Skip to content

Commit e33fc3f

Browse files
ranjithkrisranjithkris
committed
Added the feature
1. Adds the information of the TaintFlowPath to the result 2. Adds the information of number of source found (seed count)
1 parent 42d0f29 commit e33fc3f

File tree

9 files changed

+365
-44
lines changed

9 files changed

+365
-44
lines changed

‎de.fraunhofer.iem.secucheck.analysis.datastructures/src/main/java/de/fraunhofer/iem/secucheck/analysis/datastructures/TaintFlowPath.java

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
package de.fraunhofer.iem.secucheck.analysis.datastructures;
2+
3+
import java.util.List;
4+
5+
/**
6+
* TaintFlowPath
7+
*
8+
* @author Ranjith Krishnamurthy
9+
*/
10+
public interface TaintFlowPath {
11+
/**
12+
* Nodes value
13+
*
14+
* @return Nodes value
15+
*/
16+
public Object getNodeValue();
17+
18+
/**
19+
* List of children node
20+
*
21+
* @return Children node
22+
*/
23+
public List<TaintFlowPath> getChildrenNodes();
24+
25+
/**
26+
* Parent node
27+
*
28+
* @return Parent node
29+
*/
30+
public TaintFlowPath getParentNode();
31+
32+
/**
33+
* Is Root node otherwise false
34+
*
35+
* @return Root node or not
36+
*/
37+
public boolean isRootNode();
38+
39+
/**
40+
* Is sink node otherwise false
41+
*
42+
* @return Sink node or not
43+
*/
44+
public boolean isNodeSink();
45+
46+
/**
47+
* Is leaf node otherwise false
48+
*
49+
* @return Leaf node or not
50+
*/
51+
public boolean isLeafNode();
52+
}

‎de.fraunhofer.iem.secucheck.analysis.implementation/src/main/java/de/fraunhofer/iem/secucheck/analysis/implementation/SingleFlowTaintAnalysis/BoomerangSolver/BoomerangSingleFlowAnalysis.java

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import de.fraunhofer.iem.secucheck.analysis.query.TaintFlow;
1515
import de.fraunhofer.iem.secucheck.analysis.query.TaintFlowImpl;
1616
import de.fraunhofer.iem.secucheck.analysis.result.LocationDetails;
17+
import de.fraunhofer.iem.secucheck.analysis.result.SingleTaintFlowAnalysisResult;
1718
import de.fraunhofer.iem.secucheck.analysis.result.TaintFlowResult;
1819
import soot.PackManager;
1920
import soot.SceneTransformer;
@@ -55,7 +56,6 @@ public BoomerangSingleFlowAnalysis(TaintFlowImpl singleFlow, SecucheckAnalysisCo
5556
*/
5657
@Override
5758
public TaintFlowResult run() throws Exception {
58-
5959
String classPath = Utility.getCombinedSootClassPath(this.configuration.getOs(),
6060
this.configuration.getApplicationClassPath(), this.configuration.getSootClassPathJars());
6161

@@ -99,10 +99,10 @@ private void executeAnalysis() {
9999
* @param singleFlow Current single TaintFlow specification
100100
* @return List of Tainflow locations details for the current single TaintFlow specification
101101
*/
102-
public List<DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>>
102+
public List<DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>>
103103
analyzePlainFlow(TaintFlowImpl singleFlow) {
104104

105-
List<DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>>
105+
List<DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>>
106106
reachMap = new ArrayList<>();
107107

108108
// First get the seeds --- source ForwardQuery
@@ -111,6 +111,8 @@ private void executeAnalysis() {
111111

112112
Set<ForwardQuery> source = computeSeeds(analysisScope);
113113

114+
result.setSeedCount(source.size());
115+
114116
if (source.size() != 0) { // If seeds found then run the SecucheckBoomerangDemandDrivenAnalysis
115117
reachMap.addAll(new SecucheckBoomerangDemandDrivenAnalysis(this.configuration).run(source, singleFlow));
116118
}

‎de.fraunhofer.iem.secucheck.analysis.implementation/src/main/java/de/fraunhofer/iem/secucheck/analysis/implementation/SingleFlowTaintAnalysis/BoomerangSolver/guided/BoomerangGPHandler.java

