{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,7,30]],"date-time":"2025-07-30T15:35:59Z","timestamp":1753889759226,"version":"3.41.2"},"reference-count":16,"publisher":"Centre pour la Communication Scientifique Directe (CCSD)","license":[{"start":{"date-parts":[[2012,5,31]],"date-time":"2012-05-31T00:00:00Z","timestamp":1338422400000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/arxiv.org\/licenses\/nonexclusive-distrib\/1.0"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"abstract":"<jats:p>Exchanging mutable data objects with untrusted code is a delicate matter\nbecause of the risk of creating a data space that is accessible by an attacker.\nConsequently, secure programming guidelines for Java stress the importance of\nusing defensive copying before accepting or handing out references to an\ninternal mutable object. However, implementation of a copy method (like\nclone()) is entirely left to the programmer. It may not provide a sufficiently\ndeep copy of an object and is subject to overriding by a malicious sub-class.\nCurrently no language-based mechanism supports secure object cloning. This\npaper proposes a type-based annotation system for defining modular copy\npolicies for class-based object-oriented programs. A copy policy specifies the\nmaximally allowed sharing between an object and its clone. We present a static\nenforcement mechanism that will guarantee that all classes fulfil their copy\npolicy, even in the presence of overriding of copy methods, and establish the\nsemantic correctness of the overall approach in Coq. The mechanism has been\nimplemented and experimentally evaluated on clone methods from several Java\nlibraries.<\/jats:p>","DOI":"10.2168\/lmcs-8(2:5)2012","type":"journal-article","created":{"date-parts":[[2013,9,23]],"date-time":"2013-09-23T14:50:43Z","timestamp":1379947843000},"source":"Crossref","is-referenced-by-count":0,"title":["Secure the Clones"],"prefix":"10.46298","volume":"Volume 8, Issue 2","author":[{"given":"Thomas","family":"Jensen","sequence":"first","affiliation":[]},{"given":"Florent","family":"Kirchner","sequence":"additional","affiliation":[]},{"given":"David","family":"Pichardie","sequence":"additional","affiliation":[]}],"member":"25203","published-online":{"date-parts":[[2012,5,31]]},"reference":[{"key":"10.2168\/LMCS-8(2:5)2012_clone-webpage","doi-asserted-by":"crossref","unstructured":"Secure cloning webpage. http:\/\/www.irisa.fr\/celtique\/ext\/clones, September 2011. A. Aiken, J. S. Foster, J. Kodumal, and T. Terauchi. Checking and inferring local non-aliasing. InProc. of PLDI '03, pages 129-140. ACM Press, 2003.","DOI":"10.1145\/780822.781146"},{"key":"10.2168\/LMCS-8(2:5)2012_AndersonGayNaik:PLDI09","doi-asserted-by":"crossref","unstructured":"Z. Anderson, D. Gay, and M. Naik. Lightweight annotations for controlling sharing in concurrent data structures. InProc. of PLDI'09, pages 98-109. ACM Press, 2009.","DOI":"10.1145\/1542476.1542488"},{"key":"10.2168\/LMCS-8(2:5)2012_Blanchet99","doi-asserted-by":"crossref","unstructured":"B. Blanchet. Escape analysis for object-oriented languages: Application to Java. InProc. of OOPSLA, pages 20-34. ACM Press, 1999.","DOI":"10.1145\/320385.320387"},{"key":"10.2168\/LMCS-8(2:5)2012_Bloch04","unstructured":"J. Bloch.JSR 175: A metadata facility for the Java programming language. http:\/\/jcp.org\/en\/jsr\/detail?id=175, September 30, 2004."