Home

Use at Your Own Risk: The Java Unsafe API in the Wild

Use at Your Own Risk: The Java Unsafe API in the Wild
Free download from ACM
Related tools & artifacts:
Conference Paper: OOPSLA'15, October, 2015

Java is a safe language. Its runtime environment provides strong safety guarantees that any Java application can rely on. Or so we think. We show that the runtime actually does not provide these guarantees—for a large fraction of today’s Java code. Unbeknownst to many application developers, the Java runtime includes a “backdoor” that allows expert library and framework developers to circumvent Java’s safety guarantees. This backdoor is there by design, and is well known to experts, as it enables them to write high-performance “systems-level” code in Java.

For much the same reasons that safe languages are preferred over unsafe languages, these powerful—but unsafe—capabilities in Java should be restricted. They should be made safe by changing the language, the runtime system, or the libraries. At the very least, their use should be restricted. This paper is a step in that direction.

We analyzed 74 GB of compiled Java code, spread over 86,479 Java archives, to determine how Java’s unsafe capabilities are used in real-world libraries and applications. We found that 25% of Java bytecode archives depend on unsafe third-party Java code, and thus Java’s safety guarantees cannot be trusted. We identify 14 different usage patterns of Java’s unsafe capabilities, and we provide supporting evidence for why real-world code needs these capabilities. Our long-term goal is to provide a foundation for the design of new language features to regain safety in Java.

@inproceedings{Mastrangelo15, author = {Mastrangelo, Luis and Ponzanelli, Luca and Mocci, Andrea and Lanza, Michele and Hauswirth, Matthias and Nystrom, Nathaniel}, title = {Use at Your Own Risk: The Java Unsafe API in the Wild}, booktitle = {Proceedings of the 2015 ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applications}, series = {OOPSLA 2015}, year = {2015}, isbn = {978-1-4503-3689-5}, location = {Pittsburgh, PA, USA}, pages = {695--710}, numpages = {16}, url = {http://doi.acm.org/10.1145/2814270.2814313}, doi = {10.1145/2814270.2814313}, acmid = {2814313}, publisher = {ACM}, address = {New York, NY, USA}, keywords = {Java, Maven Central, Stack Overflow, mining, patterns, unsafe}, }