An empirical study on API parameter rules
Hao Zhong, Na Meng, Zexuan Li, Li Jia
Abstract
Developers build programs based on software libraries to reduce coding effort. If a program inappropriately sets an API parameter, the program may exhibit unexpected runtime behaviors. To help developers correctly use library APIs, researchers built tools to mine API parameter rules. However, it is still unknown (1) what types of parameter rules there are, and (2) how these rules distribute inside documents and source files. In this paper, we conducted an empirical study to investigate the above-mentioned questions. To analyze as many parameter rules as possible, we took a hybrid approach that combines automatic localization of constrained parameters with manual inspection. Our automatic approach---PaRu---locates parameters that have constraints either documented in Javadoc (i.e., document rules) or implied by source code (i.e., code rules). Our manual inspection (1) identifies and categorizes rules for the located parameters, and (2) establishes mapping between document and code rules. By applying PaRu to 9 widely used libraries, we located 5,334 parameters with either document or code rules. Interestingly, there are only 187 parameters that have both types of rules, and 79 pairs of these parameter rules are unmatched. Additionally, PaRu extracted 1,688 rule sentences from Javadoc and code. We manually classified these sentences into six categories, two of which are overlooked by prior approaches. We found that 86.2% of parameters have only code rules; 10.3% of parameters have only document rules; and only 3.5% of parameters have both document and code rules. Our research reveals the challenges for automating parameter rule extraction. Based on our findings, we discuss the potentials of prior approaches and present our insights for future tool design.
Ask about this paper
Your agent reads all of it.
Lune indexed this paper to the last equation, along with the top-tier papers that cite it. Ask a question and the answer quotes them.
Cited by top-tier papers6
- Bugs in Quantum computing platforms: an empirical studyMatteo Paltenghi, Michael PradelOOPSLA 2022 · 70 citations
- Uncovering the iceberg from the tip: Generating API Specifications for Bug Detection via Specification Propagation AnalysisMiaoqian Lin, Kai Chen, Yi Yang, Jinghua LiuNDSS 2025
- Generating API Parameter Security Rules with LLM for API Misuse DetectionJinghua Liu, Yi Yang, Kai Chen, Miaoqian LinNDSS 2025
- Identifying Multi-parameter Constraint Errors in Python Data Science Library API DocumentationXiufeng Xu, Fuman Xie, Chenguang Zhu, Guangdong Bai et al.ISSTA 2025
- From Documentation to Zero-day Vulnerabilities: LLM-Driven Fuzzing of JavaScript Engines in PDF ReadersSuyue Guo, Stijn Pletinckx, Tianle Yu, Yigitcan Kaya et al.CCS 2026
Related papers
- API-Misuse Detection Driven by Fine-Grained API-Constraint Knowledge GraphXiaoxue Ren, Xinyuan Ye, Zhenchang Xing, Xin Xia et al.ASE 2020 · 62 citations
- RTFM! Automatic Assumption Discovery and Verification Derivation from Library Document for API Misuse DetectionTao Lv, Ruishi Li, Yi Yang, Kai Chen et al.CCS 2020 · 27 citations
- DocTer: documentation-guided fuzzing for testing deep learning API functionsDanning Xie, Yitong Li, Mijung Kim, Hung Viet Pham et al.ISSTA 2022 · 72 citations
- APICAD: Augmenting API Misuse Detection through Specifications from Code and DocumentsXiaoke Wang, Lei ZhaoICSE 2023 · 7 citations
- MELT: Mining Effective Lightweight Transformations from Pull RequestsDaniel Ramos, Hailie Mitchell, Inês Lynce, Vasco Manquinho et al.ASE 2023 · 6 citations
