com.h3xstream.findsecbugs.taintanalysis

Class TaintAnalysis

java.lang.Object

edu.umd.cs.findbugs.ba.BasicAbstractDataflowAnalysis<Fact>

edu.umd.cs.findbugs.ba.AbstractDataflowAnalysis<Fact>

edu.umd.cs.findbugs.ba.ForwardDataflowAnalysis<FrameType>

edu.umd.cs.findbugs.ba.FrameDataflowAnalysis<Taint,TaintFrame>

com.h3xstream.findsecbugs.taintanalysis.TaintAnalysis

All Implemented Interfaces:

edu.umd.cs.findbugs.ba.DataflowAnalysis<TaintFrame>

public class TaintAnalysis
extends edu.umd.cs.findbugs.ba.FrameDataflowAnalysis<Taint,TaintFrame>

Implements taint dataflow operations, in particular meeting facts, transfer function is delegated to TaintFrameModelingVisitor

Author:

David Formanek (Y Soft Corporation, a.s.)

Constructor Summary

Constructors

Constructor and Description
TaintAnalysis(org.apache.bcel.generic.MethodGen methodGen, edu.umd.cs.findbugs.ba.DepthFirstSearch dfs, edu.umd.cs.findbugs.classfile.MethodDescriptor descriptor, TaintConfig taintConfig) Constructs analysis for the given method

Method Summary

Modifier and Type	Method and Description
TaintFrame	createFact()
void	finishAnalysis() This method must be called after executing the data flow
void	initEntryFact(TaintFrame fact) Initialize the initial state of a TaintFrame.
void	meetInto(TaintFrame fact, edu.umd.cs.findbugs.ba.Edge edge, TaintFrame result)
protected void	mergeValues(TaintFrame frame, TaintFrame result, int i)
void	transferInstruction(org.apache.bcel.generic.InstructionHandle handle, edu.umd.cs.findbugs.ba.BasicBlock block, TaintFrame fact)

Methods inherited from class edu.umd.cs.findbugs.ba.FrameDataflowAnalysis

copy, getFactAtPC, getFactBeforeExceptionCheck, getLastUpdateTimestamp, isFactValid, isTop, makeFactTop, mergeInto, modifyFrame, same, setLastUpdateTimestamp

Methods inherited from class edu.umd.cs.findbugs.ba.ForwardDataflowAnalysis

getBlockOrder, getDepthFirstSearch, isForwards

Methods inherited from class edu.umd.cs.findbugs.ba.AbstractDataflowAnalysis

getFactAfterLocation, getFactAtLocation, transfer

Methods inherited from class edu.umd.cs.findbugs.ba.BasicAbstractDataflowAnalysis

edgeTransfer, factToString, finishIteration, getFactOnEdge, getResultFact, getStartFact, resultFactIterator, startIteration

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

TaintAnalysis

public TaintAnalysis(org.apache.bcel.generic.MethodGen methodGen,
                     edu.umd.cs.findbugs.ba.DepthFirstSearch dfs,
                     edu.umd.cs.findbugs.classfile.MethodDescriptor descriptor,
                     TaintConfig taintConfig)

Constructs analysis for the given method

Parameters:

methodGen - method to analyze

dfs - DFS algorithm

descriptor - descriptor of the method to analyze

taintConfig - configured and derived taint summaries

Method Detail

mergeValues

protected void mergeValues(TaintFrame frame,
                           TaintFrame result,
                           int i)
                    throws edu.umd.cs.findbugs.ba.DataflowAnalysisException

Specified by:

mergeValues in class edu.umd.cs.findbugs.ba.FrameDataflowAnalysis<Taint,TaintFrame>

Throws:

edu.umd.cs.findbugs.ba.DataflowAnalysisException

transferInstruction

public void transferInstruction(org.apache.bcel.generic.InstructionHandle handle,
                                edu.umd.cs.findbugs.ba.BasicBlock block,
                                TaintFrame fact)
                         throws edu.umd.cs.findbugs.ba.DataflowAnalysisException

Specified by:

transferInstruction in class edu.umd.cs.findbugs.ba.AbstractDataflowAnalysis<TaintFrame>

Throws:

edu.umd.cs.findbugs.ba.DataflowAnalysisException

createFact

public TaintFrame createFact()

initEntryFact

public void initEntryFact(TaintFrame fact)

Initialize the initial state of a TaintFrame.

Parameters:

fact - Initial frame

meetInto

public void meetInto(TaintFrame fact,
                     edu.umd.cs.findbugs.ba.Edge edge,
                     TaintFrame result)
              throws edu.umd.cs.findbugs.ba.DataflowAnalysisException

Throws:

edu.umd.cs.findbugs.ba.DataflowAnalysisException

finishAnalysis

public void finishAnalysis()

This method must be called after executing the data flow