diff --git a/infer/src/quandary/TaintAnalysis.ml b/infer/src/quandary/TaintAnalysis.ml index 2250f66bd..4f55bfba3 100644 --- a/infer/src/quandary/TaintAnalysis.ml +++ b/infer/src/quandary/TaintAnalysis.ml @@ -379,15 +379,25 @@ module Make (TraceDomain : QuandarySummary.Trace) = struct match TraceDomain.Source.get_footprint_access_path source with | Some footprint_ap -> let footprint_ap_base = fst (AccessPath.extract footprint_ap) in - let input, output = + begin match AccessPath.BaseMap.find footprint_ap_base formal_map with | formal_index -> let input = QuandarySummary.make_formal_input formal_index footprint_ap in - let output = + begin match output_opt with - | Some output -> output - | None -> QuandarySummary.make_formal_output formal_index footprint_ap in - input, output + | Some output -> + (QuandarySummary.make_in_out_summary input output summary_trace) :: acc + | None -> + if not (TraceDomain.Sinks.is_empty (TraceDomain.sinks trace)) + then + let output = + QuandarySummary.make_formal_output formal_index footprint_ap in + (QuandarySummary.make_in_out_summary input output summary_trace) :: acc + else + (* output access path is same as input access path and there were no sinks + in this function. summary would be the identity function *) + acc + end | exception Not_found -> if is_global footprint_ap_base then @@ -396,12 +406,11 @@ module Make (TraceDomain : QuandarySummary.Trace) = struct match output_opt with | Some output -> output | None -> QuandarySummary.make_global_output footprint_ap in - input, output + (QuandarySummary.make_in_out_summary input output summary_trace) :: acc else failwithf - "Couldn't find formal number for %a@." AccessPath.pp_base footprint_ap_base in - let summary = QuandarySummary.make_in_out_summary input output summary_trace in - summary :: acc + "Couldn't find formal number for %a@." AccessPath.pp_base footprint_ap_base + end | None -> begin match output_opt with diff --git a/infer/tests/codetoanalyze/java/quandary/Interprocedural.java b/infer/tests/codetoanalyze/java/quandary/Interprocedural.java index 32b8b5fbd..d057f914e 100644 --- a/infer/tests/codetoanalyze/java/quandary/Interprocedural.java +++ b/infer/tests/codetoanalyze/java/quandary/Interprocedural.java @@ -58,6 +58,31 @@ class Interprocedural { InferTaint.inferSensitiveSink(returnSourceViaField().f); } + public static void returnSourceViaParameter1(Obj o) { + o.f = InferTaint.inferSecretSource(); + } + + public static void returnSourceViaParameter1Bad(Obj o) { + returnSourceViaParameter1(o); + InferTaint.inferSensitiveSink(o.f); + } + + public static void returnSourceViaParameter2(Obj o1, Obj o2) { + o2.f = o1.f; + } + + public static void returnSourceViaParameter2Bad(Obj o1, Obj o2) { + o1.f = InferTaint.inferSecretSource(); + returnSourceViaParameter2(o1, o2); + InferTaint.inferSensitiveSink(o2.f); + } + + public static void returnSourceViaParameterOk(Obj o1, Obj o2) { + o1.f = InferTaint.inferSecretSource(); + returnSourceViaParameter2(o2, o1); + InferTaint.inferSensitiveSink(o2.f); + } + public static void returnSourceViaGlobal() { sGlobal = InferTaint.inferSecretSource(); } diff --git a/infer/tests/codetoanalyze/java/quandary/issues.exp b/infer/tests/codetoanalyze/java/quandary/issues.exp index 1c793bbf3..2d5c35d2d 100644 --- a/infer/tests/codetoanalyze/java/quandary/issues.exp +++ b/infer/tests/codetoanalyze/java/quandary/issues.exp @@ -70,20 +70,22 @@ Interprocedural.java:39: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTa Interprocedural.java:44: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 31]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 44]) via { Object Interprocedural.returnSourceDirect() at [line 43] } Interprocedural.java:48: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 35]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 48]) via { Object Interprocedural.returnSourceIndirect() at [line 48] } Interprocedural.java:58: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 53]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 58]) via { Interprocedural$Obj Interprocedural.returnSourceViaField() at [line 58] } -Interprocedural.java:67: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 62]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 67]) via { void Interprocedural.returnSourceViaGlobal() at [line 66] } -Interprocedural.java:83: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 83]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 79]) via { void Interprocedural.callSinkParam1(Object,Object) at [line 83] } -Interprocedural.java:95: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 95]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 91]) via { void Interprocedural.callSinkParam2(Object,Object) at [line 95] } -Interprocedural.java:108: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 107]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 103]) via { void Interprocedural.callSinkOnFieldDirect() at [line 108] } -Interprocedural.java:118: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 117]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 112]) via { void Interprocedural.callSinkOnFieldIndirect(Interprocedural$Obj) at [line 118] } -Interprocedural.java:132: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 131]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 127]) via { void Interprocedural.callSinkOnLocal() at [line 132] } -Interprocedural.java:141: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 140]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 136]) via { void