Checking Java Bugs by Data Propagation Analysis

The objective of vulnerability analysis is to find out the unknown security holes in a system. Many software bugs, such as SQL injection, come from careless check of the input string. Finding these bugs out is very difficult without source code inspect. This paper gives a novel method to check the bugs in Java byte code based on points-to dataflow analysis, which is different to the common analysis techniques base on the vulnerability pattern check. It can be used as an assistant approach for security analysis of Java byte code.