2024

• Java-Class-Hijack: Software Supply Chain Attack for Java Based on Maven Dependency Resolution and Java Classloading , Federico Bono, Frank Reyes, Aman Sharma, Benoit Baudry, Martin Monperrus In arXiv 2024 [bibtex] [pdf]

  @misc{bono_javaclasshijack_2024,
    title = {Java-{{Class-Hijack}}: {{Software Supply Chain Attack}} for {{Java}} Based on {{Maven Dependency Resolution}} and {{Java Classloading}}},
    author = {Bono, Federico and Reyes, Frank and Sharma, Aman and Baudry, Benoit and Monperrus, Martin},
    year = {2024},
    month = jul,
    number = {arXiv:2407.18760},
    eprint = {2407.18760},
    primaryclass = {cs},
    publisher = {arXiv},
    url = {http://arxiv.org/abs/2407.18760},
    urldate = {2024-07-29},
    archiveprefix = {arXiv},
    copyright = {All rights reserved},
    date={2024}
  }
  

• SBOM.EXE: Countering Dynamic Code Injection Based on Software Bill of Materials in Java , Aman Sharma, Martin Wittlinger, Benoit Baudry, Martin Monperrus In arXiv 2024 [bibtex] [pdf] [github]

  @misc{sharma_sbom_2024,
    title = {{{SBOM}}.{{EXE}}: {{Countering Dynamic Code Injection}} Based on {{Software Bill}} of {{Materials}} in {{Java}}},
    author = {Sharma, Aman and Wittlinger, Martin and Baudry, Benoit and Monperrus, Martin},
    year = {2024},
    month = jun,
    number = {arXiv:2407.00246},
    eprint = {2407.00246},
    primaryclass = {cs},
    publisher = {arXiv},
    url = {http://arxiv.org/abs/2407.00246},
    urldate = {2024-07-02},
    archiveprefix = {arXiv},
    copyright = {All rights reserved},
    date={2024}
  }
  

2023

• Augmenting Diffs With Runtime Information , Khashayar Etemadi, Aman Sharma, Fernanda Madeiral, Martin Monperrus In IEEE Transactions on Software Engineering 2023 [bibtex] [pdf] [github]

  @article{etemadi_augmenting_2023,
  	title = {Augmenting Diffs With Runtime Information},
  	rights = {{CC}0 1.0 Universal Public Domain Dedication},
  	issn = {1939-3520},
  	url = {https://ieeexplore.ieee.org/document/10285584},
  	doi = {10.1109/TSE.2023.3324258},
  	abstract = {Source code diffs are used on a daily basis as part of code review, inspection, and auditing. To facilitate understanding, they are typically accompanied by explanations that describe the essence of what is changed in the program. As manually crafting high-quality explanations is a cumbersome task, researchers have proposed automatic techniques to generate code diff explanations. Existing explanation generation methods solely focus on static analysis, i.e., they do not take advantage of runtime information to explain code changes. In this paper, we propose Collector-Sahab, a novel tool that augments code diffs with runtime difference information. Collector-Sahab compares the program states of the original (old) and patched (new) versions of a program to find unique variable values. Then, Collector-Sahab adds this novel runtime information to the source code diff as shown, for instance, in code reviewing systems. As an evaluation, we run Collector-Sahab on 584 code diffs for Defects4J bugs and find it successfully augments the code diff for 95\% (555/584) of them. We also perform a user study and ask eight participants to score the augmented code diffs generated by Collector-Sahab. Per this user study, we conclude that developers find the idea of adding runtime data to code diffs promising and useful. Overall, our experiments show the effectiveness and usefulness of Collector-Sahab in augmenting code diffs with runtime difference information. Publicly-available repository: https://github.com/{ASSERT}-{KTH}/collector-sahab.},
  	pages = {1--20},
  	journaltitle = {{IEEE} Transactions on Software Engineering},
  	author = {Etemadi, Khashayar and Sharma, Aman and Madeiral, Fernanda and Monperrus, Martin},
  	urldate = {2023-10-26},
  	date = {2023},
  	note = {Conference Name: {IEEE} Transactions on Software Engineering},
  	file = {IEEE Xplore Abstract Record:/home/aman/Zotero/storage/I9EVKAYP/10285584.html:text/html;IEEE Xplore Full Text PDF:/home/aman/Zotero/storage/XDLRWMBG/Etemadi et al. - 2023 - Augmenting Diffs With Runtime Information.pdf:application/pdf},
  }
  

• Challenges of Producing Software Bill of Materials for Java , Musard Balliu, Benoit Baudry, Sofia Bobadilla, Mathias Ekstedt, Martin Monperrus, Javier Ron, Aman Sharma, Gabriel Skoglund, César Soto-Valero, Martin Wittlinger In IEEE Security & Privacy 2023 [bibtex] [pdf] [github]

  @article{balliu_challenges_2023,
  	title = {Challenges of Producing Software Bill of Materials for Java},
  	rights = {{CC}0 1.0 Universal Public Domain Dedication},
  	issn = {1558-4046},
  	url = {https://ieeexplore.ieee.org/document/10235318},
  	abstract = {Software bills of materials ({SBOM}) promise to become the backbone of software supply chain hardening. We deep-dive into six tools and the {SBOMs} they produce for complex open source Java projects, revealing challenges regarding the accurate production and usage of {SBOMS}.},
  	pages = {2--13},
  	journaltitle = {{IEEE} Security \& Privacy},
  	author = {Balliu, Musard and Baudry, Benoit and Bobadilla, Sofia and Ekstedt, Mathias and Monperrus, Martin and Ron, Javier and Sharma, Aman and Skoglund, Gabriel and Soto-Valero, César and Wittlinger, Martin},
  	urldate = {2023-09-27},
  	date = {2023},
  	note = {Conference Name: {IEEE} Security \& Privacy},
  	file = {IEEE Xplore Abstract Record:/home/aman/Zotero/storage/BV8PSW63/10235318.html:text/html;IEEE Xplore Full Text PDF:/home/aman/Zotero/storage/46ZV7GDG/Balliu et al. - 2023 - Challenges of Producing Software Bill of Materials.pdf:application/pdf},
  }