Refactored Taint Analysis #216

Lipen · 2024-02-09T14:05:52Z

This PR contains the config-based taint analysis (using taint-configuration module) and the refactored version of IFDS.

github-actions · 2024-02-09T14:09:49Z

Lifecycle test results

48 tests ±0 48 ✅ ±0 1m 22s ⏱️ -5s
5 suites ±0 0 💤 ±0
5 files ±0 0 ❌ ±0

Results for commit b39519f. ± Comparison against base commit 4499986.

♻️ This comment has been updated with latest results.

github-actions · 2024-02-09T14:12:50Z

Test results on JDK 19

1 325 tests +51 1 313 ✅ +50 7m 4s ⏱️ + 3m 20s
48 suites + 2 12 💤 + 1
48 files + 2 0 ❌ ± 0

Results for commit b39519f. ± Comparison against base commit 4499986.

This pull request removes 999 and adds 1050 tests. Note that renamed tests count towards both.

org.jacodb.analysis.impl.JodaDateTimeAnalysisTest ‑ test Unused variable analysis()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ NPE on uninitialized array element dereferencing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [100] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_02
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [100] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_66a
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [101] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_03
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [101] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_67a
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [102] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_04
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [102] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_68a
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [103] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_06
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [103] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_71a
…

org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ And(Not(True)) is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ And(True) is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ AnnotationType in unexpected()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(boolArg(true), false) is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(boolArg(true), true) is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(intArg(42), 42) is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(intArg(42), 999) is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(stringArg('test'), 'other') is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(stringArg('test'), 'test') is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(unresolved, any) is false()
…

This pull request removes 6 skipped tests and adds 7 skipped tests. Note that renamed tests count towards both.

org.jacodb.analysis.impl.NpeAnalysisTest ‑ activation points maintain flow sensitivity()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ array aliasing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ complex aliasing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ context injection in points-to()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ mixed array and class aliasing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ simple points-to analysis()

org.jacodb.analysis.impl.IfdsNpeTest ‑ activation points maintain flow sensitivity()
org.jacodb.analysis.impl.IfdsNpeTest ‑ array aliasing()
org.jacodb.analysis.impl.IfdsNpeTest ‑ complex aliasing()
org.jacodb.analysis.impl.IfdsNpeTest ‑ context injection in points-to()
org.jacodb.analysis.impl.IfdsNpeTest ‑ mixed array and class aliasing()
org.jacodb.analysis.impl.IfdsNpeTest ‑ no NPE after checked access with field()
org.jacodb.analysis.impl.IfdsNpeTest ‑ simple points-to analysis()

♻️ This comment has been updated with latest results.

github-actions · 2024-02-09T14:13:04Z

Test results on JDK 8

1 325 tests +51 1 311 ✅ +50 7m 28s ⏱️ + 3m 38s
48 suites + 2 14 💤 + 1
48 files + 2 0 ❌ ± 0

Results for commit b39519f. ± Comparison against base commit 4499986.

This pull request removes 999 and adds 1050 tests. Note that renamed tests count towards both.

org.jacodb.analysis.impl.JodaDateTimeAnalysisTest ‑ test Unused variable analysis()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ NPE on uninitialized array element dereferencing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [100] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_02
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [100] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_66a
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [101] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_03
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [101] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_67a
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [102] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_04
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [102] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_68a
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [103] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_06
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [103] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_71a
…

org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ And(Not(True)) is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ And(True) is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ AnnotationType in unexpected()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(boolArg(true), false) is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(boolArg(true), true) is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(intArg(42), 42) is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(intArg(42), 999) is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(stringArg('test'), 'other') is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(stringArg('test'), 'test') is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(unresolved, any) is false()
…

This pull request removes 6 skipped tests and adds 7 skipped tests. Note that renamed tests count towards both.

org.jacodb.analysis.impl.NpeAnalysisTest ‑ activation points maintain flow sensitivity()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ array aliasing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ complex aliasing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ context injection in points-to()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ mixed array and class aliasing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ simple points-to analysis()

org.jacodb.analysis.impl.IfdsNpeTest ‑ activation points maintain flow sensitivity()
org.jacodb.analysis.impl.IfdsNpeTest ‑ array aliasing()
org.jacodb.analysis.impl.IfdsNpeTest ‑ complex aliasing()
org.jacodb.analysis.impl.IfdsNpeTest ‑ context injection in points-to()
org.jacodb.analysis.impl.IfdsNpeTest ‑ mixed array and class aliasing()
org.jacodb.analysis.impl.IfdsNpeTest ‑ no NPE after checked access with field()
org.jacodb.analysis.impl.IfdsNpeTest ‑ simple points-to analysis()

♻️ This comment has been updated with latest results.

github-actions · 2024-02-09T14:13:28Z

Test results on JDK 11

1 325 tests +51 1 315 ✅ +50 8m 3s ⏱️ + 4m 5s
48 suites + 2 10 💤 + 1
48 files + 2 0 ❌ ± 0

Results for commit b39519f. ± Comparison against base commit 4499986.

