{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:05:49Z","timestamp":1783008349741,"version":"3.54.5"},"publisher-location":"New York, NY, USA","reference-count":74,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,2]],"date-time":"2024-12-02T00:00:00Z","timestamp":1733097600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"The Research Grants Council of the Hong Kong SAR, China","award":["CUHK 14209323"],"award-info":[{"award-number":["CUHK 14209323"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,2]]},"DOI":"10.1145\/3658644.3690332","type":"proceedings-article","created":{"date-parts":[[2024,12,9]],"date-time":"2024-12-09T12:19:20Z","timestamp":1733746760000},"page":"570-584","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Test Suites Guided Vulnerability Validation for Node.js Applications"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2133-3384","authenticated-orcid":false,"given":"Changhua","family":"Luo","sequence":"first","affiliation":[{"name":"Wuhan University & The Chinese University of Hong Kong, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3077-5697","authenticated-orcid":false,"given":"Penghui","family":"Li","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8260-3304","authenticated-orcid":false,"given":"Wei","family":"Meng","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong, Hong Kong SAR, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7894-8828","authenticated-orcid":false,"given":"Chao","family":"Zhang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,12,9]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607233"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420952"},{"key":"e_1_3_2_1_3_1","volume-title":"Proceedings of the 32nd USENIX Security Symposium (Security)","author":"Alhamdan Abdullah","year":"2023","unstructured":"Abdullah Alhamdan and Cristian-Alexandru Staicu. 2023. SandDriller: A Fully-Automated Approach for Testing Language-Based JavaScript Sandboxes. In Proceedings of the 32nd USENIX Security Symposium (Security). Anaheim, CA, USA."},{"key":"e_1_3_2_1_4_1","volume-title":"Proceedings of the 27th USENIX Security Symposium (Security)","author":"Alhuzali Abeer","year":"2018","unstructured":"Abeer Alhuzali, Rigel Gjomemo, Birhanu Eshete, and VN Venkatakrishnan. 2018. NAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications. In Proceedings of the 27th USENIX Security Symposium (Security). Baltimore, MD."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00083"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00077"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSM.2012.6405253"},{"key":"e_1_3_2_1_8_1","unstructured":"bcoe. 2024. c8 - native V8 code-coverage. https:\/\/www.npmjs.com\/package\/c8."},{"key":"e_1_3_2_1_9_1","volume-title":"Proceedings of the 45th International Conference on Software Engineering (ICSE)","author":"Masud Bhuiyan Masudul Hasan","year":"2023","unstructured":"Masudul Hasan Masud Bhuiyan, Adithya Srinivas Parthasarathy, Nikos Vasilakis, Michael Pradel, and Cristian-Alexandru Staicu. 2023. SecBench. js: An executable security benchmark suite for server-side JavaScript. In Proceedings of the 45th International Conference on Software Engineering (ICSE). Melbourne, Australia."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134020"},{"key":"e_1_3_2_1_11_1","unstructured":"Brainhub. 2023. Famous Node JS Apps. https:\/\/brainhub.eu\/library\/famous-apps-built-with-nodejs."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00045"},{"key":"e_1_3_2_1_13_1","volume-title":"Proceedings of the 30th USENIX Security Symposium (Security). Virtual Event.","author":"Chen Libo","year":"2021","unstructured":"Libo Chen, Yanhao Wang, Quanpu Cai, Yunfan Zhan, Hong Hu, Jiaqi Linghu, Qinsheng Hou, Chao Zhang, Haixin Duan, and Zhi Xue. 2021. Sharing more and checking less: Leveraging common input keywords to detect bugs in embedded systems. In Proceedings of the 30th USENIX Security Symposium (Security). Virtual Event."},{"key":"e_1_3_2_1_14_1","unstructured":"code intelligence. 2024. CVE-2023--36665. https:\/\/www.code-intelligence.com\/blog\/cve-protobufjs-prototype-pollution-cve-2023--36665."},{"key":"e_1_3_2_1_15_1","unstructured":"code intelligence. 2024. CVE-2024--39853. https:\/\/gist.github.com\/mestrtee\/840f5d160aab4151bd0451cfb822e6b5."},{"key":"e_1_3_2_1_16_1","unstructured":"codeql. 2024. Discover vulnerabilities across a codebase with CodeQL. https:\/\/codeql.github.com\/."