Compilation of Commit Changes within Java Source Code Repositories
Stefan Schott, Wolfram Fischer, Serena Elisa Ponta, Jonas Klauke, Eric, Bodden

TL;DR
JESS is a novel approach that efficiently compiles only the modified parts of Java code in dependencies, enabling better vulnerability patch identification without full project compilation.
Contribution
JESS introduces a method to compile only relevant code changes in Java dependencies, reducing complexity and improving vulnerability patch analysis.
Findings
JESS successfully compiles 72% of methods in isolated form.
89% of compiled methods match original bytecode.
JESS compiles 73% of modified files in real-world fix-commits.
Abstract
Java applications include third-party dependencies as bytecode. To keep these applications secure, researchers have proposed tools to re-identify dependencies that contain known vulnerabilities. Yet, to allow such re-identification, one must obtain, for each vulnerability patch, the bytecode fixing the respective vulnerability at first. Such patches for dependencies are curated in databases in the form of fix-commits. But fixcommits are in source code, and automatically compiling whole Java projects to bytecode is notoriously hard, particularly for non-current versions of the code. In this paper, we thus propose JESS, an approach that largely avoids this problem by compiling solely the relevant code that was modified within a given commit. JESS reduces the code, retaining only those parts that the committed change references. To avoid name-resolution errors, JESS automatically infers…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
