Skip to content

Commit fe448cf

Browse files
t1mlanget1mlange
committed
Clean up code
1 parent b02b477 commit fe448cf

5 files changed

Lines changed: 51 additions & 50 deletions

File tree

‎soot-infoflow/src/soot/jimple/infoflow/InfoflowManager.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ public class InfoflowManager {
2525
private IInfoflowSolver forwardSolver;
2626
private IInfoflowSolver backwardSolver;
2727
private final IInfoflowCFG icfg;
28+
private final IInfoflowCFG originalIcfg;
2829
private final ISourceSinkManager sourceSinkManager;
2930
private final ITaintPropagationWrapper taintWrapper;
3031
private final TypeUtils typeUtils;
@@ -37,6 +38,7 @@ protected InfoflowManager(InfoflowConfiguration config) {
3738
this.config = config;
3839
this.forwardSolver = null;
3940
this.icfg = null;
41+
this.originalIcfg = null;
4042
this.sourceSinkManager = null;
4143
this.taintWrapper = null;
4244
this.typeUtils = null;
@@ -51,6 +53,7 @@ protected InfoflowManager(InfoflowConfiguration config, IInfoflowSolver forwardS
5153
this.config = config;
5254
this.forwardSolver = forwardSolver;
5355
this.icfg = icfg;
56+
this.originalIcfg = null;
5457
this.sourceSinkManager = sourceSinkManager;
5558
this.taintWrapper = taintWrapper;
5659
this.typeUtils = new TypeUtils(this);
@@ -65,6 +68,7 @@ protected InfoflowManager(InfoflowConfiguration config, IInfoflowSolver forwardS
6568
this.config = config;
6669
this.forwardSolver = forwardSolver;
6770
this.icfg = icfg;
71+
this.originalIcfg = existingManager.getICFG();
6872
this.sourceSinkManager = sourceSinkManager;
6973
this.taintWrapper = taintWrapper;
7074
this.typeUtils = existingManager.getTypeUtils();
@@ -77,6 +81,7 @@ protected InfoflowManager(InfoflowConfiguration config, IInfoflowSolver forwardS
7781
this.config = config;
7882
this.forwardSolver = forwardSolver;
7983
this.icfg = icfg;
84+
this.originalIcfg = null;
8085
this.sourceSinkManager = null;
8186
this.taintWrapper = null;
8287
this.typeUtils = new TypeUtils(this);
@@ -139,6 +144,15 @@ public IInfoflowCFG getICFG() {
139144
return this.icfg;
140145
}
141146

147+
/**
148+
* Gets the interprocedural control flow graph for the other direction. Only available in the alias search.
149+
*
150+
* @return The inversed interprocedural control flow graph
151+
*/
152+
public IInfoflowCFG getOriginalICFG() {
153+
return this.originalIcfg;
154+
}
155+
142156
/**
143157
* Gets the SourceSinkManager implementation
144158
*

‎soot-infoflow/src/soot/jimple/infoflow/aliasing/BackwardsFlowSensitiveAliasStrategy.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,10 @@ public BackwardsFlowSensitiveAliasStrategy(InfoflowManager manager, IInfoflowSol
3030
public void computeAliasTaints(final Abstraction d1, final Stmt src, final Value targetValue,
3131
Set<Abstraction> taintSet, SootMethod method, Abstraction newAbs) {
3232
// Start the backwards solver
33-
Abstraction bwAbs = newAbs.deriveInactiveAbstraction(src);
3433
assert manager.getICFG() instanceof BackwardsInfoflowCFG;
3534
// sometimes we need to revisit the statement itself, so
3635
// looping through predecessors isn't always needed
37-
bSolver.processEdge(new PathEdge<Unit, Abstraction>(d1, src, bwAbs));
36+
bSolver.processEdge(new PathEdge<Unit, Abstraction>(d1, src, newAbs));
3837
}
3938

4039
@Override

‎soot-infoflow/src/soot/jimple/infoflow/problems/BackwardsAliasProblem.java‎

Lines changed: 32 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
11
package soot.jimple.infoflow.problems;
22

3-
import java.util.Arrays;
4-
import java.util.Collection;
5-
import java.util.Collections;
6-
import java.util.HashSet;
7-
import java.util.Set;
3+
import java.util.*;
84

95
import heros.FlowFunction;
106
import heros.FlowFunctions;
@@ -140,6 +136,7 @@ private Set<Abstraction> computeAliases(final DefinitionStmt defStmt, Abstractio
140136
AccessPath ap = source.getAccessPath();
141137
Value sourceBase = ap.getPlainValue();
142138
boolean handoverLeftValue = false;
139+
boolean leftSideOverwritten = false;
143140
if (leftOp instanceof StaticFieldRef) {
144141
if (manager.getConfig()
145142
.getStaticFieldTrackingMode() != InfoflowConfiguration.StaticFieldTrackingMode.None
@@ -171,11 +168,10 @@ else if (source.dependsOnCutAP() || isCircularType(leftVal)) {
171168
if (handoverLeftValue) {
172169
// We found a missed path upwards
173170
// inject same stmt in infoflow solver
174-
manager.getForwardSolver()
175-
.processEdge(new PathEdge<Unit, Abstraction>(d1, srcUnit, source.getActiveCopy()));
171+
handOver(d1, srcUnit, source);
176172
}
177173

