一句话：以简洁逻辑规则在 Doop 中建模 Java 动态代理语义，使静态分析得以穿透代理层。
动态代理是 Java 最常用的动态特性之一，允许运行时代码生成与链接，但由此产生的动态字节码层使现有静态分析无法穿透，导致大量代码不可达或建模不完整。本文观察到动态代理 API 的用法足够规整，因而可以静态建模。作者在 Doop 静态分析框架中，用一组简洁的逻辑规则直接刻画动态代理的语义，从而使 Doop 的标准分析能够处理代理背后的代码。评估基于真实 Java 程序语料 XCorpus：该方法完全处理了其中 95% 的代理创建点，并成功分析了大量此前不可达或建模不完整的代码，证明了动态特性可被静态分析有效捕获。
The dynamic proxy API is one of Java’s most widely-used dynamic features, permitting principled run-time code generation and link- ing. Dynamic proxies can implement any set of interfaces and for- ward method calls to a special object that handles them reflectively. The flexibility of dynamic proxies, however, comes at the cost of having a dynamically generated layer of bytecode that cannot be penetrated by current static analyses. In this paper, we observe that the dynamic proxy API is stylized enough to permit static analysis. We show how the semantics of dynamic proxies can be modeled in a straightforward manner as logical rules in the Doop static analysis framework. This concise set of rules enables Doop’s standard analyses to process code behind dynamic proxies. We evaluate our approach by analyzing XCorpus, a corpus of real-world Java programs: we fully handle 95% of its reported proxy creation sites. Our handling results in the analysis of significant portions of previously unreachable or incompletely- modeled code.
DOI 原文 ·
@inproceedings{paperbot4830,
title = {Static analysis of Java dynamic proxies},
author = {George Fourtounis and George Kastrinis and Yannis Smaragdakis},
booktitle = {ISSTA},
year = {2018},
doi = {10.1145/3213846.3213864}
}