scala dependent object type (…
…DOT). 2. Updated Scala version from 2.12.0-M5 to 2.12.3. 3. Supported website-based debugger instead of html-based debugger. 4. Supported loop sensitivity analysis (LSA) using loop iterations and inner-loop depths. 5. Updated the manual documentation for users. 6. Implemented more modeling for HTML DOM elements
Latest commit ce8ea82 Feb 6, 2018


Scalable Analysis Framework for ECMAScript (SAFE) Version 2.0


Copyright (c) 2016, KAIST

SAFE 2.0 is a scalable and pluggable analysis framework for JavaScript web applications developed by the Programming Language Research Group at KAIST:

Older versions are still available at the SAFE1.0 branch.

For more information, please check out our user manual.


We assume you are using an operating system with a Unix-style shell (for example, Mac OS X, Linux, or Cygwin on Windows). Assuming SAFE_HOME points to the SAFE directory, you will need to have access to the following:

In your shell startup script, add $SAFE_HOME/bin to your path. The shell scripts in this directory are Bash scripts. To run them, you must have Bash accessible in /bin/bash.


Type sbt compile and then sbt test in the SAFE directory to make sure that your installation successfully finishes the tests.

Once you have built the framework, you can call it from any directory, on any JavaScript file, simply by typing one of available commands at a command line. You can see the available commands by typing:


or with more explanation:

safe help

Some of the available commands are as follows:

  • parse: parses a JavaScript file.
  • astRewrite: rewrites a JavaScript AST via Hoister, Disambiguator, and WithRewriter.
  • compile: translates a JavaScript file to a SAFE intermediate representation.
  • cfgBuild: builds a control flow graph for a JavaScript file.
  • analyze: analyzes static properties of JavaScript expressions in a given file.

Changes from SAFE 1.0

  • SAFE 2.0 has been tested using Test262, the official ECMAScript (ECMA-262) conformance suite.
  • SAFE 2.0 now uses sbt instead of ant to build SAFE.
  • SAFE 2.0 now provides an HTML-based debugger for its analyzer.
  • Most Java source files are replaced by Scala code and the only Java source code remained is the generated parser code.
  • Several components from SAFE 1.0 may not be integrated into SAFE 2.0. Such components include interpreter, concolic testing, clone detector, clone refactoring, TypeScript support, Web API misuse detector, and several abstract domains like the string automata domain.

SAFE 2.0 Roadmap

  • SAFE 2.0 will make monthly updates.
  • The next update will include a SAFE document, browser benchmarks, and more Test262 tests.
  • We plan to support some missing features from SAFE 1.0 incrementally such as a bug detector, DOM modeling, and jQuery analysis.
  • SAFE 2.0 is aimed to be a playground for advanced research in JavaScript web applications. Thus, we intentionally designed it to be light-weight.
  • Future versions of SAFE 2.0 will address various analysis techniques, dynamic features of web applications, event handling, modeling framework, compositional analysis, and selective sensitivity among others.


Details of the SAFE framework are available in our papers:


SAFE has been used by:


The current developers of SAFE 2.0 are as follows:

and the following people have contributed to the source code: