JNI call analysis WIP

DEVELOPING_OPAL/validate/src/test/scala/org/opalj/ll/CrossLanguageForwardTaintAnalysisTest.scala

@@ -7,7 +7,7 @@ import org.opalj.br.fpcf.FPCFAnalysesManagerKey
 import org.opalj.ifds
 import org.opalj.ifds.IFDSProperty
 import org.opalj.ll.fpcf.analyses.ifds.{LLVMFunction, LLVMStatement}
-import org.opalj.ll.fpcf.analyses.ifds.taint.{JavaForwardTaintAnalysisScheduler, NativeFact, NativeForwardTaintAnalysisScheduler, NativeNullFact}
+import org.opalj.ll.fpcf.analyses.ifds.taint.{JavaForwardTaintAnalysisScheduler, NativeTaintFact, NativeForwardTaintAnalysisScheduler, NativeTaintNullFact}
 import org.opalj.ll.llvm.value.Function
 import org.opalj.log.GlobalLogContext
 import org.opalj.tac.cg.RTACallGraphKey
@@ -17,7 +17,7 @@ import org.scalatest.funspec.AnyFunSpec
 import org.scalatest.matchers.should.Matchers
 
 class CrossLanguageForwardIFDSTaintAnalysisTests extends AnyFunSpec with Matchers {
-    describe("MultilingualForwardTaintAnalysis") {
+    describe("CrossLanguageForwardTaintAnalysis") {
         implicit val config = BaseConfig.withValue(ifds.ConfigKeyPrefix+"debug", ConfigValueFactory.fromAnyRef(true))
         val project =
             Project(
@@ -61,7 +61,7 @@ class CrossLanguageForwardIFDSTaintAnalysisTests extends AnyFunSpec with Matcher
         }
 
         val function: Function = project.get(LLVMProjectKey).function("Java_TaintTest_native_1array_1tainted").get
-        val debugData = ps((LLVMFunction(function), NativeNullFact), NativeForwardTaintAnalysisScheduler.property.key).ub.asInstanceOf[IFDSProperty[LLVMStatement, NativeFact]].debugData
+        val debugData = ps((LLVMFunction(function), NativeTaintNullFact), NativeForwardTaintAnalysisScheduler.property.key).ub.asInstanceOf[IFDSProperty[LLVMStatement, NativeTaintFact]].debugData
         for {
             bb ← function.basicBlocks
             instruction ← bb.instructions

OPAL/ifds/src/main/scala/org/opalj/ifds/DataFlowAnalysis.scala

@@ -0,0 +1,45 @@
+/* BSD 2-Clause License - see OPAL/LICENSE for details. */
+package org.opalj.ifds
+
+import scala.collection.mutable
+
+abstract class DataFlowAnalysis[Facts >: Null <: AnyRef, C <: AnyRef, S <: Statement[_ <: C, _]] {
+    def icfg: ICFG[C, S]
+    def entryFacts: Facts
+    def transferFunction(facts: Facts, statement: S, successor: S): Facts
+    def join(left: Facts, right: Facts): Facts
+
+    def perform(callable: C): Map[S, Facts] = {
+        var facts = Map.empty[S, Facts]
+        val workList = new mutable.Queue[S]()
+
+        for (entryStatement ← icfg.startStatements(callable)) {
+            facts = facts.updated(entryStatement, entryFacts)
+            workList.enqueue(entryStatement)
+        }
+
+        while (workList.nonEmpty) {
+            val statement = workList.dequeue()
+            val inFacts = facts.get(statement).get
+
+            for (successor ← icfg.nextStatements(statement)) {
+                val newOutFacts = transferFunction(inFacts, statement, successor)
+                facts.get(successor) match {
+                    case None ⇒ {
+                        facts = facts.updated(successor, newOutFacts)
+                        workList.enqueue(successor)
+                    }
+                    case Some(existingOutFacts) ⇒ {
+                        val outFacts = join(existingOutFacts, newOutFacts)
+                        if (outFacts ne existingOutFacts) {
+                            facts = facts.updated(successor, outFacts)
+                            workList.enqueue(successor)
+                        }
+                    }
+                }
+            }
+        }
+
+        facts
+    }
+}

