diff --git a/core/opentaint-dataflow-core/opentaint-dataflow/src/main/kotlin/org/opentaint/dataflow/ap/ifds/taint/ExternalMethodTracker.kt b/core/opentaint-dataflow-core/opentaint-dataflow/src/main/kotlin/org/opentaint/dataflow/ap/ifds/taint/ExternalMethodTracker.kt index 2d72a5985..f7e6204ce 100644 --- a/core/opentaint-dataflow-core/opentaint-dataflow/src/main/kotlin/org/opentaint/dataflow/ap/ifds/taint/ExternalMethodTracker.kt +++ b/core/opentaint-dataflow-core/opentaint-dataflow/src/main/kotlin/org/opentaint/dataflow/ap/ifds/taint/ExternalMethodTracker.kt @@ -7,7 +7,7 @@ import java.util.concurrent.atomic.AtomicBoolean import java.util.concurrent.atomic.AtomicInteger class ExternalMethodTracker { - private val seen = ConcurrentHashMap.newKeySet() + private val trackingDisabled = ConcurrentHashMap.newKeySet() private val records = ConcurrentHashMap() fun trackExternalMethod( @@ -16,10 +16,9 @@ class ExternalMethodTracker { factPosition: String, rulesApplied: Boolean, ) { - val dedupKey = "$method|$signature|$factPosition" - if (!seen.add(dedupKey)) return - val methodKey = "$method|$signature" + if (trackingDisabled.contains(methodKey)) return + records.computeIfAbsent(methodKey) { ExternalMethodAggregation(method, signature) }.apply { @@ -29,6 +28,12 @@ class ExternalMethodTracker { } } + fun untrackMethod(method: String, signature: String) { + val methodKey = "$method|$signature" + trackingDisabled.add(methodKey) + records.remove(methodKey) + } + fun getExternalMethods(): SkippedExternalMethods { val withoutRules = mutableListOf() val withRules = mutableListOf() diff --git a/core/opentaint-dataflow-core/opentaint-jvm-dataflow/src/main/kotlin/org/opentaint/dataflow/jvm/ap/ifds/analysis/JIRAnalysisManager.kt b/core/opentaint-dataflow-core/opentaint-jvm-dataflow/src/main/kotlin/org/opentaint/dataflow/jvm/ap/ifds/analysis/JIRAnalysisManager.kt index b89139dc9..0378495ee 100644 --- a/core/opentaint-dataflow-core/opentaint-jvm-dataflow/src/main/kotlin/org/opentaint/dataflow/jvm/ap/ifds/analysis/JIRAnalysisManager.kt +++ b/core/opentaint-dataflow-core/opentaint-jvm-dataflow/src/main/kotlin/org/opentaint/dataflow/jvm/ap/ifds/analysis/JIRAnalysisManager.kt @@ -70,7 +70,7 @@ class JIRAnalysisManager( jIRDowncast(unitResolver) val jIRCallResolver = JIRCallResolver(cp, unitResolver) - return JIRMethodCallResolver(jIRCallResolver, runner) + return JIRMethodCallResolver(jIRCallResolver, runner, externalMethodTracker) } override fun getMethodAnalysisContext( diff --git a/core/opentaint-dataflow-core/opentaint-jvm-dataflow/src/main/kotlin/org/opentaint/dataflow/jvm/ap/ifds/analysis/JIRMethodCallResolver.kt b/core/opentaint-dataflow-core/opentaint-jvm-dataflow/src/main/kotlin/org/opentaint/dataflow/jvm/ap/ifds/analysis/JIRMethodCallResolver.kt index 70d4af007..0a36b4c8d 100644 --- a/core/opentaint-dataflow-core/opentaint-jvm-dataflow/src/main/kotlin/org/opentaint/dataflow/jvm/ap/ifds/analysis/JIRMethodCallResolver.kt +++ b/core/opentaint-dataflow-core/opentaint-jvm-dataflow/src/main/kotlin/org/opentaint/dataflow/jvm/ap/ifds/analysis/JIRMethodCallResolver.kt @@ -15,6 +15,7 @@ import org.opentaint.dataflow.ap.ifds.TypeInfoGroupAccessor import org.opentaint.dataflow.ap.ifds.analysis.MethodAnalysisContext import org.opentaint.dataflow.ap.ifds.analysis.MethodCallResolver import org.opentaint.dataflow.ap.ifds.analysis.MethodCallResolver.MethodCallResolutionResult +import org.opentaint.dataflow.ap.ifds.taint.ExternalMethodTracker import org.opentaint.dataflow.call.tryExtractCallTypeInfo import org.opentaint.dataflow.jvm.ap.ifds.JIRCallResolver import org.opentaint.dataflow.jvm.ap.ifds.JIRLambdaTracker @@ -34,6 +35,7 @@ import org.opentaint.ir.api.jvm.ext.findMethodOrNull class JIRMethodCallResolver( val callResolver: JIRCallResolver, val runner: TaintAnalysisUnitRunner, + val externalMethodTracker: ExternalMethodTracker? ) : MethodCallResolver { override fun resolveMethodCall( callerContext: MethodAnalysisContext, @@ -126,6 +128,12 @@ class JIRMethodCallResolver( return@tryExtractCallTypeInfo } + externalMethodTracker?.apply { + val methodName = "${lambdaMethod.enclosingClass.name}#${lambdaMethod.name}" + val methodDesc = lambdaMethod.description + untrackMethod(methodName, methodDesc) + } + lambdaResolver.addLambda(cls) } } diff --git a/core/src/main/kotlin/org/opentaint/jvm/sast/project/spring/SpringRuleProvider.kt b/core/src/main/kotlin/org/opentaint/jvm/sast/project/spring/SpringRuleProvider.kt index eefd5468e..0eccfeb1b 100644 --- a/core/src/main/kotlin/org/opentaint/jvm/sast/project/spring/SpringRuleProvider.kt +++ b/core/src/main/kotlin/org/opentaint/jvm/sast/project/spring/SpringRuleProvider.kt @@ -169,6 +169,8 @@ class SpringRuleProvider( private fun RepositoryMethodInfo.actions(): List? { val actions = mutableListOf() val repoPos = PositionWithAccess(This, repositoryContent) + actions += CopyAllMarks(This, This) + when (kind) { SpringRepoQueryKind.SAVE -> { val entityPos = Argument(0)