jgap freetts gruntspud jedit columba jfreechart

Transcription

1

2 SQL injections 100% 80% 60% 40% 20% 0% jgap freetts gruntspud jedit columba jfreechart

3 !" #$ %& "" '( ()(* +, -

4 ./0 static Class Class.forName(String classname) java.lang.class 0 +**Class.forName( java.lang.string ) 0String Object Class.newInstance() 0 "0 Class c = Class.forName( java.lang.string ); Object o = c.newinstance(); "o

5 ! (Class 0 0( 1. String classname =...; 2. Class c = Class.forName(className); 3. Object o = c.newinstance(); T 1 (); 4. T t = (T) o; new T 2 ();... # Class.newInstance"#new T()

6 $% 0 '

7 & ' ( public void addhandlers(string path) {... while (it.hasnext()) { XmlElement child = (XmlElement) it.next(); String id = child.getattribute("id"); String clazz = child.getattribute("class"); } } 1 AbstractPluginHandler handler = null; try { Class c = Class.forName(clazz); handler = (AbstractPluginHandler) 2 3,4 registerhandler(handler); } catch (ClassNotFoundException e) {... } c.newinstance();

8 ) * #4 4 0 #

9 +$ + " " 4 " )4

10 ,' - 1. String classname =...; 2. Class c = Class.forName(className); 3. Object o = c.newinstance(); 4. T t = (T) o;./' 0 4/' 1/*0T 2/' 03className 9 4 9; 1" ( " 9 T 9' : " " classname

11 ' 03 5 <classname String stringclass = java.lang.string ; foo(stringclass);... void foo(string clazz){ bar(clazz); } void bar(string classname){ Class c = Class.forName(className); } 9

12 ( ' 0 6 Stack variables Heap objects stringclass clazz classname java.lang.string

13 7 ( ) 1. String classname =...; 2. Class c = Class.forName(className); 3. Object o = c.newinstance(); 4. T t = (T) o; :""classname java.lang.string ' 2"className : &0

14 Constants Specification points Class.forName(className)

15 String classname = r.readline(); 2. Class c = Class.forName(className); 3. Object o = c.newinstance(); 4. T t = (T) o; :"classname " =* r.readline =." 1 >*? T :

16 ./* 8 Format: invocation site => class 43 InetAddress.java:1231 => java.net.inet4addressimpl 43 InetAddress.java:1231 => java.net.inet6addressimpl 86 AbstractCharsetProvider.java:126 => sun.nio.cs.iso_8859_15 86 AbstractCharsetProvider.java:126 => sun.nio.cs.ms DataFlavor.java:64 => java.io.inputstream

17 4/7 1. String classname =...; 2. Class c = Class.forName(className); 3. Object o = c.newinstance(); 4. T t = (T) o; 2( ( < o instanceof T o =* T

18 ' 0'./' / " Class.newInstance A""" "ClassCastException* 4/' *

19 ' :'0( B) Class.newInstance Object factory(string classname){ }... Class c = Class.forName(className); return c.newinstance(); SunEncoder t = (SunEncoder) factory( sun.io.encoder. + enc); SomethingElse e = (SomethingElse) factory( SomethingElse );

20 ;%0( Program IR Call graph construction Reflection resolution using points-to Resolved calls Final call graph User-provided spec Cast-based approximation Specification points

21 <0 " 2" " ( 4.( " 45( "(* / 5 4

22 +$ + " )4 ' # C 3 )Class.forName #

23 ! *0 47 " =* : >* <?* 2 D* 9 C* # 9 E#F

24 1#! <((#$ Line File App Available Benchmark Description count count Jars classes jgap genetic algorithms package 32, ,727 freetts gruntspud jedit columba jfreechart speech synthesis system graphical CVS client graphical text editor graphical client chart drawing library 42,993 80, , , , , ,821 63,847 62,910 53,689 62,885 Total 643,028 3, ,879

25 8 0% ( 0% 8 0 % forname(classname) forname(classname) forname(classname)

26 Class.forName * Class.forName jedit! : < 2 Some reflective calls don t have targets on a given analysis platform #

27 %5+ // Class javax.sound.sampled.audiosystem private static final String defaultservicesclassname = "com.sun.media.sound.defaultservices"; Vector getdefaultservices(string servicename ) { Vector v = null; try { Class defaultservices = Class.forName( defaultservicesclassname ); Method m = defaultservices.getmethod( servicesmethodname, servicesparamtypes); Object[] arguments = new Object[] { servicename }; v = (Vector) m.invoke(defaultservices,arguments); } catch(invocationtargetexception e1) {... } return v; }

28 * #" "( ) /5= 8 C =8 =C >8 >C?8 < points-to casts points-to casts points-to casts points-to casts points-to casts 1

29 * 6 =C +>?!( 56(1(#"(* #

30 ;*3 jedit 3 18,000 16,000 14,000 12,000 None Points-to Sound Local Casts 5, 000 methods Methods 10,000 8,000 6,000 4,000 2,000 0 jgap freetts gruntspud jedit columba jfreechart

31 *3 * %5 jgap freetts gruntspud jedit columba jfreechart G7MIC*JD D*CK >*>= GC8HI=*77 >*D? >*7C GLMI7*CK D*8C =*J7 GC8HI=*D? >*=? >*>C

32 ,!N);OJD(PJK(8=(8DQ $99N'#J7('JK(1OJ7Q N;8=(;55JL(288(#O988(1<#8>(O688Q 4 2N':JJ(J?(RJKQ E"F "N<##JJ(<O8?Q 5NO5O>88DQ 5

33 !4".! 17(=J8(888< 1JCHClass.forName " EF / 4 LM(L(8889"