Java InstructionHandle.getInstruction方法代码示例

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
public void transferInstruction(InstructionHandle handle, BasicBlock basicBlock, ValueNumberFrame fact)
        throws DataflowAnalysisException {

	Location location = new Location(handle, basicBlock);

	ValueNumberFrame atLocation = getFactAtLocation(location);
	copy(fact, atLocation);

	visitor.setFrame(fact);
	visitor.setHandle(handle);
	Instruction ins = handle.getInstruction();
	ins.accept(visitor);

	ValueNumberFrame afterLocation = getFactAfterLocation(location);
	copy(fact, afterLocation);
}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
public void transferInstruction(InstructionHandle handle, BasicBlock basicBlock, LockSet fact)
        throws DataflowAnalysisException {

	Instruction ins = handle.getInstruction();
	short opcode = ins.getOpcode();
	if (opcode == Constants.MONITORENTER || opcode == Constants.MONITOREXIT) {
		ValueNumberFrame frame = vnaDataflow.getFactAtLocation(new Location(handle, basicBlock));

		// NOTE: if the CFG is pruned, there may be unreachable instructions,
		// so make sure frame is valid.
		if (frame.isValid()) {
			int lockNumber = frame.getTopValue().getNumber();
			lockOp(fact, lockNumber, opcode == Constants.MONITORENTER ? 1 : -1);
		}
	} else if ((ins instanceof ReturnInstruction) && isSynchronized && !isStatic) {
		lockOp(fact, vna.getThisValue().getNumber(), -1);
	}
}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
public void transferInstruction(InstructionHandle handle, BasicBlock basicBlock, StackDepth fact) throws DataflowAnalysisException {
	Instruction ins = handle.getInstruction();
	int produced = ins.produceStack(cpg);
	int consumed = ins.consumeStack(cpg);
	if (produced == Constants.UNPREDICTABLE || consumed == Constants.UNPREDICTABLE)
		throw new IllegalStateException("Unpredictable stack delta for instruction: " + handle);
	int depth = fact.getDepth();
	depth += (produced - consumed);
	if (depth < 0)
		fact.setDepth(BOTTOM);
	else
		fact.setDepth(depth);
}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
public MatchResult match(InstructionHandle handle, ConstantPoolGen cpg,
                         ValueNumberFrame before, ValueNumberFrame after, BindingSet bindingSet) throws DataflowAnalysisException {

	Instruction ins = handle.getInstruction();
	if (!(ins instanceof NEW))
		return null;

	LocalVariable result = new LocalVariable(after.getTopValue());
	return addOrCheckDefinition(result, bindingSet);
}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
public MatchResult match(InstructionHandle handle, ConstantPoolGen cpg,
                         ValueNumberFrame before, ValueNumberFrame after, BindingSet bindingSet) throws DataflowAnalysisException {

	// See if the instruction is an InvokeInstruction
	Instruction ins = handle.getInstruction();
	if (!(ins instanceof InvokeInstruction))
		return null;
	InvokeInstruction inv = (InvokeInstruction) ins;

	String methodName = inv.getMethodName(cpg);
	boolean isStatic = inv.getOpcode() == Constants.INVOKESTATIC;
	boolean isCtor = methodName.equals("<init>");

	int actualMode = 0;

	if (isStatic) actualMode |= STATIC;
	if (isCtor) actualMode |= CONSTRUCTOR;
	if (!isStatic && !isCtor) actualMode |= INSTANCE;

	// Intersection of actual and desired modes must be nonempty.
	if ((actualMode & mode) == 0)
		return null;

	// Check class name, method name, and method signature.
	if (!methodNameMatcher.match(methodName) ||
	        !methodSigMatcher.match(inv.getSignature(cpg)) ||
	        !classNameMatcher.match(inv.getClassName(cpg)))
		return null;

	// It's a match!
	return new MatchResult(this, bindingSet);

}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
public MatchResult match(InstructionHandle handle, ConstantPoolGen cpg,
                         ValueNumberFrame before, ValueNumberFrame after, BindingSet bindingSet) throws DataflowAnalysisException {