This pull request removes 999 and adds 1050 tests. Note that renamed tests count towards both.

org.jacodb.analysis.impl.JodaDateTimeAnalysisTest ‑ test Unused variable analysis()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ NPE on uninitialized array element dereferencing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [100] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_02
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [100] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_66a
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [101] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_03
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [101] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_67a
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [102] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_04
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [102] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_68a
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [103] juliet.testcases.CWE476_NULL_Pointer_Dereference.CWE476_NULL_Pointer_Dereference__int_array_06
org.jacodb.analysis.impl.NpeAnalysisTest ‑ [103] juliet.testcases.CWE690_NULL_Deref_From_Return.CWE690_NULL_Deref_From_Return__Properties_getProperty_trim_71a
…

org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ And(Not(True)) is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ And(True) is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ AnnotationType in unexpected()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(boolArg(true), false) is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(boolArg(true), true) is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(intArg(42), 42) is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(intArg(42), 999) is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(stringArg('test'), 'other') is false()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(stringArg('test'), 'test') is true()
org.jacodb.analysis.impl.ConditionEvaluatorTest ‑ ConstantEq(unresolved, any) is false()
…

This pull request removes 6 skipped tests and adds 7 skipped tests. Note that renamed tests count towards both.

org.jacodb.analysis.impl.NpeAnalysisTest ‑ activation points maintain flow sensitivity()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ array aliasing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ complex aliasing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ context injection in points-to()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ mixed array and class aliasing()
org.jacodb.analysis.impl.NpeAnalysisTest ‑ simple points-to analysis()

org.jacodb.analysis.impl.IfdsNpeTest ‑ activation points maintain flow sensitivity()
org.jacodb.analysis.impl.IfdsNpeTest ‑ array aliasing()
org.jacodb.analysis.impl.IfdsNpeTest ‑ complex aliasing()
org.jacodb.analysis.impl.IfdsNpeTest ‑ context injection in points-to()
org.jacodb.analysis.impl.IfdsNpeTest ‑ mixed array and class aliasing()
org.jacodb.analysis.impl.IfdsNpeTest ‑ no NPE after checked access with field()
org.jacodb.analysis.impl.IfdsNpeTest ‑ simple points-to analysis()

♻️ This comment has been updated with latest results.

codecov · 2024-02-09T14:14:17Z

Codecov Report

Attention: Patch coverage is 75.07523% with 497 lines in your changes are missing coverage. Please review.

Project coverage is 75.81%. Comparing base (4499986) to head (b39519f).

Files	Patch %	Lines
...in/org/jacodb/analysis/taint/TaintFlowFunctions.kt	53.60%	110 Missing and 25 partials ⚠️
...kotlin/org/jacodb/analysis/npe/NpeFlowFunctions.kt	70.46%	47 Missing and 36 partials ⚠️
...b/taint/configuration/TaintConfigurationFeature.kt	64.65%	28 Missing and 13 partials ⚠️
...main/kotlin/org/jacodb/analysis/config/Position.kt	46.51%	12 Missing and 11 partials ⚠️
...main/kotlin/org/jacodb/analysis/ifds/IfdsResult.kt	61.66%	17 Missing and 6 partials ⚠️
...rg/jacodb/analysis/unused/UnusedVariableManager.kt	83.06%	12 Missing and 9 partials ⚠️
...n/kotlin/org/jacodb/analysis/taint/TaintManager.kt	88.34%	8 Missing and 11 partials ⚠️
...in/kotlin/org/jacodb/analysis/ifds/UnitResolver.kt	40.74%	15 Missing and 1 partial ⚠️
...main/kotlin/org/jacodb/analysis/ifds/AccessPath.kt	69.56%	4 Missing and 10 partials ⚠️
...n/org/jacodb/taint/configuration/TaintCondition.kt	78.78%	12 Missing and 2 partials ⚠️
... and 33 more

Additional details and impacted files

@@              Coverage Diff              @@
##             develop     #216      +/-   ##
=============================================
- Coverage      77.25%   75.81%   -1.45%     
+ Complexity      1680     1649      -31     
=============================================
  Files            166      175       +9     
  Lines           9648    10241     +593     
  Branches        1730     1892     +162     
=============================================
+ Hits            7454     7764     +310     
- Misses          1509     1713     +204     
- Partials         685      764      +79

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

sergeypospelov

Fix review comments, please

build.gradle.kts

buildSrc/src/main/kotlin/Dependencies.kt

jacodb-analysis/.gitignore

jacodb-analysis/src/main/kotlin/org/jacodb/analysis/config/Condition.kt

jacodb-analysis/src/main/kotlin/org/jacodb/analysis/ifds2/taint/npe/NpeFlowFunctions.kt

jacodb-analysis/src/main/kotlin/org/jacodb/analysis/library/analyzers/TaintAnalyzer.kt

jacodb-analysis/src/main/kotlin/org/jacodb/analysis/paths/Util.kt

jacodb-analysis/src/test/kotlin/org/jacodb/analysis/impl/BaseAnalysisTest.kt

jacodb-analysis/src/test/kotlin/org/jacodb/analysis/impl/BenchRunners.kt

sergeypospelov

LGTM

Lipen · 2024-02-28T10:13:01Z

@lehvolk do you still have any objections? Can we merge this PR as it is?

