Skip to content

Commit 58c32d9

Browse files
arkttarktt
committed
Reporting location fix to source methods with tainted parameters.
1 parent f57c805 commit 58c32d9

File tree

3 files changed

+37
-16
lines changed

3 files changed

+37
-16
lines changed

‎de.fraunhofer.iem.secucheck.analysis/src/main/java/de/fraunhofer/iem/secucheck/analysis/internal/SingleFlowAnalysis.java‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import boomerang.scene.AnalysisScope;
2222
import boomerang.scene.ControlFlowGraph.Edge;
2323
import boomerang.scene.Val;
24+
import boomerang.scene.jimple.JimpleStatement;
2425
import boomerang.scene.jimple.SootCallGraph;
2526
import boomerang.util.AccessPath;
2627
import de.fraunhofer.iem.secucheck.analysis.Analysis;
@@ -36,7 +37,9 @@
3637
import de.fraunhofer.iem.secucheck.analysis.result.TaintFlowQueryResult;
3738
import soot.Body;
3839
import soot.SootMethod;
40+
import soot.jimple.IdentityStmt;
3941
import soot.jimple.JimpleBody;
42+
import soot.jimple.ParameterRef;
4043
import soot.jimple.internal.JNopStmt;
4144
import wpds.impl.Weight;
4245
import wpds.impl.Weight.NoWeight;
@@ -211,11 +214,24 @@ private SameTypedPair<LocationDetails> getLocationDetailsPair(TaintFlowQueryImpl
211214
startDetails.setSourceClassName(start.cfgEdge().getMethod().getDeclaringClass().getName());
212215
startDetails.setMethodSignature(start.cfgEdge().getMethod().getSubSignature());
213216

214-
// TODO: Confirm that the destination is always Y.
215-
startDetails.setUsageStartLineNumber(start.cfgEdge().getY().getStartLineNumber());
216-
startDetails.setUsageEndLineNumber(start.cfgEdge().getY().getEndLineNumber());
217-
startDetails.setUsageStartColumnNumber(start.cfgEdge().getY().getStartColumnNumber());
218-
startDetails.setUsageEndColumnNumber(start.cfgEdge().getY().getEndColumnNumber());
217+
// When parameter is tainted.
218+
// Left and Right Op() methods don't work for IdentityStmt inside JimpleStatement.
219+
if (start.cfgEdge().getY().isIdentityStmt() && start.cfgEdge().getY() instanceof JimpleStatement) {
220+
JimpleStatement jimpleStament = (JimpleStatement) start.cfgEdge().getY();
221+
IdentityStmt identityStmt = (IdentityStmt)jimpleStament.getDelegate();
222+
if (identityStmt.getRightOp() instanceof ParameterRef) {
223+
SootMethod sootMethod = Utility.getSootMethod(start.cfgEdge().getY().getMethod());
224+
startDetails.setUsageStartLineNumber(sootMethod.getJavaSourceStartLineNumber());
225+
startDetails.setUsageEndLineNumber(-1);
226+
startDetails.setUsageStartColumnNumber(sootMethod.getJavaSourceStartColumnNumber());
227+
startDetails.setUsageEndColumnNumber(-1);
228+
}
229+
} else {
230+
startDetails.setUsageStartLineNumber(start.cfgEdge().getY().getStartLineNumber());
231+
startDetails.setUsageEndLineNumber(start.cfgEdge().getY().getEndLineNumber());
232+
startDetails.setUsageStartColumnNumber(start.cfgEdge().getY().getStartColumnNumber());
233+
startDetails.setUsageEndColumnNumber(start.cfgEdge().getY().getEndColumnNumber());
234+
}
219235

220236
startDetails.setUsageMethodSignature(start.cfgEdge().getY().getMethod().getSubSignature());
221237
startDetails.setUsageClassName(start.cfgEdge().getY().getMethod().getDeclaringClass().getName());
@@ -224,8 +240,7 @@ private SameTypedPair<LocationDetails> getLocationDetailsPair(TaintFlowQueryImpl
224240
LocationDetails endDetails = new LocationDetails();
225241
endDetails.setSourceClassName(end.cfgEdge().getMethod().getDeclaringClass().getName());
226242
endDetails.setMethodSignature(end.cfgEdge().getMethod().getSubSignature());
227-
228-
// TODO: Confirm that the destination is always Y.
243+
229244
endDetails.setUsageStartLineNumber(end.cfgEdge().getY().getStartLineNumber());
230245
endDetails.setUsageEndLineNumber(end.cfgEdge().getY().getEndLineNumber());
231246
endDetails.setUsageStartColumnNumber(end.cfgEdge().getY().getStartColumnNumber());

