Java Abstraction类代码示例

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
@Override
public void computeAliasTaints(Abstraction d1, Stmt src, Value targetValue,
		Set<Abstraction> taintSet, SootMethod method, Abstraction newAbs) {
	// Use global aliasing
	Value baseValue = ((InstanceFieldRef) targetValue).getBase();
	Set<AccessPath> aliases = methodToAliases.getUnchecked(method).get
			(new AccessPath(baseValue, true));
	if (aliases != null)
		for (AccessPath ap : aliases) {
			Abstraction aliasAbs = newAbs.deriveNewAbstraction(
					ap.merge(newAbs.getAccessPath()), null);
			if (taintSet.add(aliasAbs))
				// We have found a new alias. This new base object may however yet
				// again alias with something, so we need to check again
				if (ap.isInstanceFieldRef()) {
					InstanceFieldRef aliasBaseVal = Jimple.v().newInstanceFieldRef
							(ap.getPlainValue(), ap.getFirstField().makeRef());
					computeAliasTaints(d1, src, aliasBaseVal, taintSet, method, aliasAbs);
				}
		}
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
@Override
public Set<Abstraction> getTaintsForMethod(Stmt stmt, Abstraction d1,
		Abstraction taintedPath) {
	Set<Abstraction> resList = new HashSet<Abstraction>();
	for (ITaintPropagationWrapper w : this.wrappers) {
		Set<Abstraction> curAbsSet = w.getTaintsForMethod(stmt, d1, taintedPath);
		if (curAbsSet != null)
			resList.addAll(curAbsSet);
	}
	
	// Bookkeeping for statistics
	if (resList.isEmpty())
		misses.incrementAndGet();
	else
		hits.incrementAndGet();
	
	return resList;
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
@Override
public Set<Abstraction> getTaintsForMethod(Stmt stmt, Abstraction d1,
		Abstraction taintedPath) {
	// Compute the tainted access paths
	Set<AccessPath> aps = getTaintsForMethodInternal(stmt,
			taintedPath.getAccessPath());
	if (aps == null || aps.isEmpty())
		return null;
	
	// Convert the access paths into full abstractions
	Set<Abstraction> res = new HashSet<Abstraction>(aps.size());
	for (AccessPath ap : aps)
		if (ap == taintedPath.getAccessPath())
			res.add(taintedPath);
		else
			res.add(taintedPath.deriveNewAbstraction(ap, stmt));
	return res;
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
/**
 * Computes the taints for the aliases of a given tainted variable
 * @param d1 The context in which the variable has been tainted
 * @param src The statement that tainted the variable
 * @param targetValue The target value which has been tainted
 * @param taintSet The set to which all generated alias taints shall be
 * added
 * @param method The method containing src
 * @param newAbs The newly generated abstraction for the variable taint
 * @return The set of immediately available alias abstractions. If no such
 * abstractions exist, null is returned
 */
private void computeAliasTaints
		(final Abstraction d1, final Stmt src,
		final Value targetValue, Set<Abstraction> taintSet,
		SootMethod method, Abstraction newAbs) {
	// If we are not in a conditionally-called method, we run the
	// full alias analysis algorithm. Otherwise, we use a global
	// non-flow-sensitive approximation.
	if (!d1.getAccessPath().isEmpty()) {
		aliasingStrategy.computeAliasTaints(d1,
				src, targetValue, taintSet, method, newAbs);
	}
	else if (targetValue instanceof InstanceFieldRef) {
		assert enableImplicitFlows;
		implicitFlowAliasingStrategy.computeAliasTaints(d1, src,
				targetValue, taintSet, method, newAbs);
	}
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
/**
 * Adds a new result of the data flow analysis to the collection
 * @param resultAbs The abstraction at the sink instruction
 */
private void addResult(AbstractionAtSink resultAbs) {
	// Check whether we need to filter a result in a system package
	if (ignoreFlowsInSystemPackages && SystemClassHandler.isClassInSystemPackage
			(interproceduralCFG().getMethodOf(resultAbs.getSinkStmt()).getDeclaringClass().getName()))
		return;

	// Make sure that the sink statement also appears inside the
	// abstraction
	resultAbs = new AbstractionAtSink
			(resultAbs.getAbstraction().deriveNewAbstraction
					(resultAbs.getAbstraction().getAccessPath(), resultAbs.getSinkStmt()),
			resultAbs.getSinkStmt());
	resultAbs.getAbstraction().setCorrespondingCallSite(resultAbs.getSinkStmt());

