# Analyzing and Discovering Spatial Algorithm Complexity Vulnerabilities in Recursion
## 4 Methodology
### Model-Based Vulnerable Call Chain Search
#### 4.3.3 Uncaptured Error  
Based on the Java exception handling mechanism mentioned above, if a method's nested call does not capture errors such as \"java.lang.throwable\", 7 \"java.lang.error\", or \"java.lang.stackoverflowor\", it may indicate the presence of error types that are unforeseen or unhandled by the developer. This is particularly critical in the case of \"StackOverflowError\", as such uncaught errors can lead to algorithmic complexity vulnerabilities, potentially causing runtime errors that are not anticipated by the developers.  
By utilizing Soot or our proposed method to analyze the call chains of all public methods in Java third-party libraries, we can detect whether there are instances of recursion without catching the aforementioned types of errors. With the help of our proposed method, we can clearly identify the presence of recursive paths in the program (i.e., cases where class methods reference themselves). If these recursive methods do not show try-catch captures for errors like \"java.lang.throwable\", \"java.lang.error\", and \"java.lang.stackoverflowor\" at the statement level within the call chain context,it indicates that errors in recursion are not foreseen and handled by the developer but are thrown by the JVM, which are worth our analysis and utilization.
```
1:body of the method to be analyzed
2:boolean indicating if there is a recursion depth limit
3:hasDepthLimit \(\leftarrow\) false
4:for each\(unit\) in the method's bodydo
5:if\(unit\) is a type of conditional statement then
6:\(conditionalStatement\)\(\leftarrow\) cast \(unit\) to conditional statement
7:if\(conditionalStatement\) is recursion depth check statement then
8:\(depthVar\)\(\leftarrow\) extract variable from \(conditionalStatement\)
9:if\(depthVar\) has increment and is (class attribute or parameter reference) then
10:\(hasDepthLimit\)\(\leftarrow\) true
11:break
12:endif
13:endif
14:endfor
15:return\(hasDepthLimit\)
```
**Algorithm 2** Judging if there is constraint for recursion depth in a method body.  
As illustrated in Algorithm 3, Line 1 iterates over each exception handling block (trap) in the body and use a flag \"isInTrap\" to track whether the current iteration is inside a trap (Line 4). Then, iterate over each unit (Line 5) in the body for checking whether the unit is inside the exception and error handling block (Line 6-14). This function is further used in Algorithm 1 mentioned in Section 4.3.1.
```
1:body of the method and a \(sootMethod\) object to be analyzed
2:boolean indicating if the \(sootMethod\) is within any exception handling block (trap)
3:for each \(trap\) in \(body\)'s traps do
4:\(startUnit\)\(\leftarrow\) get the begin unit of the \(trap\)
5:\(endUnit\)\(\leftarrow\) get the end unit of the \(trap\)
6:\(isInTrap\)\(\leftarrow\) false
7:for each \(unit\) in \(body\)'s units do
8:if\(unit\)\(=startUnit\)then
9:\(isInTrap\)\(\leftarrow\) true
10:endif
11:if\(isInTrap\) and the \(unit\) contains a call to \(sootMethod\)then
12:return\(true\)
13:endif
14:if\(unit\)\(=endUnit\)then
15:\(isInTrap\)\(\leftarrow\) false
16:endif
17:endfor
18:endfor
19:returnfalse
```
**Algorithm 3** Determine if a recursion structure is captured by error handling mechanisms.