Title: SEA: String Executability Analysis by Abstract Interpretation,
Abstract: Dynamic languages often employ reflection primitives to turn dynamically
generated text into executable code at run-time. These features make standard
static analysis extremely hard if not impossible because its essential data
structures, i.e., the control-flow graph and the system of recursive equations
associated with the program to analyse, are themselves dynamically mutating
objects. We introduce SEA, an abstract interpreter for automatic sound string
executability analysis of dynamic languages employing bounded (i.e, finitely
nested) reflection and dynamic code generation. Strings are statically
approximated in an abstract domain of finite state automata with basic
operations implemented as symbolic transducers. SEA combines standard program
analysis together with string executability analysis. The analysis of a call to
reflection determines a call to the same abstract interpreter over a code which
is synthesised directly from the result of the static string executability
analysis at that program point. The use of regular languages for approximating
dynamically generated code structures allows SEA to soundly approximate safety
properties of self modifying programs yet maintaining efficiency. Soundness
here means that the semantics of the code synthesised by the analyser to
resolve reflection over-approximates the semantics of the code dynamically
built at run-rime by the program at that point.