},{"key":"e_1_3_2_1_17_1","unstructured":"dev.to. 2023. Securing Your Node.js Apps by Analyzing Real-World Command Injection Examples. https:\/\/dev.to\/lirantal\/securing-your-nodejs-apps-by-analyzing-real-world-command-injection-examples-1ll6."},{"key":"e_1_3_2_1_18_1","volume-title":"Proceedings of the 21st USENIX Security Symposium (Security)","author":"Doup\u00e9 Adam","year":"2012","unstructured":"Adam Doup\u00e9, Ludovico Cavedon, Christopher Kruegel, and Giovanni Vigna. 2012. Enemy of the state: A state-aware black-box web vulnerability scanner. In Proceedings of the 21st USENIX Security Symposium (Security). Bellevue, WA, USA."},{"key":"e_1_3_2_1_19_1","volume-title":"Vulnerability-oriented Testing for RESTful APIs. (Aug","author":"Du Wenlong","year":"2024","unstructured":"Wenlong Du, Jian Li, Yanhao Wang, Libo Chen, Ruijie Zhao, Junmin Zhu, Zhengguang Han, Yijun Wang, and Zhi Xue. 2024. Vulnerability-oriented Testing for RESTful APIs. (Aug. 2024)."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00022"},{"key":"e_1_3_2_1_21_1","volume-title":"Proceedings of the ACM on Programming Languages (Jan.","author":"Santos Jos\u00e9 Fragoso","year":"2019","unstructured":"Jos\u00e9 Fragoso Santos, Petar Maksimovi?, Gabriela Sampaio, and Philippa Gardner. 2019. JaVerT 2.0: Compositional symbolic execution for JavaScript. Proceedings of the ACM on Programming Languages (Jan. 2019)."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409719"},{"key":"e_1_3_2_1_23_1","volume-title":"Proceedings of the 33rd USENIX Security Symposium (Security)","author":"G\u00fcler Emre","year":"2024","unstructured":"Emre G\u00fcler, Sergej Schumilo, Moritz Schloegel, Nils Bars, Philipp G\u00f6rz, Xinyi Xu, Cemal Kaygusuz, and Thorsten Holz. 2024. Atropos: Effective Fuzzing of Web Applications for Server-Side Vulnerabilities. In Proceedings of the 33rd USENIX Security Symposium (Security). Philadelphia, PA, USA."},{"key":"e_1_3_2_1_24_1","unstructured":"infosecinstitute. 2024. Dictionary attack using Burp Suite. https:\/\/www.infosecinstitute.com\/resources\/hacking\/dictionary-attack-using-burp-suite\/."},{"key":"e_1_3_2_1_25_1","unstructured":"istanbuljs. 2024. Istanbul's state of the art command line interface. https:\/\/www.npmjs.com\/package\/nyc."},{"key":"e_1_3_2_1_26_1","unstructured":"Jasmine. 2024. Jasmine is a Behavior Driven Development testing framework for JavaScript. https:\/\/github.com\/jasmine\/jasmine."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179394"},{"key":"e_1_3_2_1_28_1","unstructured":"Jest. 2024. Jest is a delightful JavaScript Testing Framework with a focus on simplicity. https:\/\/jestjs.io\/."},{"key":"e_1_3_2_1_29_1","volume-title":"Proceedings of the 44th IEEE Symposium on Security and Privacy (Oakland)","author":"Kang Mingqing","year":"2023","unstructured":"Mingqing Kang, Yichao Xu, Song Li, Rigel Gjomemo, Jianwei Hou, VN Venkatakrishnan, and Yinzhi Cao. 2023. Scaling javascript abstract interpretation to detect and exploit node. js taint-style vulnerability. In Proceedings of the 44th IEEE Symposium on Security and Privacy (Oakland). San Francisco, CA, USA."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24308"},{"key":"e_1_3_2_1_31_1","volume-title":"23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID).","author":"Koishybayev Igibek","year":"2020","unstructured":"Igibek Koishybayev and Alexandros Kapravelos. 2020. Mininode: Reducing the attack surface of node.js applications. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID)."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179304"},{"key":"e_1_3_2_1_33_1","volume-title":"Proceedings of the 29th USENIX Security Symposium (Security). Virtual Event.","author":"Lee Suyoung","year":"2020","unstructured":"Suyoung Lee, HyungSeok Han, Sang Kil Cha, and Sooel Son. 2020. Montage: A neural network language Model-Guided JavaScript engine fuzzer. In Proceedings of the 29th USENIX Security Symposium (Security). Virtual Event."},{"key":"e_1_3_2_1_34_1","volume-title":"Proceedings of the 31st USENIX Security Symposium (Security)","author":"Li Song","year":"2022","unstructured":"Song Li, Mingqing Kang, Jianwei Hou, and Yinzhi Cao. 2022. Mining node. js vulnerabilities via object dependence graph and query. In Proceedings of the 31st USENIX Security Symposium (Security). Boston, MA, USA."