1. The document discusses using Chrome Developer Tools and static code analysis to detect untrusted JavaScript. It describes profiling JavaScript execution in web apps using the Chrome Developer Tools Profiles Panel and analyzing JavaScript code statically to detect suspicious URLs. 2. The Chrome Developer Tools allows debugging JavaScript, identifying performance issues, and understanding memory usage. The CPU Profiling feature logs information about JavaScript function names, URLs, time metrics, and call hierarchies. 3. Static code analysis of JavaScript uses a Wget command line tool to parse code and look for external URLs, which are categorized and logged to a testing database.

1. Università degli Studi del Sannio
Sicurezza delle Reti e dei Sistemi Software
Prof. Corrado Aaron Visaggio
Guerrera Alessandro
Micco Enrico
399/40
399/38
UntrustedJSDetection
withChromeDevToolsand
staticcodeanalyzer

2. Future Web with HTML 5
• No longer just a draft
• Only best with CSS 3 and JavaScript
• JavaScript emerged in web and mobile app
development
Sicurezza delle Reti e dei Sistemi Software

3. HTML 5 risks
• Client-side execution
• XSS vulnerabilities with new tags
• Client-side Database
• Web storage and SQL injection
• Web Sockets
• Web Workers (JavaAcript)

4. JavaScript Security Analysis
• Dynamic analysis:
Profile JavaScript
execution in web apps
Logging and post
elaboration
• Static Analysis:
Detect suspicious URLs in
JavaScript code (i.e. web
workers)
Trusted JavaScript
vs
Untrusted JavaScript

5. • It is a part of standard Chrome distribution
• Used for:
• Debugging JavaScript
• Identifying performance issues
• Understanding memory usage
Chrome Developer Tools

6. Chrome Developer Tools
• Profiles Panel: CPU

7. CPU Profiling
• JS profiling output:
{"head":{"functionName":"(root)","url":"","lineNumber":0,"tot
alTime":54969.14940502423,"selfTime":0,"numberOfCalls“:0,"vis
ible":true,"callUID":3671317361,"children":[{"functionName":"
(program)","url":"","lineNumber":0,"totalTime":37895.14804279
017,"selfTime":37895.14804279017,"numberOfCalls":0,"visible":
true,"callUID":3079893573,"children“:[],"id":2},{"functionNam
e":"(anonymousfunction)"function)","url":"chromeextension://e
panfjkfahimkgomnigadpkobaefekcd/webkit/chrome/content.js","li
neNumber":6,"totalTime":9.014784246163707,"selfTime":0,"numbe
rOfCalls":0,"visible“:true,"callUID":1398769603,"children":[{
"functionName":"bridge.extension.sendRequest","url":"chrome-
extension://epanfjkfahimkgomnigadpkobaefekcd/webkit/chrome/co
ntent.js“,"lineNumber":3,"totalTime":9.014784246163707,"selfT
ime":0,"numberOfCalls":0,"visible":true,"callUID":2480584708,
"children":[{"functionName":"(anonymous…

8. CPU Profile logging
• CPU profile information:
1. URL
2. Line Number
3. Function Name
4. Self Time
5. Total Time
6. CallUID
7. Visible

9. JavaScript static code analysis
/*! jQuery v1.7 jquery.com
| jquery.org/license
@JsDoNotOptimize
*/(function(a,b){function
cA(a){return
f.isWindow(a)?a:a.nodeType=
==9?a.defaultView||a.parent
Window:!1}function
cx(a){if(!cm[a]){var
b=c.body,d=f("<"+a+">").app
endTo(b),e=d.css("display")
;d.remove();if(e==="none"||
e===""){cn||(cn=c.createEle
ment("iframe"),cn.frameBord
er=cn.width=cn.height=0),b.
appendChild(cn)…
http://www.facebook.com/dia
log/feed?
http://pinterest.com/pin/cr
eate/button/?
http://reco.stratus.qa.ebay
.com
http://p.ebaystatic.com/aw/
home/feed/spinner_lrg.gif
…
• JS static parser:

10. Dynamic JS Analyzer
Chrome Dev Tools CPU profile parser in Java

11. Static JS Analyzer
Wget command line tool JS code parser in Java

12. Testing
• URLs list group by category:
1. Audio-video
2. Banking
3. Cooking
4. Ecommerce
5. Education
6. Gardening
7. Government
8. Medical
9. Motori Di Ricerca
10. …

13. Testing Database
Dynamic Analysis Dynamic Analysis

14. Testing results
• Metrics:
1. Max JS function execution time
2. Avg JS function execution time
3. Max JS function calls number
4. Avg JS function calls number
5. Total URL number
6. Extern URL ratio

15. Testing results
0
500
1000
1500
2000
2500
Max JS function execution time

16. Testing results
0
1000
2000
3000
4000
5000
6000
Avg JS function execution time

17. Testing results
0
0,5
1
1,5
2
2,5
3
3,5
4
4,5
Max JS function calls number

18. Testing results
0
100
200
300
400
500
600
700
800
900
1000
Avg JS function calls number

19. Testing results
0
20
40
60
80
100
120
140
160
180
Total URL number

20. Testing results
0
0,2
0,4
0,6
0,8
1
1,2
Extern URL ratio