Undefined source in leak result

[cyxin577]

Dear,
I re-define the SourcesAndSinks.txt for my project, and the taint result presents such a flow. But it confuses me that I do not define this source method findViewById() in the .txt file. Could you please tell me where goes wrong?

[main] INFO soot.jimple.infoflow.android.SetupApplication$InPlaceInfoflow - The sink interfaceinvoke $r3.<android.content.SharedPreferences$Editor: android.content.SharedPreferences$Editor putString(java.lang.String,java.lang.String)>($r2, $r1) in method <io.branch.referral.PrefHelper: void setString(java.lang.String,java.lang.String)> was called with values from the following sources: [main] INFO soot.jimple.infoflow.android.SetupApplication$InPlaceInfoflow - - $r2 = virtualinvoke r0.<com.league.theleague.activities.onboarding.SignInWithEmailActivity: android.view.View findViewById(int)>(2131231480) in method <com.league.theleague.activities.onboarding.SignInWithEmailActivity: void onCreate(android.os.Bundle)>

(and I find the id 2131231480 exactly refers to the textview_signin_password, is that a coincidence?)

Best,
Chen

[StevenArzt]

The findViewById method is handled separately, because the parameter defines the concrete text field in the UI. FlowDroid distinguishes between normal text fields and password fields by mapping this ID against the layout defintion files in the APK. By default, it considers the call to findViewById as a source if it references a password field.

[cyxin577]

Hi,

Thanks a lot for your quick reply!

Chen