infer_clone/infer/src/checkers/Sink.mli

(*
 * Copyright (c) 2016 - present Facebook, Inc.
 * All rights reserved.
 *
 * This source code is licensed under the BSD style license found in the
 * LICENSE file in the root directory of this source tree. An additional grant
 * of patent rights can be found in the PATENTS file in the same directory.
 *)

open! IStd

module type Kind = sig
  include TraceElem.Kind

  val get : Typ.Procname.t -> HilExp.t list -> Tenv.t -> (t * IntSet.t) option
  (** return Some kind if the given procname/actuals are a sink, None otherwise *)
end

module type S = sig
  include TraceElem.S

  val get : CallSite.t -> HilExp.t list -> Tenv.t -> t option
  (** return Some sink if the given call site/actuals are a sink, None otherwise *)

  val indexes : t -> IntSet.t
  (** return the indexes where taint can flow into the sink *)
end

module Make (Kind : Kind) : S with module Kind = Kind
trace building blocks: sources and sinks Reviewed By: jberdine Differential Revision: D3684221 fbshipit-source-id: fe6917f 9 years ago			`(*`
			`* Copyright (c) 2016 - present Facebook, Inc.`
			`* All rights reserved.`
			`*`
			`* This source code is licensed under the BSD style license found in the`
			`* LICENSE file in the root directory of this source tree. An additional grant`
			`* of patent rights can be found in the PATENTS file in the same directory.`
			`*)`

Open Core.Std by default, still use Caml Hashtbl, Map, Set Reviewed By: cristianoc Differential Revision: D4232458 fbshipit-source-id: 3d73c69 8 years ago			`open! IStd`

[traces] adding Sink.Make functor for easier sink creation Summary: Let's write sink specifications with less boilerplate too! Reviewed By: jvillard Differential Revision: D4357952 fbshipit-source-id: e6610a3 8 years ago			`module type Kind = sig`
			`include TraceElem.Kind`
[traces] Move all trace-related files to checkers Summary: Other checkers are going to start using these, so they shouldn't live in the Quandary directory anymore Reviewed By: jvillard Differential Revision: D4124654 fbshipit-source-id: b1d5bdd 8 years ago
Convert Reason to OCaml, and auto-format OCaml Summary: Conversion and reformat of infer source using ocamlformat auto-formatting tool. Current status: - Because Reason does not handle docstrings, the output of the conversion is not 'Warning 50'-clean, meaning that there are docstrings with ambiguous placement. I'll need to manually fix them just before landing. Reviewed By: jvillard Differential Revision: D5225546 fbshipit-source-id: 3bd2786 8 years ago			`val get : Typ.Procname.t -> HilExp.t list -> Tenv.t -> (t * IntSet.t) option`
[quandary] add indexes to sinks Summary: First step toward addressing bad traces that happen in examples like ``` void sourceMethod() { Obj source = (Obj) InferTaint.inferSecretSource(); callSameSink(null, source); // index: 1 } void callSameSink(Obj o1, Obj o2) { callMySink1(o1); // flows via o1 ~= index 0, don't expand callMySink2(o2); // flows via o2 ~= index 1, can expand } void callMySink1(Obj o) { ... // maybe interesting something happens here that doesn't happen in callMySink2 InferTaint.inferSensitiveSink(o); // flows via o ~= index 0, can expand } void callMySink2(Obj o) { InferTaint.inferSensitiveSink(o); // flows via o ~= index 0, can expand } ``` The issue is that when we recreate a trace to the sink starting from `sourceMethod`, we don't know which of the calls to `callMySink` to expand/include in the trace. If we expand the call to `callMySink(o1)`, we'll get a bogus trace. In this example that's not such a big deal, but imagine the case where the first call to `callMySink` is a different function that transitively calls the sink through some long and confusing path. Remembering the index at which taint flows into each sink will let us choose which sinks are safe to expand. This diff just adds indexes to the API; it's not actually propagating the index info or using it during expansion yet. Reviewed By: jeremydubreil Differential Revision: D5170563 fbshipit-source-id: ba4b096 8 years ago			`(** return Some kind if the given procname/actuals are a sink, None otherwise *)`
[traces] adding Sink.Make functor for easier sink creation Summary: Let's write sink specifications with less boilerplate too! Reviewed By: jvillard Differential Revision: D4357952 fbshipit-source-id: e6610a3 8 years ago			`end`
richer sink specifications Reviewed By: jeremydubreil Differential Revision: D3831688 fbshipit-source-id: 199f1a5 9 years ago
trace building blocks: sources and sinks Reviewed By: jberdine Differential Revision: D3684221 fbshipit-source-id: fe6917f 9 years ago			`module type S = sig`
			`include TraceElem.S`

