jGuard: Programming Misuse-Resilient APIs
Pages 161 - 174
Abstract
APIs provide access to valuable features, but studies have shown that they are hard to use correctly. Misuses of these APIs can be quite costly. Even though documentations and usage manuals exist, developers find it hard to integrate these in practice. Several static and dynamic analysis tools exist to detect and mitigate API misuses. But it is natural to wonder if APIs can be made more difficult to misuse by capturing the knowledge of domain experts (, API designers). Approaches like CogniCrypt have made inroads into this direction by offering API specification languages like CrySL which are then consumed by static analysis tools. But studies have shown that developers do not enjoy installing new tools into their pipeline. In this paper, we present jGuard, an extension to Java that allows API designers to directly encode their specifications while implementing their APIs. Code written in jGuard is then compiled to regular Java with the checks encoded as exceptions, thereby making sure the API user does not need to install any new tooling. Our evaluation shows that jGuard can be used to express the most commonly occuring misuses in practice, matches the accuracy of state of the art in API misuse detection tools, and introduces negligible performance overhead.
References
[1]
Marat Akhin and Mikhail Belyaev. 2021. Kotlin language specification. https://kotlinlang.org/spec/pdf/kotlin-spec.pdf
[2]
Alvin Alexander. 2019. Java JDBC connection string examples. https://alvinalexander.com/java/jdbc-connection-string-mysql-postgresql-sqlserver/
[3]
Sven Amann, Sarah Nadi, Hoan Anh Nguyen, Tien N. Nguyen, and Mira Mezini. 2016. MUBench: A Benchmark for API-Misuse Detectors. In Proceedings of the 13th International Conference on Mining Software Repositories (MSR 2016). https://doi.org/10.1145/2901739.2903506
[4]
Sven Amann, Hoan Anh Nguyen, Sarah Nadi, Tien N. Nguyen, and Mira Mezini. 2019. A Systematic Evaluation of Static API-Misuse Detectors. IEEE Transactions on Software Engineering, 45, 12 (2019), 1170–1188. https://doi.org/10.1109/TSE.2018.2827384
[5]
Pavel Avgustinov, Eric Bodden, Elnar Hajiyev, Laurie J. Hendren, Ondrej Lhoták, Oege de Moor, Neil Ongkingco, Damien Sereni, Ganesh Sittampalam, Julian Tibble, and Mathieu Verbaere. 2006. Aspects for Trace Monitoring. In Formal Approaches to Software Testing and Runtime Verification, First Combined International Workshops, FATES 2006 and RV 2006, Seattle, WA, USA, August 15-16, 2006, Revised Selected Papers, Klaus Havelund, Manuel Núñez, Grigore Rosu, and Burkhart Wolff (Eds.) (Lecture Notes in Computer Science, Vol. 4262). Springer, 20–39. https://doi.org/10.1007/11940197_2
[6]
Mihir Bellare. 2018. Symmetric Encryption. http://cseweb.ucsd.edu/~mihir/cse107/slides/s-se.pdf
[7]
Jesper Bengtson, Karthikeyan Bhargavan, Cédric Fournet, Andrew D. Gordon, and Sergio Maffeis. 2011. Refinement Types for Secure Implementations. ACM Trans. Program. Lang. Syst., 33, 2 (2011), 8:1–8:45. https://doi.org/10.1145/1890028.1890031
[8]
Rodrigo Bonifacio, Stefan Krüger, Krishna Narasimhan, Eric Bodden, and Mira Mezini. 2021. Dealing with Variability in API Misuse Specification. arxiv:2105.04950.
[9]
Feng Chen and Grigore Roşu. 2005. Java-MOP: A Monitoring Oriented Programming Environment for Java. In Tools and Algorithms for the Construction and Analysis of Systems, Nicolas Halbwachs and Lenore D. Zuck (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg. 546–550. isbn:978-3-540-31980-1
[10]
Diego Costa, Cor-Paul Bezemer, Philipp Leitner, and Artur Andrzejak. 2019. What’s wrong with my benchmark results? studying bad practices in JMH benchmarks. IEEE Transactions on Software Engineering, 47, 7 (2019), 1452–1467.
[11]
Uri Dekel and James D Herbsleb. 2009. Improving API documentation usability with knowledge pushing. In 2009 IEEE 31st International Conference on Software Engineering. 320–330.
