DOCSLIB.ORG

Towards Generating Transformation Rules Without Examples for Android API Replacement

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Towards Generating Transformation Rules Without Examples for Android API Replacement View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Institutional Knowledge at Singapore Management University Singapore Management University Institutional Knowledge at Singapore Management University Research Collection School Of Information Systems School of Information Systems 4-2019 Towards generating transformation rules without examples for android API replacement Thung Ferdian Singapore Management University, [email protected] Hong Jin KANG Singapore Management University, [email protected] Lingxiao JIANG Singapore Management University, [email protected] David LO Singapore Management University, [email protected] Follow this and additional works at: https://ink.library.smu.edu.sg/sis_research Part of the Software Engineering Commons Citation Ferdian, Thung; KANG, Hong Jin; JIANG, Lingxiao; and LO, David. Towards generating transformation rules without examples for android API replacement. (2019). Proceedings of the 35th IEEE International Conference on Software Maintenance and Evolution (ICSME), Cleveland, OH, USA, 2019 September 30 - October 4. 1-5. Research Collection School Of Information Systems. Available at: https://ink.library.smu.edu.sg/sis_research/4824 This Conference Proceeding Article is brought to you for free and open access by the School of Information Systems at Institutional Knowledge at Singapore Management University. It has been accepted for inclusion in Research Collection School Of Information Systems by an authorized administrator of Institutional Knowledge at Singapore Management University. For more information, please email [email protected]. Towards Generating Transformation Rules without Examples for Android API Replacement Ferdian Thung, Hong Jin Kang, Lingxiao Jiang, and David Lo Singapore Management University Email: fferdianthung, hjkang.2018, lxjiang, [email protected] Abstract—Deprecation of APIs in software libraries is common time when an API deprecation occurs and no code change when library maintainers make changes to a library and will no example is yet available from which to learn code changes longer support certain APIs in the future. When deprecation patterns. Thus, NEAT complements Lamonthe et al.’s approach occurs, developers whose programs depend on the APIs need to replace the usages of the deprecated APIs sooner or later. that requires code change examples. Moreover, different from Often times, software documentation specifies which new APIs Lamonthe et al.’s approach, NEAT produces code transforma- the developers should use in place of a deprecated API. However, tion rules based on semantic patches [3], [6], [14] that can replacing the usages of a deprecated API remains a challenge be easily reused, making it easier to replace deprecated APIs since developers may not know exactly how to use the new APIs. across many usage locations. The developers would first need to understand the API changes before they can replace the deprecated API correctly. Previous NEAT assumes that the API replacement mappings from work has proposed an approach to assist developers in deprecated a deprecated API to its replacement API are available, as Android API replacement by learning from examples. In this such mappings can be generated by previous approaches that work, we also focus on Android APIs and propose an approach perform API replacement mining [2], [10], [16], [17]. The named No Example API Transformation (NEAT) to generate mined mappings specify that a method A should be replaced transformation rules that can assist developers in deprecated API replacement even when code examples are not available (e.g., with a method B, but they do not specify how to actually when the deprecation has happened recently). We have validated perform this replacement. Thus, NEAT also complements those the effectiveness of NEAT on generating transformation rules approaches by providing code transformation rules that specify for deprecated Android APIs. Using NEAT, we can generate 37 how deprecated API replacement can actually be realized. transformation rules for 37 out of a selection of 100 deprecated NEAT uses a combination of API source code analysis, APIs and have validated these rules to be correct. Index Terms—API deprecation, API replacement, program type conversion, and heuristics. The approach distinguishes transformation, Android between two cases, depending on whether or not the affected API is an event handler (i.e., APIs that are called when an event occur). If both APIs are non event handlers, NEAT I. INTRODUCTION analyzes the source code of the API to check whether the Software maintenance is a daily activity for software de- implementation of the deprecated API involves the usage of velopers. One of the tasks that developers need to do while the replacement API. If such an implementation exists, NEAT maintaining a software project is to make sure that the APIs generates a transformation rule based on it. Otherwise, we that they use are up-to-date. However, API