soot.jimple.Stmt Java Examples

public Stmt getLastStmt(List<Object> body){
	if(body.size()==0)
		return null;
	
	ASTNode lastNode = (ASTNode)body.get(body.size()-1);
	if(!(lastNode instanceof ASTStatementSequenceNode))
		return null;
	
	ASTStatementSequenceNode stmtNode = (ASTStatementSequenceNode)lastNode;
	List<Object> stmts = stmtNode.getStatements();
	if(stmts.size()==0)
		return null;
	
	AugmentedStmt lastStmt = (AugmentedStmt)stmts.get(stmts.size()-1);
	return lastStmt.get_Stmt();						
}
 

private boolean isSemanticallyCorrect(String loggingPoint, Stmt stmt) {
	if(loggingPoint == null)
		return false;
	if(stmt.containsInvokeExpr()) {
		InvokeExpr inv = stmt.getInvokeExpr();
		String metSig = inv.getMethod().getSignature();
		if(metSig.equals("<android.telephony.TelephonyManager: java.lang.String getSimOperator()>") 
				|| metSig.equals("<android.telephony.TelephonyManager: java.lang.String getNetworkOperator()>")
			) {
			for(char c : loggingPoint.toCharArray()) {
				if(c < '0' || c > '9') 
					return false;
			}
		}
	}
	return true;
}
 

public boolean isParameter(Val value, Stmt u) {
   	if (u.containsInvokeExpr()) {
           InvokeExpr invokeExpr = u.getInvokeExpr();
           if (invokeExpr instanceof InstanceInvokeExpr) {
               InstanceInvokeExpr iie = (InstanceInvokeExpr) invokeExpr;
               if (iie.getBase().equals(value.value()))
                   return true;
           }
           for (Value arg : invokeExpr.getArgs()) {
               if (arg.equals(value.value())) {
                   return true;
               }
           }
       }
	return false;
}
 

@Override
public SeedFactory<Weight.NoWeight> getSeedFactory() {
    return new SeedFactory<Weight.NoWeight>() {

        @Override
        protected Collection<? extends Query> generate(SootMethod method, Stmt u) {
            if (u instanceof AssignStmt) {
                AssignStmt assignStmt = (AssignStmt) u;
                if (options.isAllocationVal(assignStmt.getRightOp())) {
                    return Collections.singleton(new ForwardQuery(new Statement((Stmt) u, method),
                            new AllocVal(assignStmt.getLeftOp(), method, assignStmt.getRightOp(),
                                    new Statement((Stmt) u, method))));
                }
            }
            return Collections.emptySet();
        }

        @Override
        public ObservableICFG<Unit, SootMethod> icfg() {
            return staticIcfg;
        }
    };
}
 

private int getConstantArrayIndexForSplitDataFlow(Stmt[] dataflow) {
	Stmt firstAssign = dataflow[0];
	if(firstAssign instanceof AssignStmt) {
		AssignStmt ass = (AssignStmt)firstAssign;
		Value value = ass.getRightOp();
		if(value instanceof ArrayRef) {
			ArrayRef aRef = (ArrayRef)value;
			Value index = aRef.getIndex();
			
			if(index instanceof IntConstant)
				return ((IntConstant) index).value;
		}
	}
	else
		throw new RuntimeException("this should not happen - wrong assumption");
	
	return -1;
}
 

@Test
public void testGLookupSwitchStmt() {
    Stmt target = Grimp.v().newAssignStmt(Grimp.v().newLocal("local0",
                IntType.v()),
            IntConstant.v(0));
    Stmt s = Grimp.v().newLookupSwitchStmt(IntConstant.v(1),
            Arrays.asList(new Value[] {
                IntConstant.v(1)
            }),
            Arrays.asList(new Unit[] {
                target
            }),
            target);
    assertTrue(ExceptionTestUtility.sameMembers(utility.VM_ERRORS, Collections.EMPTY_SET,
                unitAnalysis.mightThrow(s)));
    assertEquals(utility.VM_ERRORS_PLUS_SUPERTYPES, 
            utility.catchableSubset(unitAnalysis.mightThrow(s)));
}
 

