RClassify: Classifying Race Conditions in Web Applications via Deterministic Replay
•
1 gefällt mir•794 views
2017-08-24に開催されたICSE 2017勉強会にて RClassify: Classifying Race Conditions in Web Applications via Deterministic Replay (Lu Zhang and Chao Wang) の紹介を行った資料です。 ICSE 2017勉強会: https://sites.google.com/site/sereadings/icse2017-reading
![課題
JavaScript においては処理はアトミックに実行されるので
普通の意味でのデータ競合(data race)は存在しない
が、イベントの発生順によって、意図しない結果になる不
具合はありえる
– 右図で <script> 要素の
パース前に画像がロード
されたら?
既存のデータ競合の検出
ツール(例えばEventRacer)
は誤検出が非常に多い
7
9-2
o the application itself (see Section V). This is better
sting approaches because technologies are changing
and tools implemented using a particular version of
wser will quickly become obsolete. In contrast, our
m-agnostic approach will be more robust against these
and updates.
we concretely execute the application using deter-
replay, as opposed to heuristically filtering the warn-
1], [22] or applying conservative static analysis [18],
can robustly decide if a race condition is real (i.e., if
ecution orders are feasible). The reason why existing
port many bogus race conditions in the first place is
some hidden happens-before relations between events
accounted for, and precisely capturing all happens-
elations would have been prohibitively expensive.
econd challenge is to decide, during state recording
mparison, which fields of the program state are impor-
thus should be compared. For a typical client-side web
1 <html>
2 <head> ... </head>
3 <body>
4 <img src="image1.jpg" onload="image1Loaded()"
id="image1">
5 <!-- omitted elements... -->
6 <script id="script1">
7 function image1Loaded() {
8 document.getElementById("button1")
.addEventListener("click", func);
9 }
10 function func() {
11 document.getElementById("outputField").innerHTML
= "Well done!";
12 }
13 </script>
14 <!-- omitted elements... -->
15 <button id="button1"> button1 </button>
16 <!-- omitted elements... -->
17 <div id="outputField"> </div>
18 </body>
19 </html>
Fig. 2. Example: A client-side web application with race conditions.※ Zhang et al. RClassify: Classifying Race Conditions in Web Applications
via Deterministic Replay. In Proceedings of ICSE 2017 Fig. 2より引用](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Empfohlen
Weitere ähnliche Inhalte
Ähnlich wie RClassify: Classifying Race Conditions in Web Applications via Deterministic Replay
Ähnlich wie RClassify: Classifying Race Conditions in Web Applications via Deterministic Replay (12)
Mehr von Masahiro Sakai
Mehr von Masahiro Sakai (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (9)
RClassify: Classifying Race Conditions in Web Applications via Deterministic Replay
- 1. RClassify: Classifying Race Conditions in Web Applications via Deterministic Replay 著者: Lu Zhang and Chao Wang (Virginia Tech and University of Southern California) 紹介者: 酒井 政裕 (Preferred Networks, Inc.) @ ICSE2017勉強会 2017-08-24 要約：JavaScriptのデータ競合検査の偽陽性を、 スケジューリングしたリプレイでフィルタリング 9-2
- 2. 課題 JavaScript においては処理はアトミックに実行されるので 普通の意味でのデータ競合(data race)は存在しない が、イベントの発生順によって、意図しない結果になる不 具合はありえる – 右図で <script> 要素の パース前に画像がロード されたら? 既存のデータ競合の検出 ツール(例えばEventRacer) は誤検出が非常に多い 7 9-2 o the application itself (see Section V). This is better sting approaches because technologies are changing and tools implemented using a particular version of wser will quickly become obsolete. In contrast, our m-agnostic approach will be more robust against these and updates. we concretely execute the application using deter- replay, as opposed to heuristically filtering the warn- 1], [22] or applying conservative static analysis [18], can robustly decide if a race condition is real (i.e., if ecution orders are feasible). The reason why existing port many bogus race conditions in the first place is some hidden happens-before relations between events accounted for, and precisely capturing all happens- elations would have been prohibitively expensive. econd challenge is to decide, during state recording mparison, which fields of the program state are impor- thus should be compared. For a typical client-side web 1 <html> 2 <head> ... </head> 3 <body> 4 <img src="image1.jpg" onload="image1Loaded()" id="image1"> 5 <!-- omitted elements... --> 6 <script id="script1"> 7 function image1Loaded() { 8 document.getElementById("button1") .addEventListener("click", func); 9 } 10 function func() { 11 document.getElementById("outputField").innerHTML = "Well done!"; 12 } 13 </script> 14 <!-- omitted elements... --> 15 <button id="button1"> button1 </button> 16 <!-- omitted elements... --> 17 <div id="outputField"> </div> 18 </body> 19 </html> Fig. 2. Example: A client-side web application with race conditions.※ Zhang et al. RClassify: Classifying Race Conditions in Web Applications via Deterministic Replay. In Proceedings of ICSE 2017 Fig. 2より引用
- 3. 提案手法: RCLASSIFY 1. サイトと既存検査ツールのwarningが入力 2. instrumentaionを施してイベント列を記録 3. 競合イベント(e1,e2)の実行順序が e1→e2 と e2→e1 とな るようスケジュールしてリプレイ (それ以外のイベント順序は出来るだけ保つ) – 一方が実現不能であればデータ競合ではない (bogus) 4. 実行後に両者で状態 を比較 – 両者に本質的な違いが あれば harmful な データ競合 – 本質的に同じであれば harmless なデータ競合 8 y: Classifying Race Conditions in Web plications via Deterministic Replay Lu Zhang Virginia Tech ksburg, VA, USA Chao Wang University of Southern California Los Angeles, CA, USA are common in web applications and repair. Although there exist web applications, they all report a s. That is, the races they report are n never occur in practice, or benign, rroneous behaviors. Since manually and error prone, reporting these would be counter-productive. We deterministic replay-based method eal but also the truly harmful race ng each pair of racing events in two their impact on the program state: Instrumented Web Application Compare the Program States Execution 1 URL of Web Application Race-condition Warnings Static Analysis of HTML files Replay the Racing Event Pair Execution 2 Harmful or Harmless Fig. 1. RCLASSIFY: Our evidence-based race-condition classification metho 017 IEEE/ACM 39th International Conference on Software Engineering017 IEEE/ACM 39th International Conference on Software Engineering ※ Zhang et al. RClassify: Classifying Race Conditions in Web Applications via Deterministic Replay. In Proceedings of ICSE 2017 Fig. 1より引用 9-2
- 4. Instrumentation の詳細 Platform agnostic – JavaScriptレベルのinstrumentationを頑張ることで、 プラットフォーム非依存で実現 (手をいれた特別なブラ ウザやJavaScriptエンジンを使わなくて良い) – 結構泥臭くやっている 面白かった例として、イベント順を強制するために – イベント毎に「その前に起こっているべきイベントのリ スト」を保持 – イベント発火時にまだ発火していないイベントがあった ら、その時点では処理を実行せず、遅延して再実行 9 9-2
- 5. 実験結果と所感 実験結果 – 標準的なベンチマーク50個で正確な分類結果 (R4等の既存ツールでは一部の競合しか検出できず) – フォーチュン500企業からランダムに選んだ70サイトに適 用し、EventRacerの1903警告中、132を正しくharmful と分類 所感 – 静的解析と動的解析の組み合わせの王道 – うまい問題を選んだ上で、実装と評価をきちんとやった – フォーチュン500から評価対象を選んでいるのが面白い 10 9-2