Skip to content

Commit 6a0b788

Browse files
committed
fixed backwards tests for FRPS cases
1 parent d0fe598 commit 6a0b788

8 files changed

Lines changed: 124 additions & 105 deletions

File tree

pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535

3636
<apache-commons-cli.version>1.9.0</apache-commons-cli.version>
3737

38-
<soot.version>4.6.0-SNAPSHOT</soot.version>
38+
<soot.version>4.6.0</soot.version>
3939
</properties>
4040

4141
<developers>

soot-infoflow-android/.classpath

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,6 @@
1616
<attribute name="maven.pomderived" value="true"/>
1717
</attributes>
1818
</classpathentry>
19-
<classpathentry kind="src" output="build/testclasses" path="test">
20-
<attributes>
21-
<attribute name="test" value="true"/>
22-
<attribute name="optional" value="true"/>
23-
<attribute name="maven.pomderived" value="true"/>
24-
</attributes>
25-
</classpathentry>
2619
<classpathentry excluding="**" kind="src" output="build/classes" path="schema">
2720
<attributes>
2821
<attribute name="maven.pomderived" value="true"/>

soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/data/summary/ClassSummaries.java

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,26 @@ public MethodSummaries getAllSummariesForMethod(String signature) {
127127
return summaries;
128128
}
129129

130+
/**
131+
* Gets all method summaries for the sole class in this object. Note that this
132+
* method will throw an exception in case there are summaries for more than one
133+
* class.
134+
*
135+
* @return The method summaries for all methods in the only class contained in
136+
* this object
137+
*/
138+
public MethodSummaries getMergedMethodSummaries() {
139+
if (getClasses().size() > 1)
140+
throw new RuntimeException("Summaries for different classes cannot be merged");
141+
MethodSummaries summaries = new MethodSummaries();
142+
for (ClassMethodSummaries classSummaries : this.summaries.values()) {
143+
if (classSummaries != null) {
144+
summaries.merge(classSummaries.getMethodSummaries());
145+
}
146+
}
147+
return summaries;
148+
}
149+
130150
/**
131151
* Gets all flows across all classes and methods
132152
*

soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/taintWrappers/AccessPathPropagator.java

Lines changed: 59 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -12,42 +12,35 @@
1212
*
1313
*/
1414
public class AccessPathPropagator {
15-
15+
1616
private final Taint taint;
1717
private final GapDefinition gap;
1818
private final AccessPathPropagator parent;
1919
private final boolean inversePropagator;
20-
20+
2121
private final Stmt stmt;
2222
private final Abstraction d1;
2323
private final Abstraction d2;
24-
24+
2525
public AccessPathPropagator(Taint taint) {
2626
this(taint, null, null);
2727
}
28-
29-
public AccessPathPropagator(Taint taint,
30-
GapDefinition gap,
31-
AccessPathPropagator parent) {
28+
29+
public AccessPathPropagator(Taint taint, Stmt stmt) {
30+
this(taint, null, null, stmt, null, null);
31+
}
32+
33+
public AccessPathPropagator(Taint taint, GapDefinition gap, AccessPathPropagator parent) {
3234
this(taint, gap, parent, null, null, null);
33-
}
34-
35-
public AccessPathPropagator(Taint taint,
36-
GapDefinition gap,
37-
AccessPathPropagator parent,
38-
Stmt stmt,
39-
Abstraction d1,
35+
}
36+
37+
public AccessPathPropagator(Taint taint, GapDefinition gap, AccessPathPropagator parent, Stmt stmt, Abstraction d1,
4038
Abstraction d2) {
4139
this(taint, gap, parent, stmt, d1, d2, false);
4240
}
43-
44-
public AccessPathPropagator(Taint taint,
45-
GapDefinition gap,
46-
AccessPathPropagator parent,
47-
Stmt stmt,
48-
Abstraction d1,
49-
Abstraction d2,
50-
boolean inversePropagator) {
41+
42+
public AccessPathPropagator(Taint taint, GapDefinition gap, AccessPathPropagator parent, Stmt stmt, Abstraction d1,
43+
Abstraction d2, boolean inversePropagator) {
5144
this.taint = taint;
5245
this.gap = gap;
5346
this.parent = parent;
@@ -60,86 +53,92 @@ public AccessPathPropagator(Taint taint,
6053
public Taint getTaint() {
6154
return this.taint;
6255
}
63-
56+
6457
/**
65-
* Gets the gap in which the taint is being propagated. This gap
66-
* refers to the call stack / current method
67-
* @return The gap in which this taint is being propagated
58+
* Gets the gap in which the taint is being propagated. This gap refers to the
59+
* call stack / current method
60+
*
61+
* @return The gap in which this taint is being propagated
6862
*/
6963
public GapDefinition getGap() {
7064
return this.gap;
7165
}
72-
66+
7367
/**
7468
* Gets the parent of this AccessPathPropagator. This is the link to the
75-
* previous method in the call stack before we descended into the current
76-
* gap. If the gap is null, the parent must be null as well.
69+
* previous method in the call stack before we descended into the current gap.
70+
* If the gap is null, the parent must be null as well.
71+
*
7772
* @return The parent of this AccessPathPropagator
7873
*/
7974
public AccessPathPropagator getParent() {
8075
return this.parent;
8176
}
82-
77+
8378
/**
84-
* Gets the statement with which this propagator is associated. A statement
85-
* only exists for root-level propagators and indicates the original call
86-
* for which the summary application was started.
79+
* Gets the statement with which this propagator is associated. A statement only
80+
* exists for root-level propagators and indicates the original call for which
81+
* the summary application was started.
82+
*
8783
* @return The statement associated with this propagator
8884
*/
8985
public Stmt getStmt() {
9086
return this.stmt;
9187
}
92-
88+
9389
/**
94-
* Gets the context abstraction with which this propagator is associated.
95-
* This value only exists for root-level propagators.
90+
* Gets the context abstraction with which this propagator is associated. This
91+
* value only exists for root-level propagators.
92+
*
9693
* @return The context abstraction associated with this propagator