Lipen force-pushed the lipen/taint branch from 00839df to 16c891b Compare February 9, 2024 16:21

Taint analysis

6c679d1

sergeypospelov force-pushed the lipen/taint branch from 16c891b to 6c679d1 Compare February 12, 2024 09:29

Remove unnecessary accept override

103d20c

Lipen marked this pull request as ready for review February 12, 2024 09:54

sergeypospelov added 7 commits February 12, 2024 13:36

fix: access flags for unknown methods

b1a09c9

fix: revert 0

3ae0bcd

fix: revert 1

bf97bc3

fix: revert 2

c5fbc8f

fix: revert 3

781e65a

fix: TODO

82f2101

fix: revert 5

479be4e

sergeypospelov requested changes Feb 12, 2024

View reviewed changes

Lipen added 12 commits February 14, 2024 11:48

Debug messages

5c9bcf4

Make handleControlEvent non-suspend

d57d3c4

Move getOverrides

9eab66e

Add toString for units

f7f6fc8

Fix summary flows

4a61f44

Fix logger import

6a8a61a

Move entry point for taint analysis

8bf35bf

Delegate to basicConditionEvaluator

028fcf6

Rename Runner

f75a0c3

Use computeIfAbsert, switch to concurrent set

744679b

Make all runner fields private, restore erased types

79527b9

Reuse event instances

013d0f3

Lipen added 18 commits February 19, 2024 20:03

Remove unnecessary stuff

ec55566

Fix NPE tests

f893970

Fix running analysis from Java

e0839cc

Remove ElementAccessor's dummy constructor

b506f74

Use non-nullable T

8a6a3a0

Convert ConditionSimplifier to object

8ea7525

Compact toString

fcad9bd

Cleanup

0ed6f48

Use any

8cd0891

Cleanup

89c1226

Remove unnecessary NewVulnerability event for UnusedVariable analysis

05e992d

Remove unnecessary entry points

0cabd92

Add "entry point" position resolvers

b7a2230

Remove comment

3ec515c

Replace comment with TODO

facb51a

Remove comments

62c8770

Unify code

13e9b53

Add JvmName

0f4464b

Lipen requested a review from sergeypospelov February 21, 2024 11:51

Lipen added 7 commits February 21, 2024 16:32

Trace

ece975a

Add PassThrough rule for Map::put

d70ed76

Use info logger level for found sinks

4b720d5

Add PassThrough for decodeBase64

41ce66a

Add PassThrough rule for Map::replace

3ec7809

Fix ConditionMark evaluation, add adhoc for arrays

ae76dd6

Do not override tainted arrays

b39519f

sergeypospelov approved these changes Feb 26, 2024

View reviewed changes

Lipen merged commit bf3f6b4 into develop Feb 29, 2024

Lipen deleted the lipen/taint branch February 29, 2024 11:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Refactored Taint Analysis #216

Refactored Taint Analysis #216

Uh oh!

Lipen commented Feb 9, 2024 •

edited

Loading

Uh oh!

github-actions bot commented Feb 9, 2024 •

edited

Loading

Uh oh!

github-actions bot commented Feb 9, 2024 •

edited

Loading

Uh oh!

github-actions bot commented Feb 9, 2024 •

edited

Loading

Uh oh!

github-actions bot commented Feb 9, 2024 •

edited

Loading

Uh oh!

codecov bot commented Feb 9, 2024 •

edited

Loading

Uh oh!

sergeypospelov left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sergeypospelov left a comment

Uh oh!

Lipen commented Feb 28, 2024

Uh oh!

Uh oh!

Refactored Taint Analysis #216

Refactored Taint Analysis #216

Uh oh!

Conversation

Lipen commented Feb 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Lifecycle test results

Uh oh!

github-actions bot commented Feb 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test results on JDK 19

Uh oh!

github-actions bot commented Feb 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test results on JDK 8

Uh oh!

github-actions bot commented Feb 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test results on JDK 11

Uh oh!

codecov bot commented Feb 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sergeypospelov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sergeypospelov left a comment

Choose a reason for hiding this comment

Uh oh!

Lipen commented Feb 28, 2024

Uh oh!

Uh oh!

Lipen commented Feb 9, 2024 •

edited

Loading

github-actions bot commented Feb 9, 2024 •

edited

Loading

github-actions bot commented Feb 9, 2024 •

edited

Loading

github-actions bot commented Feb 9, 2024 •

edited

Loading

github-actions bot commented Feb 9, 2024 •

edited

Loading

codecov bot commented Feb 9, 2024 •

edited

Loading