Community
Participate
Working Groups
The dflow pointcut, as specified by Hidehiko Masuhara and Kazunori Kawauchi in the follwoing paper: www.graco.c.u-tokyo.ac.jp/~masuhara/papers/aplas2003.pdf Essentially this pointcut tracks where data originates from. I believe the paper authors made a reference implementation for another language, so perhaps you could contact them and use that as a starting point. Implementing this would have significant impact in securing Java EE applications, since we could develop standard libraries that track data from source to sink. Just before reaching the sink point, we could apply appropriate encoding and/or validation prior to data being consumed. In addition, the compiler could eventually provide optimization on what might otherwise be an expensive pointcut.
Does anybody know if a performance evaluation of this feature has been done in the meantime? If I remember correctly then the evaluation of the pointcut could potentially be very expensive without (whole-program?) optimizations.
I haven't seen any performance evaluations - admittedly I've only done simple google searching. My guess is that you're correct and performance impact is very high; would clearly documenting (e.g. in the programmers guide) the potential performance impact be an adequate compensating control for this?
(In reply to comment #2) > would clearly documenting (e.g. in the programmers guide) the > potential performance impact be an adequate compensating control for this? I guess that depends on how high the overhead really is. If it is prohibitively high then I wonder whether it's worth the effort at all. We should maybe ask Hidehiko for his opinion.
(In reply to comment #3) > (In reply to comment #2) > > would clearly documenting (e.g. in the programmers guide) the > > potential performance impact be an adequate compensating control for this? > > > I guess that depends on how high the overhead really is. If it is prohibitively > high then I wonder whether it's worth the effort at all. We should maybe ask > Hidehiko for his opinion. > I tried to contact Hidehiko earlier about implementing the dflow pointcut in AspectJ and didn't get any response. Perhaps you guys will be more successful given that you are developers for AspectJ.