updates do not heuristically match the parameters of both APIs, and convert always guarantee backward compatibility and the maintainers deprecated API parameters and/or return values to the types can decide to deprecate older APIs. Thus, when APIs are used by the replacement API (if necessary). On the other hand, deprecated, developers need to replace the deprecated APIs if both APIs are event handlers, NEAT uses similar heuristics with other APIs that can provide equivalent functionality. to generate a transformation rule to implement the replacement Many works [2], [10], [16], [17] that support deprecated method based on the deprecated method’s implementation. To API replacement only focus on identifying APIs that can make the generated transformation rules easily reusable, we replace a deprecated API. There has been very limited work on express them in semantic patches, which is widely adopted and recommending how a deprecated API can actually be replaced has shown to be useful in the context of C. Semantic patches by its replacement APIs. Lamonthe et al. [5] has proposed an can be applied to client applications using Coccinelle [6], [14]. approach to assist deprecated API replacement by learning Specifically, since Android is typically written in Java, we from code change examples that have replaced deprecated use Coccinelle4J, a recent port of Coccinelle targeting Java APIs. Their approach learns API migration patterns from these programming language [3]. examples and applies these patterns to Android applications to We evaluated NEAT on a dataset of 100 deprecated Android replace deprecated API invocations in the applications. APIs with identified replacements as input. We manually In this work, we also deal with the problem of assisting validated whether the generated transformation rules can be developers in replacing usages of deprecated APIs. In contrast used to replace the deprecated APIs correctly. We found to the work of Lamonthe et al., we propose No Example that NEAT can generate correct transformation rules for 37 API Transformation (NEAT) that can provide assistance at the deprecated APIs. Comparing the effectiveness of NEAT to that of automated program repair [4], [7], [12], which also needs match any expression. The remaining lines are the context to transform a piece of code from a bad state to a good one and change operations. In this case, the patch specifies that and correctly repair programs with the effectiveness of 22.69- all calls to setBackgroundDrawable should be replaced 53.33%, our current preliminary result is promising. Note that with a call to setBackground, while keeping the argument different from automated program repair, we do not have any of the method intact. test cases and/or failures to guide our transformations. @@ The main contributions of our work are as follows: expression view, arg; @@ 1) To the best of our knowledge, we are the first to generate - view.setBackgroundDrawable(arg); transformation rules for replacing deprecated APIs when + view.setBackground(arg); there are no available examples to learn from. Fig. 1: An example of a simplified semantic patch replacing a deprecated 2) We propose an approach named No Example API Trans- method from android.view.View class formation (NEAT) to generate transformation rules given a SmPL supports more features for writing semantic patches. deprecated method and its replacement through a combi- Further details about SmPL are available in previous work [1], nation of API source code analysis, type conversion, and [6], [15]. some heuristics. 3) Evaluation on 100 deprecated Android APIs with identified III. APPROACH replacements shows that NEAT generates correct replace- ment rules for 37 deprecated Android APIs. NEAT focuses on one-to-one mapping (i.e., a mapping from one deprecated API to one replacement API), and takes as II. BACKGROUND input a deprecated API signature (i.e., the method name, the A. Coccinelle class name, and the parameters), its replacement API signature, Coccinelle is a program matching and transformation en- and the source code of the library containing the two APIs. gine [6], [11], [14]. It was initially developed to automate API The output of NEAT is a semantic patch written in SmPL, evolutions in the Linux kernel. Coccinelle accepts as input a that specifies the transformation rule to replace a usage of the program to transform, and a semantic patch that describes the deprecated API. transformation to be performed. The semantic patch gener- We observe that a deprecated
Load more

Recommended publications
  • Semantic Patches for Java Program Transformation
