Depres: a Tool for Resolving Fully Qualified Names and Their
Total Page:16
File Type:pdf, Size:1020Kb
DepRes: A Tool for Resolving Fully Qualified Names and Their Dependencies 1st Ali Shokri 2nd Mehdi Mirakhorli Global Cybersecurity Institute Global Cybersecurity Institute Rochester Institute of Technology Rochester Institute of Technology Rochester, USA Rochester, USA [email protected] [email protected] Abstract—Reusing code snippets shared by other programmers • FQN for a type (e.g., a class in an object oriented lan- on Q&A forums (e.g., StackOverflow) is a common practice guage): the full packaging name followed by the simple followed by software developers. However, lack of sufficient name of the type; information about the fully qualified name (FQN) of identifiers in borrowed code snippets, results in serious compile errors. • FQN for a method: the full signature of the method; Programmers either have to manually search for the correct For instance, in the code snippet shown in Figure1, FQN of identifiers which is a tedious and error-prone process, a possible FQN of both identifiers Pattern and p or use tools developed to automatically identify correct FQNs. in line 3 could be java.util.regex.Pattern. In such a Despite the efforts made by researchers to automatically identify FQNs in code snippets, the current approaches suffer from low case, the FQN of compile in the same line would accuracy when it comes to practice. Moreover, while these tools be java.util.regex.Pattern.compile(java.util.String)void. It focus on resolving the FQN for an identifier in a code snippet, means that compile is a method declared in class they leave the challenge of finding the correct third-party library java.util.regex.Pattern, with a single argument of type (i.e., dependency) implementing that FQN unresolved. Using an java.lang.String, which returns nothing (i.e., void). A pro- incorrect dependency or incorrect version of a dependency might lead to a semantic error which is not detectable by compilers. grammer needs to know the FQN of each identifier in the Therefore, it can result in serious damage in the run-time. code snippet to be able to add proper imports to the program. In this paper, we introduce DepRes, a tool that leverages a Otherwise, a compile error will be raised. A dependency, on sketch-based approach to resolve FQNs in java-based code snip- the other hand, refers to a third party library that actually pets and recommend the correct dependency for each FQN. The implements an FQN. Please note that each FQN can be source code, documentation, as well as a demo video of DepRes introduced in different libraries or even in different version tool is available from https://github.com/SoftwareDesignLab/ DepRes-Tool. of a same library and hence, have different implementations. Index Terms—Dependency Resolution, Fully Qualified Name, For instance, java.util.regex.Pattern is available in different Sketching, Constraint Solving versions of java JDK libraries. Adding an incorrect library or even an incorrect version of the expected library to the project can result in semantic errors in a program. These types of error I. INTRODUCTION are not necessarily detectable by compilers and might lead to run-time crashes. However, selecting the correct dependency Borrowing a code snippet shared on an open-source code and adding it to the project is not a trivial task. repository (e.g., GitHub1) or a Q&A forum (e.g., Stackover- 2 flow ) is a common practice followed by software developers 1. String input = "Inbound Call at 5:10:54 PM from 07970123123 (Jack Daniels)"; arXiv:2108.01165v1 [cs.SE] 2 Aug 2021 2. String regex = "(\\d{11}|\\d{5} \\d{6}|\\+\\d{12})"; [1], [2]. The application of the reused code varies from 3. Pattern p = Pattern.compile(regex); building a new software [3], to investigating properties of the 4. Matcher m = p.matcher(input); 5. System.out.println(); code snippet such as their API usage models [4], or even 6. System.debug("Find: " + m.find()); 7. System.debug("Group: " + m.group()); training a model for correct code retrieval [5]. While these 8. System.debug("Matches: " + m.matches()); 9. GitHub github = new GitHubBuilder().withOAuthToken(token).build(); code reuse approaches aim to save time, efforts, and avoid re- inventing the wheel, lack of providing fully qualified names Fig. 1. An example of a code snippet without FQNs (FQNs) of identifiers in the shared code snippets, as well as insufficient dependency declaration in the shared projects are There are several approaches introduced by researchers that serious barriers in achieving an accurate and proper outcome aim to find correct FQN for an identifier in a code snippet. [6]. Based on the role of an identifier in a code snippet, we Baker [7] creates an incomplete AST of a program and through consider two types of FQNs. an iterative process called deductive linking, gradually finds FQNs. It needs an oracle to guide the process. Based on 1https://github.com a corpus of programs in a code repository, StatType [6] 2https://stackoverflow.com learns co-occurrence of FQNs in a scope. It then analyzes DepRes 1 Learning <?xml version="1.0" encoding="UTF-8"?