ASE 2024
Sun 27 October - Fri 1 November 2024 Sacramento, California, United States
Tue 29 Oct 2024 11:30 - 11:45 at Compagno - Compiler and PL Chair(s): Bernd Fischer

In recent years, scripting languages such as JavaScript and Python have gained a lot of traction due to their flexibility, allowing developers to write concise code in a short amount of time. However, this flexibility is achieved via weak, dynamic typing, which fails to catch subtle runtime bugs that would be prevented by a compiler, in static typing.Gradual type systems like TypeScript emerged as a solutions that combines the best of both worlds, allowing developers to annotate arbitrary amounts of their codebase with optional type hints. Nonetheless, most practical deployments of such systems are unsound. That is, they sacrifice type safety for performance by limiting themselves to static checks and not performing any residual runtime checks to enforce the type hints uniformly. This is a missed automation opportunity, which puts the burden on the users, who still need to perform explicit type checks at transition points between untyped and typed code to guarantee that values at runtime obey the type hints. Failure to do so can result in subtle bugs caused by type inconsistencies and, when user input is involved, it can render input validation mechanisms ineffective, resulting in type confusion problems. In this work, we aim to study the relation between gradual typing and type confusion. Our main hypothesis is that the type hints in the code can mislead developers into thinking that they are enforced consistently by the compiler, resulting in a lack of explicit runtime checks that ensure type safety. We perform a large empirical study with 30,000 open-source repositories containing JavaScript, TypeScript and Python code. We statically analyze if and how they use gradual typing and to what extent this influences the presence of explicit type checks. We find that gradual typing is at the same time widely, but not extensively used, meaning that many projects feature gradually typed code, but usually only in small portions of the codebase. This implies that there are many points in the code base where developers need to add explicit type checks, i.e., at the transition points between unanotated and annotated code. Our results further indicate that gradual typing may have a deteriorating effect on type checking practices, in particular when primitive values are involved. Finally, we manually analyze a small portion of the studied repositories and show that attackers can cause type confusion in popular open-source web applications and, thus, violate the type hints added by developers. We hope that our results help raise awareness about the limits of current gradual type systems and their unwanted effect on input validation.

Tue 29 Oct

Displayed time zone: Pacific Time (US & Canada) change

10:30 - 12:00
Compiler and PLResearch Papers at Compagno
Chair(s): Bernd Fischer Stellenbosch University
10:30
15m
Talk
Shoot Yourself in the Foot — Efficient Code Causes Inefficiency in Compiler Optimizations
Research Papers
Fengjuan Gao Nanjing University of Science and Technology, Hongyu Chen Nanjing University, Yuewei Zhou Rice University, Ke Wang Visa Research
10:45
15m
Talk
Rust-twins: Automatic Rust Compiler Testing through Program Mutation and Dual Macros Generation
Research Papers
Wenzhang Yang University of Science and Technology of China, Cuifeng Gao University of Science and Technology of China, Xiaoyuan Liu University of Science and Technology of China, Yuekang Li UNSW, Yinxing Xue University of Science and Technology of China
11:00
15m
Talk
Compiler Bug Isolation via Enhanced Test Program Mutation
Research Papers
Yujie Liu Peking University, Mingxuan Zhu Peking University, Jinhao Dong Peking University, Junzhe Yu Peking University, Dan Hao Peking University
11:15
15m
Talk
Incremental Context-free Grammar Inference in Black Box Settings
Research Papers
Feifei Li Tsinghua Shenzhen International Graduate School, Xiao Chen University of Newcastle, Xi Xiao Tsinghua Shenzhen International Graduate School, Tsinghua University, Xiaoyu Sun Australian National University, Australia, Chuan Chen Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan, China, Shaohua Wang Central University of Finance and Economics, Jitao Han Central University of Finance and Economics
11:30
15m
Talk
Typed and Confused: Studying the Unexpected Dangers of Gradual Typing
Research Papers
Dominic Troppmann CISPA Helmholtz Center for Information Security, Aurore Fass CISPA Helmholtz Center for Information Security, Cristian-Alexandru Staicu CISPA Helmholtz Center for Information Security
11:45
15m
Talk
Refinement Types for Visualization
Research Papers
Jingtao Xia University of California, Santa Barbara, Junrui Liu University of California, Santa Barbara, Nicholas Brown University of California, Santa Barbara, Yanju Chen University of California at Santa Barbara, Yu Feng University of California at Santa Barbara