178-
boolean leftSideOverwritten = !(leftOp instanceof ArrayRef) && !(leftOp instanceof FieldRef)
174+
leftSideOverwritten = !(leftOp instanceof ArrayRef) && !(leftOp instanceof FieldRef)
179175
&& Aliasing.baseMatches(leftOp, source);
180176
if (leftSideOverwritten)
181177
return null;
@@ -203,7 +199,6 @@ else if (source.dependsOnCutAP() || isCircularType(leftVal)) {
203199
.getStaticFieldTrackingMode() != InfoflowConfiguration.StaticFieldTrackingMode.None
204200
&& ap.firstFieldMatches(((StaticFieldRef) rightVal).getField())) {
205201
addLeftValue = true;
206-
// leftType = source.getAccessPath().getBaseType();
207202
}
208203
} else if (rightVal instanceof InstanceFieldRef) {
209204
InstanceFieldRef instRef = (InstanceFieldRef) rightVal;
@@ -408,10 +403,9 @@ private Set<Abstraction> computeTargetsInternal(Abstraction d1, Abstraction sour
408403
}
409404
}
410405

411-
if (res != null) {
412-
for (Abstraction d3 : res)
413-
manager.getForwardSolver().injectContext(solver, dest, d3, callSite, source, d1);
414-
}
406+
for (Abstraction d3 : res)
407+
manager.getForwardSolver().injectContext(solver, dest, d3, callSite, source, d1);
408+
415409
return res;
416410
}
417411
};
@@ -635,8 +629,7 @@ private Set<Abstraction> computeTargetsInternal(Abstraction d1, Abstraction sour
635629

636630
if (taintWrapper != null) {
637631
if (taintWrapper.isExclusive(callStmt, source)) {
638-
manager.getForwardSolver().processEdge(
639-
new PathEdge<Unit, Abstraction>(d1, callStmt, source.getActiveCopy()));
632+
handOver(d1, callSite, source);
640633
}
641634

642635
Set<Abstraction> wrapperAliases = taintWrapper.getAliasesForMethod(callStmt, d1, source);
@@ -648,8 +641,7 @@ private Set<Abstraction> computeTargetsInternal(Abstraction d1, Abstraction sour
648641
abs.setCorrespondingCallSite(callStmt);
649642

650643
for (Unit u : manager.getICFG().getPredsOf(callSite))
651-
manager.getForwardSolver().processEdge(
652-
new PathEdge<Unit, Abstraction>(d1, u, abs.getActiveCopy()));
644+
handOver(d1, u, abs);
653645
}
654646
return passOnSet;
655647
}
@@ -682,8 +674,7 @@ private Set<Abstraction> computeTargetsInternal(Abstraction d1, Abstraction sour
682674
&& arg == source.getAccessPath().getPlainValue())) {
683675
// non standard source sink manager might need this
684676
if (isSource)
685-
manager.getForwardSolver()
686-
.processEdge(new PathEdge<>(d1, callSite, source.getActiveCopy()));
677+
handOver(d1, callSite, source);
687678
return null;
688679
}
689680
} else {
@@ -694,8 +685,7 @@ private Set<Abstraction> computeTargetsInternal(Abstraction d1, Abstraction sour
694685
// the native stmt does not create a new alias but we notice that we
695686
// missed this argument in the infoflow search.
696687
Abstraction newSource = source.deriveNewAbstractionWithTurnUnit(callSite);
697-
manager.getForwardSolver()
698-
.processEdge(new PathEdge<>(d1, callSite, newSource.getActiveCopy()));
688+
handOver(d1, callSite, newSource);
699689
return null;
700690
}
701691
}
@@ -711,6 +701,27 @@ private boolean isPrimitiveOrStringBase(Abstraction abs) {
711701
return t instanceof PrimType
712702
|| (TypeUtils.isStringType(t) && !abs.getAccessPath().getCanHaveImmutableAliases());
713703
}
704+
705+
private void handOver(Abstraction d1, Unit unit, Abstraction in) {
706+
in = in.getActiveCopy();
707+
708+
if (manager.getConfig().getImplicitFlowMode().trackControlFlowDependencies()) {
709+
// We maybe turned around inside a conditional, so we reconstruct the condition
710+
// dominator. Also, we lost track of the dominators in the alias search. Thus,
711+
// we derive interprocedural wildcards.
712+
// See ImplicitTests#conditionalAliasingTest
713+
List<Unit> condUnits = manager.getOriginalICFG().getConditionalBranchesInterprocedural(unit);
714+
// No condition path -> no need to search for one
715+
for (Unit condUnit : condUnits) {
716+
Abstraction abs = in.deriveNewAbstractionWithDominator(condUnit);
717+
if (abs != null)
718+
manager.getForwardSolver().processEdge(new PathEdge<>(d1, unit, abs));
719+
}
720+
} else {
721+
manager.getForwardSolver()
722+
.processEdge(new PathEdge<>(d1, unit, in));
723+
}
724+
}
714725
};
715726
}
716727
}

