Skip to content

Commit 1962223

Browse files
marek-trtikmarek-trtik
authored
Merge pull request diffblue#125 from diffblue/marek/tpg_update_PR
Update of tokens propagation graph for instrumentation of shadow vari…
2 parents 8c57cfc + 1a32718 commit 1962223

File tree

2 files changed

+124
-107
lines changed

2 files changed

+124
-107
lines changed

‎src/taint-analysis/taint_tokens_propagation_graph.cpp

Lines changed: 115 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -55,21 +55,21 @@ taint_tokens_propagation_grapht::taint_tokens_propagation_grapht(
5555
if(propagation_rule->has_input_condition())
5656
{
5757
insert_forward_relation_from_token_to_rule(
58-
names_of_tokens.right.at(propagation_rule->get_input_taint()), id);
59-
map_from_rules_to_inputs[id].insert(
58+
names_of_tokens.right.at(propagation_rule->get_input_taint()),
59+
id,
6060
propagation_rule->get_input_location().arg_index);
6161
}
6262
else
6363
{
64-
insert_forward_relation_from_token_to_rule(get_source_token(), id);
65-
// We have to make sure that there is created a set (empty) for
66-
// the rule of map from rules to input.
67-
map_from_rules_to_inputs[id]={};
64+
insert_forward_relation_from_token_to_rule(
65+
get_source_token(),
66+
id,
67+
get_void_loc());
6868
}
6969

7070
insert_forward_relation_from_rule_to_token(
71-
id, names_of_tokens.right.at(propagation_rule->get_result_taint()));
72-
map_from_rules_to_outputs[id].insert(
71+
id,
72+
names_of_tokens.right.at(propagation_rule->get_result_taint()),
7373
translate_taintable_location(propagation_rule->get_result_location()));
7474
}
7575
}
@@ -82,13 +82,13 @@ taint_tokens_propagation_grapht::taint_tokens_propagation_grapht(
8282
const rule_idt id=std::to_string(sanitizer_rule->get_id());
8383

8484
insert_forward_relation_from_token_to_rule(
85-
names_of_tokens.right.at(sanitizer_rule->get_sanitized_taint()), id);
86-
// We have to make sure that there is created a set (empty) for
87-
// the rule of map from rules to input.
88-
map_from_rules_to_inputs[id]={};
89-
map_from_rules_to_outputs[id].insert(
85+
names_of_tokens.right.at(sanitizer_rule->get_sanitized_taint()),
86+
id,
87+
get_void_loc());
88+
insert_forward_relation_from_rule_to_token(
89+
id,
90+
get_source_token(),
9091
translate_taintable_location(sanitizer_rule->get_sanitized_location()));
91-
9292
sanitisers.insert(id);
9393
}
9494
}
@@ -103,36 +103,27 @@ taint_tokens_propagation_grapht::taint_tokens_propagation_grapht(
103103
if(sink_rule->has_input_condition())
104104
{
105105
insert_forward_relation_from_token_to_rule(
106-
names_of_tokens.right.at(sink_rule->get_input_taint()), id);
107-
map_from_rules_to_inputs[id].insert(
106+
names_of_tokens.right.at(sink_rule->get_input_taint()),
107+
id,
108108
sink_rule->get_input_location().arg_index);
109109
}
110110
else
111-
insert_forward_relation_from_token_to_rule(get_source_token(), id);
112-
111+
{
112+
insert_forward_relation_from_token_to_rule(
113+
get_source_token(),
114+
id,
115+
get_void_loc());
116+
}
113117
insert_forward_relation_from_token_to_rule(
114-
names_of_tokens.right.at(sink_rule->get_sink_target_taint()), id);
115-
insert_forward_relation_from_rule_to_token(id, get_sink_token());
116-
map_from_rules_to_inputs[id].insert(
118+
names_of_tokens.right.at(sink_rule->get_sink_target_taint()),
119+
id,
117120
translate_taintable_location(sink_rule->get_sink_target_location()));
118-
// We also have to make sure that there is created a set (empty) for
119-
// the rule of map from rules to output.
120-
map_from_rules_to_outputs[id]={};
121+
insert_forward_relation_from_rule_to_token(
122+
id,
123+
get_sink_token(),
124+
get_void_loc());
121125
}
122126
}
123-
// Sanitisers require a special handling: we have to insert edges from
124-
// a sanitasition rule into all tokens representing a propagation of tainted
125-
// data without the sanitised taint.
126-
for(const auto &sanitiser : sanitisers)
127-
// For each token (sanitised) leading to the sanitisation rule.
128-
for(const auto &sanitised_token : get_backward_tokens_from_rule(sanitiser))
129-
// For each rule leading to the token later sanitised by the sanitisation
130-
// rule.
131-
for(const auto &rule : get_backward_rules_from_token(sanitised_token))
132-
// For each token not affected by the sanitisation rule, but whose
133-
// (some) successor rules may lead to token which is later sanitised.
134-
for(const auto &token : get_backward_tokens_from_rule(rule))
135-
insert_forward_relation_from_rule_to_token(sanitiser, token);
136127
std::sort(tokens.begin(), tokens.end());
137128
std::sort(rules.begin(), rules.end());
138129
}
@@ -158,46 +149,35 @@ void taint_tokens_propagation_grapht::insert_rule(const rule_idt &rid)
158149
rules.push_back(rid);
159150
forward_map_from_rules_to_tokens[rid]={};
160151
backward_map_from_rules_to_tokens[rid]={};
152+
map_from_rules_to_inputs[rid]={};
153+
map_from_rules_to_outputs[rid]={};
161154
}
162155
}
163156

