{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,13]],"date-time":"2026-05-13T17:44:14Z","timestamp":1778694254861,"version":"3.51.4"},"reference-count":119,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2025,4,28]],"date-time":"2025-04-28T00:00:00Z","timestamp":1745798400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100000923","name":"Australian Research Council","doi-asserted-by":"crossref","award":["FL190100035"],"award-info":[{"award-number":["FL190100035"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2025,5,31]]},"abstract":"<jats:p>\n            React Native, an open source framework, simplifies cross-platform app development by allowing JavaScript-side code to interact with native-side code. Previous studies disregarded React Native, resulting in insufficient static analysis of React Native app code. This study initiates the investigation of challenges when statically analyzing React Native apps. We propose\n            <jats:sc>ReuNify<\/jats:sc>\n            to improve Soot-based static analysis coverage for JavaScript-side and native-side code.\n            <jats:sc>ReuNify<\/jats:sc>\n            converts Hermes bytecode to Soot\u2019s intermediate representation. Hermes bytecode, compiled from JavaScript code and integrated into React Native apps, possesses a unique syntax that eludes current JavaScript analyzers. Additionally, we investigate opcode distribution and conduct in-depth analyses of the usage of opcode between popular apps and malware. We also propose a benchmark consisting of 97 control flow-related cases to validate the control flow recovery of the generated intermediate representation. Furthermore, we model the cross-language communication mechanisms of React Native to expand the static analysis coverage for native-side code. Our evaluation demonstrates that\n            <jats:sc>ReuNify<\/jats:sc>\n            enables an average increase of 84% in reached nodes within the callgraph and further identifies an average of two additional privacy leaks in taint analysis. In summary, this article demonstrates that\n            <jats:sc>ReuNify<\/jats:sc>\n            significantly improves the static analysis for the React Native Android apps.\n          <\/jats:p>","DOI":"10.1145\/3702977","type":"journal-article","created":{"date-parts":[[2024,11,12]],"date-time":"2024-11-12T15:53:09Z","timestamp":1731426789000},"page":"1-33","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Demystifying React Native Android Apps for Static Analysis"],"prefix":"10.1145","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7548-5100","authenticated-orcid":false,"given":"Yonghui","family":"Liu","sequence":"first","affiliation":[{"name":"Monash University, Melbourne, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4224-6450","authenticated-orcid":false,"given":"Xiao","family":"Chen","sequence":"additional","affiliation":[{"name":"University of Newcastle, Newcastle, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6008-7265","authenticated-orcid":false,"given":"Pei","family":"Liu","sequence":"additional","affiliation":[{"name":"CSIRO\u2019s Data61, Melbourne, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6052-6184","authenticated-orcid":false,"given":"Jordan","family":"Samhi","sequence":"additional","affiliation":[{"name":"CISPA, Saarbr\u00fccken, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4928-7076","authenticated-orcid":false,"given":"John","family":"Grundy","sequence":"additional","affiliation":[{"name":"Monash University, Melbourne, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2011-9618","authenticated-orcid":false,"given":"Chunyang","family":"Chen","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2990-1614","authenticated-orcid":false,"given":"Li","family":"Li","sequence":"additional","affiliation":[{"name":"Beihang University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,4,28]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"Android Native UI Components. 