Understanding and Analyzing Java Reflection

Abstract

Java reflection has been widely used in a variety of applications and frameworks. It allows a software system to inspect and change the behaviour of its classes, interfaces, methods, and fields at runtime, enabling the software to adapt to dynamically changing runtime environments. However, this dynamic language feature imposes significant challenges to static analysis, because the behaviour of reflection-rich software is logically complex and statically hard to predict. As a result, existing static analysis tools either ignore reflection or handle it partially, resulting in missed, important behaviours, i.e., unsound results. Therefore, improving or even achieving soundness in static reflection analysis—an analysis that infers statically the behaviour of reflective code—will provide significant benefits to many analysis clients, such as bug detectors, security analyzers, and program verifiers.

In this article, we provide a comprehensive understanding of Java reflection through examining its underlying concept, API, and real-world usage, and, building on this, we introduce a new static approach to resolving Java reflection effectively in practice. We have implemented our reflection analysis in an open-source tool, called SOLAR, and evaluated its effectiveness extensively with large Java programs and libraries. Our experimental results demonstrate that SOLAR is able to (1) resolve reflection more soundly than the state-of-the-art reflection analyses; (2) automatically and accurately identify the parts of the program where reflection is resolved unsoundly or imprecisely; and (3) guide users to iteratively refine the analysis results by using lightweight annotations until their specific requirements are satisfied.

