Package com.h3xstream.findsecbugs.injection.xml

Class XmlInjectionDetector

java.lang.Object

com.h3xstream.findsecbugs.injection.AbstractTaintDetector

com.h3xstream.findsecbugs.injection.AbstractInjectionDetector

com.h3xstream.findsecbugs.injection.BasicInjectionDetector

com.h3xstream.findsecbugs.injection.xml.XmlInjectionDetector

All Implemented Interfaces:

TaintFrameAdditionalVisitor, edu.umd.cs.findbugs.Detector, edu.umd.cs.findbugs.Priorities

public class XmlInjectionDetector
extends BasicInjectionDetector
implements TaintFrameAdditionalVisitor

Detect string concatenation that appears to be constructing XML or HTML documents.

Author:

baloghadamsoftware, h3xstream

Field Summary

Fields inherited from class com.h3xstream.findsecbugs.injection.AbstractInjectionDetector

injectionSinks

Fields inherited from class com.h3xstream.findsecbugs.injection.AbstractTaintDetector

bugReporter

Fields inherited from interface edu.umd.cs.findbugs.Priorities

EXP_PRIORITY, HIGH_PRIORITY, IGNORE_PRIORITY, LOW_PRIORITY, NORMAL_PRIORITY

Constructor Summary

Constructors

Constructor	Description
XmlInjectionDetector(edu.umd.cs.findbugs.BugReporter bugReporter)

Method Summary

Modifier and Type	Method	Description
protected int	getPriorityFromTaintFrame(TaintFrame taintFrame, int offset)	The default implementation of getPriorityFromTaintFrame() can be overridden if the detector must base its priority on multiple parameters or special conditions like constant values.
boolean	shouldAnalyzeClass(edu.umd.cs.findbugs.ba.ClassContext classContext)	Before we added new tag to the taint analysis and add more effort, here is a linear search on the constant pool.
void	visitField(org.apache.bcel.generic.FieldInstruction put, org.apache.bcel.generic.MethodGen methodGen, TaintFrame frameType, Taint taint, int numProduced, org.apache.bcel.generic.ConstantPoolGen cpg)
void	visitInvoke(org.apache.bcel.generic.InvokeInstruction invoke, org.apache.bcel.generic.MethodGen methodGen, TaintFrame frameType, List<Taint> parameters, org.apache.bcel.generic.ConstantPoolGen cpg)	This method will be triggered for every method invocation (static, interface, special and virtual).
void	visitLoad(org.apache.bcel.generic.LoadInstruction instruction, org.apache.bcel.generic.MethodGen methodGen, TaintFrame frameType, int numProduced, org.apache.bcel.generic.ConstantPoolGen cpg)
void	visitReturn(org.apache.bcel.generic.MethodGen methodGen, Taint returnValue, org.apache.bcel.generic.ConstantPoolGen cpg)

Methods inherited from class com.h3xstream.findsecbugs.injection.BasicInjectionDetector

addParsedInjectionPoint, getInjectionPoint, loadConfiguredSinks, loadConfiguredSinks, loadCustomSinks, loadCustomSinksConfigFiles, loadSink, registerVisitor

Methods inherited from class com.h3xstream.findsecbugs.injection.AbstractInjectionDetector

analyzeLocation, getPriority, report

Methods inherited from class com.h3xstream.findsecbugs.injection.AbstractTaintDetector

analyzeMethod, visitClassContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

XmlInjectionDetector

public XmlInjectionDetector(edu.umd.cs.findbugs.BugReporter bugReporter)

Method Detail

getPriorityFromTaintFrame

protected int getPriorityFromTaintFrame(TaintFrame taintFrame,
                                        int offset)
                                 throws edu.umd.cs.findbugs.ba.DataflowAnalysisException

Description copied from class: AbstractInjectionDetector

The default implementation of getPriorityFromTaintFrame() can be overridden if the detector must base its priority on multiple parameters or special conditions like constant values. By default, this method will call the getPriority() method with the parameter taint at the specified offset.

Overrides:

getPriorityFromTaintFrame in class AbstractInjectionDetector

Parameters:

taintFrame - The TaintFrame for the inspected instruction call.

offset - The offset of the checked parameter.

Returns:

Priorities interface values from 1 to 5 (Enum-like interface)

Throws:

edu.umd.cs.findbugs.ba.DataflowAnalysisException - An exception thrown when the TaintFrame cannot be analyzed.

visitInvoke

public void visitInvoke(org.apache.bcel.generic.InvokeInstruction invoke,
                        org.apache.bcel.generic.MethodGen methodGen,
                        TaintFrame frameType,
                        List<Taint> parameters,
                        org.apache.bcel.generic.ConstantPoolGen cpg)
                 throws edu.umd.cs.findbugs.ba.DataflowAnalysisException

Description copied from interface: TaintFrameAdditionalVisitor

This method will be triggered for every method invocation (static, interface, special and virtual). The constant pool allowed the resolution of method name, field name, constant strings, etc. The taintframe

Specified by:

visitInvoke in interface TaintFrameAdditionalVisitor

methodGen - Method

frameType - Frame representation after the invoke (results)

parameters - Stack representation just before the invoke

Throws:

edu.umd.cs.findbugs.ba.DataflowAnalysisException

visitReturn

public void visitReturn(org.apache.bcel.generic.MethodGen methodGen,
                        Taint returnValue,
                        org.apache.bcel.generic.ConstantPoolGen cpg)
                 throws Exception

Specified by:

visitReturn in interface TaintFrameAdditionalVisitor

Parameters:

methodGen - Method

returnValue - State of the returned value.

Throws:

Exception

visitLoad

public void visitLoad(org.apache.bcel.generic.LoadInstruction instruction,
                      org.apache.bcel.generic.MethodGen methodGen,
                      TaintFrame frameType,
                      int numProduced,
                      org.apache.bcel.generic.ConstantPoolGen cpg)

Specified by:

visitLoad in interface TaintFrameAdditionalVisitor

visitField

public void visitField(org.apache.bcel.generic.FieldInstruction put,
                       org.apache.bcel.generic.MethodGen methodGen,
                       TaintFrame frameType,
                       Taint taint,
                       int numProduced,
                       org.apache.bcel.generic.ConstantPoolGen cpg)
                throws Exception

Specified by:

visitField in interface TaintFrameAdditionalVisitor

Throws:

Exception

shouldAnalyzeClass

public boolean shouldAnalyzeClass(edu.umd.cs.findbugs.ba.ClassContext classContext)

Before we added new tag to the taint analysis and add more effort, here is a linear search on the constant pool. Constant pool include all the constant use in the code of the class. It contains class references and string value. If there are no XML in string in the class, we are add not going to run this additional visitor.

Overrides:

shouldAnalyzeClass in class AbstractTaintDetector

Parameters:

classContext - Information about the class that is about to be analyzed

Returns: