Detecting Potential User-data Save & Export Losses due to Android App Termination
Detecting Potential User-data Save & Export Losses due to Android App Termination
复制标题
DOI：
10.1109/ast58925.2023.00019
复制
发表时间：
2023-05
期刊：
影响因子：
--
通讯作者：
Sydur Rahaman;Umar Farooq;Iulian Neamtiu;Zhijia Zhao
中科院分区：
文献类型：
--
作者：
Sydur Rahaman;Umar Farooq;Iulian Neamtiu;Zhijia Zhao
Android应用程序的一个常见功能是将用户的工作(如图纸)和数据(如电子表格)以文件的形式保存或导出到本地存储中。由于操作系统和一般移动环境的易变性，系统可以在不通知的情况下终止应用程序，这阻止了文件写入操作的执行；因此，应该保存/导出的用户数据反而会丢失。测试应用程序的这种潜在损失带来了几个挑战：如何识别源自用户输入或用户操作的数据(然后检查它是否已保存)，以及如何在未保存的更改挂起的准确时刻终止应用程序，从而重现潜在错误。我们通过一种方法来解决这些挑战，这种方法可以找到潜在的“丢失的写入”，即应该写入文件的用户数据，但由于系统启动的终止，文件写入并未发生。我们的方法包括两个阶段：发现潜在损失的静态分析和动态损失验证阶段，在动态损失验证阶段，我们比较有损和无损的系统级文件写入跟踪以确认错误。我们对Google Play的2182个应用程序和F-Droid的38个应用程序进行了分析。我们的方法发现163个应用程序被终止导致了损失，包括丢失用户应用程序特定的数据、笔记、照片、用户的工作和设置。相比之下，两个最先进的工具旨在发现Android应用程序中的波动性错误，但未能发现我们发现的问题。
A common feature in Android apps is saving, or exporting, user’s work (e.g., a drawing) as well as data (e.g., a spreadsheet) onto local storage, as a file. Due to the volatile nature of the OS and the mobile environment in general, the system can terminate apps without notice, which prevents the execution of file write operations; consequently, user data that was supposed to be saved/exported is instead lost. Testing apps for such potential losses raises several challenges: how to identify data originating from user input or resulting from user action (then check whether it is saved), and how to reproduce a potential error by terminating the app at the exact moment when unsaved changes are pending. We address these challenges via an approach that finds potential “lost writes”, i.e., user data supposed to be written to a file, but the file write does not take place due to system-initiated termination. Our approach consists of two phases: a static analysis that finds potential losses and a dynamic loss verification phase where we compare lossy and lossless system-level file write traces to confirm errors. We ran our analysis on 2,182 apps from Google Play and 38 apps from F-Droid. Our approach found 163 apps where termination caused losses, including losing user’s app-specific data, notes, photos, user’s work and settings. In contrast, two state-of-the-art tools aimed at finding volatility errors in Android apps failed to discover the issues we found.