2023. Retrieved from https:\/\/reactnative.dev\/docs\/native-components-android"},{"key":"e_1_3_2_3_2","unstructured":"AndroidRank. 2023. Retrieved from https:\/\/www.androidrank.org\/"},{"key":"e_1_3_2_4_2","unstructured":"AppBrain\u2019s Statistics about SDKs for Android App Frameworks. 2023. Retrieved from https:\/\/www.appbrain.com\/stats\/libraries\/tag\/app-framework\/android-app-frameworks?list=top500"},{"key":"e_1_3_2_5_2","unstructured":"bundleAssetName. 2023. Retrieved from https:\/\/reactnative.dev\/docs\/react-native-gradle-plugin#bundleassetname"},{"key":"e_1_3_2_6_2","unstructured":"BytecodeFileFormat.h. 2023. Retrieved from https:\/\/github.com\/facebook\/hermes\/blob\/main\/include\/hermes\/BCGen\/HBC\/BytecodeFileFormat.h"},{"key":"e_1_3_2_7_2","unstructured":"BytecodeList.def. 2023. Retrieved from https:\/\/github.com\/facebook\/hermes\/blob\/main\/include\/hermes\/BCGen\/HBC\/BytecodeList.def"},{"key":"e_1_3_2_8_2","unstructured":"BytecodeVersion.h. 2023. Retrieved from https:\/\/github.com\/facebook\/hermes\/blob\/main\/include\/hermes\/BCGen\/HBC\/BytecodeVersion.h"},{"key":"e_1_3_2_9_2","unstructured":"Codegen. 2023. Retrieved from https:\/\/reactnative.dev\/docs\/next\/the-new-architecture\/pillars-codegen"},{"key":"e_1_3_2_10_2","unstructured":"Cordova. 2023. Retrieved from https:\/\/cordova.apache.org\/"},{"key":"e_1_3_2_11_2","unstructured":"File. 2023. Retrieved from https:\/\/www.ibm.com\/docs\/he\/aix\/7.2?topic=f-file-command"},{"key":"e_1_3_2_12_2","unstructured":"Hermes: An Open Source JavaScript Engine Optimized for Mobile Apps Starting with React Native. 2023. Retrieved from https:\/\/engineering.fb.com\/2019\/07\/12\/android\/hermes\/"},{"key":"e_1_3_2_13_2","unstructured":"Hermes Engine Project. 2023. Retrieved from https:\/\/github.com\/facebook\/hermes"},{"key":"e_1_3_2_14_2","unstructured":"Hermes: JavaScript Engine Optimized for React Native. 2023. Retrieved from https:\/\/hermesengine.dev\/"},{"key":"e_1_3_2_15_2","unstructured":"Ionic. 2023. Retrieved from https:\/\/ionicframework.com\/"},{"key":"e_1_3_2_16_2","unstructured":"JadX: Dex to Java Decompiler. 2023. Retrieved from https:\/\/github.com\/skylot\/jadx"},{"key":"e_1_3_2_17_2","unstructured":"JavaScriptCore. 2023. Retrieved from https:\/\/developer.apple.com\/documentation\/javascriptcore"},{"key":"e_1_3_2_18_2","unstructured":"JimpleBody. 2023. Retrieved from https:\/\/www.sable.mcgill.ca\/soot\/doc\/soot\/jimple\/JimpleBody.html"},{"key":"e_1_3_2_19_2","unstructured":"JSI (JavaScript Interface). 2023. Retrieved from https:\/\/reactnative.dev\/architecture\/glossary#javascript-interfaces-jsi"},{"key":"e_1_3_2_20_2","unstructured":"Lifecycle of Reactive Effects. 2023. Retrieved from https:\/\/react.dev\/learn\/lifecycle-of-reactive-effects"},{"key":"e_1_3_2_21_2","unstructured":"Metro. 2023. Retrieved from https:\/\/facebook.github.io\/metro\/"},{"key":"e_1_3_2_22_2","unstructured":"Native Modules Intro. 2023. Retrieved from https:\/\/reactnative.dev\/docs\/native-modules-intro"},{"key":"e_1_3_2_23_2","unstructured":"New Architecture. 2023. Retrieved from https:\/\/reactnative.dev\/docs\/the-new-architecture\/landing-page"},{"key":"e_1_3_2_24_2","unstructured":"Proguard-Rules for React Native Android App. 2023. Retrieved from https:\/\/github.com\/typeorm\/react-native-example\/blob\/master\/android\/app\/proguard-rules.pro"},{"key":"e_1_3_2_25_2","unstructured":"React. 2023. Retrieved from https:\/\/react.dev\/"},{"key":"e_1_3_2_26_2","unstructured":"React-Native: A Framework for Building Native Applications Using React. 