ReuNify: A step towards whole program analysis for react native Android apps

Yonghui Liu; Xiao Chen; Pei Liu; John Grundy; Chunyang Chen; Li Li

doi:10.1109/ASE56229.2023.00113

ReuNify: A step towards whole program analysis for react native Android apps

Yonghui Liu
, Xiao Chen
, Pei Liu
, John Grundy
, Chunyang Chen
, Li Li

Department of Software Systems & Cybersecurity

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

9 Citations (Scopus)

Abstract

React Native is a widely-used open-source frame-work that facilitates the development of cross-platform mobile apps. The framework enables JavaScript code to interact with native-side code, such as Objective-C/Swift for iOS and Java/Kotlin for Android, via a communication mechanism provided by React Native. However, previous research and tools have overlooked this mechanism, resulting in incomplete analysis of React Native app code. To address this limitation, we have developed REUNIFY, a prototype tool that integrates the JavaScript and native-side code of React Native apps into an intermediate language that can be processed by the Soot static analysis framework. By doing so, REUNIFY enables the generation of a comprehensive model of the app's behavior. Our evaluation indicates that, by leveraging REUNIFY, the Soot-based framework can improve its coverage of static analysis for the 1,007 most popular React Native Android apps, augmenting the number of lines of Jimple code by 70%. Additionally, we observed an average increase of 84% in new nodes reached in the callgraph for these apps, after integrating REUNIFY. When REUNIFY is used for taint flow analysis, an average of two additional privacy leaks were identified. Overall, our results demonstrate that REUNIFY significantly enhances the Soot-based framework's capability to analyze React Native Android apps.

Original language	English
Title of host publication	Proceedings - 2023 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023
Editors	Saad Ezzini
Place of Publication	Piscataway NJ USA
Publisher	IEEE, Institute of Electrical and Electronics Engineers
Pages	1390-1402
Number of pages	13
ISBN (Electronic)	9798350329964
ISBN (Print)	9798350329971
DOIs	https://doi.org/10.1109/ASE56229.2023.00113
Publication status	Published - 2023
Event	Automated Software Engineering Conference 2023 - Echternach, Luxembourg Duration: 11 Sept 2023 → 15 Sept 2023 Conference number: 38th https://ieeexplore.ieee.org/xpl/conhome/10298258/proceeding (Proceedings) https://conf.researchr.org/home/ase-2023 (Website)

Conference

Conference	Automated Software Engineering Conference 2023
Abbreviated title	ASE 2023
Country/Territory	Luxembourg
City	Echternach
Period	11/09/23 → 15/09/23
Internet address	https://ieeexplore.ieee.org/xpl/conhome/10298258/proceeding (Proceedings) https://conf.researchr.org/home/ase-2023 (Website)

Keywords

mobile apps
react native
static analysis

Access to Document

10.1109/ASE56229.2023.00113

Cite this

Liu, Y., Chen, X., Liu, P., Grundy, J., Chen, C., & Li, L. (2023). ReuNify: A step towards whole program analysis for react native Android apps. In S. Ezzini (Ed.), Proceedings - 2023 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023 (pp. 1390-1402). IEEE, Institute of Electrical and Electronics Engineers. https://doi.org/10.1109/ASE56229.2023.00113

@inproceedings{6005fecfbf50437c88f66467929311d8,

title = "ReuNify: A step towards whole program analysis for react native Android apps",

abstract = "React Native is a widely-used open-source frame-work that facilitates the development of cross-platform mobile apps. The framework enables JavaScript code to interact with native-side code, such as Objective-C/Swift for iOS and Java/Kotlin for Android, via a communication mechanism provided by React Native. However, previous research and tools have overlooked this mechanism, resulting in incomplete analysis of React Native app code. To address this limitation, we have developed REUNIFY, a prototype tool that integrates the JavaScript and native-side code of React Native apps into an intermediate language that can be processed by the Soot static analysis framework. By doing so, REUNIFY enables the generation of a comprehensive model of the app's behavior. Our evaluation indicates that, by leveraging REUNIFY, the Soot-based framework can improve its coverage of static analysis for the 1,007 most popular React Native Android apps, augmenting the number of lines of Jimple code by 70\%. Additionally, we observed an average increase of 84\% in new nodes reached in the callgraph for these apps, after integrating REUNIFY. When REUNIFY is used for taint flow analysis, an average of two additional privacy leaks were identified. Overall, our results demonstrate that REUNIFY significantly enhances the Soot-based framework's capability to analyze React Native Android apps.",

keywords = "mobile apps, react native, static analysis",

author = "Yonghui Liu and Xiao Chen and Pei Liu and John Grundy and Chunyang Chen and Li Li",

note = "Funding Information: Grundy is supported by ARC Laureate Fellowship FL190100035. Publisher Copyright: {\textcopyright} 2023 IEEE.; Automated Software Engineering Conference 2023, ASE 2023 ; Conference date: 11-09-2023 Through 15-09-2023",

year = "2023",

doi = "10.1109/ASE56229.2023.00113",

language = "English",

isbn = "9798350329971",

pages = "1390--1402",

editor = "Saad Ezzini",

booktitle = "Proceedings - 2023 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023",

publisher = "IEEE, Institute of Electrical and Electronics Engineers",

address = "United States of America",

url = "https://ieeexplore.ieee.org/xpl/conhome/10298258/proceeding, https://conf.researchr.org/home/ase-2023",