Lines changed: 45 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,13 @@
99
import boomerang.scene.Statement;
1010
import boomerang.scene.Val;
1111
import de.fraunhofer.iem.secucheck.analysis.configuration.SecucheckAnalysisConfiguration;
12+
import de.fraunhofer.iem.secucheck.analysis.datastructures.DifferentTypedPair;
1213
import de.fraunhofer.iem.secucheck.analysis.implementation.SingleFlowTaintAnalysis.BoomerangSolver.Utility;
14+
import de.fraunhofer.iem.secucheck.analysis.implementation.SingleFlowTaintAnalysis.datastructure.BoomerangTaintFlowPath;
15+
import de.fraunhofer.iem.secucheck.analysis.implementation.SingleFlowTaintAnalysis.TaintFlowPathUtility;
1316
import de.fraunhofer.iem.secucheck.analysis.query.*;
14-
import soot.jimple.internal.JDynamicInvokeExpr;
1517

16-
import java.util.ArrayList;
17-
import java.util.Collection;
18-
import java.util.Collections;
19-
import java.util.List;
18+
import java.util.*;
2019

2120
/**
2221
* This is the Secucheck DemandDriven Manager for Boomerang
@@ -28,7 +27,7 @@ public class BoomerangGPHandler implements IDemandDrivenGuidedManager {
2827
* List of found sinks. Whenever SecucheckDemandDrivenManager finds a sink with a taintflow then it creates a
2928
* BackwardQuery and adds it to this list.
3029
*/
31-
private final ArrayList<BackwardQuery> foundSinks = new ArrayList<>();
30+
private final ArrayList<DifferentTypedPair<BackwardQuery, BoomerangTaintFlowPath>> foundSinks = new ArrayList<>();
3231

3332
/**
3433
* Current single TaintFlow specification, that the current analysis running for.
@@ -40,23 +39,27 @@ public class BoomerangGPHandler implements IDemandDrivenGuidedManager {
4039
*/
4140
private final SecucheckAnalysisConfiguration secucheckAnalysisConfiguration;
4241

42+
private final BoomerangTaintFlowPath tempPath;
43+
4344
/**
4445
* Constructor
4546
*
4647
* @param singleFlow Single TaintFlow specification
4748
* @param secucheckAnalysisConfiguration SecuchcekAnalysisConfiguration given by the client
4849
*/
49-
public BoomerangGPHandler(TaintFlowImpl singleFlow, SecucheckAnalysisConfiguration secucheckAnalysisConfiguration) {
50+
public BoomerangGPHandler(TaintFlowImpl singleFlow, SecucheckAnalysisConfiguration secucheckAnalysisConfiguration, BoomerangTaintFlowPath initialPath) {
5051
this.singleFlow = singleFlow;
5152
this.secucheckAnalysisConfiguration = secucheckAnalysisConfiguration;
53+
this.tempPath = initialPath;
54+
5255
}
5356

5457
/**
5558
* Getter for the list of found sinks
5659
*
5760
* @return List of found sinks
5861
*/
59-
public ArrayList<BackwardQuery> getFoundSinks() {
62+
public ArrayList<DifferentTypedPair<BackwardQuery, BoomerangTaintFlowPath>> getFoundSinks() {
6063
return foundSinks;
6164
}
6265

@@ -68,9 +71,7 @@ public ArrayList<BackwardQuery> getFoundSinks() {
6871
* @param dataFlowVal Fact: dataFlowVal
6972
* @return True is there is a sink method call and TaintFlow exist.
7073
*/
71-
private boolean isSink(Statement statement, ControlFlowGraph.Edge dataFlowEdge, Val dataFlowVal) {
72-
boolean isSinkFound = false;
73-
74+
private BackwardQuery isSink(Statement statement, ControlFlowGraph.Edge dataFlowEdge, Val dataFlowVal) {
7475
for (Method sinkMethod : singleFlow.getTo()) {
7576
String sinkSootSignature = Utility.wrapInAngularBrackets(sinkMethod.getSignature());
7677

