CFL-reachability and context-sensitive integrity types
Ana Milanova, Wei Huang, Yao Dong · 2014
Integrity types can help detect information flow vulnerabilities in web applications and Android apps. We study DFlow, a context-sensitive integrity type system and we give an interpretation of DFlow in terms of CFL-reachability. We propose DFlowCFL, a new, more precise integrity type system, and DFlowCFL-Infer, the corresponding type inference analysis, which is equivalent to CFL-reachability. DFlowCFL-Infer is an effective taint analysis for Android. It scales well and detects numerous privacy leaks in popular Android apps.