Re: I need to know if a java class import a package
Daniel wrote On 04/23/07 13:53,:
Eric, thanks for your help
To clarify a little bit more my problem, I will try to add some
example of what I'm needing:
I need that some users fill with code in page to solve a task, this
task involves the sorting of an array of integers, this could be
easily solved with Collections.sort, but I gave them as a
precondition, they couldn't use the Collections class (because I want
to test if they can iterate an order an array by themselves).
To correct this tasks, I have a Junit class that test against the
submitted code, so I was searching for some mechanism that could help
me with this.
The webpage is an open community JavaBlackBelt.com
You could certainly inspect the compiled byte code for
references to "forbidden" classes. The java.lang.instrument
package might be helpful here.
However, I doubt such an approach will be all that useful
as a detector of cheating. To begin with, you need to make
a useful list of banned classes -- For example, if I were
told to sort an int[], I would use Arrays.sort() and never
touch the Collections class at all. Also, the sources for
Arrays (and Collections) are readily available; a cheater
could simply copy the source and change the package names,
and thus evade your detection.
Finally, JUnit is probably not a good framework for
this sort of thing. If I try to write an array-sorter but
make an error and introduce an infinite loop, you're going
to want some kind of timeout mechanism that prevents my
blunder (or my sabotage!) from monopolizing your page until
somebody notices the problem and restarts it. As far as
I'm aware, JUnit has no such facility; it just runs tests
until they finish or fail. If they do neither ...
Various organizations have public web pages that run
externally-submitted programs under controlled conditions,
with provision for catching runaways, guarding against hacks,
and so on. Instead of reinventing the wheel, I'd suggest
you look up a few of those sites and find out what they're
using for software; perhaps you can adapt something that
already exists as opposed to building it all from scratch.
Note: If this could be done, I imagine that also could be applied to
test if the developers are using some classes that are not specified
by the architecture. (eg: when developing J2ee code, sometimes the
developers could use some classes from the app server that could
decrease the portability)
Although this shares some aspects with the programming-
assignment problem, I think it's fundamentally a different
issue. There's no "antagonist" to worry about, and the
body of code to be inspected is more or less "known," so I
think static analysis of byte code (or source code) may be
a more appropriate tool than black-box run-time testing.
--
Eric.Sosman@sun.com