Taint analysis

Features

• Based on soot-infoflow
• Support taint analysis for :
  • a directory of project classes, sources and libs, doesn't matter folder structure
  • a single jar file
  • a single zip file
• Flexible configurations
• Cached iCFG and Reusable infoflow instance to improve performance
• Auto locate source files
• Entry points auto selector
• JSP classes supported
• JSP line number reconstruct
• Can be used in library or standalone tool
• Easy to use

How to use

check out test cases in AnalysisExecutorTest.

Use as a library:

    // Project to be analysis. Can be directory path, .jar file or .zip file path.
    String project = "/home/ran/Documents/work/thusa2/ifpc-testcase/WebGoat-5.0";
    // jdk path for the project. can be omitted if configuration file contains it or "libPath" of config includes it.
    String jdk = "/home/ran/Documents/work/thusa2/ifpc-testcase/jdk/rt.jar";
    String result = "test_result.json";
    AnalysisExecutor analysisExecutor = AnalysisExecutor
            .newInstance()
            .withDefaultConfig()
            .setProject(project)
            .setJDK(jdk)
            // default is "SPARK"
            .setCallGraphAlgorithm("CHA")
            // Track source file and calculate line number of jsp. Default false.
            .trackSourceFile(true)
            // Path reconstruction time out.
            .setTimeout(180)
            // write detect result to file.
            .writeOutput(true)
            .setOutput(result)
            .analysis();
    
    // detect result.
    var ruleResult = analysisExecutor.getRuleResult();
    System.out.println(ruleResult);

// User defined config.
   String configPath = "config4.json";
   String result = "test_result.json";
   AnalysisExecutor analysisExecutor = AnalysisExecutor
            .newInstance()
            .withConfig(configPath)
            .setCallGraphAlgorithm("CHA")
            // Track source file and calculate line number of jsp. Default false.
            .trackSourceFile(true)
            .writeOutput(true)
            .setOutput(result)
            .analysis();

   // detect result.
   var ruleResult = analysisExecutor.getRuleResult();
   System.out.println(ruleResult);

Use as a standalone tool:

usage: taintanalysis [-h] [-dc {true,false}] [-c CONFIG] [-p [PROJECT [PROJECT ...]]]
          [-j JDK] [-t {true,false}] [-w {true,false}] [-o OUTPUT]
          [-cg {CHA,SPARK,VTA,RTA,GEOM}] [-to TIMEOUT]
          [-es [ENTRYSELECTOR [ENTRYSELECTOR ...]]]
          [-pathchecker [PATHCHECKER [PATHCHECKER ...]]] [-r [RULES [RULES ...]]]
          [-lr LISTRULE]

Run taint  analysis  of  given  project.  Example:  -dc  true  -p /project1
/project2 -j /jdk/rt.jar -t true -w true -o result.json -cg SPARK -to 180 -
r 78 22 89

named arguments:
  -h, --help             show this help message and exit
  -dc {true,false}, --defaultconfig {true,false}
                         Specify if use default config. (default: true)
  -c CONFIG, --config CONFIG
                         User defined config file path.
  -p [PROJECT [PROJECT ...]], --project [PROJECT [PROJECT ...]]
                         Project to be analysis.  Can  be directory path, .
                         jar file or .zip file path.
  -j JDK, --jdk JDK      Jdk path  for  the  project.  can  be  omitted  if
                         configuration file  contains  it  or  "libPath" of
                         config includes it.
  -t {true,false}, --track {true,false}
                         Track source file  and  calculate  line  number of
                         jsp files. (default: false)
  -w {true,false}, --write {true,false}
                         Write detect result to file. (default: true)
  -o OUTPUT, --output OUTPUT
                         Out put file path.
  -cg {CHA,SPARK,VTA,RTA,GEOM}, --callgraph {CHA,SPARK,VTA,RTA,GEOM}
                         Call graph algorithm. (default: SPARK)
  -to TIMEOUT, --timeout TIMEOUT
                         Path reconstruction time out. (default: 180)
  -es [ENTRYSELECTOR [ENTRYSELECTOR ...]], --entryselector [ENTRYSELECTOR [ENTRYSELECTOR ...]]
                         entry        selectors,         choose        from
                         'JspServiceEntry','AnnotationTagEntry','PublicStaticOrMainEntry'.
                         Multiple  selectors  can  be  set   with  '  '  in
                         between. Default all
  -pathchecker [PATHCHECKER [PATHCHECKER ...]], --pathchecker [PATHCHECKER [PATHCHECKER ...]]
                         path checkers.  choose  from  'default'.  Multiple
                         selectors can be set with ' ' in between.
  -r [RULES [RULES ...]], --rules [RULES [RULES ...]]
                         rules (cwe id)  for  analysis.  Multiple rules can
                         be set with ' '  in  between.  Default all if with
                         default config.
  -lr LISTRULE, --listrule LISTRULE
                         'true' to list rules in current config.

