Merge branch 'develop' of https://github.com/secure-software-engineering/FlowDroid into improve-code

Author: MarcMil

pom.xml

@@ -17,15 +17,15 @@
 		<maven.compiler.source>17</maven.compiler.source>
 		<maven.compiler.target>17</maven.compiler.target>
 
-		<maven-compiler-plugin.version>3.13.0</maven-compiler-plugin.version>
+		<maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
 		<maven-gpg-plugin.version>3.2.7</maven-gpg-plugin.version>
 		<maven-nexus-staging-plugin.version>1.7.0</maven-nexus-staging-plugin.version>
 		<maven-source-plugin.version>3.3.1</maven-source-plugin.version>
 		<maven-javadoc-plugin.version>3.11.2</maven-javadoc-plugin.version>
 		<maven-jar-plugin.version>3.4.2</maven-jar-plugin.version>
-		<maven-surefire-plugin.version>3.5.2</maven-surefire-plugin.version>
+		<maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>
 		<maven-assembly-plugin.version>3.7.1</maven-assembly-plugin.version>
-		<maven-deploy-plugin.version>3.1.3</maven-deploy-plugin.version>
+		<maven-deploy-plugin.version>3.1.4</maven-deploy-plugin.version>
 
 		<slf4j.version>2.0.13</slf4j.version>
 		<log4j.version>2.24.0</log4j.version>

soot-infoflow-android/test/soot/jimple/infoflow/android/test/droidBench/ImplicitFlowTest.java

@@ -34,6 +34,7 @@ public void runTestImplicitFlow2() throws IOException {
 		Assert.assertEquals(2, res.size());
 	}
 
+	@Ignore("Taint is on ClassA.this$0 -> ImplicitFlow3. Since leakData() is a button click and can happen multiple times, the initial Log call is inside a tainted object.")
 	@Test(timeout = 300000)
 	public void runTestImplicitFlow3() throws IOException {
 		InfoflowResults res = analyzeAPKFile("ImplicitFlows/ImplicitFlow3.apk", true);

soot-infoflow/test/soot/jimple/infoflow/test/ImplicitFlowTestCode.java

@@ -671,4 +671,43 @@ private int constantReturnInIf() {
 		}
 		return 0;
 	}
+
+	public abstract static class AbstractClassWithFieldSetter {
+
+		int foo;
+
+		abstract public void set();
+
+	}
+
+	public static class ClassWithFieldSetterA extends AbstractClassWithFieldSetter {
+
+		@Override
+		public void set() {
+			foo = 42;
+		}
+
+	}
+
+	public static class ClassWithFieldSetterB extends AbstractClassWithFieldSetter {
+
+		@Override
+		public void set() {
+			foo = 1704;
+		}
+
+	}
+
+	public void dataClassSetterTest() {
+		int tainted = TelephonyManager.getIMEI();
+		AbstractClassWithFieldSetter clazz;
+		if (tainted > 42)
+			clazz = new ClassWithFieldSetterA();
+		else
+			clazz = new ClassWithFieldSetterB();
+		clazz.set();
+		ConnectionManager cm = new ConnectionManager();
+		cm.publish(clazz.foo);
+	}
+
 }

soot-infoflow/test/soot/jimple/infoflow/test/junit/ImplicitFlowTests.java

@@ -691,4 +691,17 @@ public void nestedIfTest() {
 		infoflow.computeInfoflow(appPath, libPath, epoints, sources, sinks);
 		checkInfoflow(infoflow, 1);
 	}
+
+	@Test(timeout = 300000)
+	public void dataClassSetterTest() {
+		IInfoflow infoflow = initInfoflow();
+		infoflow.getConfig().setInspectSinks(false);
+		infoflow.getConfig().setCodeEliminationMode(InfoflowConfiguration.CodeEliminationMode.NoCodeElimination);
+
+		List<String> epoints = new ArrayList<String>();
+		epoints.add("<soot.jimple.infoflow.test.ImplicitFlowTestCode: void dataClassSetterTest()>");
+		infoflow.computeInfoflow(appPath, libPath, epoints, sources, sinks);
+		checkInfoflow(infoflow, 1);
+	}
+
 }