OPAL/ifds/src/main/scala/org/opalj/ifds/IFDSAnalysis.scala

@@ -8,11 +8,6 @@ import org.opalj.ifds.Dependees.Getter
 
 import scala.collection.{mutable, Set ⇒ SomeSet}
 
-abstract class Statement[C, Node] {
-    def node(): Node
-    def callable(): C
-}
-
 case class Dependees[Work]() {
     case class Dependee(eOptionP: SomeEOptionP, worklist: Set[Work] = Set.empty)
     var dependees = Map.empty[SomeEPK, Dependee]

OPAL/ifds/src/main/scala/org/opalj/ifds/IFDSProperty.scala

@@ -3,7 +3,7 @@ package org.opalj.ifds
 import org.opalj.fpcf.Property
 import org.opalj.fpcf.PropertyMetaInformation
 
-trait IFDSPropertyMetaInformation[S, IFDSFact] extends PropertyMetaInformation {
+trait IFDSPropertyMetaInformation[S, IFDSFact <: AbstractIFDSFact] extends PropertyMetaInformation {
     /**
      * Creates an IFDSProperty containing the result of this analysis.
      *
@@ -14,7 +14,7 @@ trait IFDSPropertyMetaInformation[S, IFDSFact] extends PropertyMetaInformation {
     def create(result: Map[S, Set[IFDSFact]], debugData: Map[S, Set[IFDSFact]]): IFDSProperty[S, IFDSFact]
 }
 
-abstract class IFDSProperty[S, IFDSFact]
+abstract class IFDSProperty[S, IFDSFact <: AbstractIFDSFact]
     extends Property
     with IFDSPropertyMetaInformation[S, IFDSFact] {
 

OPAL/ifds/src/main/scala/org/opalj/ifds/Statement.scala

@@ -0,0 +1,7 @@
+/* BSD 2-Clause License - see OPAL/LICENSE for details. */
+package org.opalj.ifds
+
+abstract class Statement[C, Node] {
+    def node(): Node
+    def callable(): C
+}

OPAL/ll/src/main/scala/org/opalj/ll/fpcf/analyses/ifds/JNICallUtil.scala

@@ -0,0 +1,87 @@
+/* BSD 2-Clause License - see OPAL/LICENSE for details. */
+package org.opalj.ll.fpcf.analyses.ifds
+
+import org.opalj.ll.llvm.value.constant.{ConstantDataArray, GetElementPtrConst}
+import org.opalj.ll.llvm.value.{Argument, Call, GetElementPtr, GlobalVariable, Load, Store, Value}
+import org.opalj.ll.llvm.{PointerType, StructType}
+
+object JNICallUtil {
+
+    /**
+     * Checks whether the call is a call to the JNI interface.
+     * This is done by the assumption that every such calls first parameter is a struct of type "struct.JNINativeInterface_"
+     */
+    def isJNICall(call: Call): Boolean = call.calledFunctionType.params.headOption match {
+        case Some(firstParam) ⇒
+            firstParam match {
+                case p1: PointerType ⇒
+                    p1.element match {
+                        case p2: PointerType ⇒
+                            p2.element match {
+                                case struct: StructType if struct.name == "struct.JNINativeInterface_" ⇒
+                                    true
+                                case other ⇒ false
+                            }
+                        case _ ⇒ false
+                    }
+                case _ ⇒ false
+            }
+        case _ ⇒ false
+    }
+
+    def resolve(call: Call): Set[NativeFunction] = resolveJNIFunction(call) match {
+        case 'CallTypeMethod ⇒ {
+            resolveMethodId(call.operand(2))
+            Set() // TODO
+        } // methodID is the third parameter
+        case _ ⇒ Set()
+    }
+
+    private def resolveJNIFunction(call: Call): Symbol = call.calledValue match {
+        case load: Load ⇒
+            load.src match {
+                // https://docs.oracle.com/en/java/javase/13/docs/specs/jni/functions.html has the indices
+                case gep: GetElementPtr if gep.isConstant ⇒ gep.constants.tail.head match {
+                    case 31      ⇒ 'GetObjectClass
+                    case 33      ⇒ 'GetMethodId
+                    case 49 | 61 ⇒ 'CallTypeMethod // CallIntMethod | CallVoidMethod
+                    case index   ⇒ throw new IllegalArgumentException(s"unknown JNI function index ${index}")
+                }
+                case _ ⇒ throw new IllegalArgumentException("unknown JNI load src")
+            }
+        case _ ⇒ throw new IllegalArgumentException("unknown JNI call argument")
+    }
+
+    private def resolveMethodId(methodId: Value): Unit = {
+        val sources = methodId.asInstanceOf[Load].src.users.toSeq.filter(_.isInstanceOf[Store]).map(_.asInstanceOf[Store].src)
+        for (call ← sources.filter(_.isInstanceOf[Call]).map(_.asInstanceOf[Call])) {
+            if (resolveJNIFunction(call) != 'GetMethodId) throw new IllegalArgumentException("unexpected call")
+            val name = resolveMethodName(call.operand(2)) // name is the third parameter
+            println(name)
+            if (!resolveClassIsThis(call.operand(1))) { // class is the second parameter
+                throw new IllegalArgumentException("unexpected class argument")
+            }
+        }
+    }
+
+    private def resolveMethodName(name: Value): String = name match {
+        case gep: GetElementPtrConst ⇒ gep.base match {
+            case global: GlobalVariable ⇒ global.initializer match {
+                case stringData: ConstantDataArray ⇒ stringData.asString
+            }
+        }
+    }
+
+    private def resolveClassIsThis(clazz: Value): Boolean = {
+        val sources = clazz.asInstanceOf[Load].src.users.toSeq.filter(_.isInstanceOf[Store]).map(_.asInstanceOf[Store].src)
+        sources.filter(_.isInstanceOf[Call]).map(_.asInstanceOf[Call]).forall(call ⇒ {
+            if (resolveJNIFunction(call) != 'GetObjectClass) throw new IllegalArgumentException("unexpected call")
+            resolveObjectIsThis(call.operand(1)) // object is the second parameter
+        })
+    }
+
+    private def resolveObjectIsThis(obj: Value): Boolean = {
+        val sources = obj.asInstanceOf[Load].src.users.toSeq.filter(_.isInstanceOf[Store]).map(_.asInstanceOf[Store].src)
+        sources.forall(_.isInstanceOf[Argument]) && sources.forall(_.asInstanceOf[Argument].index == 1)
+    }
+}

