Detecting JavaScript libraries using identifiers and hashes
Saša Lončarević, Bruno Skendrović, Ivan Kovačević, Stjepan Groš · 2023
The web is a widespread platform for data exchange and service delivery on which many depend. Due to the high demand for website creation, methods are offered that provide more time-efficient design and programming. One of them is using JavaScript libraries, which can introduce vulnerabilities into web applications. Because of the sheer number of websites, as well as libraries and their vulnerabilities, it is difficult to maintain website security. There is a need to create tools that will automatically and proactively search for vulnerable libraries and enable timely remediation. This paper deals with the aforementioned problem and provides an insight into the implemented solution. The paper describes how JavaScript libraries are obtained and used, and proposes multiple methods for detecting them. It also presents the technical side of the implementation, as well as the results obtained by detecting libraries on a set of web pages from the Croatian web space. Finally, we discuss the observed distribution of popular libraries and their vulnerabilities, as well as the limitations of the proposed implementation, and offer potential solutions with the aim of improving the project.