Kotlin is a novel language that represents an alternative to Java, and has been recently adopted as a first-class programming language for Android applications. Kotlin is achieving a significant diffusion among developers, and several studies have highlighted various advantages of the language when compared to Java.
The objective of this paper is to analyze a set of open-source Android apps, to evaluate their transition to the Kotlin programming language throughout their lifespan and understand whether the adoption of Kotlin has impacts on the success of Android apps.
We mined all the projects from the F-Droid repository of Android open-source applications, and we found the corresponding projects on the official Google Play Store and on the GitHub platform. We defined a set of eight metrics to quantify the relevance of Kotlin code in the latest update and through all releases of an application. Then, we statistically analyzed the correlation between the presence of Kotlin code in a project and popularity metrics mined from the platforms where the apps were released.
Of a set of 1232 projects that were updated after October 2017, near 20% adopted Kotlin and about 12% had more Kotlin code than Java; most of the projects that adopted Kotlin quickly transitioned from Java to the new language. The projects featuring Kotlin had on average higher popularity metrics; a statistically significant correlation has been found between the presence of Kotlin and the number of stars on the GitHub repository.
The Kotlin language seems able to guarantee a seamless migration from Java for Android developers. With an inspection on a large set of open-source Android apps, we observed that the adoption of the Kotlin language is rapid (when compared to the average lifespan of an Android project) and seems to come at no cost in terms of popularity among the users and other developers.
Currently, the majority of apps running on mobile devices are Android apps developed in Java. However, developers can now write Android applications using a new programming language: Kotlin, which Google adopted in 2017 as an official programming language for developing Android apps. Since then, Android developers have been able to: a) start writing Android applications from scratch using Kotlin, b) evolve their existing Android applications written in Java by adding Kotlin code (possible thanks to the interoperability between the two languages), or c) migrate their Android apps from Java to K…
Generating test cases through automatic app exploration is very useful for analyzing and testing Android apps. However, test cases generated by current app-exploration tools are not reproducible, i.e. when the generated test case is re-executed, the app cannot reach the same state as the explored one. As a result, app developers are not able to reproduce the failure or crash reported during the exploration, to conduct regression test after fixing the bug, or to execute the same test in different environments. In this paper, we present DroidWalker, a dynamic-analysis tool to generate reproducib…
Android is nowadays the most popular operating system in the world, not only in the realm of mobile devices, but also when considering desktop and laptop computers. Such a popularity makes it an attractive target for security attacks, also due to the sensitive information often manipulated by mobile apps. The latter are going through a transition in which the Android ecosystem is moving from the usage of Java as the official language for developing apps, to the adoption of Kotlin as the first choice supported by Google. While previous studies have partially studied security weaknesses affectin…
The mobile application (app) has become the main entrance to access the Internet on handheld devices. Unlike the Web where each webpage has a global URL to reach directly, a specific "content page" of an app can be opened only by exploring the app with several operations from the landing page. The interoperability between apps is quite fixed and thus limits the value-added "linked data" between apps. Recently, deep link has been proposed to enable targeting and opening a specific page of an app externally with an accessible uniform resource identifier (URI). However, implementing deep link for…
Resource leak bugs in Android apps are pervasive and can cause serious performance degradation and system crashes. In recent years, several resource leak detection techniques have been proposed to assist Android developers in correctly managing system resources. Yet, there exist no common bug benchmarks for effectively and reliably comparing such techniques and quantitatively evaluating their strengths and weaknesses. This paper describes our initial contribution towards constructing such a benchmark. To locate real resource leak bugs, we mined 124,215 code revisions of 34 large-scale open-sou…
An Empirical Study of Kotlin-Java Cross-Dependency Issues and Their Detection
Nanjing University of Science and Technology, China（南京理工大学）；Huawei Technologies Co., Ltd.（华为技术有限公司）；School of Computer Science, Wuhan University, China（武汉大学计算机学院）
Validation of Android apps via testing is difficult owing to the presence of flaky tests. Due to non-deterministic execution environments, a sequence of events (a test) may lead to success or failure in unpredictable ways. In this work, we present an approach and tool FlakeShovel for detecting flaky tests through systematic exploration of event orders. Our key observation is that for a test in a mobile app, there is a testing framework thread which creates the test events, a main User-Interface (UI) thread processing these events, and there may be several other background threads running async…