9794
*/
9895
public Abstraction getD1() {
9996
return this.d1;
10097
}
101-
98+
10299
/**
103-
* Gets the abstraction for which the taint wrapper was originally called.
104-
* This value only exists for root-level propagators.
100+
* Gets the abstraction for which the taint wrapper was originally called. This
101+
* value only exists for root-level propagators.
102+
*
105103
* @return The abstraction for which the taint wrapper was originally called
106104
*/
107105
public Abstraction getD2() {
108106
return this.d2;
109107
}
110-
108+
111109
/**
112110
* Creates a copy of this AccessPathPropagator with a new taint
113-
* @param newTaint The taint that the copied AccessPathPropagator shall
114-
* have
115-
* @return An AccessPathPropagator that is identical to the current one,
116-
* except for the taint which is replaced by the given value
111+
*
112+
* @param newTaint The taint that the copied AccessPathPropagator shall have
113+
* @return An AccessPathPropagator that is identical to the current one, except
114+
* for the taint which is replaced by the given value
117115
*/
118116
public AccessPathPropagator copyWithNewTaint(Taint newTaint) {
119-
return new AccessPathPropagator(newTaint, gap, parent, stmt, d1, d2,
120-
inversePropagator);
117+
return new AccessPathPropagator(newTaint, gap, parent, stmt, d1, d2, inversePropagator);
121118
}
122-
119+
123120
/**
124121
* Gets whether this is an inverse propagator used for identifying aliasing
125122
* relationships
126-
* @return True if this is an inverse propagator for which summary flows
127-
* need to reversed, otherwise false
123+
*
124+
* @return True if this is an inverse propagator for which summary flows need to
125+
* reversed, otherwise false
128126
*/
129127
public boolean isInversePropagator() {
130128
return this.inversePropagator;
131129
}
132-
130+
133131
/**
134132
* Creates a new access path propagator that is the inverse of this one.
135133
* Invariant a.deriveInversePropagator().deriveInversePropagator().equals(a)
134+
*
136135
* @return The inverse propagator of this one
137136
*/
138137
public AccessPathPropagator deriveInversePropagator() {
139-
return new AccessPathPropagator(this.taint, this.gap, this.parent,
140-
this.stmt, this.d1, this.d2, !this.inversePropagator);
138+
return new AccessPathPropagator(this.taint, this.gap, this.parent, this.stmt, this.d1, this.d2,
139+
!this.inversePropagator);
141140
}
142-
141+
143142
@Override
144143
public String toString() {
145144
return (inversePropagator ? "_" : "") + this.taint.toString();
@@ -149,20 +148,14 @@ public String toString() {
149148
public int hashCode() {
150149
final int prime = 31;
151150
int result = 1;
152-
result = prime * result
153-
+ ((taint == null) ? 0 : taint.hashCode());
154-
result = prime * result
155-
+ ((gap == null) ? 0 : gap.hashCode());
151+
result = prime * result + ((taint == null) ? 0 : taint.hashCode());
152+
result = prime * result + ((gap == null) ? 0 : gap.hashCode());
156153
// result = prime * result
157154
// + ((parent == null) ? 0 : parent.hashCode());
158-
result = prime * result
159-
+ ((stmt == null) ? 0 : stmt.hashCode());
160-
result = prime * result
161-
+ ((d1 == null) ? 0 : d1.hashCode());
162-
result = prime * result
163-
+ ((d2 == null) ? 0 : d2.hashCode());
164-
result = prime * result
165-
+ (inversePropagator ? 1 : 0);
155+
result = prime * result + ((stmt == null) ? 0 : stmt.hashCode());
156+
result = prime * result + ((d1 == null) ? 0 : d1.hashCode());
157+
result = prime * result + ((d2 == null) ? 0 : d2.hashCode());
158+
result = prime * result + (inversePropagator ? 1 : 0);
166159
return result;
167160
}
168161

