Wenyuan Xu's PhD defence "Making JavaScript safer: finding security issues in real-world code"

JavaScript powers much of the modern web and is also widely used in server, desktop, and mobile applications. Its flexibility and enormous ecosystem make software development easier, but they also make it difficult to identify security problems automatically.

During his PhD studies, Wenyuan Xu developed new techniques that make automated security analysis more practical for real-world JavaScript. One technique makes the analysis of large programs significantly faster by avoiding redundant work. Another reconstructs bundled JavaScriptÔÇöthe transformed code that is actually deployed on many websitesÔÇöso existing security tools can discover problems that would otherwise remain hidden. In a large-scale study, this technique enabled a widely used security analyzer to report more than 3,000 additional security alerts in web code. The project also developed a method for analysing third-party JavaScript packages that may contain deliberately malicious code. By combining automated code analysis with lightweight protection while the program runs, the method can identify security-sensitive behaviour even when malicious code attempts to evade analysis. The results show that practical performance and stronger security guarantees can be achieved together for real-world JavaScript software.

The PhD degree was completed at the **Department of Computer Science, Faculty of Natural Sciences, Aarhus University**.

This summary was prepared by the PhD student.