package dataflow

Supports the specification and solving of data-flow problems.


To be able to express data-flow problems at a very high-level of abstraction. I.e., that some information flows or not-flows from a well-identified source to a well-identified sink.

Usage Scenario


  1. Select sources
    1. Sources are parameters passed to methods (e.g., doPost(session : Session) (This covers the main method as well as typical callback methods.)
    2. Values returned by methods (e.g., (here, we identify the call site)
  2. Select sinks
    1. A sink is either a field (in which the value is stored)
    2. a method (parameter) which is passed the value
  3. Filtering (Terminating) data-flows
    1. If a specific operation was performed, e.g.,
    2. If a comparison (e.g., against null, > 0 , ...)
    3. An instanceOf/a checkcast
    4. A mathematical operation (e.g. +.-,...)
    5. [OPTIMIZATION] If the value was passed to a specific method (e.g., check(x : X) - throws Exception if the check fails)
    6. [OPTIMIZATION] If the value was returned by a well-identified method (e.g., String sanitized = s.replace(...,...))

4. Extending data-flows (Side Channels)

Furthermore, the framework will automatically handle taint propagation and aliasing. I.e., a tainted value that is stored in a field automatically marks the respective field as tainted.

Linear Supertypes
AnyRef, Any
  1. Alphabetic
  2. By Inheritance
  1. dataflow
  2. AnyRef
  3. Any
  1. Hide All
  2. Show All
  1. Public
  2. All

Type Members

  1. type AValueLocationMatcher = (SomeProject) ⇒ Map[Method, Set[ValueOrigin]]

  2. trait DataFlowProblem[Source, P] extends AnyRef


    Characterizes a data-flow problem.

    Characterizes a data-flow problem. The characterization consists of the specification of the problem as well as the selection of the solver.

    I.e., tries to find paths from the identified sources to the identified sinks.

    Overall Initialization

    Overall initialization is done in multiple steps.

    1. The parameters are checked.
    2. The parameters of the analysis are set.
    3. The project is initialized by the framework and also set.
    4. Initialize sourceValues and sinkInstructions (These methods needs to be overridden by your subclass.)
    5. Call solve. After you have called solve you are no longer allowed to change the project or the sources and sinks.
  3. trait DataFlowProblemFactory extends AnyRef

  4. trait DataFlowProblemRunner extends AnalysisExecutor


    Support methods to make it possible to solve a single DataFlowProblem.

    Support methods to make it possible to solve a single DataFlowProblem.


    Mix in this trait in the object which specifies your data-flow problem. After that you can run it.

  5. trait DataFlowProblemSolver[Source, Params] extends DataFlowProblem[Source, Params]


    Implements the infrastructure for solving a data-flow problem.

Value Members

  1. package instance

  2. package solver

  3. package spec


Inherited from AnyRef

Inherited from Any