一句话：提出静态分析框架 Jasmine，提升 Spring 应用调用图完整性，并有性能与安全分析实证。
Spring 框架广泛用于企业 Web 应用开发，其核心技术（如依赖注入和面向切面编程）在实现中大量使用动态特性，导致静态分析难以准确推理 Spring 应用的行为，特别是调用图完整性不足。本文提出 Jasmine，一个从 Soot 扩展而来的面向 Spring 核心技术的静态分析框架，旨在增强调用图完整性而不显著牺牲性能。作者在 Spring 微基准以及 18 个真实 Spring 程序上评估了 Jasmine 的完整性、精度和性能，实验表明其能有效提升基于 Soot 和 Doop 的最先进工具对 Spring 核心技术的支持。作者还将 Jasmine 集成到 FlowDroid 中，并在基准程序中发现了 12 条敏感信息泄露路径。Jasmine 有望为需要更完整调用图的 Spring 应用程序分析场景带来显著收益。
The Spring framework is widely used in developing enterprise web applications. Spring core technologies, such as Dependency Injection and Aspect-Oriented Programming, make development faster and easier. However, the implementation of Spring core technologies uses a lot of dynamic features. Those features impose significant challenges when using static analysis to reason about the behavior of Spring-based applications. In this paper, we propose Jasmine, a static analysis framework for Spring core technologies extends from Soot to enhance the call graph’s completeness while not greatly affecting its performance. We evaluate Jasmine’s completeness, precision, and performance using Spring micro-benchmarks and a suite of 18 real-world Spring programs. Our experiments show that Jasmine effectively enhances the state-of-the-art tools based on Soot and Doop to better support Spring core technologies. We also add Jasmine support to FlowDroid and discovered twelve sensitive information leakage paths in our benchmarks. Jasmine is expected to provide significant benefits for many program analyses scenes of Spring applications where more complete call graphs are required.