    Semantic Patches for Java Program Transformation Hong Jin Kang School of Information Systems, Singapore Management University, Singapore Ferdian Thung School of Information Systems, Singapore Management University, Singapore Julia Lawall Sorbonne Université/Inria/LIP6, France Gilles Muller Sorbonne Université/Inria/LIP6, France Lingxiao Jiang School of Information Systems, Singapore Management University, Singapore David Lo School of Information Systems, Singapore Management University, Singapore Abstract Developing software often requires code changes that are widespread and applied to multiple locations. There are tools for Java that allow developers to specify patterns for program matching and source- to-source transformation. However, to our knowledge, none allows for transforming code based on its control-flow context. We prototype Coccinelle4J, an extension to Coccinelle, which is a program transformation tool designed for widespread changes in C code, in order to work on Java source code. We adapt Coccinelle to be able to apply scripts written in the Semantic Patch Language (SmPL), a language provided by Coccinelle, to Java source files. As a case study, we demonstrate the utility of Coccinelle4J with the task of API migration. We show 6 semantic patches to migrate from deprecated Android API methods on several open source Android projects. We describe how SmPL can be used to express several API migrations and justify several of our design decisions. 2012 ACM Subject Classification Software and its engineering → Software notations and tools Keywords and phrases Program transformation, Java Digital Object Identifier 10.4230/LIPIcs.ECOOP.2019.22 Category Experience Report Supplement Material ECOOP 2019 Artifact Evaluation approved artifact available at https://dx.doi.org/10.4230/DARTS.5.2.10 Coccinelle4J can be found at https://github.com/kanghj/coccinelle/tree/java Funding This research was supported by the Singapore National Research Foundation (award number: NRF2016-NRF-ANR003) and the ANR ITrans project.
    [Show full text]
  • Coccinelle: Reducing the Barriers to Modularization in a Large C Code Base
    Coccinelle: Reducing the Barriers to Modularization in a Large C Code Base Julia Lawall Inria/LIP6/UPMC/Sorbonne University-Regal Modularity 2014 1 Modularity Wikipedia: Modularity is the degree to which a system's components may be separated and recombined. • A well-designed system (likely) starts with a high degree of modularity. • Modularity must be maintained as a system evolves. • Evolution decisions may be determined by the impact on modularity. Goal: Maintaining modularity should be easy as a system evolves. 2 Modularity and API functions Well designed API functions can improve modularity • Hide module-local variable names. • Hide module-local function protocols. Problem: • The perfect API may not be apparent in the original design. • The software may evolve, making new APIs needed. • Converting to new APIs is hard. 3 Modularity in the Linux kernel ipv4 ipv6 ext4 Net File system library library Kernel btrfs e1000e Driver library ... tun tef6862 4 An improvement in modularity could better isolate functionality in one of these modules. Case study: Memory management in Linux Since Linux 1.0, 1994: • kmalloc: allocate memory • memset: clear memory • kfree: free memory Since Linux 2.6.14, 2006: • kzalloc: allocate memory • kfree: free memory • No separate clearing, but need explicit free. Since Linux 2.6.21, 2007: • devm kzalloc: allocate memory • No explicit free. 5 6 kzalloc platform kzalloc platform devm_kzalloc 800 i2c kzalloc i2c devm_kzalloc 600 calls 400 200 0 2.6.20 2.6.22 2.6.24 2.6.26 2.6.28 2.6.30 2.6.32 2.6.34 2.6.36 2.6.38
    [Show full text]
  • Inferring Semantic Patches for the Linux Kernel
    SPINFER: Inferring Semantic Patches for the Linux Kernel Lucas Serrano and Van-Anh Nguyen, Sorbonne University/Inria/LIP6; Ferdian Thung, Lingxiao Jiang, and David Lo, School of Information Systems, Singapore Management University; Julia Lawall and Gilles Muller, Inria/Sorbonne University/LIP6 https://www.usenix.org/conference/atc20/presentation/serrano This paper is included in the Proceedings of the 2020 USENIX Annual Technical Conference. July 15–17, 2020 978-1-939133-14-4 Open access to the Proceedings of the 2020 USENIX Annual Technical Conference is sponsored by USENIX. SPINFER: Inferring Semantic Patches for the Linux Kernel Lucas Serrano Van-Anh Nguyen Sorbonne University/Inria/LIP6 Sorbonne University/Inria/LIP6 Ferdian Thung Lingxiao Jiang School of Information System School of Information System Singapore Management University Singapore Management University David Lo Julia Lawall, Gilles Muller School of Information System Inria/Sorbonne University/LIP6 Singapore Management University Abstract (i.e., diff-like) syntax, enhanced with metavariables to rep- In a large software system such as the Linux kernel, there is resent common but unspecified subterms and notation for a continual need for large-scale changes across many source reasoning about control-flow paths. Given a semantic patch, files, triggered by new needs or refined design decisions. In Coccinelle applies the rules automatically across the code this paper, we propose to ease such changes by suggesting base. Today, Coccinelle is widely adopted by the Linux com- transformation rules to developers, inferred automatically munity: semantic patches are part of the Linux kernel source from a collection of examples. Our approach can help auto- tree, are invokable from the kernel build infrastructure, and mate large-scale changes as well as help understand existing are regularly run by Intel’s Linux kernel 0-day build-testing large-scale changes, by highlighting the various cases that service [10].
