Jasmine: A Static Analysis Framework for Spring Core Technologies

The Spring framework is widely used in developing enterprise web applications. Spring core technologies, such as Dependency Injection and Aspect-Oriented Programming, make development faster and easier. However, the implementation of Spring core technologies uses a lot of dynamic features. Those features impose significant challenges when using static analysis to reason about the behavior of Spring-based applications. In this paper, we propose Jasmine, a static analysis framework for Spring core technologies extends from Soot to enhance the call graph’s completeness while not greatly affecting its performance. We evaluate Jasmine’s completeness, precision, and performance using Spring micro-benchmarks and a suite of 18 real-world Spring programs. Our experiments show that Jasmine effectively enhances the state-of-the-art tools based on Soot and Doop to better support Spring core technologies. We also add Jasmine support to FlowDroid and discovered twelve sensitive information leakage paths in our benchmarks. Jasmine is expected to provide significant benefits for many program analyses scenes of Spring applications where more complete call graphs are required.

弹簧框架被广泛用于开发企业Web应用程序，例如依赖性注入和面向方面的编程，使开发更快，更容易在使用静态分析来推理基于春季的应用程序的行为时，我们提出了茉莉花的挑战使用Spring Micro-Benchs和一组18个现实世界的春季程序来评估茉莉花的完整性，精度和性能。技术。我们还为流质添加了茉莉花的支持，并在我们的基准中发现了十二个敏感的信息泄漏路径。