Skip to content

Commit 22a45d7

Browse files
MarcMilMarcMil
committed
Support for StringConcatFactory
1 parent 535a3c7 commit 22a45d7

File tree

7 files changed

+100
-32
lines changed

7 files changed

+100
-32
lines changed

‎soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/data/sourceSink/AbstractFlowSinkSource.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ public AbstractFlowSinkSource(SourceSinkType type, int parameterIdx, String base
5757
* i.e., if all elements referenced by the given source or sink are also
5858
* referenced by this one
5959
*
60-
* @param src The source or sink with which to compare the current one
60+
* @param other The source or sink with which to compare the current one
6161
* @return True if the current source or sink is coarser than the given one,
6262
* otherwise false
6363
*/
@@ -221,7 +221,7 @@ public Map<String, String> xmlAttributes() {
221221
Map<String, String> res = new HashMap<String, String>();
222222
if (isParameter()) {
223223
res.put(XMLConstants.ATTRIBUTE_FLOWTYPE, XMLConstants.VALUE_PARAMETER);
224-
res.put(XMLConstants.ATTRIBUTE_PARAMTER_INDEX, getParameterIndex() + "");
224+
res.put(XMLConstants.ATTRIBUTE_PARAMETER_INDEX, getParameterIndex() + "");
225225
} else if (isField())
226226
res.put(XMLConstants.ATTRIBUTE_FLOWTYPE, XMLConstants.VALUE_FIELD);
227227
else if (isReturn())

‎soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/data/sourceSink/FlowSource.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
*/
1414
public class FlowSource extends AbstractFlowSinkSource implements Cloneable {
1515

16+
public static final int ANY_PARAMETER = -2;
17+
1618
public FlowSource(SourceSinkType type, String baseType) {
1719
super(type, -1, baseType, null, null, false);
1820
}

‎soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/taintWrappers/SummaryTaintWrapper.java‎

Lines changed: 61 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,34 @@
77
import java.util.List;
88
import java.util.Set;
99
import java.util.concurrent.atomic.AtomicInteger;
10-
import java.util.function.Function;
1110
import java.util.regex.Matcher;
1211
import java.util.regex.Pattern;
1312

1413
import heros.solver.Pair;
1514
import heros.solver.PathEdge;
16-
import soot.*;
17-
import soot.jimple.*;
15+
import soot.ArrayType;
16+
import soot.FastHierarchy;
17+
import soot.Hierarchy;
18+
import soot.Local;
19+
import soot.Modifier;
20+
import soot.PrimType;
21+
import soot.RefType;
22+
import soot.Scene;
23+
import soot.SootClass;
24+
import soot.SootField;
25+
import soot.SootFieldRef;
26+
import soot.SootMethod;
27+
import soot.Type;
28+
import soot.Unit;
29+
import soot.Value;
30+
import soot.VoidType;
31+
import soot.jimple.DefinitionStmt;
32+
import soot.jimple.DynamicInvokeExpr;
33+
import soot.jimple.InstanceInvokeExpr;
34+
import soot.jimple.InvokeExpr;
35+
import soot.jimple.ReturnStmt;
36+
import soot.jimple.StaticInvokeExpr;
37+
import soot.jimple.Stmt;
1838
import soot.jimple.infoflow.InfoflowConfiguration;
1939
import soot.jimple.infoflow.InfoflowManager;
2040
import soot.jimple.infoflow.data.Abstraction;
@@ -24,6 +44,7 @@
2444
import soot.jimple.infoflow.handlers.PreAnalysisHandler;
2545
import soot.jimple.infoflow.methodSummary.data.provider.IMethodSummaryProvider;
2646
import soot.jimple.infoflow.methodSummary.data.sourceSink.AbstractFlowSinkSource;
47+
import soot.jimple.infoflow.methodSummary.data.sourceSink.FlowSource;
2748
import soot.jimple.infoflow.methodSummary.data.summary.ClassMethodSummaries;
2849
import soot.jimple.infoflow.methodSummary.data.summary.ClassSummaries;
2950
import soot.jimple.infoflow.methodSummary.data.summary.GapDefinition;
@@ -507,8 +528,18 @@ public Set<Abstraction> getTaintsForMethod(Stmt stmt, Abstraction d1, Abstractio
507528
ByReferenceBoolean classSupported = new ByReferenceBoolean(false);
508529

509530
// Compute the wrapper taints for the current method
510-
final SootMethod callee = stmt.getInvokeExpr().getMethod();
511-
Set<AccessPath> res = computeTaintsForMethod(stmt, d1, taintedAbs, callee, killIncomingTaint, classSupported);
531+
final InvokeExpr inv = stmt.getInvokeExpr();
532+
final SootMethod callee = inv.getMethod();
533+
Set<AccessPath> res;
534+
if (inv instanceof DynamicInvokeExpr) {
535+
final DynamicInvokeExpr dyn = (DynamicInvokeExpr) inv;
536+
SootMethod m = dyn.getBootstrapMethodRef().tryResolve();
537+
if (m == null)
538+
return null;
539+
540+
res = computeTaintsForMethod(stmt, d1, taintedAbs, m, killIncomingTaint, classSupported);
541+
} else
542+
res = computeTaintsForMethod(stmt, d1, taintedAbs, callee, killIncomingTaint, classSupported);
512543