OPAL/ll/src/main/scala/org/opalj/ll/fpcf/analyses/ifds/NativeForwardICFG.scala

@@ -1,11 +1,10 @@
 /* BSD 2-Clause License - see OPAL/LICENSE for details. */
 package org.opalj.ll.fpcf.analyses.ifds
 
-import org.opalj.ifds.{AbstractIFDSFact, ICFG}
-import org.opalj.ll.llvm.{PointerType, StructType}
-import org.opalj.ll.llvm.value.{Call, Function, GetElementPtr, Instruction, Load, Ret, Terminator, Value}
+import org.opalj.ifds.ICFG
+import org.opalj.ll.llvm.value.{Call, Function, Instruction, Ret, Terminator}
 
-class NativeForwardICFG[IFDSFact <: AbstractIFDSFact] extends ICFG[NativeFunction, LLVMStatement] {
+object NativeForwardICFG extends ICFG[NativeFunction, LLVMStatement] {
     /**
      * Determines the statements at which the analysis starts.
      *
@@ -40,7 +39,7 @@ class NativeForwardICFG[IFDSFact <: AbstractIFDSFact] extends ICFG[NativeFunctio
      */
     override def getCalleesIfCallStatement(statement: LLVMStatement): Option[collection.Set[NativeFunction]] = {
         statement.instruction match {
-            case call: Call ⇒ Some(resolveCallee(call.calledValue))
+            case call: Call ⇒ Some(resolveCallee(call))
             case _          ⇒ None
         }
     }
@@ -50,23 +49,10 @@ class NativeForwardICFG[IFDSFact <: AbstractIFDSFact] extends ICFG[NativeFunctio
         case _      ⇒ false
     }
 