2023. Retrieved from https:\/\/github.com\/facebook\/react-native"},{"key":"e_1_3_2_27_2","unstructured":"React Native Directory. 2023. Retrieved from https:\/\/reactnative.directory\/"},{"key":"e_1_3_2_28_2","unstructured":"React Native Framework CHANGELOG. 2023. Retrieved from https:\/\/github.com\/react-native-community\/releases\/blob\/master\/CHANGELOG.md"},{"key":"e_1_3_2_29_2","unstructured":"Setting Up the Development Environment. 2023. Retrieved from https:\/\/reactnative.dev\/docs\/environment-setup"},{"key":"e_1_3_2_30_2","unstructured":"Skype. 2023. Retrieved from https:\/\/play.google.com\/store\/apps\/details?id=com.skype.raider&hl=en&gl=US"},{"key":"e_1_3_2_31_2","unstructured":"SootUp. 2023. Retrieved from https:\/\/soot-oss.github.io\/SootUp\/"},{"key":"e_1_3_2_32_2","unstructured":"SuSi. 2023. Retrieved from https:\/\/github.com\/secure-software-engineering\/SuSi\/tree\/develop\/SourceSinkLists\/"},{"key":"e_1_3_2_33_2","unstructured":"v8. 2023. Retrieved from https:\/\/github.com\/v8\/v8"},{"key":"e_1_3_2_34_2","unstructured":"VirusShare. 2023. Retrieved from https:\/\/virusshare.com\/"},{"key":"e_1_3_2_35_2","unstructured":"WebView. 2023. Retrieved from https:\/\/developer.android.com\/reference\/android\/webkit\/WebView"},{"key":"e_1_3_2_36_2","unstructured":"WebView. 2023. Retrieved from https:\/\/legacy.reactjs.org\/docs\/state-and-lifecycle.html"},{"key":"e_1_3_2_37_2","unstructured":"What Is Cross-Platform Mobile Development? 2023. Retrieved from https:\/\/kotlinlang.org\/docs\/cross-platform-mobile-development.html"},{"key":"e_1_3_2_38_2","unstructured":"What Is Cross-Platform Mobile Development? 2023. Retrieved from https:\/\/survey.stackoverflow.co\/2022\/#most-popular-technologies-misc-tech-prof"},{"key":"e_1_3_2_39_2","unstructured":"Why a New Architecture. 2023. Retrieved from https:\/\/reactnative.dev\/docs\/the-new-architecture\/why#old-architectures-issues"},{"key":"e_1_3_2_40_2","unstructured":"Hermes Issues 1089. 2024. Retrieved from https:\/\/github.com\/facebook\/hermes\/issues\/1089"},{"key":"e_1_3_2_41_2","unstructured":"MDN Web Docs. 2024. Retrieved from https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/JavaScript\/Reference\/Statements"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.11.011"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2024.3358979"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1145\/3276532"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1145\/2901739.2903508"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/2660193.2660214"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2018.00028"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.3390\/technologies9010003"},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1145\/1985793.1985871"},{"key":"e_1_3_2_50_2","doi-asserted-by":"publisher","DOI":"10.1145\/2666356.2594299"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1145\/2635868.2635916"},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1145\/2259051.2259056"},{"key":"e_1_3_2_53_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2014.2322867"},{"key":"e_1_3_2_54_2","doi-asserted-by":"publisher","DOI":"10.1145\/1640089.1640108"},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2013.6575317"},{"key":"e_1_3_2_56_2","volume-title":"36th European Conference on Object-Oriented Programming (ECOOP \u201922)","author":"Chakraborty Madhurima","year":"2022","unstructured":"Madhurima Chakraborty, Renzo Olivares, Manu Sridharan, and Behnaz Hassanshahi. 2022. Automatic root cause quantification for missing edges in JavaScript call graphs. In 36th European Conference on Object-Oriented Programming (ECOOP \u201922). Schloss Dagstuhl-Leibniz-Zentrum f\u00fcr Informatik."