513544
// Create abstractions from the access paths
514545
if (res != null && !res.isEmpty()) {
@@ -522,7 +553,7 @@ public Set<Abstraction> getTaintsForMethod(Stmt stmt, Abstraction d1, Abstractio
522553
if (!killIncomingTaint.value && (resAbs == null || resAbs.isEmpty())) {
523554
// Is this method explicitly excluded?
524555
if (!this.flows.isMethodExcluded(callee.getDeclaringClass().getName(), callee.getSubSignature())) {
525-
// wrapperMisses.incrementAndGet();
556+
// wrapperMisses.incrementAndGet();
526557

527558
if (classSupported.value)
528559
return Collections.singleton(taintedAbs);
@@ -584,7 +615,7 @@ protected void reportMissingMethod(SootMethod method) {
584615
*/
585616
private Set<AccessPath> computeTaintsForMethod(Stmt stmt, Abstraction d1, Abstraction taintedAbs,
586617
final SootMethod method, ByReferenceBoolean killIncomingTaint, ByReferenceBoolean classSupported) {
587-
// wrapperHits.incrementAndGet();
618+
// wrapperHits.incrementAndGet();
588619

589620
// Get the cached data flows
590621
ClassSummaries flowsInCallees = getFlowSummariesForMethod(stmt, method, taintedAbs, classSupported);
@@ -965,23 +996,28 @@ protected ClassSummaries getFlowSummariesForMethod(Stmt stmt, final SootMethod m
965996
*/
966997
protected SootClass getSummaryDeclaringClass(Stmt stmt, AccessPath taintedAP) {
967998
Type declaredType = null;
968-
if (stmt != null && stmt.getInvokeExpr() instanceof InstanceInvokeExpr) {
969-
// If the base object of the call is tainted, we may have a more precise type in
970-
// the access path
971-
InstanceInvokeExpr iinv = (InstanceInvokeExpr) stmt.getInvokeExpr();
972-
if (taintedAP != null && iinv.getBase() == taintedAP.getPlainValue()) {
973-
declaredType = taintedAP.getBaseType();
974-
}
999+
if (stmt != null) {
1000+
if (stmt.getInvokeExpr() instanceof InstanceInvokeExpr) {
1001+
// If the base object of the call is tainted, we may have a more precise type in
1002+
// the access path
1003+
InstanceInvokeExpr iinv = (InstanceInvokeExpr) stmt.getInvokeExpr();
1004+
if (taintedAP != null && iinv.getBase() == taintedAP.getPlainValue()) {
1005+
declaredType = taintedAP.getBaseType();
1006+
}
1007+
1008+
// We may have a call such as
1009+
// x = editable.toString();
1010+
// In that case, the callee is Object.toString(), since in the stub Android
1011+
// JAR, the class android.text.Editable does not override toString(). On a
1012+
// real device, it does. Consequently, we have a summary in the "Editable"
1013+
// class. To handle such weird cases, we walk the class hierarchy based on
1014+
// the declared type of the base object.
1015+
Type baseType = iinv.getBase().getType();
1016+
declaredType = manager.getTypeUtils().getMorePreciseType(declaredType, baseType);
1017+
} else if (stmt.getInvokeExpr() instanceof DynamicInvokeExpr) {
1018+
return ((DynamicInvokeExpr) stmt.getInvokeExpr()).getBootstrapMethodRef().getDeclaringClass();
9751019

976-
// We may have a call such as
977-
// x = editable.toString();
978-
// In that case, the callee is Object.toString(), since in the stub Android
979-
// JAR, the class android.text.Editable does not override toString(). On a
980-
// real device, it does. Consequently, we have a summary in the "Editable"
981-
// class. To handle such weird cases, we walk the class hierarchy based on
982-
// the declared type of the base object.
983-
Type baseType = iinv.getBase().getType();
984-
declaredType = manager.getTypeUtils().getMorePreciseType(declaredType, baseType);
1020+
}
9851021
}
9861022
return declaredType instanceof RefType ? ((RefType) declaredType).getSootClass() : null;
9871023
}
@@ -1102,6 +1138,8 @@ private boolean flowMatchesTaint(final AbstractFlowSinkSource flowSource, final
11021138
if (compareFields(taint, flowSource))
11031139
return true;
11041140
}
1141+
if (flowSource.getParameterIndex() == FlowSource.ANY_PARAMETER)
1142+
return true;
11051143
} else if (flowSource.isField()) {
11061144
// Flows from a field can either be applied to the same field or
11071145
// the base object in total