},{"key":"e_1_3_2_1_35_1","volume-title":"Proceedings of the 31st USENIX Security Symposium (Security)","author":"Li Yeting","year":"2022","unstructured":"Yeting Li, Yecheng Sun, Zhiwu Xu, Jialun Cao, Yuekang Li, Rongchen Li, Haiming Chen, Shing-Chi Cheung, Yang Liu, and Yang Xiao. 2022. RegexScalpel: Regular Expression Denial of Service (ReDoS) Defense by Localize-and-Fix. In Proceedings of the 31st USENIX Security Symposium (Security). Boston, MA, USA."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00062"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00121"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3092282.3092295"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179296"},{"key":"e_1_3_2_1_40_1","volume-title":"Proceedings of the 32nd USENIX Security Symposium (Security)","author":"Lyu Chenyang","year":"2023","unstructured":"Chenyang Lyu, Jiacheng Xu, Shouling Ji, Xuhong Zhang, Qinying Wang, Binbin Zhao, Gaoning Pan, Wei Cao, Peng Chen, and Raheem Beyah. 2023. MINER: A Hybrid Data-Driven Approach for REST API Fuzzing. In Proceedings of the 32nd USENIX Security Symposium (Security). Anaheim, CA, USA."},{"key":"e_1_3_2_1_41_1","unstructured":"Mocha. 2024. Mocha is a feature-rich JavaScript test framework running on Node.js and in the browser. https:\/\/mochajs.org\/."},{"key":"e_1_3_2_1_42_1","volume-title":"CrashJS: A NodeJS Benchmark for Automated Crash Reproduction. In 2024 IEEE\/ACM 21st International Conference on Mining Software Repositories (MSR). IEEE.","author":"Oliver Philip","year":"2024","unstructured":"Philip Oliver, Jens Dietrich, Craig Anslow, and Michael Homer. 2024. CrashJS: A NodeJS Benchmark for Automated Crash Reproduction. In 2024 IEEE\/ACM 21st International Conference on Mining Software Repositories (MSR). IEEE."},{"key":"e_1_3_2_1_43_1","volume-title":"Proceedings of the Web Conference (WWW)","author":"Oz Harun","year":"2024","unstructured":"Harun Oz, Abbas Acar, Ahmet Aris, G\u00fcliz Seray Tuncay, Amin Kharraz, and Selcuk Uluagac. 2024. (In) Security of File Uploads in Node. js. In Proceedings of the Web Conference (WWW). Singapore."},{"key":"e_1_3_2_1_44_1","volume-title":"Proceedings of the 44th IEEE Symposium on Security and Privacy (Oakland)","author":"Park Soyeon","year":"2023","unstructured":"Soyeon Park, Wen Xu, Insu Yun, Daehee Jang, and Taesoo Kim. 2023. Fuzzing javascript engines with aspect-preserving mutation. In Proceedings of the 44th IEEE Symposium on Security and Privacy (Oakland). San Francisco, CA, USA."},{"key":"e_1_3_2_1_45_1","unstructured":"parse community. 2024. Parse Server for Node.js \/ Express. https:\/\/github.com\/parse-community\/parse-server."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26362-5_14"},{"key":"e_1_3_2_1_47_1","volume-title":"Department of Computer Science","author":"Petukhov Andrey","year":"2008","unstructured":"Andrey Petukhov and Dmitry Kozlov. 2008. Detecting security vulnerabilities in web applications using dynamic analysis with penetration testing. Computing Systems Lab, Department of Computer Science, Moscow State University (2008)."},{"key":"e_1_3_2_1_48_1","volume-title":"Proceedings of the 20th USENIX Security Symposium (Security)","author":"Politz Joe Gibbs","year":"2011","unstructured":"Joe Gibbs Politz, Spiridon Aristides Eliopoulos, Arjun Guha, and Shriram Krishnamurthi. 2011. ADsafety: Type-Based Verification of JavaScript Sandboxing. In Proceedings of the 20th USENIX Security Symposium (Security). San Francisco, CA, USA."},{"key":"e_1_3_2_1_49_1","unstructured":"portswigger. 2024. Burp Suite - Application Security Testing Software. https:\/\/portswigger.net\/burp."},{"key":"e_1_3_2_1_50_1","unstructured":"portswigger. 2024. Small to mid-size business cybersecurity solutions. https:\/\/portswigger.net\/organizations\/small-business-security."},{"key":"e_1_3_2_1_51_1","unstructured":"primereact. 2023. The Most Complete React UI Component Library. https:\/\/github.com\/primefaces\/primereact."},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623140"},{"key":"e_1_3_2_1_53_1","unstructured":"Ville Santala. 2022. Automated Testing in a CI\/CD pipeline: node. js and react software project. (2022)."},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3236950.3236956"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2018.00033"},{"key":"e_1_3_2_1_56_1","volume-title":"Proceedings of the 32nd USENIX Security Symposium (Security)","author":"Shcherbakov Mikhail","year":"2023","unstructured":"Mikhail Shcherbakov, Musard Balliu, and Cristian-Alexandru Staicu. 