-    private def resolveCallee(calledValue: Value): Set[NativeFunction] = calledValue match {
-        case function: Function ⇒ Set(LLVMFunction(function))
-        case load: Load ⇒ resolveCallee(load.src)
-        case gep: GetElementPtr if isJNI(gep) => Set()
-        case _ ⇒ Set()
-    }
-
-    private def isJNI(gep: GetElementPtr): Boolean = {
-        if (gep.base.typ.isInstanceOf[PointerType]) {
-           val pointerType = gep.base.typ.asInstanceOf[PointerType]
-           if (pointerType.element.isInstanceOf[StructType]) {
-              val struct = pointerType.element.asInstanceOf[StructType]
-              if (struct.name == "struct.JNINativeInterface_") {
-                 return true
-              }
-           }
-        }
-        false
-    }
+    private def resolveCallee(call: Call): Set[NativeFunction] =
+        if (call.calledValue.isInstanceOf[Function])
+            Set(LLVMFunction(call.calledValue.asInstanceOf[Function]))
+        else if (JNICallUtil.isJNICall(call))
+            JNICallUtil.resolve(call)
+        else Set()
 }

OPAL/ll/src/main/scala/org/opalj/ll/fpcf/analyses/ifds/NativeIFDSProblem.scala

@@ -8,7 +8,7 @@ import org.opalj.ifds.Dependees.Getter
 import org.opalj.ifds.{AbstractIFDSFact, IFDSProblem}
 import org.opalj.ll.LLVMProjectKey
 
-abstract class NativeIFDSProblem[Fact <: AbstractIFDSFact](project: SomeProject) extends IFDSProblem[Fact, NativeFunction, LLVMStatement](new NativeForwardICFG[Fact]) {
+abstract class NativeIFDSProblem[Fact <: AbstractIFDSFact](project: SomeProject) extends IFDSProblem[Fact, NativeFunction, LLVMStatement](NativeForwardICFG) {
     final implicit val propertyStore: PropertyStore = project.get(PropertyStoreKey)
     val llvmProject = project.get(LLVMProjectKey)
 

OPAL/ll/src/main/scala/org/opalj/ll/fpcf/analyses/ifds/taint/JavaForwardTaintAnalysis.scala

@@ -73,11 +73,11 @@ class SimpleJavaForwardTaintProblem(p: SomeProject) extends ForwardTaintProblem(
             val entryFacts = nativeCallFlow(call, function, in, callee)
             for (entryFact ← entryFacts) { // ifds line 14
                 val e = (function, entryFact)
-                val exitFacts: Map[LLVMStatement, Set[NativeFact]] =
-                    dependeesGetter(e, NativeTaint.key).asInstanceOf[EOptionP[(LLVMStatement, NativeFact), IFDSProperty[LLVMStatement, NativeFact]]] match {
-                        case ep: FinalEP[_, IFDSProperty[LLVMStatement, NativeFact]] ⇒
+                val exitFacts: Map[LLVMStatement, Set[NativeTaintFact]] =
+                    dependeesGetter(e, NativeTaint.key).asInstanceOf[EOptionP[(LLVMStatement, NativeTaintFact), IFDSProperty[LLVMStatement, NativeTaintFact]]] match {
+                        case ep: FinalEP[_, IFDSProperty[LLVMStatement, NativeTaintFact]] ⇒
                             ep.p.flows
-                        case ep: InterimEUBP[_, IFDSProperty[LLVMStatement, NativeFact]] ⇒
+                        case ep: InterimEUBP[_, IFDSProperty[LLVMStatement, NativeTaintFact]] ⇒
                             ep.ub.flows
                         case _ ⇒
                             Map.empty
@@ -114,7 +114,7 @@ class SimpleJavaForwardTaintProblem(p: SomeProject) extends ForwardTaintProblem(
         callee:       LLVMFunction,
         in:           Fact,
         nativeCallee: Method
-    ): Set[NativeFact] = {
+    ): Set[NativeTaintFact] = {
         val callObject = asCall(call.stmt)
         val allParams = callObject.allParams
         val allParamsWithIndices = allParams.zipWithIndex
@@ -147,7 +147,7 @@ class SimpleJavaForwardTaintProblem(p: SomeProject) extends ForwardTaintProblem(
 
             case StaticField(classType, fieldName) ⇒ Set(JavaStaticField(classType, fieldName))
 
