Merge branch 'develop' of github.com:secure-software-engineering/FlowDroid into develop

StevenArzt · StevenArzt · commit 0cbb74b4b635 · 2022-11-30T14:19:05.000+01:00
diff --git a/soot-infoflow-android/test/soot/jimple/infoflow/android/test/otherAPKs/OtherAPKTests.java b/soot-infoflow-android/test/soot/jimple/infoflow/android/test/otherAPKs/OtherAPKTests.java
@@ -3,6 +3,7 @@
 import java.io.IOException;
 
 import org.junit.Assert;
+import org.junit.Ignore;
 import org.junit.Test;
 import org.xmlpull.v1.XmlPullParserException;
 
@@ -18,6 +19,7 @@ public void runTest1() throws IOException, XmlPullParserException {
 		Assert.assertTrue(res.size() > 0);
 	}
 
+	@Ignore("APK file missing")
 	@Test
 	public void runTest2() throws IOException, XmlPullParserException {
 		InfoflowResults res = analyzeAPKFile
diff --git a/soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/data/provider/LazySummaryProvider.java b/soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/data/provider/LazySummaryProvider.java
@@ -9,6 +9,7 @@
 import java.util.List;
 import java.util.Set;
 
+import soot.jimple.infoflow.collect.ConcurrentHashSet;
 import soot.jimple.infoflow.methodSummary.data.summary.ClassMethodSummaries;
 import soot.jimple.infoflow.methodSummary.data.summary.ClassSummaries;
 
@@ -20,7 +21,7 @@ public class LazySummaryProvider extends XMLSummaryProvider {
 
 	protected Set<File> files = new HashSet<>();
 	protected Set<Path> pathes = new HashSet<>();
-	protected Set<String> loadableClasses = new HashSet<String>();
+	protected Set<String> loadableClasses = new ConcurrentHashSet<>();
 
 	/**
 	 * Loads a summary from a folder within the StubDroid jar file.
diff --git a/soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/postProcessor/SummaryPathBuilder.java b/soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/postProcessor/SummaryPathBuilder.java
@@ -254,7 +254,7 @@ protected Runnable getTaintPathTask(AbstractionAtSink abs) {
 	}
 
 	@Override
-	protected void onTaintPathsComputed() {
+	protected void cleanupExecutor() {
 		// Don't shut down the executor, because we reset it and run several iterations
 		// on the same path builder.
 	}
diff --git a/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/JUnitTests.java b/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/JUnitTests.java
@@ -23,6 +23,7 @@
 import org.junit.Before;
 import org.junit.BeforeClass;
 
+import soot.jimple.infoflow.AbstractInfoflow;
 import soot.jimple.infoflow.IInfoflow;
 import soot.jimple.infoflow.Infoflow;
 import soot.jimple.infoflow.config.ConfigForTest;
@@ -152,13 +153,14 @@ protected void negativeCheckInfoflow(IInfoflow infoflow) {
 		}
 	}
 
+	protected abstract AbstractInfoflow createInfoflowInstance();
+
 	protected IInfoflow initInfoflow() {
 		return initInfoflow(false);
 	}
 
 	protected IInfoflow initInfoflow(boolean useTaintWrapper) {
-//		IInfoflow result = new BackwardsInfoflow();
-		Infoflow result = new Infoflow();
+		IInfoflow result = createInfoflowInstance();
 		ConfigForTest testConfig = new ConfigForTest();
 		result.setSootConfig(testConfig);
 		if (useTaintWrapper) {
diff --git a/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/SummaryTaintWrapperTests.java b/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/SummaryTaintWrapperTests.java
@@ -23,9 +23,7 @@
 import org.junit.Ignore;
 import org.junit.Test;
 