‎soot-infoflow/src/soot/jimple/infoflow/problems/BackwardsInfoflowProblem.java‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,7 @@ public Set<Abstraction> computeTargets(Abstraction d1, Abstraction source) {
8181
taintPropagationHandler.notifyFlowIn(srcUnit, source, manager,
8282
TaintPropagationHandler.FlowFunctionType.NormalFlowFunction);
8383

84-
Set<Abstraction> res = computeTargetsInternal(d1,
85-
source.isAbstractionActive() ? source : source.getActiveCopy());
84+
Set<Abstraction> res = computeTargetsInternal(d1, source);
8685
return notifyOutFlowHandlers(srcUnit, d1, source, res,
8786
TaintPropagationHandler.FlowFunctionType.NormalFlowFunction);
8887
}
@@ -430,8 +429,7 @@ public Set<Abstraction> computeTargets(Abstraction d1, Abstraction source) {
430429
taintPropagationHandler.notifyFlowIn(stmt, source, manager,
431430
TaintPropagationHandler.FlowFunctionType.CallFlowFunction);
432431

433-
Set<Abstraction> res = computeTargetsInternal(d1,
434-
source.isAbstractionActive() ? source : source.getActiveCopy());
432+
Set<Abstraction> res = computeTargetsInternal(d1, source);
435433
if (res != null) {
436434
for (Abstraction abs : res)
437435
aliasing.getAliasingStrategy().injectCallingContext(abs, solver, dest, callStmt, source,
@@ -658,8 +656,7 @@ public Set<Abstraction> computeTargets(Abstraction source, Abstraction calleeD1,
658656
taintPropagationHandler.notifyFlowIn(stmt, source, manager,
659657
TaintPropagationHandler.FlowFunctionType.ReturnFlowFunction);
660658

661-
Set<Abstraction> res = computeTargetsInternal(
662-
source.isAbstractionActive() ? source : source.getActiveCopy(), calleeD1, callerD1s);
659+
Set<Abstraction> res = computeTargetsInternal(source, calleeD1, callerD1s);
663660
return notifyOutFlowHandlers(exitSite, calleeD1, source, res,
664661
TaintPropagationHandler.FlowFunctionType.ReturnFlowFunction);
665662
}
@@ -843,8 +840,7 @@ public Set<Abstraction> computeTargets(Abstraction d1, Abstraction source) {
843840
taintPropagationHandler.notifyFlowIn(callSite, source, manager,
844841
TaintPropagationHandler.FlowFunctionType.CallToReturnFlowFunction);
845842

846-
Set<Abstraction> res = computeTargetsInternal(d1,
847-
source.isAbstractionActive() ? source : source.getActiveCopy());
843+
Set<Abstraction> res = computeTargetsInternal(d1, source);
848844
return notifyOutFlowHandlers(callSite, d1, source, res,
849845
TaintPropagationHandler.FlowFunctionType.CallToReturnFlowFunction);
850846
}

‎soot-infoflow/src/soot/jimple/infoflow/problems/rules/backward/BackwardsImplicitFlowRule.java‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -122,23 +122,6 @@ else if (stmt instanceof SwitchStmt)
122122
return null;
123123

124124
UnitContainer dominator = manager.getICFG().getDominatorOf(stmt);
125-
// When a taint which just has been handed over
126-
if (source.isAbstractionActive() && source.getPredecessor() != null
127-
&& !source.getPredecessor().isAbstractionActive()) {
128-
// We maybe turned around inside a conditional, so we reconstruct the condition
129-
// dominator
130-
// Also, we lost track of the dominators in the alias search. Thus, we derive
131-
// interprocedural wildcards.
132-
// See ImplicitTests#conditionalAliasingTest
133-
List<Unit> condUnits = manager.getICFG().getConditionalBranchesInterprocedural(stmt);
134-
// No condition path -> no need to search for one
135-
for (Unit condUnit : condUnits) {
136-
Abstraction abs = source.deriveNewAbstractionWithDominator(condUnit);
137-
if (abs != null)
138-
manager.getForwardSolver().processEdge(new PathEdge<>(d1, stmt, abs));
139-
}
140-
return null;
141-
}
142125

143126
// Taint enters a conditional branch
144127
// Only handle cases where the taint is not part of the statement
@@ -257,8 +240,6 @@ public Collection<Abstraction> propagateCallToReturnFlow(Abstraction d1, Abstrac
257240
res.add(thisTaint);
258241
}
259242

260-
System.out.println(res.size());
261-
262243
return res;
263244
}
264245
}

0 commit comments

Comments
 (0)