2023. Silent spring: Prototype pollution leads to remote code execution in Node. js. In Proceedings of the 32nd USENIX Security Symposium (Security). Anaheim, CA, USA."},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645579"},{"key":"e_1_3_2_1_58_1","unstructured":"snyk.io. 2024. CVE-2023--26158. https:\/\/security.snyk.io\/vuln\/SNYK-JS-MOCKJS-6051365."},{"key":"e_1_3_2_1_59_1","volume-title":"Proceedings of the 27th USENIX Security Symposium (Security)","author":"Staicu Cristian-Alexandru","year":"2018","unstructured":"Cristian-Alexandru Staicu and Michael Pradel. 2018. Freezing the Web: a study of ReDoS vulnerabilities in JavaScript-based web servers. In Proceedings of the 27th USENIX Security Symposium (Security). Baltimore, MD, USA."},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23071"},{"key":"e_1_3_2_1_61_1","volume-title":"Most used web frameworks among developers worldwide, as of","year":"2023","unstructured":"statista.com. 2023. Most used web frameworks among developers worldwide, as of 2023. https:\/\/www.statista.com\/statistics\/1124699\/worldwide-developer-survey-most-used-frameworks-web\/."},{"key":"e_1_3_2_1_62_1","unstructured":"swagger. 2024. OpenAPI Specification. https:\/\/swagger.io\/specification\/."},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623146"},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179317"},{"key":"e_1_3_2_1_65_1","volume-title":"Proceedings of the 28th ACM Conference on Computer and Communications Security (CCS)","author":"Vasilakis Nikos","year":"2021","unstructured":"Nikos Vasilakis, Cristian-Alexandru Staicu, Grigoris Ntousakis, Konstantinos Kallas, Ben Karel, Andr\u00e9 DeHon, and Michael Pradel. 2021. Preventing dynamic library compromise on node. js via rwx-based privilege reduction. In Proceedings of the 28th ACM Conference on Computer and Communications Security (CCS). Virtual Event, Korea."},{"key":"e_1_3_2_1_66_1","unstructured":"W3Techs. 2023. Node.js Statistics: The Updated Guide on Node.js Usage and Trends. https:\/\/www.bacancytechnology.com\/blog\/nodejs-statistics."},{"key":"e_1_3_2_1_67_1","unstructured":"W3Techs. 2024. Snyk security. https:\/\/snyk.io\/."},{"key":"e_1_3_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00081"},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616609"},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179328"},{"key":"e_1_3_2_1_71_1","volume-title":"Proceedings of the 30th USENIX Security Symposium (Security). Virtual Event.","author":"Xiao Feng","year":"2021","unstructured":"Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu, and Wenke Lee. 2021. Abusing hidden properties to attack the node.js ecosystem. In Proceedings of the 30th USENIX Security Symposium (Security). Virtual Event."},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3559340"},{"key":"e_1_3_2_1_73_1","volume-title":"International Symposium on Emerging Information Security and Applications. Springer.","author":"Ye Renjun","year":"2021","unstructured":"Renjun Ye, Liang Liu, Simin Hu, Fangzhou Zhu, Jingxiu Yang, and Feng Wang. 2021. JSLIM: Reducing the known vulnerabilities of JavaScript application by debloating. In International Symposium on Emerging Information Security and Applications. Springer."},{"key":"e_1_3_2_1_74_1","volume-title":"Proceedings of the 28th USENIX Security Symposium (Security)","author":"Zimmermann Markus","year":"2019","unstructured":"Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. 2019. Small world with high risks: A study of security threats in the npm ecosystem. In Proceedings of the 28th USENIX Security Symposium (Security). Santa Clara, CA, USA."}],"event":{"name":"CCS '24: ACM SIGSAC Conference on Computer and Communications Security","location":"Salt Lake City UT USA","acronym":"CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690332","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3658644.3690332","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T06:14:54Z","timestamp":1755843294000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690332"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,2]]},"references-count":74,"alternative-id":["10.1145\/3658644.3690332","10.1145\/3658644"],"URL":"https:\/\/doi.org\/10.1145\/3658644.3690332","relation":{},"subject":[],"published":{"date-parts":[[2024,12,2]]},"assertion":[{"value":"2024-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}