Package proguard.analysis.cpa.util

Class TaintAnalyzerResult.TaintAnalysisResult

java.lang.Object

proguard.analysis.cpa.util.TaintAnalyzerResult.TaintAnalysisResult

Enclosing class:

TaintAnalyzerResult

public static class TaintAnalyzerResult.TaintAnalysisResult
extends Object

Results for taint analysis. Provides the reached states and which sinks were triggered, but no witness trace on how the sink was reached from a source (use TaintAnalyzerResult.getTraceReconstructionResult() for that).

Method Summary

Modifier and Type	Method	Description
Collection<BamLocationDependentJvmMemoryLocation<SetAbstractState<JvmTaintSource>>>	getEndpoints()	Get locations where sinks have been triggered by a valid source.
Map<BamLocationDependentJvmMemoryLocation<SetAbstractState<JvmTaintSource>>,List<JvmTaintSink>>	getEndpointToTriggeredSinks()	Maps locations where sinks have been triggered by valid sources to the triggered sink.
ProgramLocationDependentReachedSet<JvmAbstractState<SetAbstractState<JvmTaintSource>>>	getMainMethodReachedSet()	Returns the reached states for the entry method of the analysis.
BamCache<SetAbstractState<JvmTaintSource>>	getTaintResultCache()	Returns the analysis cache, containing the analyzed taints for each reached method invocation with unique tainted parameters.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

getTaintResultCache

public BamCache<SetAbstractState<JvmTaintSource>> getTaintResultCache()

Returns the analysis cache, containing the analyzed taints for each reached method invocation with unique tainted parameters.

getMainMethodReachedSet

public ProgramLocationDependentReachedSet<JvmAbstractState<SetAbstractState<JvmTaintSource>>> getMainMethodReachedSet()

Returns the reached states for the entry method of the analysis.

getEndpoints

public Collection<BamLocationDependentJvmMemoryLocation<SetAbstractState<JvmTaintSource>>> getEndpoints()

Get locations where sinks have been triggered by a valid source.

The endpoints are computed lazily, since it can be an expensive operation, and multiple runs of TaintAnalyzer.analyze(MethodSignature) just update the same cache. So, if the same TaintAnalyzer performs several runs, it's better to get the endpoints only after all runs have been executed.

getEndpointToTriggeredSinks

public Map<BamLocationDependentJvmMemoryLocation<SetAbstractState<JvmTaintSource>>,List<JvmTaintSink>> getEndpointToTriggeredSinks()

Maps locations where sinks have been triggered by valid sources to the triggered sink.

The endpoints are computed lazily, since it can be an expensive operation, and multiple runs of TaintAnalyzer.analyze(MethodSignature) just update the same cache. So, if the same TaintAnalyzer performs several runs, it's better to get the endpoints only after all runs have been executed.