Flow-sensitive type qualifiers

Authors:
Jeffrey S. Foster;Tachio Terauchi;Alex Aiken
Affiliations:
University of California, Berkeley, CA;University of California, Berkeley, CA;University of California, Berkeley, CA
Venue:
PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
Year:
2002

Citing 29
Cited 152

Compilers: principles, techniques, and tools

Compilers: principles, techniques, and tools
Typestate: A programming language concept for enhancing software reliability

IEEE Transactions on Software Engineering
Polymorphic effect systems

POPL '88 Proceedings of the 15th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Analysis of pointers and structures

PLDI '90 Proceedings of the ACM SIGPLAN 1990 conference on Programming language design and implementation
Typing references by effect inference

ESOP'92 Symposium proceedings on 4th European symposium on programming
Implementation of the typed call-by-value λ-calculus using a stack of regions

POPL '94 Proceedings of the 21st ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Context-sensitive interprocedural points-to analysis in the presence of function pointers

PLDI '94 Proceedings of the ACM SIGPLAN 1994 conference on Programming language design and implementation
An extended form of must alias analysis for dynamic allocation

POPL '95 Proceedings of the 22nd ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Efficient context-sensitive pointer analysis for C programs

PLDI '95 Proceedings of the ACM SIGPLAN 1995 conference on Programming language design and implementation
Better static memory management: improving region-based analysis of higher-order languages

PLDI '95 Proceedings of the ACM SIGPLAN 1995 conference on Programming language design and implementation
Static detection of dynamic memory errors

PLDI '96 Proceedings of the ACM SIGPLAN 1996 conference on Programming language design and implementation
A type system for Java bytecode subroutines

POPL '98 Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Single and loving it: must-alias analysis for higher-order languages

POPL '98 Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
A simple, comprehensive type system for Java bytecode subroutines

Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Typed memory management in a calculus of capabilities

Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
A theory of type qualifiers

Proceedings of the ACM SIGPLAN 1999 conference on Programming language design and implementation
Type-based race detection for Java

PLDI '00 Proceedings of the ACM SIGPLAN 2000 conference on Programming language design and implementation
Enforcing high-level protocols in low-level software

Proceedings of the ACM SIGPLAN 2001 conference on Programming language design and implementation
Bugs as deviant behavior: a general approach to inferring errors in systems code

SOSP '01 Proceedings of the eighteenth ACM symposium on Operating systems principles
CCured: type-safe retrofitting of legacy code

POPL '02 Proceedings of the 29th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Resource usage analysis

POPL '02 Proceedings of the 29th ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Adoption and focus: practical linear types for imperative programming

PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
ESP: path-sensitive program verification in polynomial time

PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
Extended static checking for Java

PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
Tractable Constraints in Finite Semilattices

SAS '96 Proceedings of the Third International Symposium on Static Analysis
Alias Types for Recursive Data Structures

TIC '00 Selected papers from the Third International Workshop on Types in Compilation
Cyclone User''s Manual, Version 0.1.3

Cyclone User''s Manual, Version 0.1.3
Checking Programmer-Specified Non-Aliasing

Checking Programmer-Specified Non-Aliasing
Checking system rules using system-specific, programmer-written compiler extensions

OSDI'00 Proceedings of the 4th conference on Symposium on Operating System Design & Implementation - Volume 4

ESP: path-sensitive program verification in polynomial time

PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
A system and language for building system-specific, static analyses

PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
A new type system for JVM lock primitives

ASIA-PEPM '02 Proceedings of the ASIAN symposium on Partial evaluation and semantics-based program manipulation
How to write system-specific, static checkers in metal

Proceedings of the 2002 ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering
Time regions and effects for resource usage analysis

Proceedings of the 2003 ACM SIGPLAN international workshop on Types in languages design and implementation
Temporal-Safety Proofs for Systems Code

CAV '02 Proceedings of the 14th International Conference on Computer Aided Verification
Checking and inferring local non-aliasing

PLDI '03 Proceedings of the ACM SIGPLAN 2003 conference on Programming language design and implementation
An extension of HM(X) with bounded existential and universal data-types

ICFP '03 Proceedings of the eighth ACM SIGPLAN international conference on Functional programming
An effective theory of type refinements

