Static path conditions for Java

Abstract

A static path condition is a precise necessary condition for information flow between two program points. Previous work defined path conditions for procedural languages. Object oriented languages offer additional constructs such as dynamic dispatch, instanceof and exceptions. In this paper, we present an analysis of these constructs, which leads to precise path conditions operating only on the program's variables. This yields a gain in precision, allowing leverage of automatic constraint solving. We present details of path condition generation for Java constructs, and discuss preliminary insight from our prototype implementation.

Flow-sensitive, context-sensitive, and object-sensitive information flow control based on program dependence graphs

“…The average slice size is 86,023 nodes, which is about 64% of the whole source code. This is more than what is typical for backward slices, due to the higher coupling of JavaCard in contrast to normal Java, and illustrates why precise witnesses can only be achieved via path conditions as described in [21,22,47].…”

“…In addition, we proposed an even stronger mechanism on top of PDGs, called path conditions [22,47,54,55]. Path conditions are necessary and precise conditions for flow x → * y, and reveal detailed circumstances of a flow in terms of conditions on program variables.…”

Two techniques to improve the precision of a demand-driven null-dereference verification approach

“…The novelty of our technique is as follows. While certain previous approaches [9,10,11] have used the transitive closure of the immediate-producer relation (which is known as a thin slice) to perform certain inexpensive, approximate analyses, ours is the first to our knowledge to use immediate producers within the overall context of a precise, path-sensitive analysis to skip localized regions of code conservatively.…”

“…Sridharan et al originally proposed thin slicing to support program understanding and debugging tasks; they argued that thin slices were much smaller than full slices, while managing to include statements that are pertinent to program understanding and debugging tasks. Then, subsequently proposed approaches [11,10,9] have used the thin slice as a program abstraction (as opposed to using the full program) to carry out different kinds of analyses (not null-deference analysis, though). We did originally consider an approach similar to the ones referred to above.…”

“…This is done to find permissions for components such that these permissions are neither too restrictive nor too permissive. Hammer et al [11] propose an approach to identify potential run-time types of object references. All three techniques use thin slicing to identify all possible sources from which information flows (via transitive copy statements) into a given sink.…”