},{"key":"10.2168\/LMCS-8(2:5)2012_ChoiGSSM99","doi-asserted-by":"crossref","unstructured":"J.D. Choi, M. G., M. J. Serrano, V. C. Sreedhar, and S. P. Midkiff. Escape analysis for Java. InProc. of OOPSLA, pages 1-19. ACM Press, 1999.","DOI":"10.1145\/320385.320386"},{"key":"10.2168\/LMCS-8(2:5)2012_Clarke:98:Ownership","doi-asserted-by":"crossref","unstructured":"D. Clarke, J. Potter, and J. Noble. Ownership types for flexible alias protection. InProc. of the 13th ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications, OOPSLA '98, pages 48-64, New York, NY, USA, 1998. ACM.","DOI":"10.1145\/286936.286947"},{"key":"10.2168\/LMCS-8(2:5)2012_CousotCousot77","doi-asserted-by":"crossref","unstructured":"P. Cousot and R. Cousot. Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. InProc. of POPL'77, pages 238-252. ACM Press, 1977.","DOI":"10.1145\/512950.512973"},{"key":"10.2168\/LMCS-8(2:5)2012_pubsdoc:clonesPre","unstructured":"S. Drossopoulou and J. Noble. Trust the Clones. InFoVEOOS 2011 - preproceedings, September 2011."},{"key":"10.2168\/LMCS-8(2:5)2012_Fahndrich03","doi-asserted-by":"crossref","unstructured":"M. F\u00e4hndrich and K. R. M. Leino. Declaring and checking non-null types in an object-oriented language. InProc. of OOPSLA'03, pages 302-312. ACM Press, 2003.","DOI":"10.1145\/949305.949332"},{"key":"10.2168\/LMCS-8(2:5)2012_hubert08","doi-asserted-by":"crossref","unstructured":"L. Hubert, T. Jensen, and D. Pichardie. Semantic foundations and inference of non-null annotations. InProc. of FMOODS'08, volume 5051 ofLNCS, pages 132-149. Springer Berlin, 2008.","DOI":"10.1007\/978-3-540-68863-1_9"},{"key":"10.2168\/LMCS-8(2:5)2012_JensenKP:Esop11","doi-asserted-by":"crossref","unstructured":"T. Jensen, F. Kirchner, and D. Pichardie. Secure the clones: Static enforcement of secure object copying. In G. Barthe, editor,Proc. of 20th European Symposium on Programming (ESOP 2011). Springer LNCS vol. 6602, 2011.","DOI":"10.1007\/978-3-642-19718-5_17"},{"key":"10.2168\/LMCS-8(2:5)2012_Noble:98:Flexible","doi-asserted-by":"crossref","unstructured":"J. Noble, J. Potter, and J. Vitek. Flexible alias protection. InProc. of ECOOP'98, pages 158-185. Springer LNCS vol. 1445, 1998.","DOI":"10.1007\/BFb0054091"},{"key":"10.2168\/LMCS-8(2:5)2012_OHearnYR04","doi-asserted-by":"crossref","unstructured":"P. W. O'Hearn, H. Yang, and J. C. Reynolds. Separation and information hiding. InProc. of POPL'04, pages 268-280. ACM Press, 2004.","DOI":"10.1145\/964001.964024"},{"issue":"3","key":"10.2168\/LMCS-8(2:5)2012_SagivRW02","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1145\/514188.514190","volume":"24","author":"S. Sagiv, T. W. Reps, and R. Wilhelm","year":"2002","journal-title":"ACM Trans. Program. Lang. Syst."},{"key":"10.2168\/LMCS-8(2:5)2012_SunGuidelines:2010","unstructured":"Sun Developer Network.Secure Coding Guidelines for the Java Programming Language, version 3.0, 2010. http:\/\/java.sun.com\/security\/seccodeguide.html."},{"issue":"2","key":"10.2168\/LMCS-8(2:5)2012_TofteTalpin97","doi-asserted-by":"crossref","first-page":"109","DOI":"10.1006\/inco.1996.2613","volume":"132","author":"M. Tofte and J.-P. Talpin","year":"1997","journal-title":"Information and Computation"}],"container-title":["Logical Methods in Computer Science"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/lmcs.episciences.org\/801\/pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/lmcs.episciences.org\/801\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,4,11]],"date-time":"2023-04-11T19:56:28Z","timestamp":1681242988000},"score":1,"resource":{"primary":{"URL":"https:\/\/lmcs.episciences.org\/801"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012,5,31]]},"references-count":16,"URL":"https:\/\/doi.org\/10.2168\/lmcs-8(2:5)2012","relation":{"is-same-as":[{"id-type":"arxiv","id":"1204.4322","asserted-by":"subject"},{"id-type":"doi","id":"10.48550\/arXiv.1204.4322","asserted-by":"subject"}]},"ISSN":["1860-5974"],"issn-type":[{"type":"electronic","value":"1860-5974"}],"subject":[],"published":{"date-parts":[[2012,5,31]]},"article-number":"801"}}