[quandary] add indexes to sinks Summary: First step toward addressing bad traces that happen in examples like ``` void sourceMethod() { Obj source = (Obj) InferTaint.inferSecretSource(); callSameSink(null, source); // index: 1 } void callSameSink(Obj o1, Obj o2) { callMySink1(o1); // flows via o1 ~= index 0, don't expand callMySink2(o2); // flows via o2 ~= index 1, can expand } void callMySink1(Obj o) { ... // maybe interesting something happens here that doesn't happen in callMySink2 InferTaint.inferSensitiveSink(o); // flows via o ~= index 0, can expand } void callMySink2(Obj o) { InferTaint.inferSensitiveSink(o); // flows via o ~= index 0, can expand } ``` The issue is that when we recreate a trace to the sink starting from `sourceMethod`, we don't know which of the calls to `callMySink` to expand/include in the trace. If we expand the call to `callMySink(o1)`, we'll get a bogus trace. In this example that's not such a big deal, but imagine the case where the first call to `callMySink` is a different function that transitively calls the sink through some long and confusing path. Remembering the index at which taint flows into each sink will let us choose which sinks are safe to expand. This diff just adds indexes to the API; it's not actually propagating the index info or using it during expansion yet. Reviewed By: jeremydubreil Differential Revision: D5170563 fbshipit-source-id: ba4b096 8 years ago			`val get : CallSite.t -> HilExp.t list -> Tenv.t -> t option`
Convert Reason to OCaml, and auto-format OCaml Summary: Conversion and reformat of infer source using ocamlformat auto-formatting tool. Current status: - Because Reason does not handle docstrings, the output of the conversion is not 'Warning 50'-clean, meaning that there are docstrings with ambiguous placement. I'll need to manually fix them just before landing. Reviewed By: jvillard Differential Revision: D5225546 fbshipit-source-id: 3bd2786 8 years ago			`(** return Some sink if the given call site/actuals are a sink, None otherwise *)`
[traces] adding Sink.Make functor for easier sink creation Summary: Let's write sink specifications with less boilerplate too! Reviewed By: jvillard Differential Revision: D4357952 fbshipit-source-id: e6610a3 8 years ago
[quandary] add indexes to sinks Summary: First step toward addressing bad traces that happen in examples like ``` void sourceMethod() { Obj source = (Obj) InferTaint.inferSecretSource(); callSameSink(null, source); // index: 1 } void callSameSink(Obj o1, Obj o2) { callMySink1(o1); // flows via o1 ~= index 0, don't expand callMySink2(o2); // flows via o2 ~= index 1, can expand } void callMySink1(Obj o) { ... // maybe interesting something happens here that doesn't happen in callMySink2 InferTaint.inferSensitiveSink(o); // flows via o ~= index 0, can expand } void callMySink2(Obj o) { InferTaint.inferSensitiveSink(o); // flows via o ~= index 0, can expand } ``` The issue is that when we recreate a trace to the sink starting from `sourceMethod`, we don't know which of the calls to `callMySink` to expand/include in the trace. If we expand the call to `callMySink(o1)`, we'll get a bogus trace. In this example that's not such a big deal, but imagine the case where the first call to `callMySink` is a different function that transitively calls the sink through some long and confusing path. Remembering the index at which taint flows into each sink will let us choose which sinks are safe to expand. This diff just adds indexes to the API; it's not actually propagating the index info or using it during expansion yet. Reviewed By: jeremydubreil Differential Revision: D5170563 fbshipit-source-id: ba4b096 8 years ago			`val indexes : t -> IntSet.t`
Convert Reason to OCaml, and auto-format OCaml Summary: Conversion and reformat of infer source using ocamlformat auto-formatting tool. Current status: - Because Reason does not handle docstrings, the output of the conversion is not 'Warning 50'-clean, meaning that there are docstrings with ambiguous placement. I'll need to manually fix them just before landing. Reviewed By: jvillard Differential Revision: D5225546 fbshipit-source-id: 3bd2786 8 years ago			`(** return the indexes where taint can flow into the sink *)`
trace building blocks: sources and sinks Reviewed By: jberdine Differential Revision: D3684221 fbshipit-source-id: fe6917f 9 years ago			`end`
[traces] adding Sink.Make functor for easier sink creation Summary: Let's write sink specifications with less boilerplate too! Reviewed By: jvillard Differential Revision: D4357952 fbshipit-source-id: e6610a3 8 years ago
			`module Make (Kind : Kind) : S with module Kind = Kind`