Package proguard.analysis.cpa.jvm.domain.taint

Class TaintExpandOperator

java.lang.Object

proguard.analysis.cpa.jvm.operators.DefaultExpandOperator<SetAbstractState<TaintSource>>

proguard.analysis.cpa.jvm.domain.taint.TaintExpandOperator

All Implemented Interfaces:

ExpandOperator<SetAbstractState<TaintSource>>

public class TaintExpandOperator
extends DefaultExpandOperator<SetAbstractState<TaintSource>>

This ExpandOperator inherits all the functionalities of a DefaultExpandOperator and in addition taints the return values if the called function is a source.

Constructor Summary

Constructors

Constructor	Description
TaintExpandOperator(JvmCfa cfa, Map<Signature,Set<TaintSource>> signaturesToSources)	Create the operator specifying the taint sources.
TaintExpandOperator(JvmCfa cfa, Map<Signature,Set<TaintSource>> signaturesToSources, boolean expandHeap)	Create the operator specifying the taint sources.

Method Summary

Modifier and Type	Method	Description
protected List<SetAbstractState<TaintSource>>	calculateReturnValues(JvmAbstractState<SetAbstractState<TaintSource>> reducedExitState, Instruction returnInstruction, Call call)	The calculation of return values supports tainting it in case the analyzed method is a taint source.
protected JvmAbstractState<SetAbstractState<TaintSource>>	createJvmAbstractState(JvmCfaNode programLocation, JvmFrameAbstractState<SetAbstractState<TaintSource>> frame, JvmHeapAbstractState<SetAbstractState<TaintSource>> heap, MapAbstractState<String,SetAbstractState<TaintSource>> staticFields)
JvmAbstractState<SetAbstractState<TaintSource>>	expand(JvmAbstractState<SetAbstractState<TaintSource>> expandedInitialState, JvmAbstractState<SetAbstractState<TaintSource>> reducedExitState, JvmCfaNode blockEntryNode, Call call)	Reconstructs the state of the caller of a procedure using the information of the expanded initial state, the reduced exit state, the block entry node (that can be used to retrieve the CFA subgraph of the function), and the call to the procedure.
Map<Signature,Set<TaintSource>>	getSignaturesToSources()	Returns the mapping from fqns to taint sources.

Methods inherited from class proguard.analysis.cpa.jvm.operators.DefaultExpandOperator

expandHeap

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

TaintExpandOperator

public TaintExpandOperator(JvmCfa cfa,
 Map<Signature,Set<TaintSource>> signaturesToSources,
 boolean expandHeap)

Create the operator specifying the taint sources.

Parameters:

cfa - the control flow automaton of the analyzed program.

signaturesToSources - a mapping from method signatures to their TaintSource

expandHeap - whether expansion of the heap is performed

TaintExpandOperator

public TaintExpandOperator(JvmCfa cfa,
 Map<Signature,Set<TaintSource>> signaturesToSources)

Create the operator specifying the taint sources.

Parameters:

cfa - the control flow automaton of the analyzed program.

signaturesToSources - a mapping from method signatures to their TaintSource

Method Details

expand

public JvmAbstractState<SetAbstractState<TaintSource>> expand(JvmAbstractState<SetAbstractState<TaintSource>> expandedInitialState,
 JvmAbstractState<SetAbstractState<TaintSource>> reducedExitState,
 JvmCfaNode blockEntryNode,
 Call call)

Description copied from interface: ExpandOperator

Reconstructs the state of the caller of a procedure using the information of the expanded initial state, the reduced exit state, the block entry node (that can be used to retrieve the CFA subgraph of the function), and the call to the procedure.

Specified by:

expand in interface ExpandOperator<SetAbstractState<TaintSource>>

Overrides:

expand in class DefaultExpandOperator<SetAbstractState<TaintSource>>

Parameters:

expandedInitialState - the entry state of the called procedure before any reduction

reducedExitState - the state of the called procedure in its exit node

blockEntryNode - the entry node of the called procedure

call - the information of the call to the procedure

Returns:

The state of the caller after the procedure call, eventually with some collisions of identifiers that need the RebuildOperator to be solved

calculateReturnValues

protected List<SetAbstractState<TaintSource>> calculateReturnValues(JvmAbstractState<SetAbstractState<TaintSource>> reducedExitState,
 Instruction returnInstruction,
 Call call)

The calculation of return values supports tainting it in case the analyzed method is a taint source.

Overrides:

calculateReturnValues in class DefaultExpandOperator<SetAbstractState<TaintSource>>

createJvmAbstractState

protected JvmAbstractState<SetAbstractState<TaintSource>> createJvmAbstractState(JvmCfaNode programLocation,
 JvmFrameAbstractState<SetAbstractState<TaintSource>> frame,
 JvmHeapAbstractState<SetAbstractState<TaintSource>> heap,
 MapAbstractState<String,SetAbstractState<TaintSource>> staticFields)

Overrides:

createJvmAbstractState in class DefaultExpandOperator<SetAbstractState<TaintSource>>

getSignaturesToSources

public Map<Signature,Set<TaintSource>> getSignaturesToSources()

Returns the mapping from fqns to taint sources.