protected Collection<WeightedForwardQuery<TransitionFunction>> generateAtAllocationSiteOf(SootMethod m, Unit unit,
        Class allocationSuperType) {
    if (unit instanceof AssignStmt) {
        AssignStmt assignStmt = (AssignStmt) unit;
        if (assignStmt.getRightOp() instanceof NewExpr) {
            NewExpr newExpr = (NewExpr) assignStmt.getRightOp();
            Value leftOp = assignStmt.getLeftOp();
            soot.Type type = newExpr.getType();
            if (Scene.v().getOrMakeFastHierarchy().canStoreType(type,
                    Scene.v().getType(allocationSuperType.getName()))) {
                return Collections.singleton(new WeightedForwardQuery<>(new Statement((Stmt) unit, m),
                        new AllocVal(leftOp, m, assignStmt.getRightOp(), new Statement((Stmt) unit, m)),
                        initialTransition()));
            }
        }
    }
    return Collections.emptySet();
}
 

private ResultSourceInfo findDataFlowPathForSink(Stmt sinkStmt, Local sinkLokal, List<ResultSourceInfo> allDataFlows) {
	for(ResultSourceInfo singleFlow : allDataFlows){
		Stmt[] statements = singleFlow.getPath();
		AccessPath[] accessPath = singleFlow.getPathAccessPaths();
		
		for(int i = 0; i < statements.length; i++) {	
			Stmt currentStmt = statements[i];
			if(currentStmt == sinkStmt) {
				if(accessPath[i].getPlainValue() == sinkLokal)
					return singleFlow;
			}
			
			else if(currentStmt instanceof AssignStmt) {
				AssignStmt assignStmt = (AssignStmt)currentStmt;
				Value lhs = assignStmt.getLeftOp();
			
				if(lhs == sinkLokal)						
					return singleFlow;		
			}
		}
	}
	return null;
}
 

/**
 * Returns the arguments for a potential COAL query.
 * 
 * @param stmt A program statement.
 * @return An array of arguments if the statement is for a COAL query, null otherwise.
 */
public Argument[] getArgumentsForQuery(Stmt stmt) {
  if (stmt.containsInvokeExpr()) {
    InvokeExpr invokeExpr = stmt.getInvokeExpr();
    SootMethod method = invokeExpr.getMethod();
    if (AnalysisParameters.v().isAnalysisClass(method.getDeclaringClass().getName())
        && method.isConcrete() && method.hasActiveBody()) {
      MethodDescription description = queryToMethodDescriptionMap.get(method.getSignature());
      if (description == null) {
        return null;
      } else {
        return description.getArguments();
      }
    }
    return getArgumentsFromMethodDescription(queryToMethodDescriptionMap, invokeExpr);
  }
  return null;
}
 

@Override
public Optional<? extends Query> test(Stmt unit) {
    Stmt stmt = unit;
    if (!(stmt.containsInvokeExpr()))
        return Optional.empty();
    InvokeExpr invokeExpr = stmt.getInvokeExpr();
    if (!invokeExpr.getMethod().getName().matches(methodNameMatcher))
        return Optional.empty();
    Value param = invokeExpr.getArg(0);
    if (!(param instanceof Local))
        return Optional.empty();
    SootMethod newMethod = icfg.getMethodOf(unit);
    Statement newStatement = new Statement(unit, newMethod);
    Val newVal = new Val(param, newMethod);
    BackwardQuery newBackwardQuery = new BackwardQuery(newStatement, newVal);
    return Optional.<Query> of(newBackwardQuery);
}
 

private SootMethod getOrCreateInitializer(SootClass sc,
		Set<SootField> alreadyInitialized) {
	SootMethod smInit;
	// Create a static initializer if we don't already have one
	smInit = sc.getMethodByNameUnsafe("<clinit>");
	if (smInit == null) {
		smInit = new SootMethod("<clinit>", Collections.<Type>emptyList(), VoidType.v());
		smInit.setActiveBody(Jimple.v().newBody(smInit));
		sc.addMethod(smInit);
		smInit.setModifiers(Modifier.PUBLIC | Modifier.STATIC);
	}
	else {
		smInit.retrieveActiveBody();
		