164157
void taint_tokens_propagation_grapht::
165158
insert_forward_relation_from_token_to_rule(
166159
const taint_tokent::namet &tid,
167-
const rule_idt &rid)
160+
const rule_idt &rid,
161+
const int loc)
168162
{
169163
insert_token(tid);
170164
insert_rule(rid);
171-
{
172-
auto &out_rules=forward_map_from_tokens_to_rules[tid];
173-
if(std::find(out_rules.cbegin(), out_rules.cend(), rid)==out_rules.cend())
174-
out_rules.push_back(rid);
175-
}
176-
{
177-
auto &in_tokens=backward_map_from_rules_to_tokens[rid];
178-
if(std::find(in_tokens.cbegin(), in_tokens.cend(), tid)==in_tokens.cend())
179-
in_tokens.push_back(tid);
180-
}
165+
forward_map_from_tokens_to_rules[tid].push_back(rid);
166+
backward_map_from_rules_to_tokens[rid].push_back(tid);
167+
map_from_rules_to_inputs[rid].push_back(loc);
181168
}
182169

183170
void taint_tokens_propagation_grapht::
184171
insert_forward_relation_from_rule_to_token(
185172
const rule_idt &rid,
186-
const taint_tokent::namet &tid)
173+
const taint_tokent::namet &tid,
174+
const int loc)
187175
{
188176
insert_token(tid);
189177
insert_rule(rid);
190-
{
191-
auto &out_tokens=forward_map_from_rules_to_tokens[rid];
192-
if(std::find(out_tokens.cbegin(), out_tokens.cend(), tid)==
193-
out_tokens.cend())
194-
out_tokens.push_back(tid);
195-
}
196-
{
197-
auto &in_rules=backward_map_from_tokens_to_rules[tid];
198-
if(std::find(in_rules.cbegin(), in_rules.cend(), rid)==in_rules.cend())
199-
in_rules.push_back(rid);
200-
}
178+
forward_map_from_rules_to_tokens[rid].push_back(tid);
179+
backward_map_from_tokens_to_rules[tid].push_back(rid);
180+
map_from_rules_to_outputs[rid].push_back(loc);
201181
}
202182