@@ -86,8 +87,7 @@ private boolean isSink(Statement statement, ControlFlowGraph.Edge dataFlowEdge,
8687
int parameterIndex = input.getParamID();
8788
if (statement.getInvokeExpr().getArgs().size() >= parameterIndex) {
8889
if (statement.getInvokeExpr().getArg(parameterIndex).toString().equals(dataFlowVal.toString())) {
89-
foundSinks.add(BackwardQuery.make(dataFlowEdge, statement.getInvokeExpr().getArg(parameterIndex)));
90-
isSinkFound = true;
90+
return BackwardQuery.make(dataFlowEdge, statement.getInvokeExpr().getArg(parameterIndex));
9191
}
9292
}
9393
}
@@ -97,15 +97,14 @@ private boolean isSink(Statement statement, ControlFlowGraph.Edge dataFlowEdge,
9797
if (sinkMethod.isInputThis() &&
9898
statement.getInvokeExpr().isInstanceInvokeExpr()) {
9999
if (statement.getInvokeExpr().getBase().toString().equals(dataFlowVal.toString())) {
100-
foundSinks.add(BackwardQuery.make(dataFlowEdge, statement.getInvokeExpr().getBase()));
101-
isSinkFound = true;
100+
return BackwardQuery.make(dataFlowEdge, statement.getInvokeExpr().getBase());
102101
}
103102
}
104103
}
105104

106105
}
107106

108-
return isSinkFound;
107+
return null;
109108
}
110109

111110
/**
@@ -244,17 +243,44 @@ public Collection<Query> onForwardFlow(ForwardQuery query, ControlFlowGraph.Edge
244243
Statement stmt = dataFlowEdge.getStart();
245244
ArrayList<Query> out = new ArrayList<Query>();
246245

246+
//TODO: check isPostProcessing enabled
247+
BoomerangTaintFlowPath parentNode = (BoomerangTaintFlowPath) TaintFlowPathUtility.findNodeUsingDFS(tempPath, query);
248+
247249
if (stmt.containsInvokeExpr()) {
248-
if (isSink(stmt, dataFlowEdge, dataFlowVal)) {
250+
BackwardQuery sinkQuery = isSink(stmt, dataFlowEdge, dataFlowVal);
251+
if (sinkQuery != null) {
252+
//TODO: check isPostProcessing enabled
253+
BoomerangTaintFlowPath finalSinkNode = new BoomerangTaintFlowPath(
254+
sinkQuery, parentNode, false, true);
255+
parentNode.addNewChild(finalSinkNode);
256+
BoomerangTaintFlowPath singleTaintFlowPath = TaintFlowPathUtility.createSinglePathFromRootNode(finalSinkNode);
257+
DifferentTypedPair<BackwardQuery, BoomerangTaintFlowPath> res = new DifferentTypedPair<>(sinkQuery, singleTaintFlowPath);
258+
foundSinks.add(res);
249259
return Collections.emptyList();
250260
}
251261

252-
out.addAll(isPropogator(singleFlow.getThrough(), stmt, dataFlowEdge, dataFlowVal));
262+
Collection<Query> prop = isPropogator(singleFlow.getThrough(), stmt, dataFlowEdge, dataFlowVal);
263+
264+
for (Query propQuery : prop) {
265+
//TODO: check isPostProcessing enabled
266+
BoomerangTaintFlowPath finalSinkNode = new BoomerangTaintFlowPath(
267+
propQuery, parentNode, false, false);
268+
parentNode.addNewChild(finalSinkNode);
269+
out.add(propQuery);
270+
}
253271

254272
if (out.size() > 0)
255273
return out;
256274

257-
out.addAll(isPropogator(secucheckAnalysisConfiguration.getAnalysisGeneralPropagators(), stmt, dataFlowEdge, dataFlowVal));
275+
Collection<Query> generalProp = isPropogator(secucheckAnalysisConfiguration.getAnalysisGeneralPropagators(), stmt, dataFlowEdge, dataFlowVal);
276+
277+
for (Query generalPropQuery : generalProp) {
278+
//TODO: check isPostProcessing enabled
279+
BoomerangTaintFlowPath finalSinkNode = new BoomerangTaintFlowPath(
280+
generalPropQuery, parentNode, false, false);
281+
parentNode.addNewChild(finalSinkNode);
282+
out.add(generalPropQuery);
283+
}
258284
}
259285

260286
return out;

‎de.fraunhofer.iem.secucheck.analysis.implementation/src/main/java/de/fraunhofer/iem/secucheck/analysis/implementation/SingleFlowTaintAnalysis/BoomerangSolver/guided/SecucheckBoomerangDemandDrivenAnalysis.java