		// We need to collect those variables that are already initialized somewhere
		for (Unit u : smInit.getActiveBody().getUnits()) {
			Stmt s = (Stmt) u;
			for (ValueBox vb : s.getDefBoxes())
				if (vb.getValue() instanceof FieldRef)
					alreadyInitialized.add(((FieldRef) vb.getValue()).getField());
		}
	}
	return smInit;
}
 

@Ignore("Fails")
@Test
public void testJReturnVoidStmt() {
    Stmt s = Jimple.v().newReturnVoidStmt();

    Set expectedRep = new ExceptionHashSet(utility.VM_ERRORS);
    expectedRep.add(utility.ILLEGAL_MONITOR_STATE_EXCEPTION);
    assertTrue(ExceptionTestUtility.sameMembers(expectedRep, Collections.EMPTY_SET,
                unitAnalysis.mightThrow(s)));

    Set expectedCatch = new ExceptionHashSet(utility.VM_ERRORS_PLUS_SUPERTYPES);
    expectedCatch.add(utility.ILLEGAL_MONITOR_STATE_EXCEPTION);
    expectedCatch.add(utility.RUNTIME_EXCEPTION);
    expectedCatch.add(utility.EXCEPTION);
    assertEquals(expectedCatch, 
            utility.catchableSubset(unitAnalysis.mightThrow(s)));
}
 

private Local insertCast(Value oldvalue, Type oldtype, Type type, Stmt stmt) {
	Local newlocal1 = Jimple.v().newLocal("tmp", oldtype);
	Local newlocal2 = Jimple.v().newLocal("tmp", type);
	stmtBody.getLocals().add(newlocal1);
	stmtBody.getLocals().add(newlocal2);

	Unit u = Util.findFirstNonIdentityUnit(this.stmtBody, stmt);
	stmtBody.getUnits().insertBefore(
			Jimple.v().newAssignStmt(newlocal1, oldvalue), u);
	stmtBody.getUnits().insertBefore(
			Jimple.v().newAssignStmt(newlocal2,
					Jimple.v().newCastExpr(newlocal1, type)), u);
	return newlocal2;
}
 

/**
 * Gets whether the two values must always point to the same runtime object
 * @param field1 The first value
 * @param field2 The second value
 * @param position The statement at which to check for an aliasing
 * relationship
 * @return True if the two values must always point to the same runtime
 * object, otherwise false
 */
public boolean mustAlias(Local val1, Local val2, Stmt position) {
	if (val1 == val2)
		return true;
	if (!(val1.getType() instanceof RefLikeType) || !(val2.getType() instanceof RefLikeType))
		return false;

	LocalMustAliasAnalysis lmaa = strongAliasAnalysis.getUnchecked(cfg.getMethodOf(position));
	return lmaa.mustAlias(val1, position, val2, position);
}
 

public String backwardStringExtraction(SootMethod sootMethod, Stmt valueStmt, Value value)
{
	if (value.toString().contains("\""))
	{
		return value.toString();
	}
	
	//backwardStringExtraction
	/*
	Body body = sootMethod.retrieveActiveBody();
	PatchingChain<Unit> units = body.getUnits();
	
