Detekcija JavaScript biblioteka i njihovih dodataka korištenjem identifikatora i kriptografskih sažetaka

undergraduate thesis

• Title (english): Detecting JavaScript libraries and their plugins using identifiers and cryptographic hashes
• Author: Saša Lončarević
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Ivan Kovačević (član povjerenstva)
• Committee member: Bruno Štengl (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2022-07-04, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Web je široko rasprostranjena platforma za razmjenu podataka i pružanje usluga o kojoj
mnogi ovise. Zbog velike potražnje za kreiranjem web stranica nude se metode koje
pružaju vremenski efikasnije dizajniranje i programiranje. Jedna od njih se svodi na
korištenje JavaScript biblioteka koje, između ostaloga, mogu uvesti ranjivosti u web
aplikacije. Zbog same količine web stranica, a tako i biblioteka pa i njihovih ranjivosti
otežano je održavanje sigurnosti. Javlja se potreba za stvaranjem alata koji će
automatiziranim putem, proaktivno tražiti ranjive biblioteke i omogućiti pravovremeno
saniranje. Stoga se ovaj rad bavi danom problematikom i pruža uvid u implementirano
rješenje. Opisane su JavaScript biblioteke, načini njihova korištenja i pribavljanja, te
metode kojima ih se može detektirati. Prikazana je tehnička strana ostvarenja
implementacije, te rezultati dobiveni provođenjem detekcije nad skupom web stranica iz
hrvatskog mrežnog prostora. Također, prikazana je raspodjela zastupljenosti popularnih
biblioteka i njihovih ranjivosti. Komentirana su i ograničenja uočena prilikom
implementacije, te njihova potencijalna rješenja s ciljem unaprjeđenja programa.

Abstract (english)

The web is a widespread platform for data exchange and service delivery on which many
depend. Due to the high demand for website creation, methods are offered that provide
more time-efficient design and programming. One of them comes down to using
JavaScript libraries that, among other things, can introduce vulnerabilities into web
applications. Due to the sheer number of websites, as well as libraries and their
vulnerabilities, it is difficult to maintain security. There is a need to create tools that will
automatically, proactively search for vulnerable libraries and enable timely remediation.
Therefore, this paper deals with the given problem and provides an insight into the
implemented solution. JavaScript libraries, how to use and obtain them, and methods for
detecting them are described. The technical side of the implementation is presented, as
well as the results obtained by detecting a set of web pages from the Croatian web space.
Also, the usage distribution of popular libraries and their vulnerabilities is shown. The
limitations observed during the implementation were commented on, as well as their
potential solutions with the aim of improving the program.

• Keywords: ranjivosti weba; JavaScript biblioteke; detekcija ranjivosti
• Keywords (english): web vulnerabilities; JavaScript libraries; vulnerability detection
• Language: croatian
• URN:NBN: urn:nbn:hr:168:193540
• Study programme: Title: Computing; Study programme type: university; Study level: undergraduate; Academic / professional title: sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva (sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-15 10:41:38