PLDI 2025
Mon 16 - Fri 20 June 2025 Seoul, South Korea
Fri 20 Jun 2025 14:20 - 14:40 at Grand Ball Room 2 - Databases Chair(s): Adam Chlipala

Database-backed applications form the backbone of modern software, yet their complexity poses significant challenges for static analysis. These applications involve intricate interactions among application code, diverse database frameworks such as JDBC, Hibernate, and Spring Data JPA, and languages like Java and SQL. In this paper, we introduce DBridge, the first pointer analysis specifically designed for Java database-backed applications, capable of statically constructing comprehensive Java-to-database value flows. DBridge unifies application code analysis, database access specification modeling, SQL analysis, and database abstraction within a single pointer analysis framework, capturing interactions across a wide range of database access APIs and frameworks. Additionally, we present DB-Micro, a new micro-benchmark suite with 824 test cases crafted to systematically evaluate static analysis for database-backed applications. Experiments on DB-Micro and large, complex, real-world applications demonstrate DBridge's effectiveness, achieving high recall and precision in building Java-to-database value flows efficiently and outperforming state-of-the-art tools in SQL statement identification. To further validate DBridge's utility, we develop three client analyses for security and program understanding. Evaluation on these real-world applications reveals 30 Stored XSS attack vulnerabilities and 3 horizontal broken access control vulnerabilities, all previously undiscovered and real, as well as a high detection rate in impact analysis for schema changes. By open-sourcing DBridge (14K LoC) and DB-Micro (22K LoC), we seek to help advance static analysis for modern database-backed applications in the future.

Fri 20 Jun

Displayed time zone: Seoul change

14:00 - 15:20
DatabasesPLDI Research Papers at Grand Ball Room 2
Chair(s): Adam Chlipala Massachusetts Institute of Technology
14:00
20m
Talk
Polygon: Symbolic Reasoning for SQL using Conflict-Driven Under-Approximation Search
PLDI Research Papers
Pinhan Zhao University of Michigan, Yuepeng Wang Simon Fraser University, Xinyu Wang University of Michigan
DOI Pre-print
14:20
20m
Talk
Pointer Analysis for Database-Backed Applications
PLDI Research Papers
Yufei Liang Nanjing University, Teng Zhang Nanjing University, Ganlin Li Nanjing University, Tian Tan Nanjing University, Chang Xu Nanjing University, Chun Cao Nanjing University, Xiaoxing Ma Nanjing University, Yue Li Nanjing University
DOI
14:40
20m
Talk
Graphiti: Bridging Graph and Relational Database Queries
PLDI Research Papers
Yang He Simon Fraser University, Ruijie Fang University of Texas at Austin, Işıl Dillig University of Texas at Austin, Yuepeng Wang Simon Fraser University
DOI
15:00
20m
Talk
AWDIT: An Optimal Weak Database Isolation TesterDistinguished Paper
PLDI Research Papers
Lasse Møldrup Aarhus University, Andreas Pavlogiannis Aarhus University
DOI