论文标题
我们可以在多大程度上使用现有的Java Taint分析工具分析Kotlin程序？ （扩展版）
To what extent can we analyze Kotlin programs using existing Java taint analysis tools? (Extended Version)
论文作者
论文摘要
作为Java的替代方法，Kotlin自引入以来就广受欢迎，并已成为开发Android应用程序的默认选择。但是，由于其与Java的互操作性，Kotlin程序可能包含与Java对应物几乎相同的安全漏洞。因此，我们疑问：在多大程度上可以在多大程度上使用现有的Java静态污染分析，以对Kotlin代码进行？在本文中，我们调查了与Java相比，对Kotlin进行污点分析所面临的挑战。为了回答这个问题，我们进行了一项探索性研究，在其中检查了每个Kotlin构造，并将其与其Java等效物进行了比较。我们确定了18个工程挑战，这些挑战是由于Kotlin的独特结构或Kotlin和Java编译器之间生成字样的差异，静态分析作者需要进行不同的处理。对于其中的八个，我们提供了一个概念解决方案，而我们作为Secucheck-Kotlin的一部分实施的六个解决方案，这是现有Java Taint Analysis的扩展。
As an alternative to Java, Kotlin has gained rapid popularity since its introduction and has become the default choice for developing Android apps. However, due to its interoperability with Java, Kotlin programs may contain almost the same security vulnerabilities as their Java counterparts. Hence, we question: to what extent can one use an existing Java static taint analysis on Kotlin code? In this paper, we investigate the challenges in implementing a taint analysis for Kotlin compared to Java. To answer this question, we performed an exploratory study where each Kotlin construct was examined and compared to its Java equivalent. We identified 18 engineering challenges that static-analysis writers need to handle differently due to Kotlin's unique constructs or the differences in the generated bytecode between the Kotlin and Java compilers. For eight of them, we provide a conceptual solution, while six of those we implemented as part of SecuCheck-Kotlin, an extension to the existing Java taint analysis SecuCheck.
