More Sound Static Handling of Java Reflection

Smaragdakis, Yannis; Balatsouras, George; Kastrinis, George; Bravenboer, Martin

doi:10.1007/978-3-319-26529-2_26

Cited by 44 publications

(33 citation statements)

References 24 publications

(32 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The literature survey suggests looking into combinations with dynamic analysis and user annotations. Note that the highly advanced analysis tools already solve a number of these challenges (such as exception handling), but further improvement to get similar accuracy for higher efficiency is warranted since these tools would run faster on a part of the corpus [10].…”

Section: E Implications For Static Analysis Researchersmentioning

confidence: 99%

Challenges for Static Analysis of Java Reflection - Literature Review and Empirical Study

Landman

Serebrenik

Vinju

2017

2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

Abstract-The behavior of software that uses the Java Reflection API is fundamentally hard to predict by analyzing code. Only recent static analysis approaches can resolve reflection under unsound yet pragmatic assumptions. We survey what approaches exist and what their limitations are. We then analyze how realworld Java code uses the Reflection API, and how many Java projects contain code challenging state-of-the-art static analysis.Using a systematic literature review we collected and categorized all known methods of statically approximating reflective Java code. Next to this we constructed a representative corpus of Java systems and collected descriptive statistics of the usage of the Reflection API. We then applied an analysis on the abstract syntax trees of all source code to count code idioms which go beyond the limitation boundaries of static analysis approaches. The resulting data answers the research questions. The corpus, the tool and the results are openly available.We conclude that the need for unsound assumptions to resolve reflection is widely supported. In our corpus, reflection can not be ignored for 78 % of the projects. Common challenges for analysis tools such as non-exceptional exceptions, programmatic filtering meta objects, semantics of collections, and dynamic proxies, widely occur in the corpus. For Java software engineers prioritizing on robustness, we list tactics to obtain more easy to analyze reflection code, and for static analysis tool builders we provide a list of opportunities to have significant impact on real Java code.Keywords-Java; Reflection; Static Analysis; Systematic Literature Review; Empirical Study I. I Static analysis techniques are applied to support the efficiency and quality of software engineering tasks. Be it for understanding, validating, or refactoring source code, pragmatic static analysis tools exist to reduce error-prone manual labor and to increase the comprehension of complex software artefacts.Static analysis of object-oriented code is an exciting, ongoing and challenging research area, made especially challenging by dynamic language features (a.k.a. reflection). The Java Reflection API allows programmers to dynamically inspect and interact with otherwise static language concepts such as classes, fields and methods, e.g., to dynamically instantiate objects, set fields and invoke methods. These dynamic language features are useful, but their usage also wreaks havoc on the accuracy of static analysis results. This is due to the undecidability of resolving dynamic names and dynamic types.Until 2005, the analysis of code which uses the Reflection API was considered to be out of bounds for static analysis, and handled via user annotations or dynamic analysis; handling reflection would inherently be either unsound (due to unverified assumptions) or highly inaccurate (due to over-approximation) and render the contemporary static analysis tools impractical. Then, in 2005 Livshits et al. [1] published an analysis of how reflection was used in six large Java projects...

show abstract

Section: E Implications For Static Analysis Researchersmentioning

confidence: 99%

Challenges for Static Analysis of Java Reflection - Literature Review and Empirical Study

Landman

Serebrenik

Vinju

2017

2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

show abstract

“…In 11 out of the 17 apps, Ripple has successfully discovered more true targets than StrInf . This highlights the importance of making reflection analysis fully IIE‐aware for Android apps, by handling not only Case 2 as for Java programs but also Case 3.…”

Section: Discussionmentioning

confidence: 99%

“…Similarly, v may point to a non‐null object but with a statically unknown type. In this case, we can resolve the reflective calls in lines 6 to 9 by performing type inference to deduce what clz, mtd, and the objects pointed to by v are, as done previously for Java programs …”

Section: Iies In Android Appsmentioning

confidence: 99%

Ripple: Reflection analysis for Android apps in incomplete information environments

Zhang

Tan

et al. 2018

Softw Pract Exp

View full text Add to dashboard Cite

Summary Reflection poses grave problems for static security analysis, despite its widespread use in Android apps. In general, string inference has been mainly used to handle reflection, resulting in significantly missed security vulnerabilities. In this work, we bring forward the ubiquity of incomplete information environments (IIEs) for Android apps, where some critical dataflows are missing during static analysis and the need for resolving reflective calls under IIEs. We present Ripple, the first IIE‐aware static reflection analysis for Android apps that resolves reflective calls more soundly than string inference. Validation with 17 popular Android apps from Google Play demonstrates the effectiveness of Ripple in discovering reflective targets with a low false positive rate (due to its trade‐off made among soundness, precision, and scalability). As a result, Ripple enables FlowDroid, a taint analysis for Android apps, to find hundreds of sensitive data leakages that would otherwise be missed. As a fundamental analysis, Ripple will be valuable for many security analysis clients, since more program behaviors can now be analyzed under IIEs.

show abstract

“…Recent work by Li et al [10] and Smaragdakis et al [16] present promising new approaches to fully-static resolution of reflective calls in Java. Both techniques leverage meaningful operations performed on the return value of reflective calls (such as downcasts) to provide a more sound handling of reflection without compromising scalability.…”

Section: Related Workmentioning

confidence: 99%

Droidel: a general approach to Android framework modeling

Blackshear

Gendreau

Chang

2015

Proceedings of the 4th ACM SIGPLAN International Workshop on State of the Art in Program Analysis

View full text Add to dashboard Cite

We present an approach and tool for general-purpose modeling of Android for static analysis. Our approach is to explicate the reflective bridge between the Android framework and an application to make the framework source amenable to static analysis. Our DROIDEL tool does this by automatically generating application-specific stubs that summarize the reflective behavior for a particular app. The result is a program with a single entry-point that can be processed by any existing Java analysis platform (e.g., Soot, WALA, Chord). We compared call graphs constructed using DROIDEL to call graphs constructed using a state-of-the-art Android model and found that DROIDEL captures more concrete behaviors.

show abstract

More Sound Static Handling of Java Reflection

Cited by 44 publications

References 24 publications

Challenges for Static Analysis of Java Reflection - Literature Review and Empirical Study

Challenges for Static Analysis of Java Reflection - Literature Review and Empirical Study

Ripple: Reflection analysis for Android apps in incomplete information environments

Droidel: a general approach to Android framework modeling

Contact Info

Product

Resources

About