	Abstraction newAbs = this.results.putIfAbsentElseGet
			(resultAbs, resultAbs.getAbstraction());
	if (newAbs != resultAbs.getAbstraction())
		newAbs.addNeighbor(resultAbs.getAbstraction());
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
/**
 * Checks whether the given base value matches the base of the given
 * taint abstraction
 * @param baseValue The value to check
 * @param source The taint abstraction to check
 * @return True if the given value has the same base value as the given
 * taint abstraction, otherwise false
 */
protected boolean baseMatches(final Value baseValue, Abstraction source) {
	if (baseValue instanceof Local) {
		if (baseValue.equals(source.getAccessPath().getPlainValue()))
			return true;
	}
	else if (baseValue instanceof InstanceFieldRef) {
		InstanceFieldRef ifr = (InstanceFieldRef) baseValue;
		if (ifr.getBase().equals(source.getAccessPath().getPlainValue())
				&& source.getAccessPath().firstFieldMatches(ifr.getField()))
			return true;
	}
	else if (baseValue instanceof StaticFieldRef) {
		StaticFieldRef sfr = (StaticFieldRef) baseValue;
		if (source.getAccessPath().firstFieldMatches(sfr.getField()))
			return true;
	}
	return false;
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
protected boolean registerActivationCallSite(Unit callSite, SootMethod callee, Abstraction activationAbs) {
	if (!flowSensitiveAliasing)
		return false;
	Unit activationUnit = activationAbs.getActivationUnit();
	if (activationUnit == null)
		return false;

	Set<Unit> callSites = activationUnitsToCallSites.putIfAbsentElseGet
			(activationUnit, new ConcurrentHashSet<Unit>());
	if (callSites.contains(callSite))
		return false;
	
	if (!activationAbs.isAbstractionActive())
		if (!callee.getActiveBody().getUnits().contains(activationUnit)) {
			boolean found = false;
			for (Unit au : callSites)
				if (callee.getActiveBody().getUnits().contains(au)) {
					found = true;
					break;
				}
			if (!found)
				return false;
		}

	return callSites.add(callSite);
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
@Override
public void run() {
	final Set<SourceContextAndPath> paths = abstraction.getPaths();
	final Abstraction pred = abstraction.getPredecessor();
	
	if (pred != null) {
		for (SourceContextAndPath scap : paths) {
			// Process the predecessor
			if (processPredecessor(scap, pred))
				// Schedule the predecessor
				executor.execute(new SourceFindingTask(pred));
			
			// Process the predecessor's neighbors
			if (pred.getNeighbors() != null)
				for (Abstraction neighbor : pred.getNeighbors())
					if (processPredecessor(scap, neighbor))
						// Schedule the predecessor
						executor.execute(new SourceFindingTask(neighbor));
		}
	}
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
/**
 * Checks whether the given abstraction is a source. If so, a result entry
 * is created.
 * @param abs The abstraction to check
 * @param scap The path leading up to the current abstraction
 * @return True if the current abstraction is a source, otherwise false
 */
protected boolean checkForSource(Abstraction abs, SourceContextAndPath scap) {
	if (abs.getPredecessor() != null)
		return false;
	
	// If we have no predecessors, this must be a source
	assert abs.getSourceContext() != null;
	assert abs.getNeighbors() == null;
	
	// Register the source that we have found
	SourceContext sourceContext = abs.getSourceContext();
	results.addResult(scap.getAccessPath(),
			scap.getStmt(),
			sourceContext.getAccessPath(),
			sourceContext.getStmt(),
			sourceContext.getUserData(),
			scap.getPath());
	return true;
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
@Override
public void run() {
	final Set<SourceContextAndPath> paths = abstraction.getPaths();
	final Abstraction pred = abstraction.getPredecessor();
	
	if (pred != null) {
		for (SourceContextAndPath scap : paths) {						
			// Process the predecessor
			if (processPredecessor(scap, pred))
				// Schedule the predecessor
				executor.execute(new SourceFindingTask(pred));
			
			// Process the predecessor's neighbors
			if (pred.getNeighbors() != null)
				for (Abstraction neighbor : pred.getNeighbors())
					if (processPredecessor(scap, neighbor))
						// Schedule the predecessor
						executor.execute(new SourceFindingTask(neighbor));
		}
	}
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
/**
 * Checks whether the given abstraction is a source. If so, a result entry
 * is created.
 * @param abs The abstraction to check
 * @param scap The path leading up to the current abstraction
 * @return True if the current abstraction is a source, otherwise false
 */
private boolean checkForSource(Abstraction abs, SourceContextAndPath scap) {
	if (abs.getPredecessor() != null)
		return false;
	
