[Paper Review] Static Code Analysis of Multilanguage Software Systems

Anas Shatnawi, Hafedh Mili+6 more|arXiv (Cornell University)|Jun 3, 2019

Software Engineering Research20 references4 citations

TL;DR

This paper proposes a static code analysis approach for multilanguage Java EE applications that addresses five key challenges in dependency discovery, including cross-language dependencies, hidden container services, and configuration file analysis. By leveraging the KDM meta-model and extending MoDisco with custom rules, the authors implement DeJEE—a tool that achieves 100% precision and up to 70.5% higher recall than MoDisco in identifying dependencies across Java, JSP, and JSF components.

ABSTRACT

Identifying dependency call graphs of multilanguage software systems using static code analysis is challenging. The different languages used in developing today's systems often have different lexical, syntactical, and semantic rules that make thorough analysis difficult. Also, they offer different modularization and dependency mechanisms, both within and between components. Finally, they promote and--or require varieties of frameworks offering different sets of services, which introduce hidden dependencies, invisible with current static code analysis approaches. In this paper, we identify five important challenges that static code analysis must overcome with multilanguage systems and we propose requirements to handle them. Then, we present solutions of these requirements to handle JEE applications, which combine server-side Java source code with a number of client-side Web dialects (e.g., JSP, JSF) while relying on frameworks (e.g., Web and EJB containers) that create hidden dependencies. Finally, we evaluate our implementations of the solutions by developing a set of tools to analyze JEE applications to build a dependency call graph and by applying these tools on two sample JEE applications. Our evaluation shows that our tools can solve the identified challenges and improve the recall in the identification of multilanguage dependencies compared to standard JEE static code analysis and, thus, indirectly that the proposed requirements are useful to build multilanguage static code analysis.

Motivation & Objective

• To identify and address five major challenges in static code analysis of multilanguage software systems, particularly in Java EE applications.
• To overcome limitations of existing unilingual and isolated language analysis tools that miss cross-language and container-service dependencies.
• To develop a unified dependency call graph across heterogeneous components (Java, JSP, JSF) using a language-agnostic meta-model.
• To improve recall in dependency discovery by analyzing configuration files and container services not visible in source code.
• To validate the approach through implementation and evaluation on real-world JEE applications (Java PetStore and JSP Blog).

Proposed method

• The approach uses the OMG’s Knowledge Discovery Meta-model (KDM) as a language-independent foundation for modeling program elements and dependencies.
• Custom transformation rules are defined to parse and model multilanguage code (Java, JSP, JSF) and map them into the KDM model.
• Container service dependencies are codified using declarative rules derived from framework specifications and context-free grammars.
• Configuration files (e.g., web.xml, faces-config.xml) are analyzed to extract hidden dependencies not expressible in source code.
• The DeJEE tool is implemented as an Eclipse plug-in to automate dependency graph construction across components.
• The method integrates MoDisco’s KDM support for Java and extends it to handle JSP and JSF components with custom parsing and rule-based dependency inference.

Experimental results

Research questions

• RQ1 What are the key challenges in performing static code analysis on multilanguage software systems, particularly in Java EE applications?
• RQ2 How can hidden dependencies—especially those abstracted by container services and configuration files—be systematically identified and modeled?
• RQ3 To what extent can a unified KDM-based model improve the recall and precision of dependency call graph construction in multilanguage systems?
• RQ4 How does the proposed approach compare to existing tools like MoDisco in detecting cross-component and cross-language dependencies?
• RQ5 What are the practical implications of detecting previously invisible dependencies for program comprehension and software maintenance?

Key findings

• The DeJEE tool successfully addresses all five identified challenges in static analysis of multilanguage Java EE systems, including cross-language dependencies and hidden container services.
• DeJEE achieves 100% precision in dependency detection for both the JSP Blog and Java PetStore applications.
• For JSP Blog, DeJEE achieves 100% recall, while for Java PetStore, it achieves high recall, significantly outperforming MoDisco.
• DeJEE improves recall by 70.5% for KDM entity instances and 58.5% for KDM relationship instances compared to MoDisco in the two case studies.
• The analysis of configuration files and container services enables detection of dependencies not visible in source code, reducing the risk of runtime errors.
• The KDM-based unification of components across Java, JSP, and JSF enables a coherent, integrated dependency call graph for program comprehension and maintenance tasks.