-import soot.jimple.infoflow.BackwardsInfoflow;
-import soot.jimple.infoflow.IInfoflow;
-import soot.jimple.infoflow.InfoflowConfiguration;
+import soot.jimple.infoflow.*;
 import soot.jimple.infoflow.config.IInfoflowConfig;
 import soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator;
 import soot.jimple.infoflow.methodSummary.data.provider.EagerSummaryProvider;
@@ -34,7 +32,7 @@
 import soot.jimple.infoflow.taintWrappers.ITaintPropagationWrapper;
 import soot.options.Options;
 
-public class SummaryTaintWrapperTests {
+public abstract class SummaryTaintWrapperTests {
 	private static String appPath, libPath;
 
 	private String[] source = new String[] {
@@ -262,9 +260,10 @@ private void checkInfoflow(IInfoflow infoflow, int resultCount) {
 		}
 	}
 
+	protected abstract AbstractInfoflow createInfoflowInstance();
+
 	protected IInfoflow initInfoflow() throws FileNotFoundException, XMLStreamException {
-		IInfoflow result = new BackwardsInfoflow();
-//		Infoflow result = new Infoflow();
+		IInfoflow result = createInfoflowInstance();
 		result.getConfig().getAccessPathConfiguration().setUseRecursiveAccessPaths(false);
 		IInfoflowConfig testConfig = new IInfoflowConfig() {
 
diff --git a/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/WrapperListTests.java b/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/WrapperListTests.java
@@ -14,12 +14,12 @@
 import soot.jimple.infoflow.methodSummary.taintWrappers.TaintWrapperFactory;
 import soot.jimple.infoflow.taintWrappers.ITaintPropagationWrapper;
 
-public class WrapperListTests extends JUnitTests {
+public abstract class WrapperListTests extends JUnitTests {
 
 	private static File files = new File("testSummaries");
 	protected final ITaintPropagationWrapper wrapper;
 
-	public WrapperListTests() throws FileNotFoundException, XMLStreamException {
+	public WrapperListTests() {
 		wrapper = (ITaintPropagationWrapper) TaintWrapperFactory.createTaintWrapper(files);
 	}
 
diff --git a/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/backward/SummaryTaintWrapperTests.java b/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/backward/SummaryTaintWrapperTests.java
@@ -0,0 +1,11 @@
+package soot.jimple.infoflow.test.methodSummary.junit.backward;
+
+import soot.jimple.infoflow.AbstractInfoflow;
+import soot.jimple.infoflow.BackwardsInfoflow;
+
+public class SummaryTaintWrapperTests extends soot.jimple.infoflow.test.methodSummary.junit.SummaryTaintWrapperTests {
+    @Override
+    protected AbstractInfoflow createInfoflowInstance() {
+        return new BackwardsInfoflow("", false, null);
+    }
+}
diff --git a/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/backward/WrapperListTests.java b/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/backward/WrapperListTests.java
@@ -0,0 +1,11 @@
+package soot.jimple.infoflow.test.methodSummary.junit.backward;
+
+import soot.jimple.infoflow.AbstractInfoflow;
+import soot.jimple.infoflow.BackwardsInfoflow;
+
+public class WrapperListTests extends soot.jimple.infoflow.test.methodSummary.junit.WrapperListTests {
+    @Override
+    protected AbstractInfoflow createInfoflowInstance() {
+        return new BackwardsInfoflow("", false, null);
+    }
+}
diff --git a/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/forward/SummaryTaintWrapperTests.java b/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/forward/SummaryTaintWrapperTests.java
@@ -0,0 +1,11 @@
+package soot.jimple.infoflow.test.methodSummary.junit.forward;
+
+import soot.jimple.infoflow.AbstractInfoflow;
+import soot.jimple.infoflow.Infoflow;
+
+public class SummaryTaintWrapperTests extends soot.jimple.infoflow.test.methodSummary.junit.SummaryTaintWrapperTests {
+    @Override
+    protected AbstractInfoflow createInfoflowInstance() {
+        return new Infoflow("", false, null);
+    }
+}
diff --git a/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/forward/WrapperListTests.java b/soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/forward/WrapperListTests.java
@@ -0,0 +1,11 @@
+package soot.jimple.infoflow.test.methodSummary.junit.forward;
+
+import soot.jimple.infoflow.AbstractInfoflow;
+import soot.jimple.infoflow.Infoflow;
+
+public class WrapperListTests extends soot.jimple.infoflow.test.methodSummary.junit.WrapperListTests {
+    @Override
+    protected AbstractInfoflow createInfoflowInstance() {
+        return new Infoflow("", false, null);
+    }
+}
diff --git a/soot-infoflow/src/soot/jimple/infoflow/codeOptimization/InterproceduralConstantValuePropagator.java b/soot-infoflow/src/soot/jimple/infoflow/codeOptimization/InterproceduralConstantValuePropagator.java
@@ -15,7 +15,6 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import com.google.common.cache.Cache;
 import com.google.common.cache.CacheBuilder;
 import com.google.common.cache.CacheLoader;
 
