A Static Tainting Analysis Method for Aspect-Oriented Programs
summary
Introduces a static tainting method that finds where untrusted inputs flow into sensitive sinks in AspectJ-style code by building an interprocedural control-flow graph that includes woven advice, pointcuts, and join points. Shows how advice types (before/after/around advice) can taint or sanitize data, explains that weaving often modifies bytecode at compile or runtime, and reports each unsafe flow back for remediation. Demonstrates detection rules (sources, sanitizers, sinks) and how aspects can both fix and accidentally introduce vulnerabilities.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 7:58Joint Points
- 10:25Aspect
- 14:09Logging
- 17:46Point Cuts
- 21:58Taint Analysis
- 24:45Sanitization
related talks
52mTrust No Input: Taint Analysis at Compile Time
28mTypes, Deeper Static Analysis, and you
38mStatic Code Analysis - A Behind-the-scenes Look
19mThe ART of Sharing Points-to Analysis: Reusing Points-to Analysis Results Safely and(…)
42mAn Opinionated Overview on Static Analysis for Java
19mScalable Language Agnostic Taint Tracking using Explicit Data Dependencies
22mJASMaint: Portable Multi-language Taint Analysis for the Web
44mThere & Back Again