References

1. Steven Arzt, Siegfried Rasthofer, Christian Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves Le Traon, Damien Octeau, and Patrick D. McDaniel. 2014. FlowDroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI’14), Michael F. P. O’Boyle and Keshav Pingali (Eds.). ACM, 259--269.
2. Paulo Barros, René Just, Suzanne Millstein, Paul Vines, Werner Dietl, Marcelo d’Amorim, and Michael D. Ernst. 2015. Static analysis of implicit control flow: Resolving java reflection and android intents (T). In Proceedings of the 30th IEEE/ACM International Conference on Automated Software Engineering (ASE’15). 669--679.
3. Stephen M. Blackburn, Robin Garner, Chris Hoffmann, Asjad M. Khan, Kathryn S. McKinley, Rotem Bentzur, Amer Diwan, Daniel Feinberg, Daniel Frampton, Samuel Z. Guyer, Martin Hirzel, Antony L. Hosking, Maria Jump, Han Bok Lee, J. Eliot B. Moss, Aashish Phansalkar, Darko Stefanovic, Thomas VanDrunen, Daniel von Dincklage, and Ben Wiedermann. 2006. The DaCapo benchmarks: Java benchmarking development and analysis. In Proceedings of the 21st Annual ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA’06), Peri L. Tarr and William R. Cook (Eds.). ACM, 169--190.
4. Bruno Blanchet, Patrick Cousot, Radhia Cousot, Jérôme Feret, Laurent Mauborgne, Antoine Miné, David Monniaux, and Xavier Rival. 2003. A static analyzer for large safety-critical software. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation. 196--207.
5. Eric Bodden, Andreas Sewe, Jan Sinschek, Hela Oueslati, and Mira Mezini. 2011. Taming reflection: Aiding static analysis in the presence of reflection and custom class loaders. In Proceedings of the 33rd International Conference on Software Engineering (ICSE’11). 241--250.
6. Gilad Bracha and David M. Ungar. 2004. Mirrors: Design principles for meta-level facilities of object-oriented programming languages. In Proceedings of the 19th Annual ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA’04). 331--344.
7. Mathias Braux and Jacques Noyé. 2000. Towards partially evaluating reflection in java. In Proceedings of the ACM SIGPLAN Workshop on Partial Evaluation and Semantics-Based Program Manipulation (PEPM’00). 2--11.
8. Martin Bravenboer and Yannis Smaragdakis. 2009. Strictly declarative specification of sophisticated points-to analyses. In Proceedings of the 24th Annual ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA’09), Shail Arora and Gary T. Leavens (Eds.). ACM, 243--262.
9. Walter Cazzola. 2004. SmartReflection: Efficient introspection in Java. J. Object Technol. 3, 11 (2004), 117--132.
10. Shigeru Chiba. 2000. Load-time structural reflection in java. In Proceedings of the 14th European Conference on Object-Oriented Programming. 313--336.
11. Aske Simon Christensen, Anders Møller, and Michael I. Schwartzbach. 2003. Precise analysis of string expressions. In Proceedings of the 10th International Symposium on Static Analysis (SAS’03). 1--18.
12. Manuvir Das, Sorin Lerner, and Mark Seigle. 2002. ESP: Path-sensitive program verification in polynomial time. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI’02). 57--68.
13. Dylan Dawson, Ronald J. Desmarais, Holger M. Kienle, and Hausi A. Müller. 2008. Monitoring in adaptive systems using reflection. In Proceedings of the ICSE Workshop on Software Engineering for Adaptive and Self-Managing Systems (SEAMS’08). 81--88.
14. Jeffrey Dean, David Grove, and Craig Chambers. 1995. Optimization of object-oriented programs using static class hierarchy analysis. In Proceedings of the 9th European Conference on Object-Oriented Programming (ECOOP’95). 77--101.
15. FranÃğois-Nicola Demers and Jacques Malenfant. 1995. Reflection in logic, functional and object-oriented programming: A short comparative study. In International Joint Conference on Artificial Intelligence (IJCAI’95). 29--38.
16. Bill Donkervoet and Gul Agha. 2007. Reflecting on adaptive distributed monitoring. InProceeding of the Symposium on Formal Methods for Components and Objects.
17. Dawson R. Engler, David Yu Chen, and Andy Chou. 2001. Bugs as inconsistent behavior: A general approach to inferring errors in systems code. In Proceedings of the 18th ACM Symposium on Operating System Principles (SOSP’01). 57--72.
