| Title | Static analysis of implicit control flow: Resolving Java reflection and Android intents |
| Publication Type | Miscellaneous |
| Year of Publication | 2015 |
| Authors | Barros P, Just R, Millstein S, Vines P, Dietl W, d'Amorim M, Ernst MD |
| Date or Month Published | May |
| Abstract | Implicit or indirect control flow is a transfer of control between procedures using some mechanism other than an explicit procedure call. Implicit control flow is a staple design pattern that adds flexibility to system design. However, it is challenging for a static analysis to compute or verify properties about a system that uses implicit control flow. \par This paper presents static analyses for two types of implicit control flow that frequently appear in Android apps: Java reflection and Android intents. Our analyses help to resolve where control flows and what data is passed. This information improves the precision of downstream analyses, which no longer need to make conservative assumptions about implicit control flow. \par We have implemented our techniques for Java. We enhanced an existing security analysis with a more precise treatment of reflection and intents. In a case study involving ten real-world Android apps that use both intents and reflection, precision of the security analysis was increased on average by two orders of magnitude. |
| Downloads | https://types.cs.washington.edu/sparta/ SPARTA toolset
https://checkerframework.org/ Checker Framework
|
| Citation Key | BarrosJMVDdAE2015:TR-UW-CSE-15-05-01 |