	// Instruction must be MONITORENTER.
	Instruction ins = handle.getInstruction();
	if (!(ins instanceof MONITORENTER))
		return null;

	// Ensure the object being locked matches any previous
	// instructions which bound our variable name to a value.
	Variable lock = new LocalVariable(before.getTopValue());
	return addOrCheckDefinition(lock, bindingSet);
}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
/**
 * This method is used to track calls made on a specific object. For instance, this could be used to track if "setHttpOnly(true)"
 * was executed on a specific cookie object.
 *
 * This allows the detector to find interchanged calls like this
 *
 * Cookie cookie1 = new Cookie("f", "foo");     <- This cookie is unsafe
 * Cookie cookie2 = new Cookie("b", "bar");     <- This cookie is safe
 * cookie1.setHttpOnly(false);
 * cookie2.setHttpOnly(true);
 *
 * @param cpg ConstantPoolGen
 * @param startLocation The Location of the cookie initialization call.
 * @param objectStackLocation The index of the cookie on the stack.
 * @param invokeInstruction The instruction we want to detect.s
 * @return The location of the invoke instruction provided for the cookie at a specific index on the stack.
 */
private Location getCookieInstructionLocation(ConstantPoolGen cpg, Location startLocation, int objectStackLocation, String invokeInstruction) {
    Location location = startLocation;
    InstructionHandle handle = location.getHandle();

    int loadedStackValue = 0;

    // Loop until we find the setSecure call for this cookie
    while (handle.getNext() != null) {
        handle = handle.getNext();
        Instruction nextInst = handle.getInstruction();

        // We check if the index of the cookie used for this invoke is the same as the one provided
        if (nextInst instanceof ALOAD) {
            ALOAD loadInst = (ALOAD)nextInst;
            loadedStackValue = loadInst.getIndex();
        }

        if (nextInst instanceof INVOKEVIRTUAL
                && loadedStackValue == objectStackLocation) {
            INVOKEVIRTUAL invoke = (INVOKEVIRTUAL) nextInst;

            String methodNameWithSignature = invoke.getClassName(cpg) + "." + invoke.getMethodName(cpg);

            if (methodNameWithSignature.equals(invokeInstruction)) {

                Integer val = ByteCode.getConstantInt(handle.getPrev());

                if (val != null && val == TRUE_INT_VALUE) {
                    return new Location(handle, location.getBasicBlock());
                }
            }
        }
    }

    return null;
}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
public void reportMatch(ClassContext classContext, Method method, ByteCodePatternMatch match) {
	MethodGen methodGen = classContext.getMethodGen(method);
	JavaClass javaClass = classContext.getJavaClass();

	InstructionHandle call = match.getLabeledInstruction("call");

	// Ignore inner-class access methods
	InvokeInstruction inv = (InvokeInstruction) call.getInstruction();
	ConstantPoolGen cp = methodGen.getConstantPool();
	String calledMethodName = inv.getMethodName(cp);
	if (calledMethodName.startsWith("access$")
	        || calledMethodName.startsWith("access+"))
		return;

	/*
	System.out.println("Found " + calledMethodName);
	System.out.println(inv.getSignature(cp));
	System.out.println(inv.getClassName(cp));
	*/
	String calledMethodClass = inv.getClassName(cp);
	if (inv.getSignature(cp).endsWith("V") && !calledMethodName.equals("<init>"))
		return;
	/*
	if (calledMethodClass.equals(javaClass.getClassName()))
		return;
	*/
	String sourceFile = javaClass.getSourceFileName();
	/*
	System.out.println("CalledMethodClass: " + calledMethodClass);
	System.out.println("CalledMethodName: " + calledMethodName);
	*/
	int priority = NORMAL_PRIORITY;
	if (calledMethodName.equals("createNewFile"))
		priority = LOW_PRIORITY;
	else if (calledMethodClass.startsWith("java.lang")
	        || calledMethodClass.endsWith("Error")
	        || calledMethodClass.endsWith("Exception"))
		priority = HIGH_PRIORITY;
	/*
	String calledPackage = extractPackageName(calledMethodClass);
	String callingPackage = extractPackageName(javaClass.getClassName());
	if (calledPackage.length() > 0
	        && callingPackage.length() > 0
	        && (calledPackage.startsWith(callingPackage)
	        || callingPackage.startsWith(calledPackage)))
		priority++;
	*/
	// System.out.println("priority: " + priority);
			