@@ -209,5 +202,5 @@ public boolean equals(Object obj) {
209202
return false;
210203
return true;
211204
}
212-
205+
213206
}

soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/taintWrappers/SummaryTaintWrapper.java

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,8 @@ protected void handleFlowSourceInGap(Unit u, Abstraction d2) {
165165
Stmt sCallSite = (Stmt) callSite;
166166
ClassSummaries summaries = getFlowSummariesForMethod(sCallSite, sCallSite.getInvokeExpr().getMethod(),
167167
null);
168+
169+
List<AccessPathPropagator> worklist = new ArrayList<>();
168170
for (MethodFlow flow : summaries.getAllFlows()) {
169171
FlowSource src = flow.source();
170172
FlowSink tgt = flow.sink();
@@ -190,25 +192,26 @@ && isImplementationOf(callee, tgt.getGap().getSignature())) {
190192

191193
// Create the new propagator, one for every taint
192194
for (Taint returnTaint : returnTaints) {
193-
MethodFlow curFlow = flow;
194-
AccessPathPropagator propagator = new AccessPathPropagator(returnTaint);
195-
if (reverseFlows) {
195+
AccessPathPropagator propagator = new AccessPathPropagator(returnTaint, null, null, sCallSite,
196+
manager.getMainSolver().getTabulationProblem().zeroValue(), d2);
197+
if (reverseFlows)
196198
propagator = propagator.deriveInversePropagator();
197-
curFlow = flow.reverse();
198-
}
199-
AccessPathPropagator newPropagator = applyFlow(curFlow, propagator);
200-
if (newPropagator != null) {
201-
AccessPath ap = createAccessPathFromTaint(newPropagator.getTaint(), sCallSite,
202-
reverseFlows);
203-
if (ap != null) {
204-
Abstraction zeroValue = manager.getMainSolver().getTabulationProblem().zeroValue();
205-
Abstraction abs = d2.deriveNewAbstraction(ap, reverseFlows ? sCallSite : (Stmt) u);
206-
if (reverseFlows)
207-
abs.setCorrespondingCallSite(sCallSite);
208-
for (Unit succUnit : manager.getICFG().getSuccsOf(callSite))
209-
manager.getMainSolver()
210-
.processEdge(new PathEdge<Unit, Abstraction>(zeroValue, succUnit, abs));
211-
}
199+
worklist.add(propagator);
200+
}
201+
}
202+
203+
if (!worklist.isEmpty()) {
204+
Set<AccessPath> newAPs = applyFlowsIterative(summaries.getMergedMethodSummaries(), worklist,
205+
reverseFlows, sCallSite, d2, true);
206+
if (newAPs != null && !newAPs.isEmpty()) {
207+
Abstraction zeroValue = manager.getMainSolver().getTabulationProblem().zeroValue();
208+
for (AccessPath ap : newAPs) {
209+
Abstraction abs = d2.deriveNewAbstraction(ap, reverseFlows ? sCallSite : (Stmt) u);
210+
if (reverseFlows)
211+
abs.setCorrespondingCallSite(sCallSite);
212+
for (Unit succUnit : manager.getICFG().getSuccsOf(callSite))
213+
manager.getMainSolver()
214+
.processEdge(new PathEdge<Unit, Abstraction>(zeroValue, succUnit, abs));
212215
}
213216
}
214217
}
@@ -261,6 +264,8 @@ protected void handleFlowBackFromGap(Unit u, Abstraction d2, Set<AccessPathPropa
261264
if (resultAPs != null && !resultAPs.isEmpty()) {
262265
for (AccessPath ap : resultAPs) {
263266
Abstraction newAbs = rootPropagator.getD2().deriveNewAbstraction(ap, rootPropagator.getStmt());
267+
if (rootPropagator.isInversePropagator())
268+
newAbs.setCorrespondingCallSite(rootPropagator.getStmt());
264269
for (Unit succUnit : manager.getICFG().getSuccsOf(rootPropagator.getStmt()))
265270
manager.getMainSolver().processEdge(
266271
new PathEdge<Unit, Abstraction>(rootPropagator.getD1(), succUnit, newAbs));
@@ -334,6 +339,7 @@ private AccessPathPropagator getOriginalCallSite(AccessPathPropagator propagator
334339
}
335340
return null;
336341
}
342+
337343
}
338344

339345
/**
@@ -2185,8 +2191,6 @@ public Set<Abstraction> getInverseTaintsForMethod(Stmt stmt, Abstraction d1, Abs
21852191
if (!stmt.containsInvokeExpr())
21862192
return Collections.singleton(taintedAbs);
21872193

2188-
SootMethod sm = manager.getICFG().getMethodOf(stmt);
2189-
21902194
ByReferenceBoolean classSupported = new ByReferenceBoolean(false);
21912195
// Get the cached data flows
21922196
final SootMethod method = stmt.getInvokeExpr().getMethod();

soot-infoflow-summaries/test/soot/jimple/infoflow/test/methodSummary/junit/SummaryTaintWrapperTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -305,7 +305,7 @@ public void streamReduceTest() {
305305
testFlowForMethod("<soot.jimple.infoflow.test.methodSummary.ApiClassClient: void streamReduceTest()>", 1);
306306
}
307307

308-
@Test // (timeout = 30000)
308+
@Test(timeout = 30000)
309309
public void streamReduceTest2() {
310310
testFlowForMethod("<soot.jimple.infoflow.test.methodSummary.ApiClassClient: void streamReduceTest2()>", 1);
311311
}

soot-infoflow/pom.xml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,9 @@
3434
<version>${maven-surefire-plugin.version}</version>
3535
<configuration>
3636
<skipTests>true</skipTests>
37-
<!--
3837
<includes>
3938
<include>soot/jimple/infoflow/test/junit/**</include>
4039
</includes>
41-
-->
4240
</configuration>
4341
</plugin>
4442
<plugin>

0 commit comments

Comments
 (0)