18. Michael D. Ernst, René Just, Suzanne Millstein, Werner Dietl, Stuart Pernsteiner, Franziska Roesner, Karl Koscher, Paulo Barros, Ravi Bhoraskar, Seungyeop Han, Paul Vines, and Edward XueJun Wu. 2014. Collaborative verification of information flow for a high-assurance app store. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 1092--1104.
19. Ira R. Forman and Nate Forman. 2004. Java Reflection in Action. Manning Publications Co.
20. George Fourtounis, George Kastrinis, and Yannis Smaragdakis. 2018. Static analysis of java dynamic proxies. In Proceedings of the 27th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA’18). 209--220.
21. Paul V. Gestwicki and Bharat Jayaraman. 2002. Interactive visualization of java programs. In Proceedings of the IEEE CS International Symposium on Human-Centric Computing Languages and Environments (HCC’02). 226--235.
22. Neville Grech, George Kastrinis, and Yannis Smaragdakis. 2018. Efficient reflection string analysis via graph coloring. In Proceedings of the 32nd European Conference on Object-Oriented Programming (ECOOP’18). 26:1--26:25.
23. Charlotte Herzeel, Pascal Costanza, and Theo D’Hondt. 2008. Reflection for the Masses. In Self-Sustaining Systems. Springer, 87--122.
24. Martin Hirzel, Daniel von Dincklage, Amer Diwan, and Michael Hind. 2007. Fast online pointer analysis. ACM Trans. Program. Lang. Syst. 29, 2 (2007), 11.
25. George Kastrinis and Yannis Smaragdakis. 2013. Hybrid context-sensitivity for points-to analysis. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI’13), Hans-Juergen Boehm and Cormac Flanagan (Eds.). ACM, 423--434.
26. Davy Landman, Alexander Serebrenik, and Jurgen J. Vinju. 2017. Challenges for static analysis of java reflection: Literature review and empirical study. In Proceedings of the 39th International Conference on Software Engineering (ICSE’17). IEEE Press, Piscataway, NJ, 507--518.
27. Ondrej Lhoták and Laurie J. Hendren. 2003. Scaling Java points-to analysis using SPARK. In Proceedings of the 12th International Conference on Compiler Construction (CC’03), Held as Part of the Joint European Conferences on Theory and Practice of Software (ETAPS’03) (Lecture Notes in Computer Science), Görel Hedin (Ed.), Vol. 2622. Springer, 153--169.
28. Li Li, Tegawendé F. Bissyandé, Damien Octeau, and Jacques Klein. 2016. DroidRA: Taming reflection to support whole-program analysis of android apps. In Proceedings of the 25th International Symposium on Software Testing and Analysis (ISSTA’16). ACM, New York, NY, 318--329.
29. Lian Li, Yi Lu, and Jingling Xue. 2017. Dynamic symbolic execution for polymorphism. In Proceedings of the 26th International Conference on Compiler Construction. 120--130. DOI:http://dl.acm.org/citation.cfm?id=3033029
30. Yue Li, Tian Tan, Anders Møller, and Yannis Smaragdakis. 2018. Precision-guided context-sensitivity for pointer analysis. Proc. ACM Progrm. Lang. 2, OOPSLA (2018), 141:1--141:29.
31. Yue Li, Tian Tan, Anders Møller, and Yannis Smaragdakis. 2018. Scalability-first pointer analysis with self-tuning context-sensitivity. In Proceedings of the ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/SIGSOFT FSE’18). 129--140.
32. Yue Li, Tian Tan, Yulei Sui, and Jingling Xue. 2014. Self-inferencing reflection resolution for Java. In Proceedings of the 28th European Conference on Object-Oriented Programming (ECOOP’14) (Lecture Notes in Computer Science), Richard E. Jones (Ed.), Vol. 8586. Springer, 27--53.
33. Yue Li, Tian Tan, and Jingling Xue. 2015. Effective soundness-guided reflection analysis. In Proceedings of the 22nd International Symposium on Static Analysis (SAS’15) (Lecture Notes in Computer Science), Sandrine Blazy and Thomas Jensen (Eds.), Vol. 9291. Springer, 162--180.
34. Yue Li, Tian Tan, Yifei Zhang, and Jingling Xue. 2016. Program tailoring: Slicing by sequential criteria. In Proceedings of the 30th European Conference on Object-Oriented Programming (ECOOP’16) (LIPIcs), Shriram Krishnamurthi and Benjamin S. Lerner (Eds.), Vol. 56. Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik, 15:1--15:27.
