Paralegal: Practical Static Analysis for Privacy Bugs
summary
Paralegal is a static analysis tool for Rust that checks formal privacy policies over a marker-annotated Program Dependence Graph, using Rust’s ownership types to automatically model library behavior. It evaluates 11 policies across eight real apps, finds two previously unknown privacy bugs plus five known ones, and runs up to 88 seconds for whole-project analyses or about 3 seconds per incremental endpoint. Policies are auditable and robust, markers live in source code so the approach is non-invasive and amenable to CI.
AI-written summary · about
chapters (10)
- 0:00Paralegal introduction
- 2:46Limitations of static analysis
- 5:36Paralegal’s practical approach
- 7:21Specifying privacy policies
- 9:08Markers interface policy-code
- 10:51Checking data flow dependencies
- 12:59Scaling with Rust types
- 16:04Evaluation results
- 17:48Performance and scalability
- 19:36Related work comparison
related talks
50mPractical Advanced Static Analysis
44mStatic analysis as an additional barrier against bugs
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
27mPack it up
18mPreview: Verification (Correctness & Debugging)
09mModern Static Code Analysis the Example of PVS-Studio
18mEnhancing Static Analysis for Practical Bug Detection: An LLM-Integrated Approach
25mTypes & static analysis are good in PHP