	List<Stmt> stmts = new ArrayList<Stmt>();
	
	boolean start = false;
	for (Iterator<Unit> unitIter = units.snapshotIterator(); unitIter.hasNext(); )
	{
		Stmt stmt = (Stmt) unitIter.next();
		if (! stmt.equals(valueStmt))
		{
			stmts.add(stmt);
		}
	}*/
	
	
	return "";
}
 

private void handleInvokeExpr(InvokeExpr ie, Stmt stmt)
{
	SootMethodRef m = ie.getMethodRef();

	if ( ie instanceof InstanceInvokeExpr )
	{
		InstanceInvokeExpr iie = (InstanceInvokeExpr)ie;
		iie.setBase(this.uv.visit(
			iie.getBase(),m.declaringClass().getType(), stmt));
	}

	for ( int i = 0; i < ie.getArgCount(); i++ )
		ie.setArg(i, this.uv.visit(
			ie.getArg(i), m.parameterType(i), stmt));
}
 

protected FieldWritePOI createArrayFieldStore(Statement s) {
    Stmt stmt = s.getUnit().get();
    AssignStmt as = (AssignStmt) stmt;
    ArrayRef ifr = (ArrayRef) as.getLeftOp();
    Val base = new Val(ifr.getBase(), icfg().getMethodOf(as));
    Val stored = new Val(as.getRightOp(), icfg().getMethodOf(as));
    return fieldWrites.getOrCreate(new FieldWritePOI(s, base, Field.array(), stored));
}
 

public Set<Statement> getSuccsOf(Statement stmt) {
    Set<Statement> res = Sets.newHashSet();
    if (!stmt.getUnit().isPresent())
        return res;
    Stmt curr = stmt.getUnit().get();
    for (Unit succ : icfg.getSuccsOf(curr)) {
        res.add(new Statement((Stmt) succ, icfg.getMethodOf(succ)));
    }
    return res;
}
 

/**
 * Computes the path of tainted data between the source and the sink
 * @param res The data flow tracker results
 */
private void computeTaintPathsInternal(final Set<AbstractionAtSink> res) {   	
	logger.debug("Running path reconstruction");
   	logger.info("Obtainted {} connections between sources and sinks", res.size());
   	int curResIdx = 0;
   	for (final AbstractionAtSink abs : res) {
   		logger.info("Building path " + ++curResIdx);
   		executor.execute(new Runnable() {
			
			@Override
			public void run() {
				Stack<Pair<Stmt, Set<Abstraction>>> initialStack = new Stack<Pair<Stmt, Set<Abstraction>>>();
				initialStack.push(new Pair<Stmt, Set<Abstraction>>(null,
						Collections.newSetFromMap(new IdentityHashMap<Abstraction,Boolean>())));
	    		for (SourceContextAndPath context : getPaths(lastTaskId++,
	    				abs.getAbstraction(), initialStack)) {
	    			List<Stmt> newPath = new ArrayList<>(context.getPath());
	    			newPath.add(abs.getSinkStmt());
					results.addResult(abs.getAbstraction().getAccessPath(),
							abs.getSinkStmt(),
							context.getAccessPath(), context.getStmt(), context.getUserData(),
							newPath);
	    		}
			}
			
		});
   		
   	}
   	
   	try {
		executor.awaitCompletion();
	} catch (InterruptedException ex) {
		logger.error("Could not wait for path executor completion: {0}", ex.getMessage());
		ex.printStackTrace();
	}
   	executor.shutdown();
   	logger.debug("Path reconstruction done.");
}
 