a example:

java -jar taintanalysis.jar -dc true -p "/p1" -j "/jdk/rt.jar" -t true -w true -o result.json -cg CHA -to 180

Config example: defaultconfig_sample.json

{
  "epoints": [
  ],
  "rules": [
    
    {
      "name": "sql injection",
      "sources" : [
        "<java.net.URLConnection: java.io.InputStream getInputStream()>",
        ...
      ],
      "sinks" : [
        "<java.sql.Connection: java.sql.CallableStatement prepareCall(java.lang.String)>",
        ...
      ]
    }
  ],

  "excludes": [
    "com.alibaba.*",
    "org.springframework.*"
  ],
  "autoDetect": true,
  "project": "youprojectpath",
  "jdk": "rt.jar"
}

Other configurations check 'Config.java'

Result example:

[
  {
    "ruleName": "命令注入",
    "result": [
      {
        "sourceSig": "<javax.servlet.GenericServlet: java.lang.String getInitParameter(java.lang.String)>",
        "sinkSig": "<java.lang.Runtime: java.lang.Process exec(java.lang.String[])>",
        "path": [
          {
            "file": "JavaSource/org/owasp/webgoat/session/WebSession.java",
            "javaClass": "org.owasp.webgoat.session.WebSession",
            "function": "<org.owasp.webgoat.session.WebSession: void <init>(javax.servlet.http.HttpServlet,javax.servlet.ServletContext)>",
            "jimpleStmt": "$r21 = virtualinvoke r4.<javax.servlet.http.HttpServlet: java.lang.String getInitParameter(java.lang.String)>(\"DatabaseDriver\")",
            "line": 275
          },
         ...
          {
            "file": "JavaSource/org/owasp/webgoat/util/Exec.java",
            "javaClass": "org.owasp.webgoat.util.Exec",
            "function": "<org.owasp.webgoat.util.Exec: org.owasp.webgoat.util.ExecResults execSimple(java.lang.String[])>",
            "jimpleStmt": "$r1 = staticinvoke <org.owasp.webgoat.util.Exec: org.owasp.webgoat.util.ExecResults execOptions(java.lang.String[],java.lang.String,int,int,boolean)>(r0, \"\", 0, 0, 0)",
            "line": 455
          },
          {
            "file": "JavaSource/org/owasp/webgoat/util/Exec.java",
            "javaClass": "org.owasp.webgoat.util.Exec",
            "function": "<org.owasp.webgoat.util.Exec: org.owasp.webgoat.util.ExecResults execOptions(java.lang.String[],java.lang.String,int,int,boolean)>",
            "jimpleStmt": "$r8 = virtualinvoke $r7.<java.lang.Runtime: java.lang.Process exec(java.lang.String[])>(r3)",
            "line": 103
          }
        ],
        "pathStm": [
          "$r21 = virtualinvoke r4.<javax.servlet.http.HttpServlet: java.lang.String getInitParameter(java.lang.String)>(\"DatabaseDriver\")",
          "r0.<org.owasp.webgoat.session.WebSession: java.lang.String databaseDriver> = $r21",
          "return",
          "r7 = $r3",
          "return r7",
          ...
          "r110 = virtualinvoke r9.<org.owasp.webgoat.lessons.CommandInjection: java.lang.String exec(org.owasp.webgoat.session.WebSession,java.lang.String[])>(r1, $r11)",
          "$r6 = staticinvoke <org.owasp.webgoat.util.Exec: org.owasp.webgoat.util.ExecResults execSimple(java.lang.String[])>(r2)",
