Tai-e

Tai-e

✨News

• Our paper "When Absence Speaks: A Null-Aware Approach for Taint Analysis" has been accepted by ICSE'27. This work presents a simple yet effective approach for recovering missing taint flows, substantially improving the vulnerability detection capability of Tai-e's general-purpose Java taint analysis.
• Our paper "Heap Abstraction via Early-Confluent Object Merging for Pointer Analysis" has been accepted by OOPSLA'26. This work presents Valve, a novel heap abstraction technique that significantly accelerates pointer analysis while preserving high precision.
• Release v0.5.4:
  • Tai-e ships with a new frontend, providing faster and more reliable conversion from Java programs to Tai-e IR.
  • Android app analysis is supported through a PacDroid-powered plugin integrated with pointer analysis.
  • Spring DI and WEC analysis is supported through the Spring analysis plugin.
• Our paper "Two Approaches to Fast Bytecode Frontend for Static Analysis" has been accepted by OOPSLA'25. This paper presents Tai-e's new bytecode frontend, which is significantly faster and more reliable than existing frontends.
• Our paper "Pointer Analysis for Database-Backed Applications" has been accepted by PLDI'25. This paper describes an end–to–end pointer analysis for Java database–backed application developed on top of Tai-e.
• Our paper "PacDroid: A Pointer-Analysis-Centric Framework for Security Vulnerabilities in Android Apps" has been accepted by ICSE'25. This work demonstrates Tai-e's new capability in Android analysis, providing a simple yet effective approach for security analysis of Apps. This work earned the Best Artifact Award🏅.
• Our paper "Bridge the Islands: Pointer Analysis for Microservice Systems" has been accepted by ISSTA'25. This paper describes the first pointer analysis for Java Microservice systems developed on top of Tai-e.
• Our paper "Interactive Cross-Language Pointer Analysis for Resolving Native Code in Java Programs" has been accepted by ICSE'25. This is the first cross-language pointer analysis between Java and C. This work won the Distinguished Paper Award🏅.
• Our paper "Context Sensitivity without Context: A Cut-Shortcut Approach to Fast and Precise Pointer Analysis" has been accepted by PLDI'23. This is the first published research work developed on top of Tai-e.
• Our paper "Tai-e: A Developer-Friendly Static Analysis Framework for Java by Harnessing the Good Designs of Classics" has been accepted by ISSTA'23. This paper describes the designs for the major components of Tai-e.

Table of Contents

• What is Tai-e?
• How to Obtain Runnable Tai-e?
• How to Include Tai-e in Your Project?
  • Stable Version
  • Latest Version
• Documentation
  • Reference Documentation
  • Changelog
• Tai-e Assignments

What is Tai-e?

Tai-e (Chinese: 太阿; pronunciation: [ˈtaɪə:]) is a new static analysis framework for Java (please see our ISSTA 2023 paper for details), which features arguably the "best" designs from both the novel ones we proposed and those of classic frameworks such as Soot, WALA, Doop, and SpotBugs. Tai-e is easy-to-learn, easy-to-use, efficient, and highly extensible, allowing you to easily develop new analyses on top of it.

Currently, Tai-e provides the following major analysis components (and more analyses are on the way):

• Powerful pointer analysis framework
  • On-the-fly call graph construction
  • Various classic and advanced techniques of heap abstraction and context sensitivity for pointer analysis
  • Extensible analysis plugin system (allows to conveniently develop and add new analyses that interact with pointer analysis)
• Configurable security analysis
  • Taint analysis, which allows to configure sources, sinks, taint transfers, and sanitizers
  • Detection of various information leakages and injection vulnerabilities
  • Various precision and efficiency tradeoffs (benefit from the pointer analysis framework)
• Various fundamental/utility analyses
  • Fundamental analyses, e.g., reflection analysis and exception analysis
  • Modern language feature analyses, e.g., lambda and method reference analysis, and invokedynamic analysis
  • Utility tools like analysis timer, constraint checker (for debugging), and various graph dumpers
• Control/Data-flow analysis framework
  • Control-flow graph construction
  • Classic data-flow analyses, e.g., live variable analysis, constant propagation
  • Your data-flow analyses
• SpotBugs-like bug detection system
  • Bug detectors, e.g., null pointer detector, incorrect clone() detector
  • Your bug detectors

Tai-e is developed in Java, and it can run on major operating systems including Windows, Linux, and macOS.

