"The field `%s` is annotated with %s, but the lock `%s` is not held during the access to the field `%s`. Consider wrapping the access in a `synchronized(%s)` block or annotating %s with %s"
accessed_fld_str
annot_str
guarded_by_str
Format.asprintf
"The field %a is annotated with %a, but the lock %a is not held during the access to the field %s. Consider wrapping the access in a %s block or annotating %s with %a"
MF.pp_monospacedaccessed_fld_str
MF.pp_monospacedannot_str
MF.pp_monospacedguarded_by_str
line_info
guarded_by_str
syncronized_str
(Typ.Procname.to_stringpname)
annot_strin
MF.pp_monospacedannot_strin
{no_descwithdescriptions=[msg];}
@ -546,8 +550,8 @@ let dereference_string deref_str value_str access_opt loc =
@ -912,37 +926,37 @@ let desc_tainted_value_reaching_sensitive_function
letdescription=
matchtaint_kindwith
|PredSymb.Tk_unverified_SSL_socket->
F.sprintf
"The hostname of SSL socket `%s` (returned from %s) has not been verified! Reading from the socket via the call to %s %s is dangerous. You should verify the hostname of the socket using a HostnameVerifier before reading; otherwise, you may be vulnerable to a man-in-the-middle attack."
expr_str
F.asprintf
"The hostname of SSL socket %a (returned from %s) has not been verified! Reading from the socket via the call to %s %s is dangerous. You should verify the hostname of the socket using a HostnameVerifier before reading; otherwise, you may be vulnerable to a man-in-the-middle attack."
MF.pp_monospacedexpr_str
(format_methodtainting_fun)
(format_methodsensitive_fun)
(at_linetagsloc)
|PredSymb.Tk_shared_preferences_data->
F.sprintf
"`%s` holds sensitive data read from a SharedPreferences object (via call to %s). This data may leak via the call to %s %s."
expr_str
F.asprintf
"%a holds sensitive data read from a SharedPreferences object (via call to %s). This data may leak via the call to %s %s."
MF.pp_monospacedexpr_str
(format_methodtainting_fun)
(format_methodsensitive_fun)
(at_linetagsloc)
|PredSymb.Tk_privacy_annotation->
F.sprintf
"`%s` holds privacy-sensitive data (source: call to %s). This data may leak via the call to %s %s."
expr_str
F.asprintf
"%a holds privacy-sensitive data (source: call to %s). This data may leak via the call to %s %s."
MF.pp_monospacedexpr_str
(format_methodtainting_fun)
(format_methodsensitive_fun)
(at_linetagsloc)
|PredSymb.Tk_integrity_annotation->
F.sprintf
"`%s` holds untrusted user-controlled data (source: call to %s). This data may flow into a security-sensitive sink via the call to %s %s."
expr_str
F.asprintf
"%a holds untrusted user-controlled data (source: call to %s). This data may flow into a security-sensitive sink via the call to %s %s."
MF.pp_monospacedexpr_str
(format_methodtainting_fun)
(format_methodsensitive_fun)
(at_linetagsloc)
|PredSymb.Tk_unknown->
F.sprintf
"Value `%s` could be insecure (tainted) due to call to function %s %s %s %s. Function %s %s"
expr_str
F.asprintf
"Value %a could be insecure (tainted) due to call to function %s %s %s %s. Function %s %s"
MF.pp_monospacedexpr_str
(format_methodtainting_fun)
"and is reaching sensitive function"
(format_methodsensitive_fun)
@ -958,10 +972,10 @@ let desc_uninitialized_dangling_pointer_deref deref expr_str loc =
codetoanalyze/java/eradicate/ParameterNotNullable.java, void ParameterNotNullable.testThreeParameters(), 3, ERADICATE_PARAMETER_NOT_NULLABLE, [origin,`threeParameters(...)` needs a non-null value in parameter 2 but argument `null` can be null. (Origin: null constant at line 85)]
codetoanalyze/java/eradicate/ParameterNotNullable.java, void ParameterNotNullable.testThreeParameters(), 4, ERADICATE_PARAMETER_NOT_NULLABLE, [origin,`threeParameters(...)` needs a non-null value in parameter 3 but argument `null` can be null. (Origin: null constant at line 86)]
codetoanalyze/java/eradicate/PresentTest.java, Optional PresentTest$TestPresentAnnotationBasic.returnPresentBad(), 0, ERADICATE_RETURN_VALUE_NOT_PRESENT, [origin,Method `returnPresentBad()` may return an absent value but it is annotated with `@Present`. (Origin: field PresentTest$TestPresentAnnotationBasic.absent at line 47)]
codetoanalyze/java/eradicate/PresentTest.java, Optional PresentTest$TestPresentAnnotationBasic.returnPresentBad(), 1, ERADICATE_VALUE_NOT_PRESENT, [origin,The value of `PresentTest$TestPresentAnnotationBasic.absent` in the call to `get()` is not @Present. (Origin: field PresentTest$TestPresentAnnotationBasic.absent at line 47)]
codetoanalyze/java/eradicate/PresentTest.java, Optional PresentTest$TestPresentAnnotationBasic.returnPresentBad(), 1, ERADICATE_VALUE_NOT_PRESENT, [origin,The value of `PresentTest$TestPresentAnnotationBasic.absent` in the call to `get()` is not `@Present`. (Origin: field PresentTest$TestPresentAnnotationBasic.absent at line 47)]
codetoanalyze/java/eradicate/PresentTest.java, void PresentTest$TestPresentAnnotationBasic.testOptionalAbsent(), 1, ERADICATE_PARAMETER_VALUE_ABSENT, [origin,`expectPresent(...)` needs a present value in parameter 1 but argument `absent()` can be absent. (Origin: call to absent() at line 65)]
codetoanalyze/java/eradicate/PresentTest.java, void PresentTest.testPresent(Optional,Optional), 4, ERADICATE_PARAMETER_VALUE_ABSENT, [`argPresent(...)` needs a present value in parameter 1 but argument `absent` can be absent. (Origin: method parameter absent)]
codetoanalyze/java/eradicate/ReturnNotNullable.java, Object ReturnNotNullable$ConditionalAssignment.test(boolean), 0, ERADICATE_RETURN_NOT_NULLABLE, [origin,Method `test(...)` may return null but it is not annotated with `@Nullable`. (Origin: field ReturnNotNullable$ConditionalAssignment.f1 at line 146)]