35. Jie Liu, Yue Li, Tian Tan, and Jingling Xue. 2017. Reflection analysis for java: Uncovering more reflective targets precisely. In Proceedings of the 28th IEEE International Symposium on Software Reliability Engineering (ISSRE’17). 12--23.
36. Benjamin Livshits and Monica S. Lam. 2005. Finding security vulnerabilities in Java applications with static analysis. In Proceedings of the 14th USENIX Security Symposium, Patrick D. McDaniel (Ed.). USENIX Association.
37. Benjamin Livshits, Manu Sridharan, Yannis Smaragdakis, Ondrej Lhoták, José Nelson Amaral, Bor-Yuh Evan Chang, Samuel Z. Guyer, Uday P. Khedker, Anders Møller, and Dimitrios Vardoulakis. 2015. In defense of soundiness: A manifesto. Commun. ACM 58, 2 (2015), 44--46.
38. V. Benjamin Livshits, John Whaley, and Monica S. Lam. 2005. Reflection analysis for java. In Proceedings of the 3rd Asian Symposium on Programming Languages and Systems (APLAS’05). 139--160.
39. Pattie Maes. 1987. Concepts and experiments in computational reflection. In Proceedings of the Conference on Object-Oriented Programming Systems, Languages, and Applications (OOPSLA’87). 147--155.
40. J. Malenfant, M. Jacques, and F. N. Demers. 1996. A tutorial on behavioral reflection and its implementation. In Proceedings of the Reflection Conference. 1--20.
41. Ana Milanova, Atanas Rountev, and Barbara G. Ryder. 2002. Parameterized object sensitivity for points-to and side-effect analyses for Java. In Proceedings of the International Symposium on Software Testing and Analysis (ISSTA’02), Phyllis G. Frankl (Ed.). ACM, 1--11.
42. Ana Milanova, Atanas Rountev, and Barbara G. Ryder. 2005. Parameterized object sensitivity for points-to analysis for Java. ACM Trans. Softw. Eng. Methodol. 14, 1 (2005), 1--41.
43. Mayur Naik, Alex Aiken, and John Whaley. 2006. Effective static race detection for Java. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation, Michael I. Schwartzbach and Thomas Ball (Eds.). ACM, 308--319.
44. Phung Hua Nguyen and Jingling Xue. 2005. Interprocedural side-effect analysis and optimisation in the presence of dynamic class loading. In Proceedings of the 28th Australasian Computer Science Conference (ACSC’05). 9--18. Retrieved from http://crpit.com/confpapers/CRPITV38Nguyen.pdf.
45. Damien Octeau, Daniel Luchaup, Matthew Dering, Somesh Jha, and Patrick D. McDaniel. 2015. Composite constant propagation: Application to android inter-component communication analysis. In Proceedings of the 37th IEEE/ACM International Conference on Software Engineering (ICSE’15). 77--88.
46. Awais Rashid and Ruzanna Chitchyan. 2003. Persistence as an aspect. In Proceedings of the 2nd International Conference on Aspect-Oriented Software Development (AOSD’03). 120--129.
47. Siegfried Rasthofer, Steven Arzt, Marc Miltenberger, and Eric Bodden. 2016. Harvesting runtime values in android applications that feature anti-analysis techniques. In Proceedings of the 23rd Annual Network and Distributed System Security Symposium (NDSS’16). Retrieved from http://wp.internetsociety.org/ndss/wp-content/uploads/sites/25/2017/09/harvesting-runtime-values-android-applications-feature-anti-analysis-techniques.pdf.
48. Vaibhav Rastogi, Yan Chen, and Xuxian Jiang. 2013. DroidChameleon: Evaluating android anti-malware against transformation attacks. In Proceedings of the 8th ACM Symposium on Information, Computer and Communications Security (ASIA CCS’13). 329--334.
49. Jason Sawin and Atanas Rountev. 2009. Improving static resolution of dynamic class loading in Java using dynamically gathered environment information. Autom. Softw. Eng. 16, 2 (2009), 357--381.
50. Yannis Smaragdakis and George Balatsouras. 2015. Pointer analysis. Found. Trends Program. Lang. 2, 1 (2015), 1--69.
51. Yannis Smaragdakis, George Balatsouras, George Kastrinis, and Martin Bravenboer. 2015. More sound static handling of Java reflection. In Proceedings of the 13th Asian Symposium on Programming Languages and Systems (APLAS’15) (Lecture Notes in Computer Science), Xinyu Feng and Sungwoo Park (Eds.), Vol. 9458. Springer, 485--503.
52. Yannis Smaragdakis, Martin Bravenboer, and Ondrej Lhoták. 2011. Pick your contexts well: Understanding object-sensitivity. In Proceedings of the 38th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL’11), Thomas Ball and Mooly Sagiv (Eds.). ACM, 17--30.