-            case NullFact                          ⇒ Set(NativeNullFact)
+            case NullFact                          ⇒ Set(NativeTaintNullFact)
 
             case _                                 ⇒ Set() // Nothing to do
 
@@ -166,7 +166,7 @@ class SimpleJavaForwardTaintProblem(p: SomeProject) extends ForwardTaintProblem(
      */
     private def nativeReturnFlow(
         exit:         LLVMStatement,
-        in:           NativeFact,
+        in:           NativeTaintFact,
         call:         JavaStatement,
         callFact:     Fact,
         nativeCallee: Method,
@@ -217,8 +217,8 @@ class SimpleJavaForwardTaintProblem(p: SomeProject) extends ForwardTaintProblem(
             // Track the call chain to the sink back
             case NativeFlowFact(flow) if !flow.contains(JavaMethod(call.method)) ⇒
                 flows += FlowFact(JavaMethod(call.method) +: flow)
-            case NativeNullFact ⇒ flows += NullFact
-            case _              ⇒
+            case NativeTaintNullFact ⇒ flows += NullFact
+            case _                   ⇒
         }
 
         // Propagate taints of the return value
@@ -232,7 +232,7 @@ class SimpleJavaForwardTaintProblem(p: SomeProject) extends ForwardTaintProblem(
             flows += ArrayElement(call.index, taintedIndex)
           case InstanceField(index, declClass, taintedField) if returnValueDefinedBy.contains(index) ⇒
             flows += InstanceField(call.index, declClass, taintedField)*/
-                    case NativeNullFact ⇒
+                    case NativeTaintNullFact ⇒
                         val taints = createTaints(nativeCallee, call)
                         if (taints.nonEmpty) flows ++= taints
                     case _ ⇒ // Nothing to do

OPAL/ll/src/main/scala/org/opalj/ll/fpcf/analyses/ifds/taint/NativeForwardTaintAnalysis.scala

@@ -12,7 +12,7 @@ class SimpleNativeForwardTaintProblem(p: SomeProject) extends NativeForwardTaint
     /**
      * The analysis starts with all public methods in TaintAnalysisTestClass.
      */
-    override val entryPoints: Seq[(NativeFunction, NativeFact)] = Seq.empty
+    override val entryPoints: Seq[(NativeFunction, NativeTaintFact)] = Seq.empty
 
     /**
      * The sanitize method is a sanitizer.
@@ -23,12 +23,12 @@ class SimpleNativeForwardTaintProblem(p: SomeProject) extends NativeForwardTaint
     /**
      * We do not sanitize parameters.
      */
-    override protected def sanitizesParameter(call: LLVMStatement, in: NativeFact): Boolean = false
+    override protected def sanitizesParameter(call: LLVMStatement, in: NativeTaintFact): Boolean = false
 
     /**
      * Creates a new variable fact for the callee, if the source was called.
      */
-    protected def createTaints(callee: Function, call: LLVMStatement): Set[NativeFact] =
+    protected def createTaints(callee: Function, call: LLVMStatement): Set[NativeTaintFact] =
         if (callee.name == "source") Set.empty //TODO Set(NativeVariable())
         else Set.empty
 
@@ -39,17 +39,17 @@ class SimpleNativeForwardTaintProblem(p: SomeProject) extends NativeForwardTaint
     protected def createFlowFact(
         callee: Function,
         call:   LLVMStatement,
-        in:     Set[NativeFact]
+        in:     Set[NativeTaintFact]
     ): Option[NativeFlowFact] =
         if (callee.name == "sink" && in.contains(JavaVariable(-2))) Some(NativeFlowFact(Seq(call.function)))
         else None
 }
 
-class SimpleNativeForwardTaintAnalysis(implicit project: SomeProject)
+class SimpleNativeForwardTaintAnalysis(project: SomeProject)
     extends NativeIFDSAnalysis(project, new SimpleNativeForwardTaintProblem(project), NativeTaint)
 
-object NativeForwardTaintAnalysisScheduler extends NativeIFDSAnalysisScheduler[NativeFact] {
-    override def init(p: SomeProject, ps: PropertyStore) = new SimpleNativeForwardTaintAnalysis()(p)
-    override def property: IFDSPropertyMetaInformation[LLVMStatement, NativeFact] = NativeTaint
+object NativeForwardTaintAnalysisScheduler extends NativeIFDSAnalysisScheduler[NativeTaintFact] {
+    override def init(p: SomeProject, ps: PropertyStore) = new SimpleNativeForwardTaintAnalysis(p)
+    override def property: IFDSPropertyMetaInformation[LLVMStatement, NativeTaintFact] = NativeTaint
     override val uses: Set[PropertyBounds] = Set() // ++ PropertyBounds.ub(Taint) TODO: we do not use the native taint yet
 }