一句话：首个 WebView 诱发缺陷（ωBugs）实证研究，并提出自动化测试技术 ωDroid 检出 30 个未知缺陷。
WebView 是 Android 中广泛使用的组件，它让原生应用具备浏览器能力并简化原生代码与 Web 代码的互操作，但这种交互机制也引入了新型缺陷（ωBugs）。本文基于流行开源 Android 应用中的此类缺陷开展了首个实证研究，系统归纳了 ωBugs 的主要根因与表现形式，并得到若干可用于检测和诊断的有益观察。在实证研究基础上，作者提出自动化测试技术 ωDroid，以有效暴露 Android 应用中的 ωBugs。实验将 ωDroid 应用于 146 个开源 Android 应用，成功发现 30 个此前未知且互不相同的 ωBugs，并全部报告给相应开发者；其中 14 个得到确认，7 个已被修复，表明 ωDroid 能有效检测开发者真正关心的 ωBugs。
WebView is a widely used Android component that augments a native app with web browser capabilities. It eases the interactions between an app’s native code and web code. However, the interaction mechanism of WebView induces new types of bugs in Android apps. Understanding the characteristics and manifestation of these WebView-induced bugs (ωBugs for short) facilitates the correct usages of WebViews in Android apps. This motivates us to conduct the first empirical study on ωBugs based on those found in popular open-source Android apps. Our study identified the major root causes and consequences of ωBugs and made interesting observations that can be leveraged for detecting and diagnosing ωBugs. Based on the empirical study, we further propose an automated testing technique ωDroid to effectively expose ωBugs in Android apps. In our experiments, ωDroid successfully discovered 30 unique and previously-unknown ωBugs when applied to 146 open-source Android apps. We reported the 30 ωBugs to the corresponding app developers. Out of these 30 ωBugs, 14 were confirmed and 7 of them were fixed. This shows that ωDroid can effectively detect ωBugs that are of the developers’ concern.
DOI 原文 ·
@inproceedings{paperbot4752,
title = {A tale of two cities: how WebView induces bugs to Android applications},
author = {Jiajun Hu and Lili Wei and Yepang Liu and Shing-Chi Cheung and Huaxun Huang},
booktitle = {ASE},
year = {2018},
doi = {10.1145/3238147.3238180}
}