ICFP '03 Proceedings of the eighth ACM SIGPLAN international conference on Functional programming
MECA: an extensible, expressive system and language for statically checking security properties

Proceedings of the 10th ACM conference on Computer and communications security
Abstractions from proofs

Proceedings of the 31st ACM SIGPLAN-SIGACT symposium on Principles of programming languages
A generic type system for the Pi-calculus

Theoretical Computer Science
Securing web application code by static analysis and runtime protection

Proceedings of the 13th international conference on World Wide Web
Verifying safety properties using separation and heterogeneous abstractions

Proceedings of the ACM SIGPLAN 2004 conference on Programming language design and implementation
Parametric regular path queries

Proceedings of the ACM SIGPLAN 2004 conference on Programming language design and implementation
Software validation via scalable path-sensitive value flow analysis

ISSTA '04 Proceedings of the 2004 ACM SIGSOFT international symposium on Software testing and analysis
A type system for resource protocol verification and its correctness proof

Proceedings of the 2004 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation
A practical type system and language for reference immutability

OOPSLA '04 Proceedings of the 19th annual ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications
Transparent proxies for java futures

OOPSLA '04 Proceedings of the 19th annual ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications
Practical predicate dispatch

OOPSLA '04 Proceedings of the 19th annual ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications
Pluggable verification modules: an extensible protection mechanism for the JVM

OOPSLA '04 Proceedings of the 19th annual ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications
Correlation exploitation in error ranking

Proceedings of the 12th ACM SIGSOFT twelfth international symposium on Foundations of software engineering
Static Analysis for Security

IEEE Security and Privacy
Connecting effects and uniqueness with adoption

Proceedings of the 32nd ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Scalable error detection using boolean satisfiability

Proceedings of the 32nd ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Finding bugs is easy

ACM SIGPLAN Notices
Resource usage analysis

ACM Transactions on Programming Languages and Systems (TOPLAS)
Verifying safety policies with size properties and alias controls

Proceedings of the 27th international conference on Software engineering
Path slicing

Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation
Semantic type qualifiers

Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation
Programmer specified pointer independence

MSP '04 Proceedings of the 2004 workshop on Memory system performance
Visualizing type qualifier inference with Eclipse

eclipse '04 Proceedings of the 2004 OOPSLA workshop on eclipse technology eXchange
Trace effects and object orientation

PPDP '05 Proceedings of the 7th ACM SIGPLAN international conference on Principles and practice of declarative programming
Permissive interfaces

Proceedings of the 10th European software engineering conference held jointly with 13th ACM SIGSOFT international symposium on Foundations of software engineering
Joining dataflow with predicates

Proceedings of the 10th European software engineering conference held jointly with 13th ACM SIGSOFT international symposium on Foundations of software engineering
Javari: adding reference immutability to Java

OOPSLA '05 Proceedings of the 20th annual ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications
Resource usage analysis for a functional language with exceptions

Proceedings of the 2006 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation
Type-based confinement

Journal of Functional Programming
Typestate verification: abstraction techniques and complexity results

Science of Computer Programming - Special issue: Static analysis symposium (SAS 2003)
Error checking with client-driven pointer analysis

Science of Computer Programming - Special issue: Static analysis symposium (SAS 2003)
LOCKSMITH: context-sensitive correlation analysis for race detection

Proceedings of the 2006 ACM SIGPLAN conference on Programming language design and implementation
Applying flow-sensitive CQUAL to verify MINIX authorization check placement

Proceedings of the 2006 workshop on Programming languages and analysis for security
Certified In-lined Reference Monitoring on .NET

Proceedings of the 2006 workshop on Programming languages and analysis for security
Condate: a proto-language at the confluence between checking and compiling

Proceedings of the 8th ACM SIGPLAN international conference on Principles and practice of declarative programming
The case for analysis preserving language transformation

Proceedings of the 2006 international symposium on Software testing and analysis
A framework for implementing pluggable type systems

Proceedings of the 21st annual ACM SIGPLAN conference on Object-oriented programming systems, languages, and applications
Efficient path conditions in dependence graphs for software safety analysis

ACM Transactions on Software Engineering and Methodology (TOSEM)
EXE: automatically generating inputs of death

