# To what extent can we analyze Kotlin programs using existing Java taint analysis tools? (Extended Version)

arXiv: https://arxiv.org/abs/2207.09379 · HTML: https://mlsanity.com/paper/2207.09379/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Jul 2022.

## Built on by (most cited first, 1 of 1)

- [From Detection to Prevention: Explaining Security-Critical Code to Avoid Vulnerabilities](https://mlsanity.com/paper/2602.00711/) (2026)

## Abstract (arXiv)

As an alternative to Java, Kotlin has gained rapid popularity since its introduction and has become the default choice for developing Android apps. However, due to its interoperability with Java, Kotlin programs may contain almost the same security vulnerabilities as their Java counterparts. Hence, we question: to what extent can one use an existing Java static taint analysis on Kotlin code? In this paper, we investigate the challenges in implementing a taint analysis for Kotlin compared to Java. To answer this question, we performed an exploratory study where each Kotlin construct was examined and compared to its Java equivalent. We identified 18 engineering challenges that static-analysis writers need to handle differently due to Kotlin's unique constructs or the differences in the generated bytecode between the Kotlin and Java compilers. For eight of them, we provide a conceptual solution, while six of those we implemented as part of SecuCheck-Kotlin, an extension to the existing Java taint analysis SecuCheck.