@@ -381,6 +380,8 @@ private void removeCallSite(Stmt callSite, SootMethod caller) {
 		// Fix the callgraph
 		if (Scene.v().hasCallGraph())
 			Scene.v().getCallGraph().removeAllEdgesOutOf(callSite);
+
+		manager.getICFG().notifyMethodChanged(caller);
 	}
 
 	/**
@@ -491,6 +492,8 @@ private void propagateReturnValueIntoCallers(SootMethod sm) {
 						// Fix the callgraph
 						if (Scene.v().hasCallGraph())
 							Scene.v().getCallGraph().swapEdgesOutOf(assign, inv);
+
+						icfg.notifyMethodChanged(caller);
 					}
 				}
 	}
diff --git a/soot-infoflow/src/soot/jimple/infoflow/data/pathBuilders/ContextSensitivePathBuilder.java b/soot-infoflow/src/soot/jimple/infoflow/data/pathBuilders/ContextSensitivePathBuilder.java
@@ -2,13 +2,15 @@
 
 import java.util.HashSet;
 import java.util.Set;
+import java.util.Stack;
 import java.util.concurrent.PriorityBlockingQueue;
 import java.util.concurrent.ThreadFactory;
 import java.util.concurrent.TimeUnit;
 
 import heros.solver.Pair;
 import soot.jimple.Stmt;
 import soot.jimple.infoflow.InfoflowManager;
+import soot.jimple.infoflow.collect.ConcurrentHashSet;
 import soot.jimple.infoflow.collect.ConcurrentIdentityHashMultiMap;
 import soot.jimple.infoflow.data.Abstraction;
 import soot.jimple.infoflow.data.AbstractionAtSink;
@@ -30,6 +32,9 @@ public class ContextSensitivePathBuilder extends ConcurrentAbstractionPathBuilde
 
 	protected ConcurrentIdentityHashMultiMap<Abstraction, SourceContextAndPath> pathCache = new ConcurrentIdentityHashMultiMap<>();
 
+	// Set holds all paths that reach an already cached subpath
+	protected ConcurrentHashSet<Pair<SourceContextAndPath, SourceContextAndPath>> deferredPaths = new ConcurrentHashSet<>();
+
 	/**
 	 * Creates a new instance of the {@link ContextSensitivePathBuilder} class
 	 * 
@@ -56,7 +61,6 @@ public Thread newThread(Runnable r) {
 		return executor;
 	}
 
-
 	/**
 	 * Task for tracking back the path from sink to source.
 	 * 
@@ -89,53 +93,32 @@ public void run() {
 			}
 		}
 