private AbstractBoomerangSolver<W> forwardSolve(ForwardQuery query) {
    Optional<Stmt> unit = query.asNode().stmt().getUnit();
    AbstractBoomerangSolver<W> solver = queryToSolvers.getOrCreate(query);
    if (unit.isPresent()) {
        if (isMultiArrayAllocation(unit.get()) && options.arrayFlows()) {
            // TODO fix; adjust as below;
            SingleNode<Node<Statement, Val>> sourveVal = new SingleNode<Node<Statement, Val>>(query.asNode());
            GeneratedState<Node<Statement, Val>, Field> genState = new GeneratedState<Node<Statement, Val>, Field>(
                    sourveVal, Field.array());
            insertTransition(solver.getFieldAutomaton(),
                    new Transition<Field, INode<Node<Statement, Val>>>(sourveVal, Field.array(), genState));
            insertTransition(solver.getFieldAutomaton(), new Transition<Field, INode<Node<Statement, Val>>>(
                    genState, Field.empty(), solver.getFieldAutomaton().getInitialState()));
        }
        if (isStringAllocation(unit.get())) {
            // Scene.v().forceResolve("java.lang.String",
            // SootClass.BODIES);
            SootClass stringClass = Scene.v().getSootClass("java.lang.String");
            if (stringClass.declaresField("char[] value")) {
                SootField valueField = stringClass.getFieldByName("value");
                SingleNode<Node<Statement, Val>> s = new SingleNode<Node<Statement, Val>>(query.asNode());
                INode<Node<Statement, Val>> irState = solver.getFieldAutomaton().createState(s,
                        new Field(valueField));
                insertTransition(solver.getFieldAutomaton(), new Transition<Field, INode<Node<Statement, Val>>>(
                        new SingleNode<Node<Statement, Val>>(query.asNode()), new Field(valueField), irState));
                insertTransition(solver.getFieldAutomaton(), new Transition<Field, INode<Node<Statement, Val>>>(
                        irState, Field.empty(), solver.getFieldAutomaton().getInitialState()));
            }
        }
        if (query instanceof WeightedForwardQuery) {
            WeightedForwardQuery<W> q = (WeightedForwardQuery<W>) query;
            solver.solve(q.asNode(), q.weight());
        } else {
            solver.solve(query.asNode());
        }
    }
    return solver;
}
 

public AugmentedStmt get_AugStmt( Stmt s)
   {
AugmentedStmt as = (AugmentedStmt) binding.get( s);
if (as == null)
    throw new RuntimeException( "Could not find augmented statement for: " + s.toString());

return as;
   }
 

@Override
public void computeAliasTaints
		(final Abstraction d1, final Stmt src,
		final Value targetValue, Set<Abstraction> taintSet,
		SootMethod method, Abstraction newAbs) {
	// nothing to do here
}
 

@Override
public void addCalleeListener(CalleeListener<Unit, SootMethod> listener) {
    if (!calleeListeners.put(listener.getObservedCaller(), listener)) {
        return;
    }

    // Notify the new listener about edges we already know
    Unit unit = listener.getObservedCaller();
    Stmt stmt = (Stmt) unit;
    Iterator<Edge> edgeIterator = demandDrivenCallGraph.edgesOutOf(unit);
    while (edgeIterator.hasNext()) {
        Edge edge = edgeIterator.next();
        listener.onCalleeAdded(unit, edge.tgt());
    }

    InvokeExpr ie = stmt.getInvokeExpr();
    // Now check if we need to find new edges
    if ((ie instanceof InstanceInvokeExpr)) {
        // If it was invoked on an object we might find new instances
        if (ie instanceof SpecialInvokeExpr) {
            // If it was a special invoke, there is a single target
            addCallIfNotInGraph(unit, ie.getMethod(), Kind.SPECIAL);
            // If the precomputed graph has more edges than our graph, there may be more edges to find
        } else if (precomputedCallGraph != null && potentiallyHasMoreEdges(precomputedCallGraph.edgesOutOf(unit),
                demandDrivenCallGraph.edgesOutOf(unit))) {
            // Query for callees of the unit and add edges to the graph
            queryForCallees(unit);
        }
    } else {
        // Call was not invoked on an object. Must be static
        addCallIfNotInGraph(unit, ie.getMethod(), Kind.STATIC);
    }
}
 

/**
 * Returns a string (natural number) representation of the instance key associated with l
 * at statement s or <code>null</code> if there is no such key associated or <code>UNKNOWN</code> if 
 * the value of l at s is {@link #UNKNOWN}. 
 * @param l any local of the associated method
 * @param s the statement at which to check
 */
public String instanceKeyString(Local l, Stmt s) {
    Object ln = getFlowBefore(s).get(l);
    if(ln==null) {
    	return null;
    } else  if(ln==UNKNOWN) {
    	return UNKNOWN.toString();
    }
    return ln.toString();
}
 

