Securing Erlang and Elixir applications
summary
Static analyses implemented on RefactorErl produce a three-layer semantic program graph and about ~20 checkers that detect flaws in Erlang and Elixir; results feed the SAFE toolchain for one‑time audits or CI. Applied to open‑source projects, the analyses find mostly DoS via atom exhaustion, plus OS and injection bugs and unsafe BEAM file loading; an OpenID Connect client issue was reported and fixed. Elixir support reads BEAM abstract code, maps it to the Refactor AST, and reports findings to module+line (loss of exact source ranges).
AI-written summary · about
chapters (17)
- 0:00Security analysis tools intro
- 1:29Static analysis in Refactor
- 3:17Building analysis representation
- 5:03Filtering false positives
- 6:31Open source checkers in Refactor
- 7:12Erlang project vulnerabilities
- 7:57Fixed OpenID Connect example
- 8:42Extending to Elixir apps
- 10:12BEAM code analysis in Elixir
- 11:42Erlang vs Elixir analysis
- 12:45Elixir standard library checkers
- 13:29Elixir vulnerability limits
- 14:34EEx domain-specific analysis
- 15:18Introducing Safe tool
- 16:25Safe in CI pipelines
- 16:48Formal verification research
- 17:55Conclusion
related talks
32mDon’t let it crash: How we applied our security checks on Elixir code
21mWhat Are the Critical Security Flaws in My System?
23mThanks for all the bugs!
47mA Root Canal Static Analysis Based Audit of Zephyr
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
37mSecurity of the BEAM
47mA Root Canal Static Analysis Based Audit of Zephyr
26mSecurity Automation For GraphQL