As a courtesy to the developers, we expect that you please cite the paper from ISSTA 2023 describing the Tai-e framework in your research work:

Tian Tan and Yue Li. 2023. Tai-e: A Developer-Friendly Static Analysis Framework for Java by Harnessing the Good Designs of Classics. In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA '23), July 17–21, 2023, Seattle, WA, USA (pdf, bibtex).

How to Obtain Runnable Tai-e?

The recommended way is to download the distribution ZIP from GitHub Releases. The ZIP contains Tai-e, all runtime dependencies, offline documentation, and startup scripts for Windows, Linux, and macOS.

Alternatively, you might build the latest Tai-e yourself from the source code. This can be simply accomplished via Gradle (be sure that Java 17 (or higher version) is available on your system):

./gradlew distZip

The distribution ZIP will be generated in tai-e/build/distributions/. After extracting it, run Tai-e via the startup script:

# on Linux/macOS
./tai-e-<version>/bin/tai-e -h
# on Windows
.\tai-e-<version>\bin\tai-e.bat -h

For compatibility with older releases and scripts, Tai-e still provides a legacy all-in-one JAR:

./gradlew fatJar
java -jar build/tai-e-all-<version>.jar -h

How to Include Tai-e in Your Project?

Tai-e is designed as a standalone tool, but you also have the option to include it in your project as a dependency. It is available on Maven repositories, allowing you to easily integrate it into your Java projects using build tools such as Gradle and Maven. We maintain both stable and latest versions of Tai-e, and here are the corresponding coordinates in Gradle and Maven script formats:

Stable Version

For Gradle:

dependencies {
    implementation("net.pascal-lab:tai-e:0.5.4")
}

For Maven:

<dependencies>
    <dependency>
        <groupId>net.pascal-lab</groupId>
        <artifactId>tai-e</artifactId>
        <version>0.5.4</version>
    </dependency>
</dependencies>

Latest Version

For Gradle:

repositories {
    mavenCentral()
    maven { url = uri("https://central.sonatype.com/repository/maven-snapshots/") }
}

dependencies {
    implementation("net.pascal-lab:tai-e:0.5.5-SNAPSHOT")
}

For Maven:

<repositories>
    <repository>
        <id>snapshots</id>
        <name>Sonatype snapshot server</name>
        <url>https://central.sonatype.com/repository/maven-snapshots/</url>
    </repository>
</repositories>

<dependencies>
    <dependency>
        <groupId>net.pascal-lab</groupId>
        <artifactId>tai-e</artifactId>
        <version>0.5.5-SNAPSHOT</version>
    </dependency>
</dependencies>

You can use these coordinates in your Gradle or Maven scripts to include the desired version of Tai-e in your project.

Documentation

Reference Documentation

We have provided detailed information of Tai-e in the Reference Documentation, which covers various aspects such as Setup in IntelliJ IDEA, Command-Line Options, and Development of New Analysis.

Please note that the reference documentation mentioned above pertains to the latest version of Tai-e. If you need documentation for a specific stable version, please refer to the Documentation Index. Additionally, the documentation is included within the repository and maintained alongside the source code. You can access the reference documentation for a particular version of Tai-e (in AsciiDoc format) by exploring the docs/en directory, starting from index.adoc. This allows you to access version-specific documentation for Tai-e.

In addition to the reference documentation, Javadocs for Tai-e are also available as a useful reference resource.

Changelog

Since we are actively developing and updating Tai-e, we record the notable changes we made, especially the new features and breaking changes, in CHANGELOG. If you find something wrong after updating Tai-e, maybe you could check CHANGELOG for useful information.

Tai-e Assignments

In addition, we have developed an educational version of Tai-e where eight programming assignments are carefully designed for systematically training learners to implement various static analysis techniques to analyze real Java programs. The educational version shares a large amount of code with Tai-e, thus doing the assignments would be a good way to get familiar with Tai-e.