-		/**
-		 * Uses the cached paths to extend the current path
-		 *
-		 * @param scap SourceContextAndPath of the current abstraction
-		 * @param cachedScap cached SourceContextAndPath to extend scap
-		 */
-		private void buildFullPathFromCache(SourceContextAndPath scap, SourceContextAndPath cachedScap) {
-			// Try to extend scap with cachedScap
-			SourceContextAndPath extendedScap = scap.extendPath(cachedScap);
-			if (extendedScap != null) {
-				Abstraction last = extendedScap.getLastAbstraction();
-				if (pathCache.put(last, extendedScap)) {
-					// If the new path wasn't seen before, queue it
-					scheduleDependentTask(new SourceFindingTask(last));
-				} else {
-					// Otherwise, try to build the path further using the cache
-					if (!checkForSource(last, extendedScap))
-						for (SourceContextAndPath preds : pathCache.get(last.getPredecessor()))
-							buildFullPathFromCache(extendedScap, preds);
-				}
-			}
-		}
-
 		private void processAndQueue(Abstraction pred, SourceContextAndPath scap) {
 			// Skip abstractions that don't contain any new information. This might
 			// be the case when a turn unit was added to the abstraction.
-			if (pred.getCorrespondingCallSite() == null && pred.getCurrentStmt() == null && pred.getTurnUnit() != null) {
+			if (pred.getCorrespondingCallSite() == null && pred.getCurrentStmt() == null
+					&& pred.getTurnUnit() != null) {
 				processAndQueue(pred.getPredecessor(), scap);
 				return;
 			}
 
 			ProcessingResult p = processPredecessor(scap, pred);
 			switch (p.getResult()) {
-				case NEW:
-					// Schedule the predecessor
-					assert pathCache.containsKey(pred);
-					scheduleDependentTask(new SourceFindingTask(pred));
-					break;
-				case CACHED:
-					// In case we already know the subpath, append it to the path and queue it
-					buildFullPathFromCache(scap, p.getScap());
-					break;
-				case INFEASIBLE_OR_MAX_PATHS_REACHED:
-					// Nothing to do
-					break;
-				default:
-					assert false;
+			case NEW:
+				// Schedule the predecessor
+				assert pathCache.containsKey(pred);
+				scheduleDependentTask(new SourceFindingTask(pred));
+				break;
+			case CACHED:
+				// In case we already know the subpath, we do append the path after the path
+				// builder terminated
+				deferredPaths.add(new Pair<>(scap, p.getScap()));
+				break;
+			case INFEASIBLE_OR_MAX_PATHS_REACHED:
+				// Nothing to do
+				break;
+			default:
+				assert false;
 			}
 		}
 
@@ -148,7 +131,8 @@ private ProcessingResult processPredecessor(SourceContextAndPath scap, Abstracti
 					return ProcessingResult.INFEASIBLE_OR_MAX_PATHS_REACHED();
 
 				checkForSource(pred, extendedScap);
-				return pathCache.put(pred, extendedScap) ? ProcessingResult.NEW() : ProcessingResult.CACHED(extendedScap);
+				return pathCache.put(pred, extendedScap) ? ProcessingResult.NEW()
+						: ProcessingResult.CACHED(extendedScap);
 			}
 
 			// If we enter a method, we put it on the stack
@@ -302,13 +286,49 @@ public void computeTaintPaths(Set<AbstractionAtSink> res) {
 			logger.error("Could not wait for executor termination", e);
 		} finally {
 			onTaintPathsComputed();
+			cleanupExecutor();
+		}
+	}
+
+	/**
+	 * Uses the cached path to extend the current path
+	 *
+	 * @param scap SourceContextAndPath of the current abstraction
+	 * @param cachedScap cached SourceContextAndPath to extend scap
+	 */
+	protected void buildFullPathFromCache(SourceContextAndPath scap, SourceContextAndPath cachedScap) {
+		// Try to extend scap with cachedScap
+		Stack<Pair<SourceContextAndPath, SourceContextAndPath>> workStack = new Stack<>();
+		workStack.push(new Pair<>(scap, cachedScap));
+		while (!workStack.isEmpty()) {
+			Pair<SourceContextAndPath, SourceContextAndPath> p = workStack.pop();
+			scap = p.getO1();
+			cachedScap = p.getO2();
+
+			SourceContextAndPath extendedScap = scap.extendPath(cachedScap);
+			if (extendedScap != null) {
+				Abstraction last = extendedScap.getLastAbstraction();
+				// Try to build the path further using the cache if we didn't reach a source
+				if (!checkForSource(last, extendedScap))
+					for (SourceContextAndPath preds : pathCache.get(last.getPredecessor()))
+						workStack.push(new Pair<>(extendedScap, preds));
+			}
 		}
 	}
 