}

Liu, Y, Chen, X, Liu, P, Grundy, J, Chen, C & Li, L 2023, ReuNify: A step towards whole program analysis for react native Android apps. in S Ezzini (ed.), Proceedings - 2023 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023. IEEE, Institute of Electrical and Electronics Engineers, Piscataway NJ USA, pp. 1390-1402, Automated Software Engineering Conference 2023, Echternach, Luxembourg, 11/09/23. https://doi.org/10.1109/ASE56229.2023.00113

ReuNify: A step towards whole program analysis for react native Android apps. / Liu, Yonghui; Chen, Xiao; Liu, Pei et al.
Proceedings - 2023 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023. ed. / Saad Ezzini. Piscataway NJ USA: IEEE, Institute of Electrical and Electronics Engineers, 2023. p. 1390-1402.

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

TY - GEN

T1 - ReuNify

T2 - Automated Software Engineering Conference 2023

AU - Liu, Yonghui

AU - Chen, Xiao

AU - Liu, Pei

AU - Grundy, John

AU - Chen, Chunyang

AU - Li, Li

N1 - Conference code: 38th

PY - 2023

Y1 - 2023

N2 - React Native is a widely-used open-source frame-work that facilitates the development of cross-platform mobile apps. The framework enables JavaScript code to interact with native-side code, such as Objective-C/Swift for iOS and Java/Kotlin for Android, via a communication mechanism provided by React Native. However, previous research and tools have overlooked this mechanism, resulting in incomplete analysis of React Native app code. To address this limitation, we have developed REUNIFY, a prototype tool that integrates the JavaScript and native-side code of React Native apps into an intermediate language that can be processed by the Soot static analysis framework. By doing so, REUNIFY enables the generation of a comprehensive model of the app's behavior. Our evaluation indicates that, by leveraging REUNIFY, the Soot-based framework can improve its coverage of static analysis for the 1,007 most popular React Native Android apps, augmenting the number of lines of Jimple code by 70%. Additionally, we observed an average increase of 84% in new nodes reached in the callgraph for these apps, after integrating REUNIFY. When REUNIFY is used for taint flow analysis, an average of two additional privacy leaks were identified. Overall, our results demonstrate that REUNIFY significantly enhances the Soot-based framework's capability to analyze React Native Android apps.

AB - React Native is a widely-used open-source frame-work that facilitates the development of cross-platform mobile apps. The framework enables JavaScript code to interact with native-side code, such as Objective-C/Swift for iOS and Java/Kotlin for Android, via a communication mechanism provided by React Native. However, previous research and tools have overlooked this mechanism, resulting in incomplete analysis of React Native app code. To address this limitation, we have developed REUNIFY, a prototype tool that integrates the JavaScript and native-side code of React Native apps into an intermediate language that can be processed by the Soot static analysis framework. By doing so, REUNIFY enables the generation of a comprehensive model of the app's behavior. Our evaluation indicates that, by leveraging REUNIFY, the Soot-based framework can improve its coverage of static analysis for the 1,007 most popular React Native Android apps, augmenting the number of lines of Jimple code by 70%. Additionally, we observed an average increase of 84% in new nodes reached in the callgraph for these apps, after integrating REUNIFY. When REUNIFY is used for taint flow analysis, an average of two additional privacy leaks were identified. Overall, our results demonstrate that REUNIFY significantly enhances the Soot-based framework's capability to analyze React Native Android apps.

KW - mobile apps

KW - react native

KW - static analysis

UR - https://www.scopus.com/pages/publications/85178998999

U2 - 10.1109/ASE56229.2023.00113

DO - 10.1109/ASE56229.2023.00113

M3 - Conference Paper

AN - SCOPUS:85178998999

SN - 9798350329971

SP - 1390

EP - 1402

BT - Proceedings - 2023 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023

A2 - Ezzini, Saad

PB - IEEE, Institute of Electrical and Electronics Engineers

CY - Piscataway NJ USA

Y2 - 11 September 2023 through 15 September 2023

ER -

Liu Y, Chen X, Liu P, Grundy J, Chen C, Li L. ReuNify: A step towards whole program analysis for react native Android apps. In Ezzini S, editor, Proceedings - 2023 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023. Piscataway NJ USA: IEEE, Institute of Electrical and Electronics Engineers. 2023. p. 1390-1402 doi: 10.1109/ASE56229.2023.00113

ReuNify: A step towards whole program analysis for react native Android apps

Abstract

Conference

Keywords

Access to Document

Other files and links

HCMDSE: Human-centric Model-driven Software Engineering

Cite this

ReuNify: A step towards whole program analysis for react native Android apps

Abstract

Conference

Keywords

Access to Document

Other files and links

Projects

HCMDSE: Human-centric Model-driven Software Engineering

Cite this