Type qualifier inference for java

Abstract

Java's type system provides programmers with strong guarantees of type and memory safety, but there are many important properties not captured by standard Java types. We describe JQual, a tool that adds user-defined type qualifiers to Java, allowing programmers to quickly and easily incorporate extra lightweight, application-specific type checking into their programs. JQual provides type qualifier inference, so that programmers need only add a few key qualifier annotations to their program, and then JQual infers any remaining qualifiers and checks their consistency. We explore two applications of JQual. First, we introduce opaque and enum qualifiers to track C pointers and enumerations that flow through Java code via the JNI. In our benchmarks we found that these C values are treated correctly, but there are some places where a client could potentially violate safety. Second, we introduce a readonly qualifier for annotating references that cannot be used to modify the objects they refer to. We found that JQual is able to automatically infer readonly in many places on method signatures. These results suggest that type qualifiers and type qualifier inference are a useful addition to Java.

Verification games

“…Even the most precise available inference tools leave much room for improvement. An earlier inference system for Javari [22,23] achieved even worse results, with precision of about 70% (compared to Julia's 100% precision and 98% recall). It can prove about 98% of all dereferences in a program to be safe -that is, it proves that no null value ever flows to those dereferences, so those dereferences cannot result in a null pointer exception at run time.…”

Large-scale analysis of format string vulnerabilities in Debian Linux

“…This approach can also apply scalably to languages other than C/C++, for example JQual [19] can find bugs using taint analysis of Java code. Thus, entire classes of security bugs can in the future be eliminated from widely deployed software.…”

Specification Inference Using Context-Free Language Reachability

“…CFL reachability for program analyses. A large number of program analyses have been expressed as CFL reachability problems, for example points-to analysis [26,28], many set constraint problems [11,13,19], various interprocedural analyses [23,24], and type qualifier inference [10]. Our work makes these techniques more applicable for whole-program analysis by providing a practical and sound approach to dealing with missing or hard-to-analyze portions of the program.…”