> <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <?xmlxsi:schemaLocation= version="1.0" encoding="http://maven.apache.org/POM/4.0.0"UTF-8"?> http://maven.apache.org/xsd/maven-4.0.0.xsd"> <modelVersion><project xmlns=4.0.0"http://maven.apache.org/POM/4.0.0"</modelVersion> <groupId>org.example</groupId>xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" <artifactId>DepRes</artifactId> <version>1.0xsi:schemaLocation=-SNAPSHOT</version>"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> <modelVersion><?xml version=4.0.0"1.0"</modelVersion>encoding="UTF-8"?> <properties><groupId>org.example</groupId><project xmlns="http://maven.apache.org/POM/4.0.0" <maven.compiler.source><artifactId>DepRes</artifactId>xmlns:xsi=8"http://www.w3.org/2001/XMLSchema</maven.compiler.source> -instance" <maven.compiler.target><version>1.0-SNAPSHOT</version>8</maven.compiler.target> <aetherVersion>xsi:schemaLocation=1.1.0</aetherVersion>"http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> <mavenVersion><properties><modelVersion>3.2.1</mavenVersion>4.0.0</modelVersion> <maven.compiler.source><groupId>org.example</groupId>8</maven.compiler.source> {A1, A2, A3} <maven.compiler.target><artifactId>DepRes</artifactId>8</maven.compiler.target> Annotated </properties> <dependencies><aetherVersion><version>1.0-1.1.0SNAPSHOT</version></aetherVersion> <!-- https:<mavenVersion>//mvnrepository.com/artifact/org.kohsuke/github3.2.1</mavenVersion> -api --> <dependency><properties> </properties><groupId>org.kohsuke</groupId><maven.compiler.source>8</maven.compiler.source> <dependencies><maven.compiler.target>8</maven.compiler.target> <artifactId>github<!-- https:<aetherVersion>//mvnrepository.com/artifact/org.kohsuke/github-api</artifactId>1.1.0</aetherVersion> -api --> <version><dependency><mavenVersion>1.123</version>3.2.1</mavenVersion> </dependency><groupId>org.kohsuke</groupId> <dependency></properties> <groupId>org.eclipse.jdt</groupId><dependencies><artifactId>github-api</artifactId> {A1, A4, A5, A6, A7} Class Hierarchies <version><!-- https:1.123//mvnrepository.com/artifact/org.kohsuke/github</version> -api --> <artifactId>org.eclipse.jdt.core</artifactId></dependency><dependency> <version><dependency>3.25.0<groupId>org.kohsuke</groupId></version> <groupId>org.eclipse.jdt</groupId> </dependency> <artifactId>github-api</artifactId> <artifactId>org.eclipse.jdt.core</artifactId><version>1.123</version> <version></dependency>3.25.0</version> </dependencies></dependency><dependency> </project> <groupId>org.eclipse.jdt</groupId> <artifactId>org.eclipse.jdt.core</artifactId> {A11, A5, A1, A2, A20} </dependencies><version>3.25.0</version> Resolving </project> </dependency> 3 </dependencies> </project> Dependency Item Sets FQNs Open-Source Dependency Repositories Declaration Repo. Itemset Verification Artifact Knowledgebase java.util.regex.Matcher java.util.regex.Pattern Resolve Sketches org.kohsuke.github.GitHubBuilder 2 Sketching org.kohsuke.github.GitHub package edu.rit.se.depres; import java.util.regex.Pattern; … package edu.rit.se.depres; Import, Type, Method, Field public classimportGitHubUtilsjava.util.regex.Pattern; { publicpublicint test(Stringclass GitHubUtils token){ { String input = "Inbound Call at 5:10:54 PM from 07970123123 (Jackpublic Daniels)"int test(String; token){ String regexString = "(input\\d{11}| = "Inbound\\d{5} \Call\d{6}| at\ \5:10:54+\\d{12})" PM ;from Pattern07970123123 p = Pattern.compile(regex);(Jack Daniels)"; Matcher mString = p.matcher(input); regex = "(\\d{11}|\\d{5} \\d{6}|\\+\\d{12})"; Pattern p = Pattern.compile(regex); System.out.println();Matcher m = p.matcher(input); System.debug("Find: " + m.find()); System.debug(System.out.println();"Group: " + m.group()); Evidence Mining FQN Sketches System.debug(System.debug("Matches:"Find: " + m.matches()); " + m.find()); System.debug("Group: " + m.group()); GitHub github = new GitHubBuilder().withOAuthToken(token).build();System.debug("Matches: " + m.matches()); Project Dependencies GitHub github = new GitHubBuilder().withOAuthToken(token).build(); … } } } } Source Code ?.matcher(java.lang.String)? org.kohsuke:github-api:1.123 <?xml version="1.0" encoding="UTF-8"?> <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 SMT Solver http://maven.apache.org/xsd/maven-4.0.0.xsd"> ?.compile(java.lang.String)?