	bugReporter.reportBug(new BugInstance(this, "RV_RETURN_VALUE_IGNORED",
	        priority)
	        .addClassAndMethod(methodGen, sourceFile)
	        .addCalledMethod(methodGen, inv)
	        .addSourceLine(methodGen, sourceFile, call));
}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
public void transferInstruction(InstructionHandle handle, BasicBlock basicBlock) {
	// Record what Location we are analyzing
	this.location = new Location(handle, basicBlock);

	final Instruction ins = handle.getInstruction();
	final ConstantPoolGen cpg = getCPG();
	final ResourceValueFrame frame = getFrame();

	int status = -1;
	boolean created = false;

	// Is a resource created, opened, or closed by this instruction?
	Location creationPoint = stream.getLocation();
	if (handle == creationPoint.getHandle() && basicBlock == creationPoint.getBasicBlock()) {
		// Resource creation
		if (stream.isOpenOnCreation()) {
			status = ResourceValueFrame.OPEN;
			stream.setOpenLocation(location);
			resourceTracker.addStreamOpenLocation(location, stream);
		} else {
			status = ResourceValueFrame.CREATED;
		}
		created = true;
	} else if (resourceTracker.isResourceOpen(basicBlock, handle, cpg, stream, frame)) {
		// Resource opened
		status = ResourceValueFrame.OPEN;
		stream.setOpenLocation(location);
		resourceTracker.addStreamOpenLocation(location, stream);
	} else if (resourceTracker.isResourceClose(basicBlock, handle, cpg, stream, frame)) {
		// Resource closed
		status = ResourceValueFrame.CLOSED;
	}

	// Model use of instance values in frame slots
	ins.accept(this);

	// If needed, update frame status
	if (status != -1) {
		frame.setStatus(status);
		if (created)
			frame.setValue(frame.getNumSlots() - 1, ResourceValue.instance());
	}

}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
private void analyzeMethod(ClassContext classContext, Method method)
        throws CFGBuilderException, DataflowAnalysisException {

	if (DEBUG) System.out.println("Clearing redundant branch information");
	redundantBranchList.clear();
	definitelySameBranchSet.clear();
	definitelyDifferentBranchSet.clear();
	undeterminedBranchSet.clear();

	if (DEBUG)
		System.out.println(SignatureConverter.convertMethodSignature(classContext.getMethodGen(method)));

	// Get the IsNullValueAnalysis for the method from the ClassContext
	IsNullValueDataflow invDataflow = classContext.getIsNullValueDataflow(method);

	// Look for null check blocks where the reference being checked
	// is definitely null, or null on some path
	Iterator<BasicBlock> bbIter = invDataflow.getCFG().blockIterator();
	while (bbIter.hasNext()) {
		BasicBlock basicBlock = bbIter.next();

		if (basicBlock.isNullCheck()) {
			analyzeNullCheck(classContext, method, invDataflow, basicBlock);
		} else if (!basicBlock.isEmpty()) {
			// Look for all reference comparisons where
			//    - both values compared are definitely null, or
			//    - one value is definitely null and one is definitely not null
			// These cases are not null dereferences,
			// but they are quite likely to indicate an error, so while we've got
			// information about null values, we may as well report them.
			InstructionHandle lastHandle = basicBlock.getLastInstruction();
			Instruction last = lastHandle.getInstruction();
			switch (last.getOpcode()) {
			case Constants.IF_ACMPEQ:
			case Constants.IF_ACMPNE:
				analyzeRefComparisonBranch(method, invDataflow, basicBlock, lastHandle);
				break;
			case Constants.IFNULL:
			case Constants.IFNONNULL:
				analyzeIfNullBranch(method, invDataflow, basicBlock, lastHandle);
				break;
			}
		}
	}