‎de.fraunhofer.iem.secucheck.analysis/src/main/java/de/fraunhofer/iem/secucheck/analysis/internal/SingleFlowAnalysisScope.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ private Collection<Val> generateSourceVariables(TaintFlowQuery partialFlow,
8888
if (ToStringEquals(statement.getMethod(), sourceSootSignature) &&
8989
statement.isIdentityStmt()) {
9090

91-
// Left and Right Op() methods don't work for JimpleIdentityStmt.
91+
// Left and Right Op() methods don't work for IdentityStmt inside JimpleStatement.
9292
if (statement instanceof JimpleStatement) {
9393

9494
JimpleStatement jimpleStament = (JimpleStatement) statement;

‎de.fraunhofer.iem.secucheck.analysis/src/main/java/de/fraunhofer/iem/secucheck/analysis/internal/Utility.java‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44
import java.util.ArrayList;
55
import java.util.List;
66

7+
import boomerang.scene.WrappedClass;
78
import de.fraunhofer.iem.secucheck.analysis.query.CompositeTaintFlowQuery;
89
import de.fraunhofer.iem.secucheck.analysis.query.Method;
9-
import de.fraunhofer.iem.secucheck.analysis.query.MethodImpl;
1010
import de.fraunhofer.iem.secucheck.analysis.query.TaintFlowQuery;
1111
import soot.Scene;
1212
import soot.SootClass;
@@ -15,16 +15,16 @@
1515

1616
class Utility {
1717

18-
static List<Method> getMethods(CompositeTaintFlowQuery flowQuery) {
19-
List<Method> methods = new ArrayList<Method>();
18+
static List<de.fraunhofer.iem.secucheck.analysis.query.Method> getMethods(CompositeTaintFlowQuery flowQuery) {
19+
List<de.fraunhofer.iem.secucheck.analysis.query.Method> methods = new ArrayList<>();
2020
for (TaintFlowQuery singleFlow: flowQuery.getTaintFlowQueries()) {
2121
methods.addAll(getMethods(singleFlow));
2222
}
2323
return methods;
2424
}
2525

26-
static List<Method> getMethods(TaintFlowQuery flowQuery) {
27-
List<Method> methods = new ArrayList<Method>();
26+
static List<de.fraunhofer.iem.secucheck.analysis.query.Method> getMethods(TaintFlowQuery flowQuery) {
27+
List<de.fraunhofer.iem.secucheck.analysis.query.Method> methods = new ArrayList<>();
2828
flowQuery.getFrom().forEach(y -> methods.add((Method)y));
2929
flowQuery.getTo().forEach(y -> methods.add((Method)y));
3030

@@ -37,7 +37,13 @@ static List<Method> getMethods(TaintFlowQuery flowQuery) {
3737
return methods;
3838
}
3939

40-
static SootMethod getSootMethod(Method method) {
40+
static SootMethod getSootMethod(boomerang.scene.Method method) {
41+
WrappedClass wrappedClass = method.getDeclaringClass();
42+
SootClass clazz = (SootClass) wrappedClass.getDelegate();
43+
return clazz.getMethod(method.getSubSignature());
44+
}
45+
46+
static SootMethod getSootMethod(de.fraunhofer.iem.secucheck.analysis.query.Method method) {
4147
String[] signatures = method.getSignature().split(":");
4248
SootClass sootClass = Scene.v().forceResolve(signatures[0], SootClass.BODIES);
4349
if (sootClass != null && signatures.length >= 2) {
@@ -48,7 +54,7 @@ static SootMethod getSootMethod(Method method) {
4854

4955
static SootMethod findSourceMethodDefinition(TaintFlowQuery partialFlow,
5056
SootMethod method, Stmt actualStatement) {
51-
for (Method sourceMethod : partialFlow.getFrom()) {
57+
for (de.fraunhofer.iem.secucheck.analysis.query.Method sourceMethod : partialFlow.getFrom()) {
5258
String sourceSootSignature = "<" + sourceMethod.getSignature() + ">";
5359
if (method.getSignature().equals(sourceSootSignature)) {
5460
return method;
@@ -62,7 +68,7 @@ static SootMethod findSourceMethodDefinition(TaintFlowQuery partialFlow,
6268

6369
static SootMethod findSinkMethodDefinition(TaintFlowQuery partialFlow,
6470
SootMethod method, Stmt actualStatement) {
65-
for (Method sinkMethod : partialFlow.getTo()) {
71+
for (de.fraunhofer.iem.secucheck.analysis.query.Method sinkMethod : partialFlow.getTo()) {
6672
String sinkSootSignature = "<" + sinkMethod.getSignature() + ">";
6773
if (actualStatement.containsInvokeExpr() &&
6874
actualStatement.toString().contains(sinkSootSignature)) {

0 commit comments

Comments
 (0)