Finding an instance of LCK02J in Tomcat

[reprogrammer]

No description provided.

[reprogrammer]

I limited the entry points only to the main method in org.apache.catalina.startup.Bootstrap to get rid of the exception in issue #14.

I ran all the test cases to see which one hits the instance of LCK02J in org.apache.naming.java.javaURLContextFactory.getInitialContext(Hashtable<?, ?>). It turned out that the test org.apache.catalina.startup.TestTomcat.testEnableNamingGlobal() reaches this bug instance.

[reprogrammer]

We used receiver instance context with only one entry point, i.e. org.apache.catalina.startup.TestTomcat.testEnableNamingGlobal() to avoid the exception in issue #14 (https://github.com/reprogrammer/keshmesh/issues#issue/14/comment/655924).

[reprogrammer]

Tomcat creates several threads that listen on specific ports, and uses URLs to communicate with these threads. WALA cannot know about this call mechanism. So, we need to find some other entry points. The method org.apache.naming.java.javaURLContextFactory.getInitialContext(Hashtable<?, ?>) contains an instance of LCK02J. When we made this method the entry point of WALA analysis, it successfully detected the bug instance.

[reprogrammer]

We think that WALA fails to construct the call graph when we use a method of an abstract class as the entry point. The problem with using a method of an abstract class as an entry point is that WALA tries to make an instance of the class in its fake root.

[reprogrammer]

If you use C2.m as an entry point, WALA fails to construct the call graph because it sees that C2.m is defined in an abstract class C1.

abstract class C1 {
  void m() {}
}

class C2 extends C1 {
}

[reprogrammer]

We used receiver instance context and the entry point org.apache.catalina.startup.TestTomcat.HelloWorldJndi.doGet(HttpServletRequest, HttpServletResponse). But, WALA call graph didn't include org.apache.naming.java.javaURLContextFactory.getInitialContext(Hashtable<?, ?>), the method that contains an instance of LCK02J. The problem is that in the middle of the call sequence from the doGet to getInitialContext, javax.naming.spi.NamingManager.getInitialContext(Hashtable<?, ?>) makes a reflective call. It first sets the variable factory to (InitialContextFactory) helper.loadClass(className).newInstance();. Then, it executes factory.getInitialContext(env);. javaURLContextFactory is a subclass of InitialContextFactory, but, WALA won't include methods of any implementations of the interface InitialContextFactory in its call graph.