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package de.fraunhofer.iem.secucheck.analysis.implementation.SingleFlowTaintAnalysis.BoomerangSolver.guided;
22

3+
import boomerang.BackwardQuery;
34
import boomerang.ForwardQuery;
45
import boomerang.Query;
56
import boomerang.QueryGraph;
@@ -9,9 +10,12 @@
910
import de.fraunhofer.iem.secucheck.analysis.datastructures.SameTypedPair;
1011
import de.fraunhofer.iem.secucheck.analysis.implementation.SingleFlowTaintAnalysis.BoomerangSolver.Utility;
1112
import de.fraunhofer.iem.secucheck.analysis.datastructures.DifferentTypedPair;
13+
import de.fraunhofer.iem.secucheck.analysis.implementation.SingleFlowTaintAnalysis.datastructure.BoomerangTaintFlowPath;
14+
import de.fraunhofer.iem.secucheck.analysis.implementation.SingleFlowTaintAnalysis.TaintFlowPathUtility;
1215
import de.fraunhofer.iem.secucheck.analysis.query.TaintFlowImpl;
1316
import de.fraunhofer.iem.secucheck.analysis.result.LocationDetails;
1417
import de.fraunhofer.iem.secucheck.analysis.result.LocationType;
18+
import de.fraunhofer.iem.secucheck.analysis.result.SingleTaintFlowAnalysisResult;
1519
import soot.SootMethod;
1620
import soot.jimple.IdentityStmt;
1721
import soot.jimple.ParameterRef;
@@ -39,12 +43,14 @@ public SecucheckBoomerangDemandDrivenAnalysis(SecucheckAnalysisConfiguration sec
3943
* @param singleFlow Current single TaintFlow specification---looking for this TaintFlow
4044
* @return Returns the result for the single given TaintFlow-specification ( There may be more than one TaintFlow in the result)
4145
*/
42-
public List<DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>> run(Set<ForwardQuery> sources, TaintFlowImpl singleFlow) {
46+
public List<DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>> run(Set<ForwardQuery> sources, TaintFlowImpl singleFlow) {
4347

44-
List<DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>> reachMap = new ArrayList<>();
48+
List<DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>> reachMap = new ArrayList<>();
4549

4650
for (ForwardQuery source : sources) {
47-
BoomerangGPHandler boomerangGPHandler = new BoomerangGPHandler(singleFlow, this.secucheckAnalysisConfiguration);
51+
BoomerangTaintFlowPath boomerangTaintFlowPath = new BoomerangTaintFlowPath(
52+
source, null, true, false);
53+
BoomerangGPHandler boomerangGPHandler = new BoomerangGPHandler(singleFlow, this.secucheckAnalysisConfiguration, boomerangTaintFlowPath);
4854
SecucheckDefaultBoomerangOptions secucheckDefaultBoomerangOptions = new SecucheckDefaultBoomerangOptions(singleFlow);
4955
CustomDataFlowScope customDataFlowScope = new CustomDataFlowScope(singleFlow, this.secucheckAnalysisConfiguration);
5056

@@ -55,8 +61,14 @@ public List<DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>> r
5561

5662
QueryGraph<Weight.NoWeight> queryGraph = demandDrivenGuidedAnalysis.run(source);
5763

58-
for (Query sink : boomerangGPHandler.getFoundSinks()) {
59-
reachMap.add(new DifferentTypedPair<>(singleFlow, getLocationDetailsPair(source, sink)));
64+
for (DifferentTypedPair<BackwardQuery, BoomerangTaintFlowPath> sinkNode : boomerangGPHandler.getFoundSinks()) {
65+
BackwardQuery sink = sinkNode.getFirst();
66+
TaintFlowPathUtility.print(sinkNode.getSecond());
67+
SingleTaintFlowAnalysisResult res = new SingleTaintFlowAnalysisResult(
68+
new DifferentTypedPair<>(singleFlow, getLocationDetailsPair(source, sink)),
69+
sinkNode.getSecond()
70+
);
71+
reachMap.add(new DifferentTypedPair<>(singleFlow, res));
6072
}
6173
}
6274

‎de.fraunhofer.iem.secucheck.analysis.implementation/src/main/java/de/fraunhofer/iem/secucheck/analysis/implementation/SingleFlowTaintAnalysis/FlowDroidSolver/FlowDroidSingleFlowAnalysis.java

