From FLOWCORE to JITFLOW: Improving the speed of Information Flow in JavaScript

Abstract

Today's web applications remain vulnerable to cross-site scripting attacks that enable data theft. Information flow tracking in the JavaScript VM of a web engine can track data flows through the web application and prevent the communication of sensitive data to unintended recipients, thereby stopping data theft. Existing solutions have focused on the incorporating information flow into the JS interpreter, rather than the just-in-time compiler, rendering the resulting performance non-competitive.

This thesis presents an implementation of information flow tracking that works with the just-in-time compiler, outperforming all previous interpreter-based information flow tracking engines by more than a factor of two. The JIT-based engine (i) has the same coverage as previous implementations, (ii) requires comparatively light implementation effort, and (iii) introduces new optimizations to remain performant. When evaluated against three industry standard benchmark suites, the tracking engine retains an average slowdown of 73% over engines that do not support information flow, remaining will within the range that many users will find an acceptable price for obtaining substantially increased security against data theft.