53. Brian Cantwell Smith. 1982. Procedural Reflection in Programming Languages. Ph.D. Dissertation. Massachusetts Institute of Technology, Cambridge, MA. Retrieved from http://hdl.handle.net/1721.1/15961.
54. J. M. Sobel and Daniel P. Friedman. 1996. An Introduction to Reflection-Oriented Programming. University of Indiana.
55. Benoît Sonntag and Dominique Colnet. 2014. Efficient compilation strategy for object-oriented languages under the closed-world assumption. Softw. Pract. Exper. 44, 5 (2014), 565--592.
56. Manu Sridharan, Shay Artzi, Marco Pistoia, Salvatore Guarnieri, Omer Tripp, and Ryan Berg. 2011. F4F: taint analysis of framework-based web applications. In Proceedings of the 26th Annual ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA’11). 1053--1068.
57. Manu Sridharan, Satish Chandra, Julian Dolby, Stephen J. Fink, and Eran Yahav. 2013. Alias analysis for object-oriented programs. In Proceedings of the Conference on Aliasing in Object-Oriented Programming. Types, Analysis, and Verification, Dave Clarke, James Noble, and Tobias Wrigstad (Eds.). Lecture Notes in Computer Science, Vol. 7850. Springer, 196--232.
58. Manu Sridharan, Stephen J. Fink, and Rastislav Bodík. 2007. Thin slicing. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation, Jeanne Ferrante and Kathryn S. McKinley (Eds.). ACM, 112--122.
59. Yulei Sui, Yue Li, and Jingling Xue. 2013. Query-directed adaptive heap cloning for optimizing compilers. In Proceedings of the IEEE/ACM International Symposium on Code Generation and Optimization (CGO’13). 1:1--1:11.
60. Tian Tan, Yue Li, and Jingling Xue. 2016. Making k-object-sensitive pointer analysis more precise with still k-limiting. In Proceedings of the 23rd International Symposium on Static Analysis (SAS’16) (Lecture Notes in Computer Science), Xavier Rival (Ed.), Vol. 9837. Springer, 489--510.
61. Tian Tan, Yue Li, and Jingling Xue. 2017. Efficient and precise points-to analysis: Modeling the heap by merging equivalent automata. In Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI’17), Albert Cohen and Martin T. Vechev (Eds.). ACM, 278--291.
62. Rei Thiessen and Ondřej Lhoták. 2017. Context transformations for pointer analysis. In Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI’17). ACM, New York, NY, 263--277.
63. Raja Vallée-Rai, Phong Co, Etienne Gagnon, Laurie J. Hendren, Patrick Lam, and Vijay Sundaresan. 1999. Soot—A Java bytecode optimization framework. In Proceedings of the Conference of the Centre for Advanced Studies on Collaborative Research, Stephen A. MacKay and J. Howard Johnson (Eds.). IBM, 13.
64. WALA. {n. d.}. T. J. Watson Libraries for Analysis. Retrieved from http://wala.sf.net.
65. John Whaley and Monica S. Lam. 2004. Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI’04). ACM, New York, NY, 131--144.
66. Jingling Xue and Phung Hua Nguyen. 2005. Completeness analysis for incomplete object-oriented programs. In Proceedings of the 14th International Conference on Compiler Construction (CC’05), Held as Part of the Joint European Conferences on Theory and Practice of Software (ETAPS’05). 271--286.
67. Yifei Zhang, Yue Li, Tian Tan, and Jingling Xue. 2018. Ripple: Reflection analysis for android apps in incomplete information environments. Softw. Pract. Exper. 48, 8 (2018), 1419--1437.
68. Yifei Zhang, Tian Tan, Yue Li, and Jingling Xue. 2017. Ripple: Reflection analysis for android apps in incomplete information environments. In Proceedings of the 7th ACM on Conference on Data and Application Security and Privacy (CODASPY’17). 281--288.
69. Yury Zhauniarovich, Maqsood Ahmad, Olga Gadyatskaya, Bruno Crispo, and Fabio Massacci. 2015. StaDynA: Addressing the problem of dynamic code updates in the security analysis of android applications. In Proceedings of the 5th ACM Conference on Data and Application Security and Privacy (CODASPY’15). 37--48.

Index Terms

• Software and its engineering

  • Software notations and tools

    • General programming languages

      • Language types

        • Object oriented languages

• Theory of computation

  • Semantics and reasoning

    • Program reasoning

      • Program analysis