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import de.fraunhofer.iem.secucheck.analysis.query.*;
99
import de.fraunhofer.iem.secucheck.analysis.result.LocationDetails;
1010
import de.fraunhofer.iem.secucheck.analysis.result.LocationType;
11+
import de.fraunhofer.iem.secucheck.analysis.result.SingleTaintFlowAnalysisResult;
1112
import de.fraunhofer.iem.secucheck.analysis.result.TaintFlowResult;
1213
import soot.*;
1314
import soot.jimple.JimpleBody;
@@ -127,11 +128,11 @@ public TaintFlowResult run() throws Exception {
127128
* @param configuration SecuCheck configuration
128129
* @return Result
129130
*/
130-
public List<DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>>
131+
public List<DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>>
131132
analyzePlainFlow(TaintFlowImpl singleFlow, Infoflow infoFlow,
132133
DefaultEntryPointCreator entryPointCreator, SecucheckAnalysisConfiguration configuration) {
133134

134-
List<DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>>
135+
List<DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>>
135136
reachMap = new ArrayList<>();
136137

137138
List<String> sources = getCanonicalMethodSignatures(singleFlow.getFrom());
@@ -153,7 +154,11 @@ public TaintFlowResult run() throws Exception {
153154
if (map.size() > 0) {
154155
for (DataFlowResult dataFlowResult : map.getResultSet()) {
155156
SameTypedPair<LocationDetails> locationPair = getLocationDetailsPair(singleFlow, dataFlowResult);
156-
reachMap.add(new DifferentTypedPair<>(singleFlow, locationPair));
157+
SingleTaintFlowAnalysisResult res = new SingleTaintFlowAnalysisResult(
158+
new DifferentTypedPair<>(singleFlow, locationPair),
159+
null
160+
);
161+
reachMap.add(new DifferentTypedPair<>(singleFlow, res));
157162
}
158163
}
159164
}
@@ -172,7 +177,7 @@ public TaintFlowResult run() throws Exception {
172177
* @param configuration SecuCheck configuration
173178
* @return Result
174179
*/
175-
public List<DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>>
180+
public List<DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>>
176181
analyzePropogatorFlow(TaintFlowImpl singleFlow, Infoflow infoFlow,
177182
DefaultEntryPointCreator entryPointCreator, SecucheckAnalysisConfiguration configuration) {
178183

@@ -194,25 +199,27 @@ public TaintFlowResult run() throws Exception {
194199

195200
newQuery2.getTo().addAll(singleFlow.getTo());
196201

197-
List<DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>>
202+
List<DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>>
198203
originalReachMap = new ArrayList<>(),
199204
reachMap1 = analyzePlainFlow(newQuery1, infoFlow, entryPointCreator, configuration),
200205
reachMap2 = analyzePlainFlow(newQuery2, infoFlow, entryPointCreator, configuration);
201206

202207
if (reachMap1.size() != 0 && reachMap2.size() != 0) {
203-
for (DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>
208+
for (DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>
204209
sourcePair : reachMap1) {
205210

206-
for (DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>
211+
for (DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>
207212
sinkPair : reachMap2) {
208213

209-
if (isSourceAndSinkMatching(sourcePair.getSecond(), sinkPair.getSecond())) {
214+
if (isSourceAndSinkMatching(sourcePair.getSecond().getLocationDetails().getSecond(),
215+
sinkPair.getSecond().getLocationDetails().getSecond())) {
210216
SameTypedPair<LocationDetails> stichedPair =
211-
stitchSourceAndSink(sourcePair.getSecond(), sinkPair.getSecond());
217+
stitchSourceAndSink(sourcePair.getSecond().getLocationDetails().getSecond(),
218+
sinkPair.getSecond().getLocationDetails().getSecond());
212219

213220
originalReachMap.add(new
214-
DifferentTypedPair<TaintFlowImpl, SameTypedPair<LocationDetails>>
215-
(singleFlow, stichedPair));
221+
DifferentTypedPair<TaintFlowImpl, SingleTaintFlowAnalysisResult>
222+
(singleFlow, new SingleTaintFlowAnalysisResult(new DifferentTypedPair<>(singleFlow, stichedPair), null)));
216223
}
217224
}
218225

0 commit comments

Comments
 (0)