Understanding and Analyzing Java Reflection

Abstract

Java reflection has been increasingly used in a wide range of software. It allows a software system to inspect and/or modify the behaviour of its classes, interfaces, methods and fields at runtime, enabling the software to adapt to dynamically changing runtime environments. However, this dynamic language feature imposes significant challenges to static analysis, because the behaviour of reflection-rich software is logically complex and statically hard to predict, especially when manipulated frequently by statically unknown string values. As a result, existing static analysis tools either ignore reflection or handle it partially, resulting in missed, important behaviours, i.e., unsound results. Therefore, improving or even achieving soundness in (static) reflection analysis-an analysis that infers statically the behaviour of reflective code-will provide significant benefits to many analysis clients, such as bug detectors, security analyzers and program verifiers.This paper makes two contributions: we provide a comprehensive understanding of Java reflection through examining its underlying concept, API and real-world usage, and, building on this, we introduce a new static approach to resolving Java reflection effectively in practice. We have implemented our reflection analysis in an open-source tool, called SOLAR, and evaluated its effectiveness extensively with large Java programs and libraries. Our experimental results demonstrate that SOLAR is able to (1) resolve reflection more soundly than the state-of-the-art reflection analysis; (2) automatically and accurately identify the parts of the program where reflection is resolved unsoundly or imprecisely; and (3) guide users to iteratively refine the analysis results by using lightweight annotations until their specific requirements are satisfied.

Effects of Program Representation on Pointer Analyses — An Empirical Study

“…Here, we have used the TamiFlex framework for handling reflection calls. Other approaches have improved the reflection handling [10,[15][16][17][18]25]. To convince ourself, we experimented with one of the state-of-the-art techniques, i.e., reflection with matching substring resolution [10].…”

“…Researchers have proposed various approaches to enhance the precision and soundness of static analyses [6,9,10,14,17,26,30,31]. They use program analysis frameworks to prototype and evaluate their algorithms.…”

Graphical Flow-based Spark Programming

“…Message part 1: (contains the generic method invocation statement): The component in its 'internal logic' has the necessary code to check the category of the component. Accordingly, Java statements to invoke the standalone method implementation of the encapsulated Spark APIs via reflection [63,64] are added for every vertex. These Java statements form the main methods in Spark Driver program.…”

Salsa: static analysis of serialization features

“…In this paper, we focus on aiding points to analysis in handling by serialization-related features in a program. Previous research on static analysis also explored the challenges involving supporting reflection features [6,24,25,34]. These approaches involve making certain assumptions when performing the analysis, in order to create analyses that are not overly imprecise.…”

“…Therefore, ignoring such constructs leads to unsound callgraphs; they miss feasible runtime paths because they cannot infer the possible execution from the code [29,30,37]. To tackle this problem, previous literature explored certain classes of dynamic features, such as reflection features [6,24,25,34], and programs with Remote Method Invocation (RMI) [33]. However, as demonstrated by Reif et al [29,30], one programming construct that has been left out from the programming analysis techniques is the support for handling serialization (and deserialization) of objects.…”