As an alternative to Java, Kotlin has gained rapid popularity since its introduction and has become the default choice for developing Android apps. However, due to its interoperability with Java, Kotlin programs may contain almost the same security vulnerabilities as their Java counterparts. Hence, we question: to what extent can one use an existing Java static taint analysis on Kotlin code? In this paper, we investigate the challenges in implementing a taint analysis for Kotlin compared to Java. To answer this question, we performed an exploratory study where each Kotlin construct was examine…
In recent years, researchers have developed a number of tools to conduct taint analysis of Android applications. While all the respective papers aim at providing a thorough empirical evaluation, comparability is hindered by varying or unclear evaluation targets. Sometimes, the apps used for evaluation are not precisely described. In other cases, authors use an established benchmark but cover it only partially. In yet other cases, the evaluations differ in terms of the data leaks searched for, or lack a ground truth to compare against. All those limitations make it impossible to truly compare t…
Spotting Setting-Related UI Display Bugs in Android Apps
School of Informatics (National Characteristic Demonstration Software School), Xiamen University（厦门大学信息学院（国家示范性软件学院））；Fujian Engineering Research Center of High-Performance Intelligent Computing Systems（福建省高性能智能计算系统工程研究中心）
Android applications may leak privacy data carelessly or maliciously. In this work we perform inter-component data-flow analysis to detect privacy leaks between components of Android applications. Unlike all current approaches, our tool, called IccTA, propagates the context between the components, which improves the precision of the analysis. IccTA outperforms all other available tools by reaching a precision of 95.0% and a recall of 82.6% on DroidBench. Our approach detects 147 inter-component based privacy leaks in 14 applications in a set of 3000 real-world applications with a precision of …
The boom in mobile apps has changed the traditional landscape of software development by introducing new challenges due to the limited resources of mobile devices, e.g., memory, CPU, network bandwidth and battery. The energy consumption of mobile apps is nowadays a hot topic and researchers are actively investigating the role of coding practices on energy efficiency. Recent studies suggest that design quality can conflict with energy efficiency. Therefore, it is important to take into account energy efficiency when evolving the design of a mobile app. The research community has proposed approa…
In this paper, we present a concolic execution technique for detecting SQL injection vulnerabilities in Android apps, with a new tool we called ConsiDroid. We extend the source code of apps with mocking technique, such that the execution of original source code is not affected. The extended source code can be treated as Java applications and may be executed by SPF with concolic execution. We automatically produce a DummyMain class out of static analysis such that the essential functions are called sequentially and, the events leading to vulnerable functions are triggered. We extend SPF with ta…
Many developers and organizations implement apps for Android, the most widely used operating system for mobile devices. Common problems developers face are the various hardware devices, customized Android variants, and frequent updates, forcing them to implement workarounds for the different versions and variants of Android APIs used in practice. In this paper, we contribute the Android Compatibility checkS dataSet (AndroidCompass) that comprises changes to compatibility checks developers use to enforce workarounds for specific Android versions in their apps. We extracted 80,324 changes to com…
Machine learning-based malware detection dominates current security defense approaches for Android apps. However, due to the evolution of Android platforms and malware, existing such techniques are widely limited by their need for constant retraining that are costly, and reliance on new malware samples that may not be timely available. As a result, new and emerging malware slips through, as seen from the continued surging of malware in the wild. Thus, a more practical detector needs not only to be accurate but, more critically, to be able to sustain its capabilities over time without frequent …
Context: A Legacy system can be defined as a system that significantly resists modification and evolution. According to the literature, there are two main strategies to migrate a legacy system: (a) to replace the legacy system by a new one, (b) to incrementally migrate parts from the legacy system to the new one. Incremental migration allows developers to better control the risks that may occur during the migration process. However, this strategy is more complex because it requires decomposition of the legacy system into different parts, e.g. a set of files, and to define the order of migratio…
Large Language Models for Mobile GUI Text Input Generation: An Empirical Study
Macau University of Science and Technology（澳门科技大学）；Institute of Software Chinese Academy of Sciences（中国科学院软件研究所）；Technical University of Munich（慕尼黑工业大学）；University of Nottingham Ningbo China（诺丁汉大学宁波校区）；MUST Science and Technology Research Institute（澳门科技大学珠海研究院）