    [Show full text]
  • Automating Patching of Vulnerable Open-Source Software Versions in Application Binaries
    Automating Patching of Vulnerable Open-Source Software Versions in Application Binaries Ruian Duan:, Ashish Bijlani:, Yang Ji:, Omar Alrawi:, Yiyuan Xiong˚, Moses Ike:, Brendan Saltaformaggio,: and Wenke Lee: fruian, ashish.bijlani, yang.ji, alrawi, [email protected], [email protected] [email protected], [email protected] : Georgia Institute of Technology, ˚ Peking University Abstract—Mobile application developers rely heavily on open- while ensuring backward compatibility, and test for unin- source software (OSS) to offload common functionalities such tended side-effects. For the Android platform, Google has as the implementation of protocols and media format playback. initiated the App Security Improvement Program (ASIP) [21] Over the past years, several vulnerabilities have been found in to notify developers of vulnerable third-party libraries in popular open-source libraries like OpenSSL and FFmpeg. Mobile use. Unfortunately, many developers, as OSSPolice [15] and applications that include such libraries inherit these flaws, which LibScout [4] show, do not update or patch their application, make them vulnerable. Fortunately, the open-source community is responsive and patches are made available within days. However, which leaves end-users exposed. Android developers mainly mobile application developers are often left unaware of these use Java and C/C++ [1] libraries. While Derr et al. [14] flaws. The App Security Improvement Program (ASIP) isa show that vulnerable Java libraries can be fixed by library- commendable effort by Google to notify application developers level update, their C/C++ counterparts, which contain many of these flaws, but recent work has shown that many developers more documented security bugs in the National Vulnerability do not act on this information.
    [Show full text]
  • SED 1214 Transcript EPISODE 1214
    SED 1214 Transcript EPISODE 1214 [INTRODUCTION] [00:00:00] JM: Static analysis is a type of debugging that identifies defects without running the ​ code. Static analysis tools can be especially useful for enforcing security policies by analyzing code for security vulnerabilities early in the development process allowing teams to rapidly address potential issues and conform to best practices. R2c has developed a fast open source static analysis tool called Semgrep. Semgrep provides syntax-aware code scanning and a database of thousands of community-defined rules to compare your code against. Semgrep also makes it easy for security engineers and developers to define custom rules to enforce their organization's policies. R2c's platform has been adopted by a lot of companies such as Dropbox and Snowflake and they are gaining a lot of traction. Isaac Evans is the founder and CEO of r2c. Before founding r2c he was an entrepreneur in residence at Red Point and a computer scientist at the U.S. Department of Defense. Isaac joins the show today to talk about how r2c is helping teams improve cloud security and static analysis. How static analysis fits into CI/CD workflows and what to expect from r2c and the Semgrep project in the future. [INTERVIEW] [00:01:15] JM: Isaac, welcome to the show. ​ [00:01:17] IE: Hey, Jeff. It's great to be here. ​ [00:01:19] JM: I have done probably 15 shows over the years on static analysis tools. Why are ​ there so many static analysis tools? [00:01:30] IE: Well, you know, Jeff, I think it's something really deep about developer ​ psychology actually.