/**
 * {@inheritDoc}
 */
@Override
public String instanceKeyString(Local l, Stmt s) {
    Object ln = getFlowBefore(s).get(l);
    if(invalidInstanceKeys.contains(ln)) {
        return UNKNOWN_LABEL;
    }
    return super.instanceKeyString(l, s);
}
 

public static Map<UniqStmt, StmtKey> toStmtKeys(Map<UniqStmt, StmtValue> uniqStmtKeyValues)
{
	Map<UniqStmt, StmtKey> keyPairs = new HashMap<UniqStmt, StmtKey>();
	
	for (Map.Entry<UniqStmt, StmtValue> entry : uniqStmtKeyValues.entrySet())
	{
		UniqStmt uniqStmt = entry.getKey();
		
		StmtKey stmtKey = new StmtKey();
		SootMethod sm = Scene.v().getMethod(uniqStmt.methodSignature);
		stmtKey.setMethod(sm);
		
		Body body = sm.retrieveActiveBody();
		int count = 0;
		for (Iterator<Unit> iter = body.getUnits().snapshotIterator(); iter.hasNext(); )
		{
			Stmt stmt = (Stmt) iter.next();
			count++;
			
			if (count == uniqStmt.stmtSeq)
			{
				stmtKey.setStmt(stmt);
				break;
			}
		}
		
		keyPairs.put(uniqStmt, stmtKey);
	}
	
	return keyPairs;
}
 

public Abstraction(AccessPath sourceVal,
		Stmt sourceStmt,
		Object userData,
		boolean exceptionThrown,
		boolean isImplicit){
	this(sourceVal,
			new SourceContext(sourceVal, sourceStmt, userData),
			exceptionThrown, isImplicit);
}
 

@Override
public SourceInfo getSourceInfo(Stmt sCallSite, InterproceduralCFG<Unit, SootMethod> cfg) {
	SourceType type = getSourceType(sCallSite, cfg);
	if (type == SourceType.NoSource)
		return null;
	
	return getSourceInfo(sCallSite, type);
}
 

/**
 * Gets a list of all units that invoke other methods in the given method
 * @param method The method from which to get all invocations
 * @return The list of units calling other methods in the given method if
 * there is at least one such unit. Otherwise null.
 */
private List<Unit> getCallsInMethod(SootMethod method) {
	List<Unit> callSites = null;
	for (Unit u : method.getActiveBody().getUnits())
		if (((Stmt) u).containsInvokeExpr()) {
			if (callSites == null)
				callSites = new ArrayList<Unit>();
			callSites.add(u);
		}
	return callSites;
}
 

@Override
public void onSecureObjectFound(final IAnalysisSeed secureObject) {
	IPreferenceStore store = Activator.getDefault().getPreferenceStore();
	if (!store.getBoolean(Constants.SHOW_SECURE_OBJECTS) || this.depOnly) {
		return;
	}

	final Statement stmt = secureObject.stmt();
	final Stmt unit = stmt.getUnit().get();
	final List<ValueBox> useAndDefBoxes = unit.getUseAndDefBoxes();
	final Optional<ValueBox> varOpt = useAndDefBoxes.stream().filter(e -> e instanceof JimpleLocalBox).findFirst();
	ValueBox var = null;
	if (varOpt.isPresent()) {
		var = varOpt.get();
	} else {
		for (final ValueBox box : useAndDefBoxes) {
			if (box.getValue() instanceof JimpleLocal) {
				var = box;
				break;
			}
		}
	}
	final Value varName = var.getValue();
	this.markerGenerator.addMarker(Constants.CC_MARKER_TYPE, -1, unitToResource(stmt), unit.getJavaSourceStartLineNumber(),
			"Object " + (varName.toString().startsWith("$r") || varName.toString().startsWith("$stack")  ? " of Type " + var.getValue().getType().toQuotedString() : varName) + " is secure.", "",
			secureObject.getMethod().getActiveBody().toString(), Severities.Info, new HashMap<>(), false);
}