203183
std::ostream &taint_to_dot(
@@ -208,18 +188,27 @@ std::ostream &taint_to_dot(
208188
<< " rankdir=TB;\n"
209189
<< " node [fontsize=12];\n\n";
210190
for(const taint_tokent::namet &token : graph.get_tokens())
191+
{
211192
ostr << " \"" << token
212-
<< "\" [label=\""
213-
<< (token == taint_tokens_propagation_grapht::get_source_token() ?
214-
taint_tokens_propagation_grapht::get_source_token().name :
215-
token == taint_tokens_propagation_grapht::get_sink_token() ?
216-
taint_tokens_propagation_grapht::get_sink_token().name :
217-
(msgstream() << token).get())
218-
<< "\", shape="
219-
<< (token==graph.get_source_token() ? "octagon" :
220-
(token==graph.get_sink_token() ? "doubleoctagon" :
221-
"ellipse"))
222-
<< "];\n";
193+
<< "\" [label=\"";
194+
if(token == taint_tokens_propagation_grapht::get_source_token())
195+
{
196+
ostr << taint_tokens_propagation_grapht::get_source_token().name
197+
<< "\", shape=octagon, style=filled, fillcolor=aquamarine";
198+
}
199+
else if(token == taint_tokens_propagation_grapht::get_sink_token())
200+
{
201+
ostr << taint_tokens_propagation_grapht::get_sink_token().name
202+
<< "\", shape=doubleoctagon, style=filled, fillcolor=lightcoral";
203+
}
204+
else
205+
{
206+
ostr << token << "\", shape=ellipse";
207+
if(graph.get_forward_rules_from_token(token).empty())
208+
ostr << ", style=filled, fillcolor=gold";
209+
}
210+
ostr << "];\n";
211+
}
223212
ostr << "\n";
224213
for(const auto &rule : graph.get_rules())
225214
{
@@ -236,42 +225,74 @@ std::ostream &taint_to_dot(
236225
bool first=true;
237226
for(const auto index : graph.get_map_from_rules_to_inputs().at(rule))
238227
{
239-
if(!first)
240-
ostr << ", ";
241-
ostr << "ARG" << index;
242-
first=false;
228+
if(index!=taint_tokens_propagation_grapht::get_void_loc())
229+
{
230+
if(!first)
231+
ostr << ", ";
232+
ostr << "ARG" << index;
233+
first=false;
234+
}
243235
}
244236
ostr << "}\\lOUTPUTS: {";
245237
first=true;
246238
for(const auto index : graph.get_map_from_rules_to_outputs().at(rule))
247239
{
248-
if(!first)
249-
ostr << ", ";
250-
if(index<0)
251-
ostr << "RETVAL";
252-
else
253-
ostr << "ARG" << index;
254-
first=false;
240+
if(index!=taint_tokens_propagation_grapht::get_void_loc())
241+
{
242+
if(!first)
243+
ostr << ", ";
244+
if(index==-1)
245+
ostr << "RETVAL";
246+
else
247+
ostr << "ARG" << index;
248+
first=false;
249+
}
255250
}
256251
ostr << "}\\l\", shape=box"
257252
<< (graph.get_sanitiser_rules().count(rule)!=0UL ?
258253
", style=filled, fillcolor=lightgray" :
259-
"" )
254+
", style=filled, fillcolor=azure" )
260255
<< "];\n";
261256
}
262257
ostr << "\n";
263-
for(const auto &token : graph.get_tokens())
258+
259+
for(const auto &rule : graph.get_rules())
264260
{
265-
for(const auto &rule : graph.get_forward_rules_from_token(token))
266-
ostr << " \"" << token
267-
<< "\" -> "
268-
<< "\"" << rule
269-
<< "\";\n";
270-
for(const auto &rule : graph.get_backward_rules_from_token(token))
271-
ostr << " \"" << rule
272-
<< "\" -> "
273-
<< "\"" << token
274-
<< "\";\n";
261+
const auto &in_tokens=graph.get_backward_tokens_from_rule(rule);
262+
const auto &in_locs=graph.get_map_from_rules_to_inputs().at(rule);
263+
assert(in_tokens.size()==in_locs.size());
264+
for(std::size_t i=0UL, n=in_tokens.size(); i!=n; ++i)
265+
{
266+
ostr << " \"" << in_tokens.at(i) << "\" -> \"" << rule << "\"";
267+
if(in_locs.at(i)!=taint_tokens_propagation_grapht::get_void_loc())
268+
{
269+
ostr << " [label=\"";
270+
if(in_locs.at(i)==-1)
271+
ostr << "RETVAL";
272+
else
273+
ostr << "ARG" << in_locs.at(i);
274+
ostr << "\"]";
275+
}
276+
ostr << "\n";
277+
}
278+
279+
const auto &out_tokens=graph.get_forward_tokens_from_rule(rule);
280+
const auto &out_locs=graph.get_map_from_rules_to_outputs().at(rule);
281+
assert(out_tokens.size()==out_locs.size());
282+
for(std::size_t i=0UL, n=out_tokens.size(); i!=n; ++i)
283+
{
284+
ostr << " \"" << rule << "\" -> \"" << out_tokens.at(i) << "\"";
285+
if(out_locs.at(i)!=taint_tokens_propagation_grapht::get_void_loc())
286+
{
287+
ostr << " [label=\"";
288+
if(out_locs.at(i)==-1)
289+
ostr << "RETVAL";
290+
else
291+
ostr << "ARG" << out_locs.at(i);
292+
ostr << "\"]";
293+
}
294+
ostr << "\n";
295+
}
275296
}
276297
ostr << "}\n";
277298

‎src/taint-analysis/taint_tokens_propagation_graph.h

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,10 @@ class taint_tokens_propagation_grapht
5757
backward_map_from_rules_to_tokenst;
5858

5959
// To track references of input and output parameters of individual rules.
60-
// The "return_value" value in the output map is denoted by -1.
61-
typedef std::map<rule_idt, std::set<int>>
60+
// The "return_value" value in the output map is denoted by -1. The values
61+
// 999 (see the static method 'get_void_loc()') means 'no value', i.e. it
62+
// is a dummy reference, typically related to SOURCE and SINK nodes.
63+
typedef std::map<rule_idt, std::vector<int>>
6264
map_from_rules_to_inputst;
6365
typedef map_from_rules_to_inputst map_from_rules_to_outputst;
6466

@@ -75,6 +77,8 @@ class taint_tokens_propagation_grapht
7577
return { "com.diffblue.security.built-ins", "SINK" };
7678
}
7779

80+
static int get_void_loc() { return -2; }
81+
7882
const std::vector<taint_tokent::namet> &get_tokens() const { return tokens; }
7983
const std::vector<rule_idt> &get_rules() const { return rules; }
8084
const std::set<rule_idt> &get_sanitiser_rules() const
@@ -112,21 +116,13 @@ class taint_tokens_propagation_grapht
112116

113117
void insert_forward_relation_from_token_to_rule(
114118
const taint_tokent::namet &tid,
115-
const rule_idt &rid);
119+
const rule_idt &rid,
120+
const int loc);
116121

117122
void insert_forward_relation_from_rule_to_token(
118123
const rule_idt &rid,
119-
const taint_tokent::namet &tid);
120-
121-
void insert_backward_relation_from_token_to_rule(
122124
const taint_tokent::namet &tid,
123-
const rule_idt &rid)
124-
{ insert_forward_relation_from_rule_to_token(rid, tid); }
125-
126-
void insert_backward_relation_from_rule_to_token(
127-
const rule_idt &rid,
128-
const taint_tokent::namet &tid)
129-
{ insert_forward_relation_from_token_to_rule(tid, rid); }
125+
const int loc);
130126

131127
static constexpr std::size_t SOURCE_index = 0ULL;
132128
static constexpr std::size_t SINK_index = 1ULL;

0 commit comments

Comments
 (0)