Package

org.opalj.ai

dataflow

Permalink

package dataflow

Supports the specification and solving of data-flow problems.

Goal

To be able to express data-flow problems at a very high-level of abstraction. I.e., that some information flows or not-flows from a well-identified source to a well-identified sink.

Usage Scenario

Concept

  1. Select sources
    1. Sources are parameters passed to methods (e.g., doPost(session : Session) (This covers the main method as well as typical callback methods.)
    2. Values returned by methods (e.g., System.in.read) (here, we identify the call site)
  2. Select sinks
    1. A sink is either a field (in which the value is stored)
    2. a method (parameter) which is passed the value
  3. Filtering (Terminating) data-flows
    1. If a specific operation was performed, e.g.,
    2. If a comparison (e.g., against null, > 0 , ...)
    3. An instanceOf/a checkcast
    4. A mathematical operation (e.g. +.-,...)
    5. [OPTIMIZATION] If the value was passed to a specific method (e.g., check(x : X) - throws Exception if the check fails)
    6. [OPTIMIZATION] If the value was returned by a well-identified method (e.g., String sanitized = s.replace(...,...))

4. Extending data-flows (Side Channels)

Furthermore, the framework will automatically handle taint propagation and aliasing. I.e., a tainted value that is stored in a field automatically marks the respective field as tainted.

Source
package.scala
Linear Supertypes
AnyRef, Any
Ordering
  1. Alphabetic
  2. By Inheritance
Inherited
  1. dataflow
  2. AnyRef
  3. Any
  1. Hide All
  2. Show All
Visibility
  1. Public
  2. All

Type Members

  1. type AValueLocationMatcher = (SomeProject) ⇒ Map[Method, Set[ValueOrigin]]

    Permalink
  2. trait DataFlowProblem[Source, P] extends AnyRef

    Permalink

    Characterizes a data-flow problem.

    Characterizes a data-flow problem. The characterization consists of the specification of the problem as well as the selection of the solver.

    I.e., tries to find paths from the identified sources to the identified sinks.

    Overall Initialization

    Overall initialization is done in multiple steps.

    1. The parameters are checked.
    2. The parameters of the analysis are set.
    3. The project is initialized by the framework and also set.
    4. Initialize sourceValues and sinkInstructions (These methods needs to be overridden by your subclass.)
    5. Call solve. After you have called solve you are no longer allowed to change the project or the sources and sinks.
  3. trait DataFlowProblemFactory extends AnyRef

    Permalink
  4. trait DataFlowProblemRunner extends AnalysisExecutor

    Permalink

    Support methods to make it possible to solve a single DataFlowProblem.

    Support methods to make it possible to solve a single DataFlowProblem.

    Usage

    Mix in this trait in the object which specifies your data-flow problem. After that you can run it.

  5. trait DataFlowProblemSolver[Source, Params] extends DataFlowProblem[Source, Params]

    Permalink

    Implements the infrastructure for solving a data-flow problem.

Value Members

  1. package instance

    Permalink
  2. package solver

    Permalink
  3. package spec

    Permalink

Inherited from AnyRef

Inherited from Any

Ungrouped