Users beware: preference inconsistencies ahead

Behrang, Farnaz; Cohen, Myra B.; Orso, Alessandro

doi:10.1145/2786805.2786869

Cited by 23 publications

(8 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the existing techniques [6], [8], [10], [11] analyze configuration APIs by conducting path-insensitive analysis, which can be somewhat inaccurate and miss incompatible configuration APIs without considering the if-conditions (e.g., Line 6 in Figure 2). Therefore, a path-sensitive analysis is necessary to obtain {A, X , F} by solving path constraints triggering configuration APIs with the constraint solver.…”

Section: B Confdroid Overviewmentioning

confidence: 99%

Characterizing and Detecting Configuration Compatibility Issues in Android Apps

Huang¹,

Wen²,

Wei³

et al. 2021

Preprint

View full text Add to dashboard Cite

XML configuration files are widely used in Android to define an app's user interface and essential runtime information such as system permissions. As Android evolves, it might introduce functional changes in the configuration environment, thus causing compatibility issues that manifest as inconsistent app behaviors at different API levels. Such issues can often induce software crashes and inconsistent look-and-feel when running at specific Android versions. Existing works incur plenty of false positive and false negative issue-detection rules by conducting trivial data-flow analysis while failing to model the XML tree hierarchies of the Android configuration files. Besides, little is known about how the changes in an Android framework can induce such compatibility issues. To bridge such gaps, we conducted a systematic study by analyzing 196 real-world issues collected from 43 popular apps. We identified common patterns of Android framework code changes that induce such configuration compatibility issues. Based on the findings, we propose CONFDROID that can automatically extract rules for detecting configuration compatibility issues. The intuition is to perform symbolic execution based on a model learned from the common code change patterns. Experiment results show that CONFDROID can successfully extract 282 valid issue-detection rules with a precision of 91.9%. Among them, 65 extracted rules can manifest issues that cannot be detected by the rules of stateof-the-art baselines. More importantly, 11 out of them have led to the detection of 107 reproducible configuration compatibility issues that the baselines cannot detect in 30 out of 316 real-world Android apps.

show abstract

Section: B Confdroid Overviewmentioning

confidence: 99%

Characterizing and Detecting Configuration Compatibility Issues in Android Apps

Huang¹,

Wen²,

Wei³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Configurations are loaded by reading from an external file or database and storing parameter values in program variables. Mature projects have well-defined application programming interfaces (APIs) for loading configurations [2,12,38,39,40,41,42,43]. All projects evaluated in this paper have such APIs.…”

Section: Configurations and Their Usagementioning

confidence: 99%

Understanding and discovering software configuration dependencies in cloud and datacenter systems

Chen

Wang

Legunsen

et al. 2020

Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Softw

View full text Add to dashboard Cite

A large percentage of real-world software configuration issues, such as misconfigurations, involve multiple interdependent configuration parameters. However, existing techniques and tools either do not consider dependencies among configuration parameters-termed configuration dependencies-or rely on one or two dependency types and code patterns as input. Without rigorous understanding of configuration dependencies, it is hard to deal with many resulting configuration issues.This thesis presents our study of software configuration dependencies in 16 widely-used cloud and datacenter systems, including dependencies within and across software components. To understand types of configuration dependencies, we conduct an exhaustive search of descriptions in structured configuration metadata and unstructured user manuals. We find and manually analyze 521 configuration dependencies. We define five types of configuration dependencies and identify their common code patterns. We report on consequences of not satisfying these dependencies and current software engineering practices for handling the consequences.We mechanize the knowledge gained from our study in a tool, cDep, which detects configuration dependencies. cDep automatically discovers five types of configuration dependencies from bytecode using static program analysis. We apply cDep to the eight Java and Scala software systems in our manual study. cDep finds 87.9% (275/313) of the related subset of dependencies from our study. cDep also finds 448 previously undocumented dependencies, with a 6.0% average false positive rate. Overall, our results show that configuration dependencies are more prevalent and diverse than previously reported and should henceforth be considered a first-class issue in software configuration engineering.

show abstract

“…Researchers have developed various tools to automatically check for errors in software configurations (e.g., [18], [19]). Unlike the configurations found in cloud instances, these tools are mainly geared towards configurations that are represented as key-value pairs, where each key consistently corresponds to a specific configuration parameter.…”

Section: Configuration Analysismentioning

confidence: 99%

“…Such keyvalue pairs can be directly used by the existing configuration analysis tools such as Encore [14] and ConfigV [21]. While existing studies on configuration analysis have mostly focused on configuration stores that do not require data extraction such as Windows Registry (e.g., [26]), or configurations with standard file formats such as XML or JSON (e.g., [19], [27]), most configuration files of cloud applications are kept in human-readable text files that do not use standard file formats. As discused in Sec.…”

Section: Extractionmentioning

confidence: 99%

ConfEx: Towards Automating Software Configuration Analytics in the Cloud

Tuncer

Bila²,

Duri³

et al. 2018

2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W)

View full text Add to dashboard Cite

Modern cloud services have complex architectures, often comprising many software components, and depend on hundreds of configurations parameters to function correctly, securely, and with high performance. Due to the prevalence of open-source software, developers can easily deploy services using third-party software without mastering the configurations of that software. As a result, configuration errors (i.e., misconfigurations) are among the leading causes of service disruptions and outages. While existing cloud automation tools ease the process of service deployment and management, support for detecting misconfigurations in the cloud has not been addressed thoroughly, likely due to the lack of frameworks suitable for consistent parsing of unstandardized configuration files. This paper introduces ConfEx, a framework that enables discovery and extraction of text-based software configurations in the cloud. ConfEx uses a novel vocabulary-based technique to identify configuration files in cloud system instances with unlabeled content. To extract the information in these files, ConfEx leverages existing configuration parsers and post-processes the extracted data for analysis. We show that ConfEx achieves over 99% precision and 100% recall in identifying configuration files on 7805 popular Docker Hub images. Using two applied examples, we demonstrate that ConfEx also enables detecting misconfigurations in the cloud via existing tools that are designed for configurations represented as key-value pairs, revealing 184 errors in public Docker Hub images.

show abstract