Seneca: Taint-Based Call Graph Construction for Java Object Deserialization
summary
Seneca implements a two-phase, taint-driven extension to call-graph construction that inserts synthetic serialization methods and uses taint-state propagation over WALA-style pointer sets to discover callback dispatches (writeObject/readObject/readResolve). It passes all prior serialization soundness tests, produces fewer spurious edges than a baseline SOTA (SASA) on real Java corpora, finds known untrusted-deserialization vulnerable paths in three open-source projects where SASA misses them, and adds little runtime/analysis overhead.
AI-written summary · about
chapters (11)
- 0:00Seneca and call graphs
- 1:23Object deserialization in Java
- 3:33Why call graphs miss deserialization
- 5:19Two-phase taint-based refinement
- 8:05Modeling object read/write behavior
- 9:28Taint states and method dispatch
- 14:05Evaluating Seneca's soundness and precision
- 15:30Seneca for vulnerability detection
- 16:13Summary and future directions
- 16:40Q&A: Integration with call graph constructors
- 17:43Q&A: Limitations and failure modes
related talks
34mDeserialization: what, how and why [not]
41mHigh-Secure Java Serialization
51mSerialization: A New Hope
37mA Static Tainting Analysis Method for Aspect-Oriented Programs
23mSerialization 2.0
49mMarshalling: Data-Oriented Serialization
38mStatic Code Analysis - A Behind-the-scenes Look
47mA Modern Fairy Tale: Java Serialization