    [Show full text]
  • Automated Secure Code Review for Webapplications
    DEGREE PROJECT IN TECHNOLOGY, FIRST CYCLE, 15 CREDITS STOCKHOLM, SWEDEN 2021 Automated secure code review for web­applications SADEQ GHOLAMI ZEINEB AMRI KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF ELECTRICAL ENGINEERING AND COMPUTER SCIENCE Title English: Automated secure code review for web­applications Svenska: Automatiserad kodgranskning för webbapplikationer Authors Sadeq Gholami <[email protected]> Zeineb Amri <[email protected]> School of Electrical Engineering and Computer Science KTH Royal Institute of Technology Place for Project Stockholm, Sweden Examiner Johan Montelius KTH Royal Institute of Technology Supervisors Fadil Galjic KTH Royal Institute of Technology Christoffer Jerkeby F­Secure ii Abstract Carefully scanning and analysing web­applications is important, in order to avoid potential security vulnerabilities, or at least reduce them. Traditional code reviewing methods, such as manual code reviews, have various drawbacks when performed on large code­bases. Therefore it is appropriate to explore automated code reviewing tools and study their performance and reliability. The literature study helped identify various prerequisites, which facilitated the application of automated code reviewing tools. In a case study, two static analysis tools, CodeQL and Semgrep, were used to find security risks in three open source web­ applications with already known vulnerabilities. The result of the case study indicates that the automated code reviewing tools are much faster and more efficient than the manual reviewing, and they can detect security vulnerabilities to a certain acceptable degree. However there are vulnerabilities that do not follow a pattern and are difficult to be identified with these tools, and need human intelligence to be detected. Keywords: automated code reviewing tools, CodeQL, Semgrep, code review, security vulner­ abilities, web­applications iii Abstrakt Det är viktigt att skanna och analysera webbapplikationer noggrant för att undvika potentiella säkerhetsproblem eller åtminstone minska dem.
    [Show full text]
  • Detect Complex Code Patterns Using Semantic Grep
    Detect complex code patterns using semantic grep Bence Nagy | [email protected] @r2cdev 1 tl;dw - This Talk ● Secure code is hard ● Static analysis tools are too noisy / too slow ● grep isn’t expressive enough ● Need something, fast, code-aware, flexible, powerful… open source! Semgrep: Fast and syntax-aware semantic code pattern search for many languages: like grep but for code 2 Use Semgrep to: ● Search: Find security bugs ● Guard: Enforce best practices ● Monitor: Get notifications about new matches ● Migrate: Refactor code easily 3 $ whois @underyx (Bence Nagy) engineer @ r2c previously at: Astroscreen (information warfare) Kiwi.com (travel) $ getent group r2c We’re an SF based code analysis startup. Mission: profoundly improve code security & reliability 4 Outline 1. A 60 second history 2. Trees. (well… syntax trees) 3. Learning Semgrep! 4. Integration into CI/CD ⚙ 5. Semgrep Rules Registry 5 github.com/returntocorp/semgrep 6 Semgrep, Est. 2009 First version of Semgrep (sgrep/pfff) was written at Facebook circa 2009 and was used to enforce nearly 1000 rules! The original author, Yoann Padioleau (@aryx), joined r2c last year. Yoann was the first static analysis hire at Facebook and previously PhD @ Inria, contributor to coccinelle.lip6.fr 7 Language Support License 8 grep and Abstract Syntax Trees (ASTs) 9 xkcd 1171 FALSE POSITIVES 10 Code is not a string, it’s a tree 臨 string != tree @app.route("/index") @app.route(“/index”) def index(): rep = response.set_cookie(name(), def index(): secure=False, s=func()) return rep name(), func()
    [Show full text]
  • Introducing Semgrep
    introducing semgrep Drew Dennison | r2c @drewdennison Slides are posted at bit.ly/hella-secure-semgrep 1 Tl;dr - This Talk ● Writing secure code is hard ● SAST tools are too noisy / too slow, grep isn’t expressive enough ● Need something, fast, code-aware, flexible, powerful… open source! ● Enter: semgrep Use to: ● Enforce org / code specific patterns and best practices ● Find security bugs ● Scan every PR for vulnerabilities 2 whois? Presenting: Drew Dennison, co-founder @ r2c BS in CompSci from MIT, ex-Palantir r2c We’re a static analysis startup based in SF and we really care about software security. 3 Talk Outline 1. Writing secure code is hard 2. Getting started with semgrep 3. Demo 4. Using it yourself 4 It’s really hard to write secure code 5 Cookies @app.route("/index") def index(): resp = response.set_cookie("username","DrewDennison") return resp 6 How might we detect this? ⇒ REGEX grep -RE 'response\.set_cookie\(' path/to/code 7 Code Equivalence response.set_cookie("username","DrewDennison") Default from flask.response import set_cookie as sc Import and rename sc("username","DrewDennison") response.set_cookie("username","Drew", secure=True, path="/") Keyword arguments response.set_cookie( Multiline "username","DrewDennison", secure=True, samesite=Secure, httponly=True) # response.set_cookie("username","DrewDennison", secure=True) Commented out code 8 Regex Matches response.set_cookie("username","DrewDennison") from flask.response import set_cookie as sc sc("username","DrewDennison")1 True Positive response.set_cookie("username","Drew",3
    [Show full text]
  • Effective Source Code Analysis with Minimization
    Effective Source Code Analysis with Minimization Geet Tapan Telang Kotaro Hashimoto Krishnaji Desai Hitachi India Pvt. Ltd. Hitachi India Pvt. Ltd. Hitachi India Pvt. Ltd. Research Engineer Software Engineer Researcher Bangalore, India Bangalore, India Bangalore, India Email: [email protected] Email: [email protected] Email: [email protected] Abstract—During embedded software development using open source, there exists substantial amount of code that is ineffective which reduces the debugging efficiency, readability for human inspection and increase in search space for analysis. In domains like real-time embedded system and mission critical systems, this may result in inefficiency and inconsistencies affecting lower quality of service, enhanced readability, increased verification and validation efforts. To mitigate these shortcomings, we propose the method of minimization with an easy to use tool support that leverages preprocessor directives with GCC for cutting out ifdef blocks. Case studies of Linux kernel tree, Busybox and industry- strength OSS projects are evaluated indicating average reduction in lines of code roughly around 5%-22% in base kernel using minimization technique. This results in increased efficiency for analysis, testing and human inspections that may help in assuring dependability of systems. Fig. 1: Overview of minimization. I. INTRODUCTION The outgrowth of Linux operating system and other real- II. BACKGROUND time embedded systems in dependable computing has raised concern in possible areas such as mission critical system. The In OSS software domain, there are many developers con- size of code has grown to approximately 20 million lines of tributing towards the common goal such as real-time, safety- code (Linux) and with this scale and complexity, it becomes mitigation etc.
    [Show full text]
  • Clang and Coccinelle: Synergising Program Analysis Tools for CERT C Secure Coding Standard Certification
    Clang and Coccinelle synergising program analysis tools for CERT C Secure Coding Standard certification Olesen, Mads Christian; Hansen, René Rydhof; Lawall, Julia; Palix, Nicolas Jean-Michel Published in: Proceedings of the Fourth International Workshop on Foundations and Tecniques for Open Source Software Certification (OpenCert 2010) DOI: 10.14279/tuj.eceasst.33.455 Publication date: 2010 Document version Publisher's PDF, also known as Version of record Document license: Unspecified Citation for published version (APA): Olesen, M. C., Hansen, R. R., Lawall, J., & Palix, N. J-M. (2010). Clang and Coccinelle: synergising program analysis tools for CERT C Secure Coding Standard certification. In L. S. Barbosa, A. Cerone, & S. A. Shaikh (Eds.), Proceedings of the Fourth International Workshop on Foundations and Tecniques for Open Source Software Certification (OpenCert 2010) Electronic Communications of the EASST Vol. 33 https://doi.org/10.14279/tuj.eceasst.33.455 Download date: 01. Oct. 2021 Electronic Communications of the EASST Volume 33 (2010) Proceedings of the Fourth International Workshop on Foundations and Techniques for Open Source Software Certification (OpenCert 2010) Clang and Coccinelle: Synergising program analysis tools for CERT C Secure Coding Standard certification Mads Chr. Olesen, Rene´ Rydhof Hansen, Julia L. Lawall, Nicolas Palix 18 pages Guest Editors: Luis S. Barbosa, Antonio Cerone, Siraj A. Shaikh Managing Editors: Tiziana Margaria, Julia Padberg, Gabriele Taentzer ECEASST Home Page: http://www.easst.org/eceasst/ ISSN 1863-2122 ECEASST Clang and Coccinelle: Synergising program analysis tools for CERT C Secure Coding Standard certification Mads Chr. Olesen1, Rene´ Rydhof Hansen1, Julia L. Lawall2, Nicolas Palix2 1rrh,[email protected], http://www.cs.aau.dk 2julia,[email protected], http://www.diku.dk Abstract: Writing correct C programs is well-known to be hard, not least due to the many language features intrinsic to C.
