Package com.h3xstream.findsecbugs.taintanalysis

Class TaintMethodConfigWithArgumentsAndLocation

java.lang.Object

com.h3xstream.findsecbugs.taintanalysis.TaintMethodConfig

com.h3xstream.findsecbugs.taintanalysis.TaintMethodConfigWithArgumentsAndLocation

All Implemented Interfaces:

TaintTypeConfig

public class TaintMethodConfigWithArgumentsAndLocation
extends TaintMethodConfig

Summary of information about a taint analysis method with configured arguments and location of the call.

Can be used to fine-tune false-positives in specific classes.

Examples:
javax/servlet/http/HttpServletRequest.getAttribute("applicationConstant"):SAFE@org/apache/jsp/edit_jsp
javax/servlet/http/HttpServletRequest.getAttribute(UNKNOWN):SAFE@org/apache/jsp/constants_jsp

Author:

Tomas Polesovsky (Liferay, Inc.)

Field Summary

Fields inherited from class com.h3xstream.findsecbugs.taintanalysis.TaintMethodConfig

configPattern, fullMethodPattern, SAFE_CONFIG

Constructor Summary

Constructors

Constructor	Description
TaintMethodConfigWithArgumentsAndLocation()	Constructs an empty configured summary

Method Summary

Modifier and Type	Method	Description
static boolean	accepts(String typeSignature, String config)
String	getLocation()
TaintMethodConfigWithArgumentsAndLocation	load(String taintConfig)	Loads method config from String, the method config contains a current class as the context The method accepts syntax similar to TaintMethodConfig.load(String) with small difference. The summary must ends with '@' character followed by class name

Methods inherited from class com.h3xstream.findsecbugs.taintanalysis.TaintMethodConfig

addMutableStackIndex, getDefaultConstructorConfig, getMutableStackIndices, getOutputTaint, getParametersOutputTaints, getTypeSignature, hasMutableStackIndices, isConfigured, isInformative, isParametersOutputTaintsProcessed, setOuputTaint, setParameterOutputTaint, setParametersOutputTaintsProcessed, setTypeSignature, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

TaintMethodConfigWithArgumentsAndLocation

public TaintMethodConfigWithArgumentsAndLocation()

Constructs an empty configured summary

Method Detail

accepts

public static boolean accepts(String typeSignature,
                              String config)

load

public TaintMethodConfigWithArgumentsAndLocation load(String taintConfig)
                                               throws IOException

Loads method config from String, the method config contains a current class as the context

The method accepts syntax similar to TaintMethodConfig.load(String) with small difference.
The summary must ends with '@' character followed by class name

Specified by:

load in interface TaintTypeConfig

Overrides:

load in class TaintMethodConfig

Parameters:

taintConfig - method summary with syntax described above

Returns:

initialized object with taint method summary

Throws:

IOException - for bad format of parameter

NullPointerException - if argument is null

getLocation

public String getLocation()