This document outlines a static analysis tool called File Access Reporter that analyzes which files a Java program may access. It uses both forward and backward dataflow analysis to track string values that may be passed to File constructors. The tool was tested on sample code and real code from GitHub with promising but limited results, as it cannot infer all possible values for fields, methods, or loops. The tool aims to inform developers about potential file accesses before running an application.

1. File Access Reporter
Charles Chen

2. Outline
• introduction
• design & implementation
• experiment result & limitation

3. Introduction
• Security issue: File accessibility of a program
• We all want to know what files an application would access
• We want know the fact before running it
• Simple static analysis tool
• analysis files a JAVA program might access

4. Main idea
• Assumption: a JAVA program would always using
”java.io.File” to operate on a file object
• analysis possible String values reach File constructors

5. Forward V.S. Backward analysis
• Forward:
• track all strings
• evaluate their values
• record if they reach a File constructor
• Backward:
• start at File constructors
• only record their arguments
• evaluate arguments’ values backward
Backward is less expensive!
<entry>
str = …str = …
<exit>
else then
File file = new File(str);
D

6. Binary Tree Representation & Lattice
• solve Variables (VAR) to Values (VAL)
• semi-lattice
TOP
MERGE
VAR VAL
S
+
L
VAR VAL
str + “literal”

7. Dynamic Substitution by Last Definition
parDir = new File(“dir”);
String suffix = “.txt”;
String child = “impossible”;
child = “aFile” + suffix;
new File (parDir, child);
parDir
/
child
parDir
/
+
aFile suffix
parDir
/
+
aFile .txt
dir
/
+
aFile .txt

8. Experiment Result – loop

9. Experiment result – loop2

10. Experiment Result – real code from github

11. Limitation
• Local dataflow analysis
• cannot infer possible values of a field
• cannot infer possible values return by a method invocation
• cannot estimate value in while loop when value is related to the times
of iteration
• e.g. while (c) { path += ”a” };
• Didn’t consider “File.rename()” method and “new File(URI uri)”
constructor in current implementation