Package com.h3xstream.findsecbugs.taintanalysis

Class TaintConfig

java.lang.Object

java.util.AbstractMap<K,V>

java.util.HashMap<String,TaintMethodConfig>

com.h3xstream.findsecbugs.taintanalysis.TaintConfig

All Implemented Interfaces:

Serializable, Cloneable, Map<String,TaintMethodConfig>

public class TaintConfig
extends HashMap<String,TaintMethodConfig>

Map of taint summaries for all known methods and classes This class extends HashMap:

• The key is the method signature (ie : org/hibernate/Session.createQuery(Ljava/lang/String;)Lorg/hibernate/Query;)
• The value is the behavior of the method ("0" for param index 0 is tainted, "UNKNOWN" if the method does not become tainted base on the value, "TAINTED" if the result must be consider unsafe)

Author:

David Formanek (Y Soft Corporation, a.s.)

See Also:

Serialized Form

Nested Class Summary

Nested classes/interfaces inherited from class java.util.AbstractMap

AbstractMap.SimpleEntry<K extends Object,V extends Object>, AbstractMap.SimpleImmutableEntry<K extends Object,V extends Object>

Nested classes/interfaces inherited from interface java.util.Map

Map.Entry<K extends Object,V extends Object>

Constructor Summary

Constructors

Constructor	Description
TaintConfig()

Method Summary

Modifier and Type	Method	Description
void	dump(PrintStream output)	Dumps all the summaries for debugging
Taint.State	getClassTaintState(String typeSignature, Taint.State defaultState)
Taint.State	getFieldTaintState(String fieldSignature, Taint.State defaultState)
TaintMethodConfig	getMethodConfig(TaintFrame frame, edu.umd.cs.findbugs.classfile.MethodDescriptor methodDescriptor, String className, String methodId)
Taint	getStaticFieldTaint(String fieldSignature, Taint defaultValue)
TaintMethodConfig	getSuperMethodConfig(String className, String methodId)
TaintClassConfig	getTaintClassConfig(String typeSignature)
boolean	isClassImmutable(String typeSignature)
boolean	isClassTaintSafe(String typeSignature)
void	load(InputStream input, boolean checkRewrite)	Loads summaries from stream checking the format
void	putStaticFieldTaint(String fieldSignature, Taint t)

Methods inherited from class java.util.HashMap

clear, clone, compute, computeIfAbsent, computeIfPresent, containsKey, containsValue, entrySet, forEach, get, getOrDefault, isEmpty, keySet, merge, put, putAll, putIfAbsent, remove, remove, replace, replace, replaceAll, size, values

Methods inherited from class java.util.AbstractMap

equals, hashCode, toString

Methods inherited from class java.lang.Object

finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface java.util.Map

equals, hashCode

Constructor Detail

TaintConfig

public TaintConfig()

Method Detail

dump

public void dump(PrintStream output)

Dumps all the summaries for debugging

Parameters:

output - stream where to output the summaries

load

public void load(InputStream input,
                 boolean checkRewrite)
          throws IOException

Loads summaries from stream checking the format

Parameters:

input - input stream of configured summaries

checkRewrite - whether to check duplicit summaries

Throws:

IOException - if cannot read the stream or the format is bad

IllegalArgumentException - for bad method format

IllegalStateException - if there are duplicit configurations

isClassImmutable

public boolean isClassImmutable(String typeSignature)

isClassTaintSafe

public boolean isClassTaintSafe(String typeSignature)

getClassTaintState

public Taint.State getClassTaintState(String typeSignature,
                                      Taint.State defaultState)

getFieldTaintState

public Taint.State getFieldTaintState(String fieldSignature,
                                      Taint.State defaultState)

getTaintClassConfig

public TaintClassConfig getTaintClassConfig(String typeSignature)

getMethodConfig

public TaintMethodConfig getMethodConfig(TaintFrame frame,
                                         edu.umd.cs.findbugs.classfile.MethodDescriptor methodDescriptor,
                                         String className,
                                         String methodId)

getSuperMethodConfig

public TaintMethodConfig getSuperMethodConfig(String className,
                                              String methodId)

getStaticFieldTaint

public Taint getStaticFieldTaint(String fieldSignature,
                                 Taint defaultValue)

putStaticFieldTaint

public void putStaticFieldTaint(String fieldSignature,
                                Taint t)