Skip to content

Commit 40a65dc

Browse files
marek-trtiksmowton
marek-trtik
authored and
smowton
committed
Reduced size of computed summaries by excluding standard libraries etc. Also, reduced number of roots per app.
1 parent 90f0bee commit 40a65dc

File tree

16 files changed

+105
-634
lines changed

16 files changed

+105
-634
lines changed

‎regression/december_demo_sprint/Alfresco/APP/roots.json

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,4 @@
11
[
2-
"org.alfresco.web.app.Application.handleServletError",
3-
"org.alfresco.web.app.Application.handleSystemError",
4-
"org.alfresco.web.sharepoint.auth.BasicAuthenticationHandler.authenticateRequest",
5-
"org.alfresco.web.sharepoint.auth.BasicAuthenticationHandler.isUserAuthenticated",
6-
"org.alfresco.web.app.servlet.UploadFileServlet.service",
7-
"org.alfresco.web.app.servlet.CommandServlet.service",
8-
"org.alfresco.web.app.servlet.UploadContentServlet.doPut",
9-
"org.alfresco.web.app.servlet.DownloadRawContentServlet.service",
10-
"org.alfresco.web.app.servlet.DownloadRawContentServlet.processRequest"
2+
"org.alfresco.web.app.servlet.UploadContentServlet.doPut"
113
]
124

‎regression/december_demo_sprint/Alfresco/APP/taint.json

Lines changed: 0 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,79 +1,3 @@
11
[
2-
{
3-
"id": "source_0_X1",
4-
"kind": "source",
5-
"where": "return_value",
6-
"taint": "X1",
7-
"function": "javax.servlet.http.HttpServletRequest.getQueryString"
8-
},
9-
{
10-
"id": "source_1_X1",
11-
"kind": "source",
12-
"where": "return_value",
13-
"taint": "X1",
14-
"function": "javax.servlet.http.HttpServletRequest.getRequestURI"
15-
},
16-
{
17-
"id": "source_2_X1",
18-
"kind": "source",
19-
"where": "return_value",
20-
"taint": "X1",
21-
"function": "javax.servlet.http.HttpServletRequest.getRequestURL"
22-
},
23-
{
24-
"id": "source_3_X1",
25-
"kind": "source",
26-
"where": "return_value",
27-
"taint": "X1",
28-
"function": "javax.servlet.ServletRequest.getParameter"
29-
},
30-
{
31-
"id": "source_4_X1",
32-
"kind": "source",
33-
"where": "return_value",
34-
"taint": "X1",
35-
"function": "javax.servlet.ServletRequest.getParameterValues"
36-
},
37-
{
38-
"id": "source_5_X1",
39-
"kind": "source",
40-
"where": "return_value",
41-
"taint": "X1",
42-
"function": "javax.servlet.ServletRequest.getInputStream"
43-
},
44-
45-
{
46-
"id": "sink_0_X1",
47-
"kind": "sanitizer",
48-
"where": "return_value",
49-
"taint": "X1",
50-
"function": "",
51-
"message": "sanitize(X1)"
52-
},
53-
54-
{
55-
"id": "sink_0_X1",
56-
"kind": "sink",
57-
"where": "parameter1",
58-
"taint": "X1",
59-
"function": "java.io.PrintWriter.write",
60-
"message": "sink(X1)"
61-
},
62-
{
63-
"id": "sink_1_X1",
64-
"kind": "sink",
65-
"where": "return_value",
66-
"taint": "parameter1",
67-
"function": "java.io.PrintWriter.print",
68-
"message": "sink(X1)"
69-
},
70-
{
71-
"id": "sink_2_X1",
72-
"kind": "sink",
73-
"where": "parameter1",
74-
"taint": "X1",
75-
"function": "java.io.PrintWriter.println",
76-
"message": "sink(X1)"
77-
}
782
]
793

‎regression/december_demo_sprint/DSpace/APP/roots.json

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
[
2-
"org.dspace.app.webui.servlet.BitstreamServlet.doDSGet",
3-
"org.dspace.app.webui.servlet.DisplayStatisticsServlet.doDSGet"
2+
"org.dspace.app.webui.servlet.BitstreamServlet.doDSGet"
43
]
54

‎regression/december_demo_sprint/Encuestame/APP/HACKS.txt

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,3 @@ actually carries taint (these are more precise, since a Java field 'taintfield'
99
can only ever be addressed by that name). This will be fixed by the precision
1010
improvements described elsewhere.
1111

12-
13-
14-

‎regression/december_demo_sprint/Encuestame/APP/README.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Analysed commit: 42cb745cbf15c9b40e497242898c2f75ded278f7
2121
We had to use few hacks in the app to produce traces. So, we cloned the
2222
original repository and perform changes there. Here is the new analysed
2323
repository: https://github.com/smowton/encuestame/
24-
24+
Hacks are described in the file HACKS.txt
2525