	// If we have no predecessors, this must be a source
	assert abs.getSourceContext() != null;
	assert abs.getNeighbors() == null;
	
	// Register the source that we have found
	SourceContext sourceContext = abs.getSourceContext();
	results.addResult(scap.getAccessPath(),
			scap.getStmt(),
			sourceContext.getAccessPath(),
			sourceContext.getStmt(),
			sourceContext.getUserData(),
			scap.getPath());
	return true;
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
@Override
protected void processExit(PathEdge<Unit, Abstraction> edge) {
	super.processExit(edge);
	
	if (followReturnsPastSeeds && followReturnsPastSeedsHandler != null) {
		final Abstraction d1 = edge.factAtSource();
		final Unit u = edge.getTarget();
		final Abstraction d2 = edge.factAtTarget();
		
		final SootMethod methodThatNeedsSummary = icfg.getMethodOf(u);
		final Map<Unit, Map<Abstraction, Abstraction>> inc = incoming(d1, methodThatNeedsSummary);
		
		if (inc == null || inc.isEmpty())
			followReturnsPastSeedsHandler.handleFollowReturnsPastSeeds(d1, u, d2);
	}
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
@Override
public void injectContext(IInfoflowSolver otherSolver, SootMethod callee, Abstraction d3,
		Unit callSite, Abstraction d2, Abstraction d1) {
	if (!(otherSolver instanceof InfoflowSolver))
		throw new RuntimeException("Other solver must be of same type");
	
	synchronized (incoming) {
		for (Unit sP : icfg.getStartPointsOf(callee))
			addIncoming(sP, d3, callSite, d2);
	}
	
	// First, get a list of the other solver's jump functions.
	// Then release the lock on otherSolver.jumpFn before doing
	// anything that locks our own jumpFn.
	final Set<Abstraction> otherAbstractions;
	final InfoflowSolver solver = (InfoflowSolver) otherSolver;
	synchronized (solver.jumpFn) {
		otherAbstractions = new HashSet<Abstraction>
				(solver.jumpFn.reverseLookup(callSite, d2).keySet());
	}
	for (Abstraction dx1: otherAbstractions)
		if (!dx1.getAccessPath().isEmpty() && !dx1.getAccessPath().isStaticFieldRef())
			processEdge(new PathEdge<Unit, Abstraction>(d1, callSite, d2));
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
@Override
protected Set<Abstraction> computeReturnFlowFunction(
		FlowFunction<Abstraction> retFunction,
		Abstraction d1,
		Abstraction d2,
		Unit callSite,
		Set<Abstraction> callerSideDs) {
	if (retFunction instanceof SolverReturnFlowFunction) {
		// Get the d1s at the start points of the caller
		Set<Abstraction> d1s = new HashSet<Abstraction>(callerSideDs.size() * 5);
		for (Abstraction d4 : callerSideDs)
			if (d4 == zeroValue)
				d1s.add(d4);
			else
				synchronized (jumpFn) {
					d1s.addAll(jumpFn.reverseLookup(callSite, d4).keySet());
				}
		
		return ((SolverReturnFlowFunction) retFunction).computeTargets(d2, d1, d1s);
	}
	else
		return retFunction.computeTargets(d2);
}
 

import soot.jimple.infoflow.data.Abstraction; //导入依赖的package包/类
@Override
protected void propagate(Abstraction sourceVal, Unit target, Abstraction targetVal, EdgeFunction<BinaryDomain> f,
		/* deliberately exposed to clients */ Unit relatedCallSite,
		/* deliberately exposed to clients */ boolean isUnbalancedReturn) {	
	// Check whether we already have an abstraction that entails the new one.
	// In such a case, we can simply ignore the new abstraction.
	boolean noProp = false;
	/*
	for (Abstraction abs : new HashSet<Abstraction>(jumpFn.forwardLookup(sourceVal, target).keySet()))
		if (abs != targetVal) {
			if (abs.entails(targetVal)) {
				noProp = true;
				break;
			} 
			if (targetVal.entails(abs)) {
				jumpFn.removeFunction(sourceVal, target, abs);
			}
		}
	*/
	if (!noProp)
		super.propagate(sourceVal, target, targetVal, f, relatedCallSite, isUnbalancedReturn);
}