	Iterator<RedundantBranch> i = redundantBranchList.iterator();
	while (i.hasNext()) {
		RedundantBranch redundantBranch = i.next();
		if (DEBUG) System.out.println("Redundant branch: " + redundantBranch);
		InstructionHandle handle = redundantBranch.handle;
		int lineNumber = redundantBranch.lineNumber;

		// The source to bytecode compiler may sometimes duplicate blocks of
		// code along different control paths.  So, to report the bug,
		// we check to ensure that the branch is REALLY determined each
		// place it is duplicated, and that it is determined in the same way.
		if (!undeterminedBranchSet.get(lineNumber) &&
		        !(definitelySameBranchSet.get(lineNumber) && definitelyDifferentBranchSet.get(lineNumber))) {
			reportRedundantNullCheck(classContext, method, handle, redundantBranch);
		}
	}
}
 

import org.apache.bcel.generic.InstructionHandle; //导入方法依赖的package包/类
@Override
public void sawOpcode(int seen) {
    if (seen != Constants.INVOKEVIRTUAL) {
        return;
    }
    String fullClassName = getClassConstantOperand();
    String method = getNameConstantOperand();

    //The method call is doing XML parsing (see class javadoc)
    if (fullClassName.equals("javax/xml/stream/XMLInputFactory") &&
            method.equals("createXMLStreamReader")) {
        ClassContext classCtx = getClassContext();
        ConstantPoolGen cpg = classCtx.getConstantPoolGen();
        CFG cfg;
        try {
            cfg = classCtx.getCFG(getMethod());
        } catch (CFGBuilderException e) {
            AnalysisContext.logError("Cannot get CFG", e);
            return;
        }
        for (Iterator<Location> i = cfg.locationIterator(); i.hasNext();) {
            Location location = i.next();
            Instruction inst = location.getHandle().getInstruction();

            //DTD disallow
            //XMLInputFactory.setProperty
            if (inst instanceof org.apache.bcel.generic.INVOKEVIRTUAL) {
                InvokeInstruction invoke = (InvokeInstruction) inst;
                if ("setProperty".equals(invoke.getMethodName(cpg))) {
                    org.apache.bcel.generic.LDC loadConst = ByteCode.getPrevInstruction(location.getHandle(), LDC.class);
                    if (loadConst != null) {
                        if (PROPERTY_SUPPORT_DTD.equals(loadConst.getValue(cpg)) || PROPERTY_IS_SUPPORTING_EXTERNAL_ENTITIES.equals(loadConst.getValue(cpg))){
                            InstructionHandle prev1 = location.getHandle().getPrev();
                            InstructionHandle prev2 = prev1.getPrev();
                            //Case where the boolean is wrapped like : Boolean.valueOf(true) : 2 instructions
                            if (invokeInstruction().atClass("java.lang.Boolean").atMethod("valueOf").matches(prev1.getInstruction(),cpg)) {
                                if (prev2.getInstruction() instanceof ICONST) {
                                    Integer valueWrapped = ByteCode.getConstantInt(prev2);
                                    if (valueWrapped != null && valueWrapped.equals(0)) { //Value is false
                                        return; //Safe feature is disable
                                    }
                                }
                            }
                            //Case where the boolean is declared as : Boolean.FALSE
                            else if (prev1.getInstruction() instanceof org.apache.bcel.generic.GETSTATIC) {
                                org.apache.bcel.generic.GETSTATIC getstatic = (org.apache.bcel.generic.GETSTATIC) prev1.getInstruction();
                                if (getstatic.getClassType(cpg).getClassName().equals("java.lang.Boolean") &&
                                        getstatic.getFieldName(cpg).equals("FALSE")) {
                                    return;
                                }
                            }
                        }
                    }
                }
            }
        }
        //Raise a bug
        bugReporter.reportBug(new BugInstance(this, XXE_XMLSTREAMREADER_TYPE, Priorities.NORMAL_PRIORITY) //
                .addClass(this).addMethod(this).addSourceLine(this));
    }
}