Making JavaScript safer: finding security issues in real-world code

JavaScript powers much of the modern web and is also widely used in server, desktop, and mobile applications. Its flexibility and enormous ecosystem make software development easier, but they also make it difficult to identify security problems automatically.

During his PhD studies, Wenyuan Xu developed new techniques that make automated security analysis more practical for real-world JavaScript. One technique makes the analysis of large programs significantly faster by avoiding redundant work. Another reconstructs bundled JavaScriptÔÇöthe transformed code that is actually deployed on many websitesÔÇöso existing security tools can discover problems that would otherwise remain hidden. In a large-scale study, this technique enabled a widely used security analyzer to report more than 3,000 additional security alerts in web code. The project also developed a method for analysing third-party JavaScript packages that may contain deliberately malicious code. By combining automated code analysis with lightweight protection while the program runs, the method can identify security-sensitive behaviour even when malicious code attempts to evade analysis. The results show that practical performance and stronger security guarantees can be achieved together for real-world JavaScript software.

The PhD degree was completed at the **Department of Computer Science, Faculty of Natural Sciences, Aarhus University**.

This summary was prepared by the PhD student.

Time: Friday, 18 September, 2026
Place: Building 5341, room 333, Aarhus University
Title of dissertation: Practical Static Analysis for JavaScript Security: Scalability and Soundness
Contact information: Wenyuan Xu, e-mail: wenyuan.xu@cs.au.dk, tel.: +45 50341971
Members of the assessment committee:
Professor Eric Bodden, Paderborn University, Germany  
Associate Professor Alexandros Kapravelos, North Carolina State University, USA  
Associate Professor Amin Timany (chair), Aarhus University, Denmark
Main supervisor: Professor Anders M├©ller, Department of Computer Science, Aarhus University
Language: The PhD dissertation will be defended in English.

The defence is public.
The PhD thesis is available for reading at the Graduate School of Natural Sciences/GSNS, Ny Munkegade 120, building 1521, 8000 Aarhus C