@@ -2705,7 +2705,7 @@ class Traverser(
2705
2705
val parameters = resolveParameters(invokeExpr.args, invokeExpr.method.parameterTypes)
2706
2706
2707
2707
if (UtSettings .useTaintAnalysis) {
2708
- processTaintSink(SymbolicMethodData (invokeExpr.method.executableId, null , parameters, null ))
2708
+ processTaintSink(SymbolicMethodData (invokeExpr.method.executableId, base = null , args = parameters, result = null ))
2709
2709
}
2710
2710
2711
2711
val result = mockMakeSymbolic(invokeExpr) ? : mockStaticMethod(invokeExpr.method, parameters)
@@ -2738,7 +2738,7 @@ class Traverser(
2738
2738
val resolvedParameters = resolveParameters(parameters, method.parameterTypes)
2739
2739
2740
2740
if (UtSettings .useTaintAnalysis) {
2741
- processTaintSink(SymbolicMethodData (method.executableId, instance, resolvedParameters, null ))
2741
+ processTaintSink(SymbolicMethodData (method.executableId, instance, resolvedParameters, result = null ))
2742
2742
}
2743
2743
2744
2744
val invocation = Invocation (instance, method, resolvedParameters) {
@@ -2911,7 +2911,7 @@ class Traverser(
2911
2911
val parameters = resolveParameters(invokeExpr.args, method.parameterTypes)
2912
2912
2913
2913
if (UtSettings .useTaintAnalysis) {
2914
- processTaintSink(SymbolicMethodData (method.executableId, instance, parameters, null ))
2914
+ processTaintSink(SymbolicMethodData (method.executableId, instance, parameters, result = null ))
2915
2915
}
2916
2916
2917
2917
val invocation = Invocation (instance, method, parameters, InvocationTarget (instance, method))
@@ -4270,33 +4270,49 @@ class Traverser(
4270
4270
}
4271
4271
4272
4272
private fun TraversalContext.processTaintSink (methodData : SymbolicMethodData ) {
4273
- val methodName = methodData.methodId.simpleNameWithClass
4274
4273
val sinkConfigurations = taintContext.configuration.getSinksBy(methodData.methodId)
4275
-
4276
- for (sink in sinkConfigurations) {
4274
+ sinkConfigurations.forEach { sink ->
4277
4275
val condition = sink.condition.toBoolExpr(this @Traverser, methodData)
4276
+ sink.check.entities.forEach { entity ->
4277
+ implicitlyThrowTaintError(methodData, entity, sink.marks, condition)
4278
+ }
4279
+ }
4280
+ }
4281
+
4282
+ private fun TraversalContext.implicitlyThrowTaintError (
4283
+ methodData : SymbolicMethodData ,
4284
+ entity : TaintEntity ,
4285
+ marks : TaintMarks ,
4286
+ condition : UtBoolExpression ,
4287
+ ) {
4288
+ val symbolicEntity = methodData.choose(entity) ? : return
4289
+ val entityAddr = symbolicEntity.addrOrNull ? : return
4290
+ val containsAnyMark = taintContext.markManager.containsAnyMark(memory, entityAddr)
4291
+
4292
+ val methodName = methodData.methodId.simpleNameWithClass
4293
+ val taintedVarType = symbolicEntity.type.toQuotedString()
4278
4294
4279
- for (entity in sink.check.entities) {
4280
- val symbolicEntity = methodData.choose(entity) ? : continue
4281
- val entityAddr = symbolicEntity.addrOrNull ? : continue
4282
- val taintedVarType = symbolicEntity.type.toQuotedString()
4295
+ if (UtSettings .throwTaintErrorOnlyForAllMarks) {
4296
+ implicitlyThrowException(
4297
+ TaintAnalysisError (methodName, taintedVarType, " tainted" ),
4298
+ setOf (mkAnd(containsAnyMark, condition))
4299
+ )
4300
+ return
4301
+ }
4283
4302
4284
- if (sink.marks is TaintMarksAll || UtSettings .ThrowTaintErrorOnlyForAllMarks ) {
4285
- val containsAnyMark = taintContext.markManager.containsAnyMark(memory, entityAddr)
4303
+ when (marks) {
4304
+ is TaintMarksAll ->
4305
+ implicitlyThrowException(
4306
+ TaintAnalysisError (methodName, taintedVarType, " tainted" ),
4307
+ setOf (mkAnd(containsAnyMark, condition))
4308
+ )
4309
+ is TaintMarksSet -> {
4310
+ marks.marks.forEach { mark ->
4311
+ val containsMark = taintContext.markManager.containsMark(memory, entityAddr, mark)
4286
4312
implicitlyThrowException(
4287
- TaintAnalysisError (methodName, taintedVarType, " tainted " ),
4288
- setOf (mkAnd(containsAnyMark , condition))
4313
+ TaintAnalysisError (methodName, taintedVarType, mark.name ),
4314
+ setOf (mkAnd(containsMark , condition))
4289
4315
)
4290
- } else if (sink.marks is TaintMarksSet ) {
4291
- for (mark in sink.marks.marks) {
4292
- val containsMark = taintContext.markManager.containsMark(memory, entityAddr, mark)
4293
- implicitlyThrowException(
4294
- TaintAnalysisError (methodName, taintedVarType, mark.name),
4295
- setOf (mkAnd(containsMark, condition))
4296
- )
4297
- }
4298
- } else {
4299
- error(" ${sink.marks::class .java.canonicalName} not is TaintMarksAll and not is TaintMarksSet" )
4300
4316
}
4301
4317
}
4302
4318
}
0 commit comments