2626
Installation on Ubuntu:
2727

‎regression/december_demo_sprint/Ginco/APP/roots.json

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
11
[
2-
"fr.mcc.ginco.security.AuthenticationFilter.attemptAuthentication",
3-
"fr.mcc.ginco.rest.services.ImportRestService.uploadFile",
4-
"fr.mcc.ginco.rest.services.ImportRestService.uploadGincoXmlThesaurusFile"
2+
"fr.mcc.ginco.security.AuthenticationFilter.attemptAuthentication"
53
]
64

‎regression/december_demo_sprint/README.txt

Lines changed: 41 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,13 @@ There are two special sub-directories:
1616
and data providing fully automated analysis of benchmarks.
1717

1818
./TRAINING
19-
This is a root directory of traning benchmarks. They serve us only for
20-
debugging purposes. They won't be part of the evaluation (demo).
19+
This is a root directory of traning benchmarks. They serve us for
20+
debugging purposes.
21+
22+
./TOY_APPS
23+
This is a root directory of small Java web applications. They serve us
24+
for debugging purposes.
25+
2126

2227
All remaining sub-directories in this directory represent root directories
2328
of genuine benchmarks which will be used in the evaluation. Names of these
@@ -27,6 +32,11 @@ There is also file "INFO.txt" in this directory. It contains general info about
2732
this demo (its specification) received from meetings and discussions with
2833
management.
2934

35+
Once the benchmarks are evalauted, there will be generated file "index.html"
36+
representing a root file for browsing all computed results and statistics
37+
of all evaluated benchmarks.
38+
39+
3040
1.1. Directory structure of a benchmark
3141

3242
Each benchmark directory (including training ones) must have this structure
@@ -84,6 +94,8 @@ following:
8494
/<java-web-app-sources-dir>
8595
...
8696
README.txt
97+
HACKS.txt (optional)
98+
jars.json (optional)
8799
roots.json
88100
taint.json
89101
./BENCHMARK
@@ -105,6 +117,12 @@ The directory "RESULTS.aux" is auxiliary. We use it for debug purposes - until
105117
we update the analyser so that it is able to produce results usable for the
106118
evaluation.
107119

120+
The file "HACKS.txt" describes modification we had to do in source code of the
121+
benchmark in order to produce an error-trace.
122+
123+
The file "jars.json" specifies what JAR files should be specified in classpath
124+
variable. When not specified, all JAR files in the buld directory are used.
125+
108126

109127
2. Directory structure of analyser
110128

@@ -130,7 +148,26 @@ The "run.py" is the root script of the analyser. Whenever you want to run the
130148
analyser, use this Python script.
131149

132150

133-
3. Structure of results
151+
3. How to run the evalaution
134152

135-
TODO!
153+
Open terminal in the sub-directory "goto-analyser" and type there:
154+
python ./run.py -E <benchmark> --statistics
155+
156+
where <benchmark> is a root directory of some benchmark. For example:
157+
python ./run.py -E "../Encuestame" --statistics
158+
python ./run.py -E "../TRAINING/taint_traces_05" --statistics
159+
will evaluate benchmarks "Encuestame" and the training one "taint_traces_05".
160+
To evaluate only real-word benchmarks you can type:
161+
python ./run.py -E REAL --statistics
162+
To ovaluate only training benchmarks you can type:
163+
python ./run.py -E TRAINING --statistics
164+
To ovaluate all benchmarks you can type:
165+
python ./run.py -E ALL --statistics
166+
167+
168+
4. Structure of results
169+
170+
Results from the evaluation (including statistical data) are presented in form
171+
of HTML files. The root HTML file "index.html" is located in the root directory
172+
of the evaluation framework.
136173

‎regression/december_demo_sprint/Red5/APP/roots.json

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,5 @@
11
[
2-
"org.red5.server.net.rtmpt.RTMPTServlet.handleOpen",
3-
"org.red5.server.net.rtmpt.RTMPTServlet.handleSend",
4-
"org.red5.server.net.rtmpt.RTMPTServlet.service",
5-
"org.red5.server.net.servlet.AMFTunnelServlet.service",
62
"org.red5.server.net.servlet.RedirectHTTPServlet.service",
7-
"org.red5.server.net.servlet.AMFGatewayServlet.service",
8-
"org.red5.server.net.servlet.AMFGatewayServlet.serviceAMF"
3+
"org.red5.server.net.servlet.AMFGatewayServlet.service"
94
]
105

‎regression/december_demo_sprint/Sakai/APP/HACKS.txt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
1. Complex taint sources (e.g. where only InputStreams derived from a Servlet,
2+
rather than all InputStreams, should yield taint) were implemented by direct
3+
modification of the source, but are conceptually not difficult (need to add
4+
state to classes that indirectly yield taint).
5+
6+
2. Character arrays as used in Strings are imprecisely modelled and lead to
7+
taint getting everywhere, so I added a parallel field 'taintfield' that
8+
actually carries taint (these are more precise, since a Java field 'taintfield'
9+
can only ever be addressed by that name). This will be fixed by the precision
10+
improvements described elsewhere.
11+

0 commit comments

Comments
 (0)