Proceedings of the 13th ACM conference on Computer and communications security
Bit level types for high level reasoning

Proceedings of the 14th ACM SIGSOFT international symposium on Foundations of software engineering
Flow-insensitive type qualifiers

ACM Transactions on Programming Languages and Systems (TOPLAS)
Using model checking to find serious file system errors

ACM Transactions on Computer Systems (TOCS)
Understanding collateral evolution in Linux device drivers

Proceedings of the 1st ACM SIGOPS/EuroSys European Conference on Computer Systems 2006
Type checking a multithreaded functional language with session types

Theoretical Computer Science
Saturn: A scalable framework for error detection using Boolean satisfiability

ACM Transactions on Programming Languages and Systems (TOPLAS) - Special issue on POPL 2005
Using SCL to Specify and Check Design Intent in Source Code

IEEE Transactions on Software Engineering
Sound and precise analysis of web applications for injection vulnerabilities

Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation
Static specification inference using predicate mining

Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation
Model checking large network protocol implementations

NSDI'04 Proceedings of the 1st conference on Symposium on Networked Systems Design and Implementation - Volume 1
Using model checking to find serious file system errors

OSDI'04 Proceedings of the 6th conference on Symposium on Opearting Systems Design & Implementation - Volume 6
Large-scale analysis of format string vulnerabilities in Debian Linux

Proceedings of the 2007 workshop on Programming languages and analysis for security
Mutatis Mutandis: Safe and predictable dynamic software updating

ACM Transactions on Programming Languages and Systems (TOPLAS)
Modular typestate checking of aliased objects

Proceedings of the 22nd annual ACM SIGPLAN conference on Object-oriented programming systems and applications
Type qualifier inference for java

Proceedings of the 22nd annual ACM SIGPLAN conference on Object-oriented programming systems and applications
A survey of static analysis methods for identifying security vulnerabilities in software systems

IBM Systems Journal
Generating precise and concise procedure summaries

Proceedings of the 35th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Effective typestate verification in the presence of aliasing

ACM Transactions on Software Engineering and Methodology (TOSEM)
Types and trace effects of higher order programs

Journal of Functional Programming
Rule-based static analysis of network protocol implementations

Information and Computation
Static detection of cross-site scripting vulnerabilities

Proceedings of the 30th international conference on Software engineering
Checking race freedom via linear programming

Proceedings of the 2008 ACM SIGPLAN conference on Programming language design and implementation
The CLOSER: automating resource management in java

Proceedings of the 7th international symposium on Memory management
Towards easing the diagnosis of bugs in OS code

Proceedings of the 4th workshop on Programming languages and operating systems
A capability calculus for concurrency and determinism

ACM Transactions on Programming Languages and Systems (TOPLAS)
A type system equivalent to a model checker

ACM Transactions on Programming Languages and Systems (TOPLAS)
The Verified Software Challenge: A Call for a Holistic Approach to Reliability

Verified Software: Theories, Tools, Experiments
Automatic Verification of Strongly Dynamic Software Systems

Verified Software: Theories, Tools, Experiments
Protocol Inference Using Static Path Profiles

SAS '08 Proceedings of the 15th international symposium on Static Analysis
Kilim: Isolation-Typed Actors for Java

ECOOP '08 Proceedings of the 22nd European conference on Object-Oriented Programming
Inference of Reference Immutability

ECOOP '08 Proceedings of the 22nd European conference on Object-Oriented Programming
Enforcing object protocols by combining static and runtime analysis

Proceedings of the 23rd ACM SIGPLAN conference on Object-oriented programming systems languages and applications
Typestate-like analysis of multiple interacting objects

Proceedings of the 23rd ACM SIGPLAN conference on Object-oriented programming systems languages and applications
Constrained types for object-oriented languages

Proceedings of the 23rd ACM SIGPLAN conference on Object-oriented programming systems languages and applications
EXE: Automatically Generating Inputs of Death

ACM Transactions on Information and System Security (TISSEC)
Types and trace effects for object orientation

Higher-Order and Symbolic Computation
Types and higher-order recursion schemes for verification of higher-order programs

Proceedings of the 36th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages
A generic type-and-effect system

Proceedings of the 4th international workshop on Types in language design and implementation
Runtime Monitoring of Object Invariants with Guarantee

