Главная
Study mode:
on
1
Intro
2
Binding code: extending the JavaScript environment
3
Write a string to a file from JavaScript
4
Chrome browser runtime system
5
Binding errors can lead to violations of JavaScript's
6
We focus on finding and preventing binding bugs in four JavaScript runtime systems
7
Static analysis tools to find bugs in binding code
8
What do binding bugs look like?
9
Buffer fill in context
10
Checker for memory errors in Node.js
11
A use-after-free bug in PDFium
12
Checker results
13
Preventing bugs with a safer JavaScript engine API
14
Wrap up
Description:
Explore a comprehensive analysis of security vulnerabilities in JavaScript bindings during this 18-minute IEEE conference talk. Delve into the challenges of implementing runtime functions in C++ for JavaScript environments like Node.js and Chrome. Discover various types of exploitable errors in binding code, and learn about newly developed static checkers for detecting these flaws. Examine a suite of 81 proof-of-concept exploits crafted to demonstrate the severity of binding layer security issues. Gain insights into a backwards-compatible, low-overhead API designed to prevent such vulnerabilities. Understand the impact of binding bugs through real-world examples, including awarded bug bounties. Analyze specific cases like buffer overflows and use-after-free bugs in popular runtime systems. Acquire knowledge on implementing safer JavaScript engine APIs to mitigate these security risks.

Finding and Preventing Bugs in JavaScript Bindings

IEEE
Add to list
0:00 / 0:00