},{"key":"e_1_3_2_57_2","doi-asserted-by":"crossref","unstructured":"Daihang Chen Yonghui Liu Mingyi Zhou Yanjie Zhao Haoyu Wang Shuai Wang Xiao Chen Tegawend\u00e9 F. Bissyand\u00e9 Jacques Klein and Li Li. 2024. LLM for mobile: An initial roadmap. arXiv:2407.06573.","DOI":"10.1145\/3708528"},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.1145\/3647632.3651388"},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.1145\/202530.202534"},{"key":"e_1_3_2_60_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2019.00013"},{"key":"e_1_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382205"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.5555\/2486788.2486887"},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/202529.202541"},{"key":"e_1_3_2_64_2","volume-title":"FuzzIL: Coverage Guided Fuzzing for JavaScript Engines","author":"Gro\u00df Samuel","year":"2018","unstructured":"Samuel Gro\u00df. 2018. FuzzIL: Coverage Guided Fuzzing for JavaScript Engines. Master\u2019s thesis. Department of Informatics, Karlsruhe Institute of Technology."},{"key":"e_1_3_2_65_2","first-page":"1","volume-title":"36th European Conference on Object-Oriented Programming (ECOOP \u201922)","volume":"222","author":"He Dongjie","year":"2022","unstructured":"Dongjie He, Jingbo Lu, and Jingling Xue. 2022. Qilin: A new framework for supporting fine-grained context-sensitivity in Java pointer analysis. In 36th European Conference on Object-Oriented Programming (ECOOP \u201922). Schloss Dagstuhl-Leibniz-Zentrum f\u00fcr Informatik 222, Article 30 (2022), 1\u201329 pages,"},{"key":"e_1_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASEW60602.2023.00007"},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380243"},{"key":"e_1_3_2_68_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-03237-0_17"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.1145\/2635868.2635904"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2015.28"},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2018.2865733"},{"key":"e_1_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00026"},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2004.1281665"},{"key":"e_1_3_2_74_2","first-page":"96","article-title":"SAFE: Formal specification and implementation of a scalable analysis framework for ECMAScript","author":"Lee Hongki","year":"2012","unstructured":"Hongki Lee, Sooncheol Won, Joonho Jin, Junhee Cho, and Sukyoung Ryu. 2012. SAFE: Formal specification and implementation of a scalable analysis framework for ECMAScript. In 19th International Workshop on Foundations of Object-Oriented Languages (FOOL \u201912). Citeseer, 96.","journal-title":"19th International Workshop on Foundations of Object-Oriented Languages (FOOL \u201912)"},{"key":"e_1_3_2_75_2","doi-asserted-by":"publisher","DOI":"10.1145\/2970276.2970368"},{"key":"e_1_3_2_76_2","first-page":"723","volume-title":"24th USENIX Security Symposium (USENIX Security \u201915)","author":"Lekies Sebastian","year":"2015","unstructured":"Sebastian Lekies, Ben Stock, Martin Wentzel, and Martin Johns. 2015. The unexpected dangers of dynamic \\(\\{\\) JavaScript \\(\\}\\) . In 24th USENIX Security Symposium (USENIX Security \u201915), 723\u2013735."},{"key":"e_1_3_2_77_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2014.34"},{"key":"e_1_3_2_78_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.48"},{"key":"e_1_3_2_79_2","first-page":"676","volume-title":"IEEE Transactions on Software Engineering","author":"Li Li","year":"2019","unstructured":"Li Li, Tegawend\u00e9 F. Bissyand\u00e9, and Jacques Klein. 2019. Rebooting research on detecting repackaged Android apps: Literature review and benchmark. IEEE Transactions on Software Engineering (2019), 676\u2013693."