Runtime Verification
Type-Based Deadlock-Freedom Verification for Non-Block-Structured Lock Primitives and Mutable References

APLAS '08 Proceedings of the 6th Asian Symposium on Programming Languages and Systems
An empirical security study of the native code in the JDK

SS'08 Proceedings of the 17th conference on Security symposium
Interprocedural and Flow-Sensitive Type Analysis for Memory and Type Safety of C Code

Journal of Automated Reasoning
TAJ: effective taint analysis of web applications

Proceedings of the 2009 ACM SIGPLAN conference on Programming language design and implementation
Software model checking

ACM Computing Surveys (CSUR)
Practical API Protocol Checking with Access Permissions

Genoa Proceedings of the 23rd European Conference on ECOOP 2009 --- Object-Oriented Programming
Polymorphic Fractional Capabilities

SAS '09 Proceedings of the 16th International Symposium on Static Analysis
A few billion lines of code later: using static analysis to find bugs in the real world

Communications of the ACM
Low-level liquid types

Proceedings of the 37th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Modular session types for distributed object-oriented programming

Proceedings of the 37th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Provably correct inline monitoring for multithreaded Java-like programs

Journal of Computer Security - EU-Funded ICT Research on Trust and Security
Client-driven pointer analysis

SAS'03 Proceedings of the 10th international conference on Static analysis
Z-ranking: using statistical analysis to counter the impact of static analysis approximations

SAS'03 Proceedings of the 10th international conference on Static analysis
Existential heap abstraction entailment is undecidable

SAS'03 Proceedings of the 10th international conference on Static analysis
Typestate verification: abstraction techniques and complexity results

SAS'03 Proceedings of the 10th international conference on Static analysis
Java bytecode verification for @NonNull types

CC'08/ETAPS'08 Proceedings of the Joint European Conferences on Theory and Practice of Software 17th international conference on Compiler construction
Recency types for analyzing scripting languages

ECOOP'10 Proceedings of the 24th European conference on Object-oriented programming
IntPatch: automatically fix integer-overflow-to-buffer-overflow vulnerability at compile-time

ESORICS'10 Proceedings of the 15th European conference on Research in computer security
LOCKSMITH: Practical static race detection for C

ACM Transactions on Programming Languages and Systems (TOPLAS)
A formal nethod (a networked formal method)

Innovations in Systems and Software Engineering
Zero-sized heap allocations vulnerability analysis

WOOT'10 Proceedings of the 4th USENIX conference on Offensive technologies
Union and intersection types to support both dynamic and static typing

Information Processing Letters
Extending type systems in a library: Type-safe XML processing in C++

Science of Computer Programming
Verifying pointer and string analyses with region type systems

LPAR'10 Proceedings of the 16th international conference on Logic for programming, artificial intelligence, and reasoning
2ndStrike: toward manifesting hidden concurrency typestate bugs

Proceedings of the sixteenth international conference on Architectural support for programming languages and operating systems
Formalisation and implementation of an algorithm for bytecode verification of @NonNull types

Science of Computer Programming
A decade of software model checking with SLAM

Communications of the ACM
Building and using pluggable type-checkers

Proceedings of the 33rd International Conference on Software Engineering
Tainted flow analysis on e-SSA-form programs

CC'11/ETAPS'11 Proceedings of the 20th international conference on Compiler construction: part of the joint European conferences on theory and practice of software
Saving the world wide web from vulnerable JavaScript

Proceedings of the 2011 International Symposium on Software Testing and Analysis
Static typing for a substructural lambda calculus

Frontiers of Computer Science in China
Context-sensitive auto-sanitization in web templating languages using type qualifiers

Proceedings of the 18th ACM conference on Computer and communications security
QVM: An Efficient Runtime for Detecting Defects in Deployed Systems

ACM Transactions on Software Engineering and Methodology (TOSEM)
Static typing with value space-based subtyping

Proceedings of the South African Institute of Computer Scientists and Information Technologists Conference on Knowledge, Innovation and Leadership in a Diverse, Multidisciplinary Environment
Harmless compiler plugins

Proceedings of the 13th Workshop on Formal Techniques for Java-Like Programs
Implementing a Language with Flow-Sensitive and Structural Typing on the JVM

