一句话：提出首个面向 Java 数据库支撑应用的指针分析 DBridge，统一建模应用代码、数据库框架与 SQL，并配套微基准 DB-Micro。
数据库支撑应用是现代软件的基石，但应用代码、JDBC/Hibernate/Spring Data JPA 等框架以及 Java 与 SQL 之间的复杂交互，给静态分析带来很大挑战。本文提出 DBridge，这是首个专门面向 Java 数据库支撑应用的指针分析，能够在单一指针分析框架中统一应用代码分析、数据库访问规约建模、SQL 分析与数据库抽象，从而静态构建完整的 Java 到数据库的值流，并覆盖广泛的数据库访问 API 和框架。作者同时提出 DB-Micro，一个包含 824 个测试用例的微基准套件，用于系统评估此类静态分析。实验表明，DBridge 在 DB-Micro 与大型真实应用上均能高效构建 Java 到数据库值流，具有高召回率与高精度，在 SQL 语句识别上优于现有工具。三个面向安全与程序理解的客户端分析进一步发现 30 个存储型 XSS 漏洞和 3 个水平越权漏洞，并在模式变更影响分析中取得高检出率。DBridge（14K LoC）与 DB-Micro（22K LoC）已开源。
Database-backed applications form the backbone of modern software, yet their complexity poses significant challenges for static analysis. These applications involve intricate interactions among application code, diverse database frameworks such as JDBC, Hibernate, and Spring Data JPA, and languages like Java and SQL. In this paper, we introduce DBridge, the first pointer analysis specifically designed for Java database-backed applications, capable of statically constructing comprehensive Java-to-database value flows. DBridge unifies application code analysis, database access specification modeling, SQL analysis, and database abstraction within a single pointer analysis framework, capturing interactions across a wide range of database access APIs and frameworks. Additionally, we present DB-Micro, a new micro-benchmark suite with 824 test cases crafted to systematically evaluate static analysis for database-backed applications. Experiments on DB-Micro and large, complex, real-world applications demonstrate DBridge’s effectiveness, achieving high recall and precision in building Java-to-database value flows efficiently and outperforming state-of-the-art tools in SQL statement identification. To further validate DBridge’s utility, we develop three client analyses for security and program understanding. Evaluation on these real-world applications reveals 30 Stored XSS attack vulnerabilities and 3 horizontal broken access control vulnerabilities, all previously undiscovered and real, as well as a high detection rate in impact analysis for schema changes. By open-sourcing DBridge (14K LoC) and DB-Micro (22K LoC), we seek to help advance static analysis for modern database-backed applications in the future.
@article{paperbot3132,
title = {Pointer Analysis for Database-Backed Applications},
author = {Yufei Liang and Teng Zhang and Ganlin Li and Tian Tan and Chang Xu and Chun Cao and Xiaoxing Ma and Yue Li},
journal = {Proceedings of the ACM on Programming Languages},
volume = {9},
number = {PLDI},
year = {2025},
doi = {10.1145/3729307}
}