paperbot · PL 论文追踪

全部论文 待读 收藏

P2 ReuNify: A Step Towards Whole Program Analysis for React Native Android Apps

ReuNify：迈向 React Native Android 应用全程序分析的一步
ASE 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE)2023匹配度 4/10 · 该论文属于静态分析与全程序分析方向，并将 JS 与原生 Android 代码统一到 Soot IR，和用户对程序分析、跨语言分析的方法论兴趣有部分重合；但其目标场景是 React Native 移动应用，不涉及 ML/Agentic 程序、LLM 改进静态分析、浮点程序分析或贝叶斯程序分析等核心研究方向。引用 16 inbox
Yonghui Liu, Xiao Chen, Pei Liu, John Grundy, Chunyang Chen, Li Li
程序分析与抽象解释安全与隐私
crossref: 2026-09-12dblp: 2026-09-12arxiv: 2026-09-12

AI 速览

一句话：提出 REUNIFY，将 React Native 应用的 JavaScript 与原生代码统一为 Soot 中间表示，实现全程序静态分析。

React Native 允许 JavaScript 代码通过其通信机制与原生代码（Android 上的 Java/Kotlin）交互，但已有研究与工具忽视了这一机制，导致对 React Native 应用的分析不完整。本文提出 REUNIFY，一个将 React Native 应用的 JavaScript 与原生代码统一转换为 Soot 静态分析框架可处理的中间语言的原型工具，从而生成完整的应用行为模型。作者在 1,007 个最流行的 React Native Android 应用上进行评估：Jimple 代码行数平均增加 70%，调用图可达新节点平均增加 84%；用于污点流分析时平均多发现两个隐私泄露。结果表明 REUNIFY 显著增强了基于 Soot 的框架分析 React Native Android 应用的能力。

问题
React Native 通过通信机制桥接 JavaScript 与原生代码，已有静态分析工具忽略该机制，导致对 React Native 应用代码的分析不完整。
方法
开发 REUNIFY 原型工具，将 React Native 应用的 JavaScript 端与原生端代码整合为 Soot 可处理的中间语言（Jimple），以构建完整的应用行为模型。
评估
在 1,007 个最流行的 React Native Android 应用上评估：Jimple 代码行数增加 70%，调用图新节点平均增加 84%，污点流分析平均多发现两个隐私泄露。
原文摘要（Abstract）

React Native is a widely-used open-source frame-work that facilitates the development of cross-platform mobile apps. The framework enables JavaScript code to interact with native-side code, such as Objective-C/Swift for iOS and Java/Kotlin for Android, via a communication mechanism provided by React Native. However, previous research and tools have overlooked this mechanism, resulting in incomplete analysis of React Native app code. To address this limitation, we have developed REUNIFY, a prototype tool that integrates the JavaScript and native-side code of React Native apps into an intermediate language that can be processed by the Soot static analysis framework. By doing so, REUNIFY enables the generation of a comprehensive model of the app's behavior. Our evaluation indicates that, by leveraging REUNIFY, the Soot-based framework can improve its coverage of static analysis for the 1,007 most popular React Native Android apps, augmenting the number of lines of Jimple code by 70%. Additionally, we observed an average increase of 84% in new nodes reached in the callgraph for these apps, after integrating REUNIFY. When REUNIFY is used for taint flow analysis, an average of two additional privacy leaks were identified. Overall, our results demonstrate that REUNIFY significantly enhances the Soot-based framework's capability to analyze React Native Android apps.

链接与引用

DOI 原文 · arXiv · PDF（开放获取） · DBLP

BibTeX 
@inproceedings{abs-2309-03524,
  title = {ReuNify: A Step Towards Whole Program Analysis for React Native Android Apps},
  author = {Yonghui Liu and Xiao Chen and Pei Liu and John Grundy and Chunyang Chen and Li Li},
  booktitle = {ASE},
  year = {2023},
  doi = {10.1109/ase56229.2023.00113}
}