Interprocedural.callSinkOnGlobal() at [line 141] } -Interprocedural.java:156: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 155]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 136]) via { void Interprocedural.callSinkOnGlobal() at [line 156], void Interprocedural.setGlobal(Object) at [line 155] } -Interprocedural.java:170: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 169]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 165]) via { void Interprocedural.getGlobalThenCallSink() at [line 170] } -Interprocedural.java:178: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 176]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 178]) via { Object Interprocedural.id(Object) at [line 177] } -Interprocedural.java:185: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 182]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 185]) via { Object Interprocedural.id(Object) at [line 183], Object Interprocedural.id(Object) at [line 184] } -Interprocedural.java:196: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 191]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 196]) via { Object Interprocedural.returnSourceConditional(boolean) at [line 196] } -Interprocedural.java:207: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 205]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 207]) via { } -Interprocedural.java:230: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 228]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 230]) via { } +Interprocedural.java:67: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 62]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 67]) via { void Interprocedural.returnSourceViaParameter1(Interprocedural$Obj) at [line 66] } +Interprocedural.java:77: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 75]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 77]) via { void Interprocedural.returnSourceViaParameter2(Interprocedural$Obj,Interprocedural$Obj) at [line 76] } +Interprocedural.java:92: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 87]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 92]) via { void Interprocedural.returnSourceViaGlobal() at [line 91] } +Interprocedural.java:108: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 108]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 104]) via { void Interprocedural.callSinkParam1(Object,Object) at [line 108] } +Interprocedural.java:120: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 120]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 116]) via { void Interprocedural.callSinkParam2(Object,Object) at [line 120] } +Interprocedural.java:133: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 132]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 128]) via { void Interprocedural.callSinkOnFieldDirect() at [line 133] } +Interprocedural.java:143: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 142]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 137]) via { void Interprocedural.callSinkOnFieldIndirect(Interprocedural$Obj) at [line 143] } +Interprocedural.java:157: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 156]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 152]) via { void Interprocedural.callSinkOnLocal() at [line 157] } +Interprocedural.java:166: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 165]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 161]) via { void Interprocedural.callSinkOnGlobal() at [line 166] } +Interprocedural.java:181: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 180]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 161]) via { void Interprocedural.callSinkOnGlobal() at [line 181], void Interprocedural.setGlobal(Object) at [line 180] } +Interprocedural.java:195: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 194]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 190]) via { void Interprocedural.getGlobalThenCallSink() at [line 195] } +Interprocedural.java:203: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 201]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 203]) via { Object Interprocedural.id(Object) at [line 202] } +Interprocedural.java:210: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 207]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 210]) via { Object Interprocedural.id(Object) at [line 208], Object Interprocedural.id(Object) at [line 209] } +Interprocedural.java:221: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 216]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 221]) via { Object Interprocedural.returnSourceConditional(boolean) at [line 221] } +Interprocedural.java:232: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 230]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 232]) via { } +Interprocedural.java:255: ERROR: QUANDARY_TAINT_ERROR Error: Other(Object InferTaint.inferSecretSource() at [line 253]) -> Other(void InferTaint.inferSensitiveSink(Object) at [line 255]) via { } LoggingPrivateData.java:18: ERROR: QUANDARY_TAINT_ERROR Error: SharedPreferences(String SharedPreferences.getString(String,String) at [line 18]) -> Logging(int Log.d(String,String) at [line 18]) via { } LoggingPrivateData.java:22: ERROR: QUANDARY_TAINT_ERROR Error: SharedPreferences(String SharedPreferences.getString(String,String) at [line 22]) -> Logging(int Log.d(String,String) at [line 22]) via { } LoggingPrivateData.java:37: ERROR: QUANDARY_TAINT_ERROR Error: SharedPreferences(String SharedPreferences.getString(String,String) at [line 36]) -> Logging(int Log.w(String,Throwable) at [line 37]) via { }