Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Unbundle-Rewrite-Rebundle: Runtime Detection and Rewriting of Privacy-Harming Code in JavaScript Bundles

Mir Masood Ali, Peter Snyder, Chris Kanich, Hamed Haddadi

TL;DR

This work presents Unbundle-Rewrite-Rebundle (URR), a system for detecting privacy-harming portions of bundled JavaScript code and rewriting that code at runtime to remove the privacy-harming behavior without breaking the surrounding code or overall application, and finds it to be an effective approach to a large-and-growing blind spot unaddressed by current privacy tools.

Abstract

This work presents Unbundle-Rewrite-Rebundle (URR), a system for detecting privacy-harming portions of bundled JavaScript code and rewriting that code at runtime to remove the privacy-harming behavior without breaking the surrounding code or overall application. URR is a novel solution to the problem of JavaScript bundles, where websites pre-compile multiple code units into a single file, making it impossible for content filters and ad-blockers to differentiate between desired and unwanted resources. Where traditional content filtering tools rely on URLs, URR analyzes the code at the AST level, and replaces harmful AST sub-trees with privacy-and-functionality maintaining alternatives. We present an open-sourced implementation of URR as a Firefox extension and evaluate it against JavaScript bundles generated by the most popular bundling system (Webpack) deployed on the Tranco 10k. We evaluate URR by precision (1.00), recall (0.95), and speed (0.43s per script) when detecting and rewriting three representative privacy-harming libraries often included in JavaScript bundles, and find URR to be an effective approach to a large-and-growing blind spot unaddressed by current privacy tools.

Unbundle-Rewrite-Rebundle: Runtime Detection and Rewriting of Privacy-Harming Code in JavaScript Bundles

TL;DR

This work presents Unbundle-Rewrite-Rebundle (URR), a system for detecting privacy-harming portions of bundled JavaScript code and rewriting that code at runtime to remove the privacy-harming behavior without breaking the surrounding code or overall application, and finds it to be an effective approach to a large-and-growing blind spot unaddressed by current privacy tools.

Abstract

This work presents Unbundle-Rewrite-Rebundle (URR), a system for detecting privacy-harming portions of bundled JavaScript code and rewriting that code at runtime to remove the privacy-harming behavior without breaking the surrounding code or overall application. URR is a novel solution to the problem of JavaScript bundles, where websites pre-compile multiple code units into a single file, making it impossible for content filters and ad-blockers to differentiate between desired and unwanted resources. Where traditional content filtering tools rely on URLs, URR analyzes the code at the AST level, and replaces harmful AST sub-trees with privacy-and-functionality maintaining alternatives. We present an open-sourced implementation of URR as a Firefox extension and evaluate it against JavaScript bundles generated by the most popular bundling system (Webpack) deployed on the Tranco 10k. We evaluate URR by precision (1.00), recall (0.95), and speed (0.43s per script) when detecting and rewriting three representative privacy-harming libraries often included in JavaScript bundles, and find URR to be an effective approach to a large-and-growing blind spot unaddressed by current privacy tools.
Paper Structure (57 sections, 3 figures, 5 tables, 2 algorithms)

This paper contains 57 sections, 3 figures, 5 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Background
  3. Bundles and Relevant Concepts
  4. Modular Programming.
  5. JavaScript Module Systems.
  6. Inter-module Dependencies.
  7. Minification.
  8. Source Maps.
  9. Popular Bundlers.
  10. General Structure of Webpack Bundles.
  11. Motivating Example
  12. Generic Code Inclusion.
  13. Typical Content Blocking Approach.
  14. Limitations of Existing Content Blocking Approaches.
  15. Properties of an Ideal Solution
  16. ...and 42 more sections

Figures (3)

  • Figure 1: Motivating example.
  • Figure 2: Overview of the framework.
  • Figure 3: An overview of the target libraries identified from a crawl of the Tranco 10K. In addition to the 697 instances of true positive (✕) matches above the 8% threshold, we observed $>$15K instances of true negative () matches of modules below the threshold.