},{"key":"e_1_3_2_80_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2017.04.001"},{"key":"e_1_3_2_81_2","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213857"},{"key":"e_1_3_2_82_2","first-page":"2513","volume-title":"31st USENIX Security Symposium (USENIX Security \u201922)","author":"Li Wen","year":"2022","unstructured":"Wen Li, Jiang Ming, Xiapu Luo, and Haipeng Cai. 2022. PolyCruise: A cross-language dynamic information flow analysis. In 31st USENIX Security Symposium (USENIX Security \u201922), 2513\u20132530."},{"key":"e_1_3_2_83_2","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3561341"},{"key":"e_1_3_2_84_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE56229.2023.00113"},{"key":"e_1_3_2_85_2","unstructured":"Yonghui Liu Xiao Chen Yue Liu Pingfan Kong Tegawend\u00e9 F. Bissyande Jacques Klein Xiaoyu Sun Chunyang Chen and John Grundy. 2022. A comparative study of smartphone and smart TV apps. arXiv:2211.01752."},{"key":"e_1_3_2_86_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASEW52652.2021.00023"},{"key":"e_1_3_2_87_2","doi-asserted-by":"publisher","DOI":"10.1145\/3544968"},{"key":"e_1_3_2_88_2","doi-asserted-by":"publisher","DOI":"10.1145\/3641540"},{"key":"e_1_3_2_89_2","unstructured":"Yue Liu Chakkrit Tantithamthavorn Yonghui Liu Patanamon Thongtanunam and Li Li. 2022. Automatically recommend code updates: Are we there yet? arXiv preprint arXiv:2209.07048."},{"key":"e_1_3_2_90_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133910"},{"key":"e_1_3_2_91_2","doi-asserted-by":"publisher","DOI":"10.1145\/2931037.2931054"},{"key":"e_1_3_2_92_2","doi-asserted-by":"publisher","DOI":"10.1145\/2931037.2931047"},{"key":"e_1_3_2_93_2","unstructured":"Developers Meta. 2023. Core Components and Native Components. Retrieved from https:\/\/reactnative.dev\/docs\/intro-react-native-components"},{"key":"e_1_3_2_94_2","doi-asserted-by":"publisher","DOI":"10.1016\/0022-0000(78)90014-4"},{"key":"e_1_3_2_95_2","article-title":"Document structure integrity: A robust basis for cross-site scripting defense","volume":"20","author":"Nadji Yacin","year":"2009","unstructured":"Yacin Nadji, Prateek Saxena, and Dawn Song. 2009. Document structure integrity: A robust basis for cross-site scripting defense. In Network and Distributed System Security Symposium (NDSS), Vol. 20.","journal-title":"Network and Distributed System Security Symposium (NDSS)"},{"key":"e_1_3_2_96_2","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338933"},{"key":"e_1_3_2_97_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464836"},{"key":"e_1_3_2_98_2","first-page":"735","volume-title":"29th European Conference on Object-Oriented Programming (ECOOP \u201915). Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik","volume":"37","author":"Park Changhee","year":"2015","unstructured":"Changhee Park and Sukyoung Ryu. 2015. Scalable and precise static analysis of JavaScript applications via loop-sensitivity. In 29th European Conference on Object-Oriented Programming (ECOOP \u201915). Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik 37 (2015), 735\u2013756."},{"key":"e_1_3_2_99_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2017.62"},{"key":"e_1_3_2_100_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2014.30"},{"key":"e_1_3_2_101_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00126"},{"key":"e_1_3_2_102_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3512766"},{"key":"e_1_3_2_103_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510457.3513059"},{"key":"e_1_3_2_104_2","first-page":"361","volume-title":"27th USENIX Security Symposium (USENIX Security \u201918)","author":"Staicu Cristian-Alexandru","year":"2018","unstructured":"Cristian-Alexandru Staicu and Michael Pradel. 2018. Freezing the Web: A study of \\(\\{\\) ReDoS \\(\\}\\) vulnerabilities in \\(\\{\\) JavaScript-based \\(\\}\\) Web servers. In 27th USENIX Security Symposium (USENIX Security \u201918), 361\u2013376."