          "$r1 = staticinvoke <org.owasp.webgoat.util.Exec: org.owasp.webgoat.util.ExecResults execOptions(java.lang.String[],java.lang.String,int,int,boolean)>(r0, \"\", 0, 0, 0)",
          "$r8 = virtualinvoke $r7.<java.lang.Runtime: java.lang.Process exec(java.lang.String[])>(r3)"
        ]
      },
    "resultCount": 16
  },
  {
    "ruleName": "路径操作",
    "result": [
      {
        "sourceSig": "<javax.servlet.ServletRequest: java.lang.String getParameter(java.lang.String)>",
        "sinkSig": "<java.io.File: void <init>(java.lang.String)>",
        "path": [
          {
            "file": "jsp-demo/org/apache/jsp/jsp_005fcustom_005fscript_005ffor_005foracle_jsp.java",
            "jspFile": "jsp-demo/jsp_custom_script_for_oracle.jsp",
            "javaClass": "org.apache.jsp.jsp_005fcustom_005fscript_005ffor_005foracle_jsp",
            "function": "<org.apache.jsp.jsp_005fcustom_005fscript_005ffor_005foracle_jsp: void _jspService(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>",
            "jimpleStmt": "$r43 = interfaceinvoke r2.<javax.servlet.http.HttpServletRequest: java.lang.String getParameter(java.lang.String)>(\"z2\")",
            "line": 477,
            "jspLine": 474
          },
          {
            "file": "jsp-demo/org/apache/jsp/jsp_005fcustom_005fscript_005ffor_005foracle_jsp.java",
            "jspFile": "jsp-demo/jsp_custom_script_for_oracle.jsp",
            "javaClass": "org.apache.jsp.jsp_005fcustom_005fscript_005ffor_005foracle_jsp",
            "function": "<org.apache.jsp.jsp_005fcustom_005fscript_005ffor_005foracle_jsp: void _jspService(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>",
            "jimpleStmt": "$r44 = virtualinvoke $r42.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r43)",
            "line": 477,
            "jspLine": 474
          }
        ],
        "pathStm": [
          "$r43 = interfaceinvoke r2.<javax.servlet.http.HttpServletRequest: java.lang.String getParameter(java.lang.String)>(\"z2\")",
          "$r44 = virtualinvoke $r42.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r43)",
          "$r45 = virtualinvoke $r44.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>(\"\")",
          "$r46 = virtualinvoke $r45.<java.lang.StringBuilder: java.lang.String toString()>()",
          "$r48 = virtualinvoke r0.<org.apache.jsp.jsp_005fcustom_005fscript_005ffor_005foracle_jsp: java.lang.String decode(java.lang.String,java.lang.String)>($r46, $r47)",
          "return r17",
          "$r49 = virtualinvoke r0.<org.apache.jsp.jsp_005fcustom_005fscript_005ffor_005foracle_jsp: java.lang.String EC(java.lang.String)>($r48)",
          "return r2",
          "$r58[2] = $r49",
          "$r98 = $r58[1]",
          "virtualinvoke r0.<org.apache.jsp.jsp_005fcustom_005fscript_005ffor_005foracle_jsp: java.lang.String RenameFileOrDirCode(java.lang.String,java.lang.String)>($r98, $r97)",
          "specialinvoke $r0.<java.io.File: void <init>(java.lang.String)>(r1)",
          "specialinvoke $r0.<java.io.File: void <init>(java.lang.String)>(r1)"
        ],
        "resultCount": 127
    }
  ]