    [Show full text]
  • Aalborg Universitet Coccinelle Tool Support for Automated
    View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by VBN Aalborg Universitet Coccinelle Tool support for automated CERT C Secure Coding Standard certification Olesen, Mads Chr.; Hansen, Rene Rydhof; Lawall, Julia L.; Palix, Nicolas Jean-Michel Published in: Science of Computer Programming DOI (link to publication from Publisher): 10.1016/j.scico.2012.10.011 Publication date: 2014 Document Version Early version, also known as pre-print Link to publication from Aalborg University Citation for published version (APA): Olesen, M. C., Hansen, R. R., Lawall, J. L., & Palix, N. J-M. (2014). Coccinelle: Tool support for automated CERT C Secure Coding Standard certification. Science of Computer Programming, 91(Part B), 141-160. https://doi.org/10.1016/j.scico.2012.10.011 General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. ? Users may download and print one copy of any publication from the public portal for the purpose of private study or research. ? You may not further distribute the material or use it for any profit-making activity or commercial gain ? You may freely distribute the URL identifying the publication in the public portal ? Take down policy If you believe that this document breaches copyright please contact us at [email protected] providing details, and we will remove access to the work immediately and investigate your claim.
    [Show full text]
  • Design and Implementation of Semantic Patch Support for the Spoon Java Transformation Engine
    DEGREE PROJECT IN COMPUTER SCIENCE AND ENGINEERING, SECOND CYCLE, 30 CREDITS STOCKHOLM, SWEDEN 2021 Design and Implementation of Semantic Patch Support for the Spoon Java Transformation Engine MIKAEL FORSBERG KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF ELECTRICAL ENGINEERING AND COMPUTER SCIENCE Design and Implementation of Semantic Patch Support for the Spoon Java Transformation Engine MIKAEL FORSBERG Master in Computer Science Date: January 26, 2021 Supervisor: Nicolas Yves Maurice Harrand Examiner: Martin Monperrus School of Electrical Engineering and Computer Science Swedish title: Design och implementering av stöd för semantiska patchar för Javatransformeringsmotorn Spoon iii Abstract Software development is more often than not a collaborative process, creating a need for tools and file formats that enable developers to create and share suc- cinct representations of changes to source code in order to facilitate efficient communication. Standard POSIX diffs and patches have long been important parts of the toolkit, but their lack of support for the syntax and semantics of spe- cific programming languages results in limited expressiveness. The Semantic Patch Language (SmPL), introduced in 2006 together with the tool Coccinelle, increases the expressiveness of POSIX-style patches for the C programming language by leveraging support for the syntax and semantics of C. For exam- ple, an SmPL patch can specify changes to source code using metavariables that bind arbitrary program variable names, allowing for the specification of transformations involving variable references regardless of what specific vari- able names appear in programs targeted by the patch. A recent development is Coccinelle4J, a prototype modification of Coccinelle targeting the Java pro- gramming language. Coccinelle4J remains based on a toolkit designed for the parsing and modeling of C, adapted to operate on Java source code.
    [Show full text]