},{"key":"e_1_3_2_105_2","first-page":"655","volume-title":"23rd USENIX Security Symposium (USENIX Security \u201914)","author":"Stock Ben","year":"2014","unstructured":"Ben Stock, Sebastian Lekies, Tobias Mueller, Patrick Spiegel, and Martin Johns. 2014. Precise client-side protection against \\(\\{\\) DOM-based \\(\\}\\) \\(\\{\\) cross-site \\(\\}\\) scripting. In 23rd USENIX Security Symposium (USENIX Security \u201914), 655\u2013670."},{"key":"e_1_3_2_106_2","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106298"},{"key":"e_1_3_2_107_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978343"},{"key":"e_1_3_2_108_2","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3613098"},{"key":"e_1_3_2_109_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3266324"},{"key":"e_1_3_2_110_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598120"},{"key":"e_1_3_2_111_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICIEV.2014.6850807"},{"key":"e_1_3_2_112_2","unstructured":"Raja Vallee-Rai and Laurie J. Hendren. 1998. Jimple: Simplifying Java bytecode for analyses and transformations. (1998)."},{"key":"e_1_3_2_113_2","first-page":"12","article-title":"Cross site scripting prevention with dynamic data tainting and static analysis.","volume":"2007","author":"Vogt Philipp","year":"2007","unstructured":"Philipp Vogt, Florian Nentwich, Nenad Jovanovic, Engin Kirda, Christopher Kruegel, and Giovanni Vigna. 2007. Cross site scripting prevention with dynamic data tainting and static analysis. In Network and Distributed System Security Symposium (NDSS), Vol. 2007, 12.","journal-title":"Network and Distributed System Security Symposium (NDSS)"},{"key":"e_1_3_2_114_2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243835"},{"key":"e_1_3_2_115_2","doi-asserted-by":"publisher","DOI":"10.1145\/2970276.2970312"},{"key":"e_1_3_2_116_2","first-page":"11","article-title":"Understanding and detecting fragmentation-induced compatibility issues for Android apps","volume":"46","author":"Wei Lili","year":"2018","unstructured":"Lili Wei, Yepang Liu, Shing-Chi Cheung, Huaxun Huang, Xuan Lu, and Xuanzhe Liu. 2018. Understanding and detecting fragmentation-induced compatibility issues for Android apps. IEEE Transactions on Software Engineering 46, 11 (2018), 1176\u20131199.","journal-title":"IEEE Transactions on Software Engineering"},{"key":"e_1_3_2_117_2","doi-asserted-by":"publisher","DOI":"10.1145\/2892208.2892218"},{"key":"e_1_3_2_118_2","doi-asserted-by":"crossref","unstructured":"Zhiqiang Zang Fu-Yao Yu Aditya Thimmaiah August Shi and Milos Gligoric. 2024. Java JIT testing with template extraction. arXiv:2403.11281.","DOI":"10.1145\/3643777"},{"key":"e_1_3_2_119_2","doi-asserted-by":"publisher","DOI":"10.1145\/2896921.2896932"},{"key":"e_1_3_2_120_2","doi-asserted-by":"crossref","unstructured":"Yanjie Zhao Pei Liu Xiaoyu Sun Yue Liu Yonghui Liu John Grundy and Li Li. 2022. Autopatch: Learning to generate patches for automatically fixing compatibility issues in Android apps. Available at SSRN 4254659.","DOI":"10.2139\/ssrn.4254659"}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3702977","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3702977","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:04Z","timestamp":1750295884000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3702977"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,28]]},"references-count":119,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,5,31]]}},"alternative-id":["10.1145\/3702977"],"URL":"https:\/\/doi.org\/10.1145\/3702977","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,4,28]]},"assertion":[{"value":"2023-11-29","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-09-28","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-04-28","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}