Gradual typing embedded securely in JavaScript

  • Swamy N
  • Fournet C
  • Rastogi A
 et al. 
  • 44

    Readers

    Mendeley users who have this article in their library.
  • 5

    Citations

    Citations of this article.

Abstract

JavaScript’s flexible semantics makes writing correct code hard and writing secure code extremely difficult. To address the former prob- lem, various forms of gradual typing have been proposed, such as Closure and TypeScript. However, supporting all common pro- gramming idioms is not easy; for example, TypeScript deliberately gives up type soundness for programming convenience. In this pa- per, we propose a gradual type system and implementation techniques that provide important safety and security guarantees. We present TS?, a gradual type system and source-to-source compiler for JavaScript. In contrast to prior gradual type systems, TS? features full runtime reflection over three kinds of types: (1) simple types for higher-order functions, recursive datatypes and dictionary-based extensible records; (2) the type any, for dynami- cally type-safe TS? expressions; and (3) the type un, for untrusted, potentially malicious JavaScript contexts in which TS? is embed- ded. After type-checking, the compiler instruments the program with various checks to ensure the type safety of TS? despite its interactions with arbitrary JavaScript contexts, which are free to use eval, stack walks, prototype customizations, and other offen- sive features. The proof of our main theorem employs a form of type-preserving compilation, wherein we prove all the runtime in- variants of the translation of TS? to JavaScript by showing that translated programs are well-typed in JS?, a previously proposed dependently typed language for proving functional correctness of JavaScript programs. We describe a prototype compiler, a secure runtime, and sample applications for TS?. Our examples illustrate how web security pat- terns that developers currently program in JavaScript (with much difficulty and still with dubious results) can instead be programmed naturally in TS?, retaining a flavor of idiomatic JavaScript, while providing strong safety guarantees by virtue of typing.

Get free article suggestions today

Mendeley saves you time finding and organizing research

Sign up here
Already have an account ?Sign in

Find this document

Authors

  • Nikhil Swamy

  • Cedric Fournet

  • Aseem Rastogi

  • Karthikeyan Bhargavan

  • Juan Chen

  • Pierre-Yves Strub

Cite this document

Choose a citation style from the tabs below

Save time finding and organizing research with Mendeley

Sign up for free