‎soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/xml/SummaryReader.java‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_BASETYPE;
44
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_FLOWTYPE;
55
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_MATCH_STRICT;
6-
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_PARAMTER_INDEX;
6+
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_PARAMETER_INDEX;
77
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_TAINT_SUB_FIELDS;
88
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.TREE_CLEAR;
99
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.TREE_FLOW;
@@ -51,7 +51,7 @@ private enum State {
5151
*
5252
* @param reader The reader from which to read the method summaries
5353
* @param summaries The data object in which to place the summaries
54-
* @return XMLStreamException Thrown in case of a syntax error in the input file
54+
* @throws XMLStreamException Thrown in case of a syntax error in the input file
5555
* @throws IOException Thrown if the reader could not be read
5656
*/
5757
public void read(Reader reader, ClassMethodSummaries summaries)
@@ -247,7 +247,7 @@ public void read(Reader reader, ClassMethodSummaries summaries)
247247
*
248248
* @param fileName The file from which to read the method summaries
249249
* @param summaries The data object in which to place the summaries
250-
* @return XMLStreamException Thrown in case of a syntax error in the input file
250+
* @throws XMLStreamException Thrown in case of a syntax error in the input file
251251
* @throws IOException Thrown if the file could not be read
252252
*/
253253

@@ -418,9 +418,11 @@ private boolean isGapBaseObject(Map<String, String> attributes) {
418418
}
419419

420420
private int parameterIdx(Map<String, String> attributes) {
421-
String strIdx = attributes.get(ATTRIBUTE_PARAMTER_INDEX);
421+
String strIdx = attributes.get(ATTRIBUTE_PARAMETER_INDEX);
422422
if (strIdx == null || strIdx.isEmpty())
423423
throw new RuntimeException("Parameter index not specified");
424+
if (strIdx.equals("*"))
425+
return FlowSource.ANY_PARAMETER;
424426
return Integer.parseInt(strIdx);
425427
}
426428

‎soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/xml/SummaryWriter.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_ACCESSPATHTYPES;
55
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_BASETYPE;
66
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_FLOWTYPE;
7-
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_PARAMTER_INDEX;
7+
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.ATTRIBUTE_PARAMETER_INDEX;
88
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.TREE_FLOW;
99
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.TREE_FLOWS;
1010
import static soot.jimple.infoflow.methodSummary.xml.XMLConstants.TREE_SINK;
@@ -214,7 +214,7 @@ private void writeAbstractFlowSinkSource(XMLStreamWriter writer, AbstractFlowSin
214214
// nothing we need to write in the xml file here (we write the
215215
// access path later)
216216
} else if (currentFlow.isParameter())
217-
writer.writeAttribute(ATTRIBUTE_PARAMTER_INDEX, currentFlow.getParameterIndex() + "");
217+
writer.writeAttribute(ATTRIBUTE_PARAMETER_INDEX, currentFlow.getParameterIndex() + "");
218218
else if (currentFlow.isGapBaseObject()) {
219219
// nothing special to write
220220
} else

‎soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/xml/XMLConstants.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ public class XMLConstants {
2727
public static final String ATTRIBUTE_METHOD_SIG = "id";
2828
public static final String ATTRIBUTE_IS_EXCLUDED = "isExcluded";
2929
public static final String ATTRIBUTE_FLOWTYPE = "sourceSinkType";
30-
public static final String ATTRIBUTE_PARAMTER_INDEX = "ParameterIndex";
30+
public static final String ATTRIBUTE_PARAMETER_INDEX = "ParameterIndex";
3131
public static final String ATTRIBUTE_ACCESSPATH = "AccessPath";
3232
public static final String ATTRIBUTE_ACCESSPATHTYPES = "AccessPathTypes";
3333
public static final String ATTRIBUTE_BASETYPE = "BaseType";

‎soot-infoflow-summaries/summariesManual/java.lang.invoke.StringConcatFactory.xml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<?xml version="1.0" ?>
2+
<summary fileFormatVersion="102">
3+
<hierarchy superClass="java.lang.Object">
4+
</hierarchy>
5+
<methods>
6+
<!-- Note that this a summary for dynamic invokes. For these, we do not actually know the number and types of parameters.
7+
As such, we use the wildcard * to match all possible concrete parameters used for the call site. -->
8+
<method id="java.lang.invoke.CallSite makeConcat(java.lang.invoke.MethodHandles$Lookup,java.lang.String,java.lang.invoke.MethodType)">
9+
<flows>
10+
<flow isAlias="false">
11+
<from sourceSinkType="Parameter" ParameterIndex="*" />
12+
<to sourceSinkType="Return" />
13+
</flow>
14+
</flows>
15+
</method>
16+
17+
<method id="java.lang.invoke.CallSite makeConcatWithConstants(java.lang.invoke.MethodHandles$Lookup,java.lang.String,java.lang.invoke.MethodType,java.lang.String,java.lang.Object[])">
18+
<flows>
19+
<flow isAlias="false">
20+
<from sourceSinkType="Parameter" ParameterIndex="*" />
21+
<to sourceSinkType="Return" />
22+
</flow>
23+
</flows>
24+
</method>
25+
</methods>
26+
</summary>

0 commit comments

Comments
 (0)