Characterizing and Detecting Bugs in WeChat Mini-Programs
Tao Wang, Qingxin Xu, Xiaoning Chang, Wensheng Dou, Jiaxin Zhu, Jinhui Xie, Yuetang Deng, Jianbo Yang, Jiaheng Yang, Jun Wei, Tao Huang
摘要
Built on the WeChat social platform, WeChat Mini-Programs are widely used by more than 400 million users every day. Consequently, the reliability of Mini-Programs is particularly crucial. However, WeChat Mini-Programs suffer from various bugs related to execution environment, lifecycle management, asynchronous mechanism, etc. These bugs have seriously affected users' experience and caused serious impacts. In this paper, we conduct the first empirical study on 83 WeChat Mini-Program bugs, and perform an in-depth analysis of their root causes, impacts and fixes. From this study, we obtain many interesting findings that can open up new research directions for combating WeChat Mini-Program bugs. Based on the bug patterns found in our study, we further develop WeDetector to detect WeChat Mini-Program bugs. Our evaluation on 25 real-world Mini-Programs has found 11 previously unknown bugs, and 7 of them have been confirmed by developers.
问问这篇 Paper
智能体会读完全文。
Lune 把这篇 Paper 索引到了最后一个公式,引用它的顶会 Paper 也一样。你提问,回答直接引用原文。
引用它的顶会 Paper7
- ωTest: WebView-Oriented Testing for Android ApplicationsJiajun Hu, Lili Wei, Yepang Liu, Shing-Chi CheungISSTA 2023 · 被引用 8 次
- State Reconciliation Defects in Infrastructure as CodeMd. Mahadi Hassan, John Salvador, Shubhra Kanti Karmaker Santu, Akond RahmanFSE 2024 · 被引用 8 次
- Wemint:Tainting Sensitive Data Leaks in WeChat Mini-ProgramsShi Meng, Liu Wang, Shenao Wang, Kailong Wang 等ASE 2023 · 被引用 8 次
- An Empirical Study on Kubernetes Operator BugsQingxin Xu, Yu Gao, Jun WeiISSTA 2024 · 被引用 7 次
- MiniCAT: Understanding and Detecting Cross-Page Request Forgery Vulnerabilities in Mini-ProgramsZidong Zhang, Qinsheng Hou, Lingyun Ying, Wenrui Diao 等CCS 2024 · 被引用 6 次
它引用的顶会 Paper4
- Keep me Updated: An Empirical Study of Third-Party Library Updatability on AndroidErik Derr, Sven Bugiel, Sascha Fahl, Yasemin Acar 等CCS 2017 · 被引用 196 次
- An empirical study on program failures of deep learning jobsRu Zhang, Wencong Xiao, Hongyu Zhang, Yu Liu 等ICSE 2020 · 被引用 96 次
- SYNODE: Understanding and Automatically Preventing Injection Attacks on NODE.JSCristian-Alexandru Staicu, Michael Pradel, Benjamin LivshitsNDSS 2018 · 被引用 91 次
- Race Detection for Event-Driven Node.js ApplicationsXiaoning Chang, Wensheng Dou, Jun Wei, Tao Huang 等ASE 2021 · 被引用 6 次
相关 Paper
- Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-ProgramsYue Zhang, Yuqing Yang, Zhiqiang LinCCS 2023 · 被引用 14 次
- Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic AnalysisZidong Zhang, Zhentao Xie, Lingyun Ying, Qinsheng Hou 等CCS 2026
- One Size Does Not Fit All: Uncovering and Exploiting Cross Platform Discrepant APIs in WeChatChao Wang, Yue Zhang, Zhiqiang LinUSENIX Security 2023
- Taintmini: Detecting Flow of Sensitive Data in Mini-Programs with Static Taint AnalysisChao Wang, Ronny Ko, Yue Zhang, Yuqing Yang 等ICSE 2023 · 被引用 36 次
- MiniChecker: Detecting Data Privacy Risk of Abusive Permission Request Behavior in Mini-ProgramsYin Wang, Ming Fan, Hao Zhou, Haijun Wang 等ASE 2024 · 被引用 2 次
