.png){kind=icon}
返回
Study of JavaScript Static Analysis Tools for Vulnerability Detection in Node.js Packages
.png){kind=icon}
OA
AI
DOI：10.1109/TR.2023.3286301.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
With the emergence of the Node.js ecosystem, JavaScript has become a widely used programming language for implementing server-side web applications. In this article, we present the first empirical study of static code analysis tools for detecting vulnerabilities in Node.js code. To conduct a comprehensive tool evaluation, we created the largest known curated dataset of Node.js code vulnerabilities. We characterized and annotated a set of 957 vulnerabilities by analyzing information contained in npm advisory reports. We tested nine different tools and found that many important vulnerabilities appearing in the OWASP top-10 are not detected by any tool. The three best performing tools combined only detect up to 57.6% of all vulnerabilities in the dataset, but at a very low precision of 0.11%. Our curated dataset offers a new benchmark to help characterize existing Node.js code vulnerabilities and foster the development of better vulnerability detection tools for Node.js code.
Keyword:
Automatic testing
computer security
static analysis
期刊
IF:
5.7
论文数:
2.8K
被引数:
8.5K
机构
引用论文
Food Shortage in Small Fragments: Evidence from an Area-Sensitive Passerine小型碎片化生境中的食物短缺：一种区域敏感性雀形目鸟类的证据.png)
Ecology
EcologyIF0
PREAI
分享收藏
分享收藏MTHFR C677T and A1298C polymorphisms as a risk factor for congenital heart defects in Down syndrome
PREAI
分享收藏
查看更多内容