Finding and Preventing Bugs in JavaScript Bindings
Explore a comprehensive analysis of security vulnerabilities in JavaScript bindings during this 18-minute IEEE conference talk. Delve into the challenges of implementing runtime functions in C++ for JavaScript environments like Node.js and Chrome. Discover various types of exploitable errors in binding code, and learn about newly developed static checkers for detecting these flaws. Examine a suite of 81 proof-of-concept exploits crafted to demonstrate the severity of binding layer security issues. Gain insights into a backwards-compatible, low-overhead API designed to prevent such vulnerabilities. Understand the impact of binding bugs through real-world examples, including awarded bug bounties. Analyze specific cases like buffer overflows and use-after-free bugs in popular runtime systems. Acquire knowledge on implementing safer JavaScript engine APIs to mitigate these security risks.