Abstract:WebAssembly is revolutionizing the approach to developing modern applications. Although this technology was born to create portable and performant modules in web browsers, currently, its capabilities are extensively exploited in multiple and heterogeneous use-case scenarios. With the extensive effort of the community, new toolkits make the use of this technology more suitable for real-world applications. In this context, it is crucial to study the liaisons between the WebAssembly ecosystem and software security. Indeed, WebAssembly can be a medium for improving the security of a system, but it can also be exploited to evade detection systems or for performing cryptomining activities. In addition, programs developed in low-level languages such as C can be compiled in WebAssembly binaries, and it is interesting to evaluate the security impacts of executing programs vulnerable to attacks against memory in the WebAssembly sandboxed environment. Also, WebAssembly has been designed to provide a secure and isolated environment, but such capabilities should be assessed in order to analyze their weaknesses and propose new mechanisms for addressing them. Although some research works have provided surveys of the most relevant solutions aimed at discovering WebAssembly vulnerabilities or detecting attacks, at the time of writing, there is no comprehensive review of security-related literature in the WebAssembly ecosystem. We aim to fill this gap by proposing a comprehensive review of research works dealing with security in WebAssembly. We analyze 121 papers by identifying seven different security categories. We hope that our work will provide insights into the complex landscape of WebAssembly and guide researchers, developers, and security professionals towards novel avenues in the realm of the WebAssembly ecosystem.

Semantics and Security Issues in JavaScript

Semantic Security: Privacy Definitions Revisited.

Characterizing JavaScript Security Code Smells

Jasmine: Scale Up JavaScript Static Security Analysis with Computation-based Semantic Explanation

A Semantic Framework for the Security Analysis of Ethereum Smart Contracts

Semantics-Based Analysis of Content Security Policy Deployment

The Essence of JavaScript

Secure Semantic Communications: Challenges, Approaches, and Opportunities

An analysis of the dynamic behavior of JavaScript programs

Transaction-based Sandboxing for JavaScript

A Security Study about Electron Applications and a Programming Methodology to Tame DOM Functionalities.

SafeJS: Hermetic Sandboxing for JavaScript

Secure Coding Practices in Java: Challenges and Vulnerabilities

Looking for Criminal Intents in JavaScript Obfuscated Code

What are developers talking about information security? A large-scale study using semantic analysis of Q&A posts

Mayall: A Framework for Desktop JavaScript Auditing and Post-Exploitation Analysis

WebAssembly and Security: a review

A Simple Semantics and Static Analysis for Stack Inspection

Towards an Axiomatic Verification System for JavaScript

Executable Operational Semantics of Solidity

Secure Semantic Communications: Fundamentals and Challenges