Electronic Notes in Theoretical Computer Science (ENTCS)
Structural invariants

SAS'06 Proceedings of the 13th international conference on Static Analysis
Analysis of low-level code using cooperating decompilers

SAS'06 Proceedings of the 13th international conference on Static Analysis
One million (LOC) and counting: static analysis for errors and vulnerabilities in the linux kernel source code

Ada-Europe'06 Proceedings of the 11th Ada-Europe international conference on Reliable Software Technologies
A path sensitive type system for resource usage verification of c like languages

APLAS'05 Proceedings of the Third Asian conference on Programming Languages and Systems
Checking for deadlock, double-free and other abuses in the linux kernel source code

ICCS'06 Proceedings of the 6th international conference on Computational Science - Volume Part IV
A type system equivalent to a model checker

ESOP'05 Proceedings of the 14th European conference on Programming Languages and Systems
Learning component interfaces with may and must abstractions

CAV'10 Proceedings of the 22nd international conference on Computer Aided Verification
Interprocedural analysis for privileged code placement and tainted variable detection

ECOOP'05 Proceedings of the 19th European conference on Object-Oriented Programming
Resource usage analysis for the π-calculus

VMCAI'06 Proceedings of the 7th international conference on Verification, Model Checking, and Abstract Interpretation
Saturn: a SAT-based tool for bug detection

CAV'05 Proceedings of the 17th international conference on Computer Aided Verification
Using dependent types to certify the safety of assembly code

SAS'05 Proceedings of the 12th international conference on Static Analysis
Safe programming with pointers through stateful views

PADL'05 Proceedings of the 7th international conference on Practical Aspects of Declarative Languages
On the revival of dynamic languages

SC'05 Proceedings of the 4th international conference on Software Composition
An extensible open-source compiler infrastructure for testing

HVC'05 Proceedings of the First Haifa international conference on Hardware and Software Verification and Testing
Efficient flow-sensitive interprocedural data-flow analysis in the presence of pointers

CC'06 Proceedings of the 15th international conference on Compiler Construction
ILC: a foundation for automated reasoning about pointer programs

ESOP'06 Proceedings of the 15th European conference on Programming Languages and Systems
Inference of user-defined type qualifiers and qualifier rules

ESOP'06 Proceedings of the 15th European conference on Programming Languages and Systems
Safe locking for multi-threaded java

FSEN'11 Proceedings of the 4th IPM international conference on Fundamentals of Software Engineering
Deterministic parallelism via liquid effects

Proceedings of the 33rd ACM SIGPLAN conference on Programming Language Design and Implementation
make test-zesti: a symbolic execution solution for improving regression testing

Proceedings of the 34th International Conference on Software Engineering
Dependent types for JavaScript

Proceedings of the ACM international conference on Object oriented programming systems languages and applications
Tracking linear and affine resources with JAVA(X)

ECOOP'07 Proceedings of the 21st European conference on Object-Oriented Programming
Static single information form for abstract compilation

TCS'12 Proceedings of the 7th IFIP TC 1/WG 202 international conference on Theoretical Computer Science
Verifying pointer and string analyses with region type systems

Computer Languages, Systems and Structures
Model Checking Higher-Order Programs

Journal of the ACM (JACM)
A calculus for constraint-based flow typing

Proceedings of the 15th Workshop on Formal Techniques for Java-like Programs
AUTOCRYPT: enabling homomorphic computation on servers to protect sensitive web content

Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
Efficient static checker for tainted variable attacks

Science of Computer Programming
Using type analysis in compiler to mitigate integer-overflow-to-buffer-overflow threat

Journal of Computer Security - ESORICS 2010

Quantified Score

Hi-index	0.03

Visualization

Abstract

We present a system for extending standard type systems with flow-sensitive type qualifiers. Users annotate their programs with type qualifiers, and inference checks that the annotations are correct. In our system only the type qualifiers are modeled flow-sensitively---the underlying standard types are unchanged, which allows us to obtain an efficient constraint-based inference algorithm that integrates flow-insensitive alias analysis, effect inference, and ideas from linear type systems to support strong updates. We demonstrate the usefulness of flow-sensitive type qualifiers by finding a number of new locking bugs in the Linux kernel.