<?xml version="1.0" encoding="utf-8"?>
<export-example>
  <doc>
    <id>1573</id>
    <completedYear>2025</completedYear>
    <publishedYear>2025</publishedYear>
    <thesisYearAccepted>2024</thesisYearAccepted>
    <language>eng</language>
    <pageFirst/>
    <pageLast/>
    <pageNumber>ix, 126 Seiten</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>doctoralthesis</type>
    <publisherName/>
    <publisherPlace/>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2025-05-14</completedDate>
    <publishedDate>2025-05-14</publishedDate>
    <thesisDateAccepted>2024-10-07</thesisDateAccepted>
    <title language="eng">Static Analyses of Interlanguage Interoperations</title>
    <abstract language="eng">Software Developers are moving towards a multilingual development where they combine two languages in a single application to harness the strengths of each language.  For example, performance-critical components of a Java application can be implemented in C language. It provides flexibility, at the same time, it becomes difficult to statically analyze these applications. The amalgamation of two languages in a single application may introduce bugs ranging from type-mismatch to security vulnerabilities. Therefore, it is necessary to develop static analysis techniques to aid developers in multilingual development. In this thesis, we develop techniques to study and analyze these applications.&#13;
&#13;
In the first part of the thesis, we study the prevalence of security and privacy vulnerabilities in hybrid apps. Hybrid apps are Android apps that combine both Java and Javascript components, where the Android part is secured (on the device), while the JavaScript part is exposed to web. Additionally, some of the Java functions are available to JavaScript component through an interface called as bridge interface. In the pursuit of the goal, we adopt a static backtracking of data dependencies to determine the flow of information from the android component to the web component. Our study revealed the potential sources of unsoundness in the existing static analyses. Static backtracing also induces imprecision in the analysis, i.e., there might be some flows that are not possible during runtime albeit are reported by the analysis. These were mitigated through a manual verification. This work reveals that the android-web hybridization can lead to (potential) vulnerabilities that might impact the confidentiality as well as the integrity properties of these apps. &#13;
&#13;
From the communication patterns occurring in Android WebView, we noticed that its is feasible for an attacker to jeopardize the integrity of apps by corrupting some value, say an input on the web through bridge interfaces. Motivated by this, we define a information flow analysis of the bridge interfaces and the associated data flows in hybrid apps. In the first step, we propose a novel threat model where we model the attacker as someone who wants to influence the behavior of android app as an integrity violation. Based on this threat model, we then propose a demand-driven analysis technique to detect confidentiality and integrity violations. Our analysis leverages, a demand-driven technique, where it only analyzes the relevant part of app for the information flow analysis with the help of function summaries --- escaping the need of a whole-program analysis.&#13;
&#13;
In the second part of the thesis, we generalize the approach to static analysis of multilingual applications. To this end, we investigate into the question of combining existing single language analyses to analyze multilingual programs. To provide an affirmative answer, we define an analysis to leverage single language analyses for call-graph and pointer analysis of multilingual programs. Our analysis takes two existing unilingual analyses and analyzes the complete multilingual program. It uses a novel summary specialization technique that resolves the information flows at the bridge interfaces by utilizing independent pre-analyses (modulo foreign function interfaces) of each language component. We apply this technique to analyze Android-NDK and GraalVM Java-Python multilingual applications for generating call-graphs.&#13;
&#13;
In summary, we have developed novel techniques for information flow and call-graph analysis for multilingual programs. With this, we motivate the need of static analyses for multilingual applications and its applications which includes, vulnerability detection, program understanding, amongst others.</abstract>
    <identifier type="urn">urn:nbn:de:bvb:739-opus4-15736</identifier>
    <enrichment key="opus.source">publish</enrichment>
    <enrichment key="opus.doi.autoCreate">false</enrichment>
    <enrichment key="opus.urn.autoCreate">true</enrichment>
    <licence>Standardbedingung laut Einverständniserklärung</licence>
    <author>Jyoti Prakash</author>
    <collection role="ddc" number="004">Datenverarbeitung; Informatik</collection>
    <collection role="open_access" number="">open_access</collection>
    <collection role="institutes" number="">Fakultät für Informatik und Mathematik</collection>
    <thesisPublisher>Universität Passau</thesisPublisher>
    <thesisGrantor>Universität Passau</thesisGrantor>
    <file>https://opus4.kobv.de/opus4-uni-passau/files/1573/Dissertation_Prakash.pdf</file>
  </doc>
  <doc>
    <id>1554</id>
    <completedYear>2025</completedYear>
    <publishedYear>2025</publishedYear>
    <thesisYearAccepted>2025</thesisYearAccepted>
    <language>eng</language>
    <pageFirst/>
    <pageLast/>
    <pageNumber>127 Seiten</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>doctoralthesis</type>
    <publisherName/>
    <publisherPlace/>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2025-03-18</completedDate>
