Security code smells are receiving increasing attention in the domain of Android app development. They serve as coding guidelines aimed at identifying vulnerabilities originating from the application's source code. Numerous related tools have been proposed to align with DevSecOps guidelines. However, they lack of comparable effort in creating benchmarks for open-source apps, making the thorough evaluation of these tools challenging, and requiring time-consuming manual effort. In this paper, we propose Privbench, an evolving benchmark that captures vulnerabilities related to the Android ecosystem. It incorporates multiple code patterns for each vulnerability. To showcase its significance, we used it to evaluate two well-known tools used to identify Android security code smells. This evaluation focused on Privilege Escalation (PE) vulnerabilities and we present their performance in detecting the vulnerabilities within their scopes. We believe that our benchmark can be useful for advancing the capabilities of state-of-the-art tools, enhancing their effectiveness in vulnerability detection, and increasing developers awareness to evade privilege escalation vulnerabilities.

International audience

International audience

International audience

International audience

Early testing reduces the cost of detecting faults and improves the system reliability. In particular, testing component or service based systems during modeling frees the tests from implementation details, especially those related to the middleware. COSTOTest is a tool that helps the tester during the process of designing tests at the model level. It suggests the possibilities and the lacks when (s)he builds test cases. Building executable tests is achieved thanks to model transformations.

An efficient mechanism for method lookup is csscntial in any reasonable implementation of a clussbased object-oriented language.One tcchniquc, static caches, provide constant time lookup, but consumes cxcessive memory.To alleviate the memory consumption problem many systems USC a coloring schcmc that allows cache rows to be shared and thus reduces the ovcrall cache size.This technique is easily implcmcntcd I'OI stongly typed languages such as C++ and Eiffcl, but not for languages such as CLOS or Smalltalk.This papct provides a solution to this latter problem: that of coloring for static caches in dynamically typed objcct-oricnted languages.Our solution is to use an incrcmcntal coloring algorithm to avoid the memory consumption problems of the naive approach.