 	/**
 	 * Method that is called when the taint paths have been computed
 	 */
 	protected void onTaintPathsComputed() {
+		for (Pair<SourceContextAndPath, SourceContextAndPath> deferredPair : deferredPaths) {
+			buildFullPathFromCache(deferredPair.getO1(), deferredPair.getO2());
+		}
+	}
+
+	/**
+	 * Method that is called to shut down the executor
+	 */
+	protected void cleanupExecutor() {
 		shutdown();
 	}
 
diff --git a/soot-infoflow/src/soot/jimple/infoflow/data/pathBuilders/DefaultPathBuilderFactory.java b/soot-infoflow/src/soot/jimple/infoflow/data/pathBuilders/DefaultPathBuilderFactory.java
@@ -33,10 +33,9 @@ public RepeatableContextSensitivePathBuilder(InfoflowManager manager) {
 		}
 
 		@Override
-		protected void onTaintPathsComputed() {
+		protected void cleanupExecutor() {
 			// Do not terminate the executor
 		}
-
 	}
 
 	/**
diff --git a/soot-infoflow/src/soot/jimple/infoflow/problems/rules/backward/BackwardsWrapperRule.java b/soot-infoflow/src/soot/jimple/infoflow/problems/rules/backward/BackwardsWrapperRule.java
@@ -38,7 +38,6 @@
 import soot.jimple.infoflow.util.preanalyses.SingleLiveVariableAnalysis;
 
 public class BackwardsWrapperRule extends AbstractTaintPropagationRule {
-	public static boolean DEBUG_TW = false;
 
 	public BackwardsWrapperRule(InfoflowManager manager, Abstraction zeroValue, TaintPropagationResults results) {
 		super(manager, zeroValue, results);
@@ -141,8 +140,8 @@ public Collection<Abstraction> propagateCallToReturnFlow(Abstraction d1, Abstrac
 						addAbstraction = false;
 				}
 
-				// Primitive Assignment -> set turn unit
-				boolean performAliasSearch = false;
+				// Set the turn unit on primitive assignment. Otherwise, perform an alias search.
+				boolean performAliasSearch = true;
 				if (retValTainted && leftOp != null) {
 					Type t;
 					if (leftOp instanceof FieldRef)
@@ -196,10 +195,6 @@ public Collection<Abstraction> propagateCallToReturnFlow(Abstraction d1, Abstrac
 				if (abs != source)
 					abs.setCorrespondingCallSite(stmt);
 
-		if (DEBUG_TW)
-			System.out.println("In: " + source.toString() + "\n" + "Stmt:" + stmt.toString() + "\n"
-					+ (res == null ? "[]" : res.toString()) + "\n");
-
 		return res;
 	}
 
diff --git a/soot-infoflow/src/soot/jimple/infoflow/solver/cfg/BackwardsInfoflowCFG.java b/soot-infoflow/src/soot/jimple/infoflow/solver/cfg/BackwardsInfoflowCFG.java

Original file line number	Diff line number	Diff line change
`@@ -254,7 +254,7 @@ protected Runnable getTaintPathTask(AbstractionAtSink abs) {`
`254`	`254`	`}`
`255`	`255`
`256`	`256`	`@Override`
`257`		`- protected void onTaintPathsComputed() {`
	`257`	`+ protected void cleanupExecutor() {`
`258`	`258`	`// Don't shut down the executor, because we reset it and run several iterations`
`259`	`259`	`// on the same path builder.`
`260`	`260`	`}`