    <publishedDate>2025-03-18</publishedDate>
    <thesisDateAccepted>2025-02-17</thesisDateAccepted>
    <title language="eng">Tackling Test Flakiness: Understanding the Problem and Providing Practical Mitigations</title>
    <abstract language="eng">"Software is eating the world". With this phrase from his 2011 Wall Street Journal interview, Marc Andreessen predicted a decade of disruptive software-based innovations affecting various industries. Today, over ten years later, many of his predictions have come true: six of the seven most valuable companies worldwide are computer technology firms, and more than half of the world's population has access to the internet and owns a smartphone, with numbers still growing rapidly. The increasing importance of software has also changed software development. To ensure product quality despite high complexity and fast product cycles, software developers started to adopt continuous integration and regression testing practices: each change to an existing system is automatically tested and reverted in case it breaks any existing functionality. As a result, large software projects are conducting millions of test executions each day. One obstacle to such extensive testing are non-deterministic tests that can pass and fail without any changes to the underlying system or the test itself. These tests are commonly referred to as flaky tests. Flaky tests break regression testing, as they cause test failures that are unrelated to the changes that are being tested. Developers are forced to investigate these intermittent failures, wasting their time and decreasing their trust in testing. This thesis presents our research that aims at understanding and mitigating test flakiness. To comprehend the nature of flaky tests, we conducted both code-based studies on open-source projects, as well as a developer survey. All our investigations confirmed that flakiness is a frequently occurring and severe issue. The causes of flakiness, however, depend on the domain of the project and the source of the test: while asynchronous waiting and concurrency are overall the most prevalent causes aside from test order dependencies, Python projects tend to experience more flakiness caused by networking and randomness. Flaky tests that were not written by developers but generated automatically tend to be more often caused by randomness or unspecified behavior. To avoid test flakiness in generated tests, developers can use existing flakiness suppression mechanisms of test generation frameworks, which we found to be effective. In general, however, most developers currently address the issue of test flakiness by rerunning failing tests. Nevertheless, they would like more support when dealing with test flakiness, namely better visualizations, automated detection and debugging techniques, and education on the topic. In response to this feedback, we developed and evaluated a generic flakiness prediction approach, as well as an automated flakiness debugging technique. Our flakiness prediction method is easy to use and widely applicable. In contrast to previous techniques, it avoids any form of static or dynamic analysis. Instead, it relies solely on a test's execution result history and version control information, two commonly available artifacts. Additionally, it aims to classify real-world failures as either caused by flakiness or a regression. Previous techniques mainly focused on identifying potential flaky test cases in test suites, a related but less actionable question. An evaluation on a large-scale automotive software project yielded positive results. Our approach showed a strong predictive performance (95.5% F1-score), outperforming the previously used heuristic. We also introduced Spectrum-based Flaky Fault Localization (SFFL), an automated debugging technique that aims to pinpoint the specific lines in the source code that cause a flaky test's non-deterministic behavior. SFFL extends traditional Spectrum-based Fault Localization (SFL) by considering multiple coverage behaviors of the same test case, a highly common phenomenon among flaky tests. Our evaluation on 101 flaky Python tests showed that SFFL outperforms traditional SFL and was able to narrow down the flaky fault's location to 3.5% of a project's code base on average.</abstract>
    <identifier type="urn">urn:nbn:de:bvb:739-opus4-15549</identifier>
    <enrichment key="opus.source">publish</enrichment>
    <licence>Creative Commons - CC BY-SA - Namensnennung - Weitergabe unter gleichen Bedingungen 4.0 International</licence>
    <author>Martin Gruber</author>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Test Flakiness</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Flaky Test</value>
    </subject>
    <subject>
      <language>deu</language>
      <type>swd</type>
      <value>Softwareentwicklung</value>
    </subject>
    <subject>
      <language>deu</language>
      <type>swd</type>
      <value>Softwaretest</value>
    </subject>
    <subject>
      <language>deu</language>
      <type>swd</type>
      <value>Qualitätssicherung</value>
    </subject>
    <subject>
      <language>deu</language>
      <type>swd</type>
      <value>Testen</value>
    </subject>
    <collection role="ddc" number="004">Datenverarbeitung; Informatik</collection>
    <collection role="open_access" number="">open_access</collection>
    <collection role="institutes" number="">Fakultät für Informatik und Mathematik</collection>
    <thesisPublisher>Universität Passau</thesisPublisher>
    <thesisGrantor>Universität Passau</thesisGrantor>
    <file>https://opus4.kobv.de/opus4-uni-passau/files/1554/Dissertation_Gruber.pdf</file>
  </doc>
</export-example>