[12]
Felix Dobslaw, Morgan Vallin, and Robin Sundström. 2020. Free the Bugs: Disclosing Blocking Violations in Reactive Programming. In 2020 IEEE 20th International Working Conference on Source Code Analysis and Manipulation (SCAM). 177–186. https://doi.org/10.1109/SCAM51674.2020.00025
[13]
Manuel Egele, David Brumley, Yanick Fratantonio, and Christopher Kruegel. 2013. An empirical study of cryptographic misuse in android applications. In 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS’13, Berlin, Germany, November 4-8, 2013. ACM, 73–84. https://doi.org/10.1145/2508859.2516693
[14]
Tzilla Elrad, Robert E. Filman, and Atef Bader. 2001. Aspect-Oriented Programming: Introduction. Commun. ACM, 44, 10 (2001), Oct., 29–32. issn:0001-0782 https://doi.org/10.1145/383845.383853
[15]
Mohammadreza Hazhirpasand, Mohammad Ghafari, and Oscar Nierstrasz. 2020. Java cryptography uses in the wild. In Proceedings of the 14th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM). 1–6.
[16]
Brittany Johnson, Yoonki Song, Emerson Murphy-Hill, and Robert Bowdidge. 2013. Why don’t software developers use static analysis tools to find bugs? In 2013 35th International Conference on Software Engineering (ICSE). 672–681. https://doi.org/10.1109/ICSE.2013.6606613
[17]
Douglas Kramer. 1999. API documentation from source code comments: a case study of Javadoc. In Proceedings of the 17th annual international conference on Computer documentation. 147–153.
[18]
Stefan Krüger. 2022. The CrySL Language, CogniCrypt. https://www.eclipse.org/cognicrypt/documentation/crysl/
[19]
Stefan Krüger, Sarah Nadi, Michael Reif, Karim Ali, Mira Mezini, Eric Bodden, Florian Göpfert, Felix Günther, Christian Weinert, Daniel Demmler, and Ram Kamath. 2017. CogniCrypt: supporting developers in using cryptography. In Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering, ASE 2017, Urbana, IL, USA, October 30 - November 03, 2017, Grigore Rosu, Massimiliano Di Penta, and Tien N. Nguyen (Eds.). IEEE Computer Society, 931–936. https://doi.org/10.1109/ASE.2017.8115707
[20]
Stefan Krüger, Johannes Späth, Karim Ali, Eric Bodden, and Mira Mezini. 2018. CrySL: An Extensible Approach to Validating the Correct Usage of Cryptographic APIs. In 32nd European Conference on Object-Oriented Programming, ECOOP 2018, July 16-21, 2018, Amsterdam, The Netherlands, Todd D. Millstein (Ed.) (LIPIcs, Vol. 109). Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 10:1–10:27. https://doi.org/10.4230/LIPIcs.ECOOP.2018.10
[21]
Gary T. Leavens, Albert L. Baker, and Clyde Ruby. 2006. Preliminary Design of JML: A Behavioral Interface Specification Language for Java. SIGSOFT Softw. Eng. Notes, 31, 3 (2006), May, 1–38. issn:0163-5948 https://doi.org/10.1145/1127878.1127884
[22]
Kaituo Li, Christoph Reichenbach, Christoph Csallner, and Yannis Smaragdakis. 2014. Residual Investigation: Predictive and Precise Bug Detection. ACM Trans. Softw. Eng. Methodol., 24, 2 (2014), Article 7, Dec., 32 pages. issn:1049-331X https://doi.org/10.1145/2656201
[23]
Xia Li. 2020. An Integrated Approach for Automated Software Debugging via Machine Learning and Big Code Mining. The University of Texas at Dallas.
[24]
Bill Marczak and John Scott-Railton. 2020. Move Fast and Roll Your Own Crypto: A Quick Look at the Confidentiality of Zoom Meetings. https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/
[25]
A.J. Menezes, P.C. van Oorschot, and S.A. Vanstone. 2018. Handbook of Applied Cryptography. CRC Press. isbn:9780429881329 https://books.google.de/books?id=YyCyDwAAQBAJ
[26]
Bertrand Meyer. 1988. Eiffel: A language and environment for software engineering. Journal of Systems and Software, 8, 3 (1988), 199–246. issn:0164-1212 https://doi.org/10.1016/0164-1212(88)90022-2
[27]
Bertrand Meyer. 2002. Design by contract. Prentice Hall Upper Saddle River.
[28]
Bodo Möller. 2004. Security of CBC Ciphersuites in SSL/TLS: Problems and Countermeasures. https://www.openssl.org/~bodo/tls-cbc.txt
[29]
Dong Qiu, Bixin Li, and Hareton Leung. 2016. Understanding the API usage in Java. Information and Software Technology, 73 (2016), 81–100. issn:0950-5849 https://doi.org/10.1016/j.infsof.2016.01.011
[30]
Xiaoxue Ren, Xinyuan Ye, Zhenchang Xing, Xin Xia, Xiwei Xu, Liming Zhu, and Jianling Sun. 2020. API-Misuse Detection Driven by Fine-Grained API-Constraint Knowledge Graph. In 2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE). 461–472.
[31]
Martin P Robillard, Eric Bodden, David Kawrykow, Mira Mezini, and Tristan Ratchford. 2012. Automated API property inference techniques. IEEE Transactions on Software Engineering, 39, 5 (2012), 613–637.
[32]
M. P. Robillard, E. Bodden, D. Kawrykow, M. Mezini, and T. Ratchford. 2013. Automated API Property Inference Techniques. IEEE Transactions on Software Engineering, 39, 5 (2013), 613–637. https://doi.org/10.1109/TSE.2012.63
[33]
Martin P Robillard and Robert DeLine. 2011. A field study of API learning obstacles. Empirical Software Engineering, 16, 6 (2011), 703–732.
[34]
Anish Tondwalkar, Matthew Kolosick, and Ranjit Jhala. 2021. Refinements of Futures Past: Higher-Order Specification with Implicit Refinement Types. In 35th European Conference on Object-Oriented Programming (ECOOP 2021), Anders Møller and Manu Sridharan (Eds.) (Leibniz International Proceedings in Informatics (LIPIcs), Vol. 194). Schloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl, Germany. 18:1–18:29. isbn:978-3-95977-190-0 issn:1868-8969 https://doi.org/10.4230/LIPIcs.ECOOP.2021.18
[35]
Niki Vazou, Patrick M. Rondon, and Ranjit Jhala. 2013. Abstract Refinement Types. In Programming Languages and Systems, Matthias Felleisen and Philippa Gardner (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg. 209–228. isbn:978-3-642-37036-6
[36]
Markus Voelter. 2011. Language and IDE Modularization and Composition with MPS. In Generative and Transformational Techniques in Software Engineering IV, International Summer School, GTTSE 2011, Braga, Portugal, July 3-9, 2011. Revised Papers, Ralf Lämmel, João Saraiva, and Joost Visser (Eds.) (Lecture Notes in Computer Science, Vol. 7680). Springer, 383–430. https://doi.org/10.1007/978-3-642-35992-7_11
[37]
Markus Voelter. 2013. Language and IDE Modularization and Composition with MPS. Springer Berlin Heidelberg, Berlin, Heidelberg. 383–430. isbn:978-3-642-35992-7 https://doi.org/10.1007/978-3-642-35992-7_11
[38]
Chamila Wijayarathna and Nalin A. G. Arachchilage. 2018. Why Johnny Can’t Store Passwords Securely? A Usability Evaluation of Bouncycastle Password Hashing. In Proceedings of the 22nd International Conference on Evaluation and Assessment in Software Engineering 2018 (EASE’18). Association for Computing Machinery, New York, NY, USA. 205–210. isbn:9781450364034 https://doi.org/10.1145/3210459.3210483
[39]
Tianyi Zhang, Ganesha Upadhyaya, Anastasia Reinhardt, Hridesh Rajan, and Miryung Kim. 2018. Are Code Examples on an Online Q&A Forum Reliable?: A Study of API Misuse on Stack Overflow. In 2018 IEEE/ACM 40th International Conference on Software Engineering (ICSE). 886–896. https://doi.org/10.1145/3180155.3180260
Index Terms
- jGuard: Programming Misuse-Resilient APIs
Recommendations
The OWL API: A Java API for OWL ontologies
We present the OWL API, a high level Application Programming Interface (API) for working with OWL ontologies. The OWL API is closely aligned with the OWL 2 structural specification. It supports parsing and rendering in the syntaxes defined in the W3C ...
Understanding developers' needs on deprecation as a language feature
ICSE '18: Proceedings of the 40th International Conference on Software EngineeringDeprecation is a language feature that allows API producers to mark a feature as obsolete. We aim to gain a deep understanding of the needs of API producers and consumers alike regarding deprecation. To that end, we investigate why API producers ...
The indolent lambdification of Java: Understanding the support for lambda expressions in the Java ecosystem
AbstractAs Java 8 introduced functional interfaces and lambda expressions to the Java programming language, the JDK API was changed to introduce support for lambda expressions, thus allowing consumers to define lambda functions when using Java’s ...
Comments
Information & Contributors
Information
Published In
November 2022
278 pages
ISBN:9781450399197
DOI:10.1145/3567512
- General Chair:
- Bernd Fischer,
- Program Chairs:
- Lola Burgueño,
- Walter Cazzola
Copyright © 2022 ACM.
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].
Sponsors
Publisher
Association for Computing Machinery
New York, NY, United States
Publication History
Published: 01 December 2022
Check for updates
Badges
Author Tags
Qualifiers
- Research-article
Funding Sources
- Athene center for cyber security
- Crossing SFB 119
Conference
SLE '22
Sponsor:
SLE '22: 15th ACM SIGPLAN International Conference on Software Language Engineering
December 6 - 7, 2022
Auckland, New Zealand
Upcoming Conference
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- 0Total Citations
- 94Total Downloads
- Downloads (Last 12 months)20
- Downloads (Last 6 weeks)1
Reflects downloads up to 09 Nov 2024
Other Metrics
Citations
View Options
Get Access
Login options
Check if you have access through your login credentials or your institution to get full access on this article.
Sign in