codeshield-security / spds Goto Github PK

java.lang.ClassCastException: boomerang.scene.jimple.JimpleVal cannot be cast to boomerang.scene.AllocVal
	at boomerang.WeightedBoomerang.forwardSolve(WeightedBoomerang.java:1176)
        ...

var = query.var();

public class BoomerangExampleTarget1 {
  public static void main(String... args) {
    Data p = new Data();
    taintIt(customSource(), p);
  }

  private static String customSource() { return "I'm tainted"; }
  private static void customSink(String sunk) { System.out.println(sunk); }

  private static void taintIt(String in, Data out) {
    Data x = out;
    Data.setter(x, in);
    customSink(Data.getter(out));
  }

  static class Data {
    private String f;
    static void setter(Data self, String value) {
      self.f = value;
    }
    static String getter(Data self) {
      return self.f;
    }
  }
}

 private static Transformer createAnalysisTransformer() {
    return new SceneTransformer() {
      protected void internalTransform(
          String phaseName, @SuppressWarnings("rawtypes") Map options) {
        SootCallGraph sootCallGraph = new SootCallGraph();
        AnalysisScope scope =
            new AnalysisScope(sootCallGraph) {
              @Override
              protected Collection<? extends Query> generate(Edge cfgEdge) {
                Statement statement = cfgEdge.getStart();
                if (statement.toString().contains("customSource") && statement.containsInvokeExpr()) {
                  Val arg = statement.getLeftOp();
                  return Collections.singleton(new ForwardQuery(cfgEdge,
                          new AllocVal(arg, statement, arg)));
                }
                return Collections.emptySet();
              }
            };

        Boomerang solver =
            new Boomerang(
                sootCallGraph, SootDataFlowScope.make(Scene.v()), new DefaultBoomerangOptions() {
              @Override
              public int analysisTimeoutMS() {
                return 10000;
              }
            });

        Collection<Query> seeds = scope.computeSeeds();
        for (Query query : seeds) {
          System.out.println("Solving query: " + query);

          ForwardBoomerangResults<Weight.NoWeight> res = solver.solve((ForwardQuery) query);

          if (res.isTimedout()) {
            throw new RuntimeException("Timed out");
          }

          res.asStatementValWeightTable().cellSet().forEach(cell -> {
            if (cell.getRowKey().getStart().containsInvokeExpr() &&
                    cell.getRowKey().getStart().getInvokeExpr().getMethod().getName().contains("customSink") &&
                    cell.getRowKey().getStart().uses(cell.getColumnKey())) {
              System.out.println("SOURCE: " + query.cfgEdge().getStart().toString());
              System.out.println("SINK: " + cell.getRowKey().getStart().toString());
            }
          });
        }
      }
    };
  }

public final class V {

  static Vector v;

  public static void main(String[] args) {
    Vector x = new Vector();
    v = x;
    foo();
    v.firstElement();
  }

  public static void foo() {
  }
}

public final class V {

  static Vector v;

  public static void main(String[] args) {
    Vector x = new Vector();
    v = x;
    //foo();
    v.firstElement();
  }

  public static void foo() {
  }
}

static class BoomerangOptions extends DefaultBoomerangOptions{
    @Override
    public boolean onTheFlyCallGraph() {
        return false;
    }

    public StaticFieldStrategy getStaticFieldStrategy() {
        return StaticFieldStrategy.FLOW_SENSITIVE;
    };

    @Override
    public boolean allowMultipleQueries() {
        return true;
    }

    @Override
    public boolean throwFlows() {
        return true;
    }

    @Override
    public boolean trackAnySubclassOfThrowable() {
        return true;
    }
}

import boomerang.Boomerang;
import boomerang.BoomerangOptions;
import boomerang.ForwardQuery;
import boomerang.scene.*;
import boomerang.scene.jimple.*;
import soot.*;
import soot.jimple.AssignStmt;
import soot.options.Options;

import java.util.Arrays;
import java.util.Collections;
import java.util.Map;

public class Repro {
  static BoomerangOptions opts = new IntAndStringBoomerangOptions();

  private static void setupSoot(String classPath) {
    Options.v().set_whole_program(true);
    Options.v().setPhaseOption("cg.spark", "on");
    Options.v().set_no_bodies_for_excluded(true);
    Options.v().set_allow_phantom_refs(true);
    Options.v().set_keep_line_number(true);

    /* ********* Uncomment this line to see methods invoked on Foo! ********* */
    // Options.v().set_exclude(Collections.singletonList("Foo"));

    Options.v().setPhaseOption("jb", "use-original-names:true");
    Options.v().set_soot_classpath(classPath);
    Options.v().set_prepend_classpath(true);
    Options.v().set_process_dir(Arrays.asList(classPath.split(":")));
    Scene.v().loadNecessaryClasses();
  }

  private static void analyze() {
    PackManager.v().getPack("wjtp").add(new Transform("wjtp.repro", new ReproTransformer()));
    PackManager.v().getPack("cg").apply();
    PackManager.v().getPack("wjtp").apply();
  }

  public static void main(String[] args) {
    setupSoot("Test.jar");
    analyze();
  }

  private static Map<Statement, DeclaredMethod> getMethodsInvokedFromInstanceInStatement(Method method, AssignStmt as) {
    Boomerang solver = new Boomerang(new SootCallGraph(), SootDataFlowScope.make(Scene.v()), opts);
    Statement stmt = JimpleStatement.create(as, method)[0];
    Val var = new AllocVal(new JimpleVal(as.getLeftOp(), method), stmt, new JimpleVal(as.getRightOp(), method));
    ForwardQuery fwq = new ForwardQuery(stmt, var);
    return solver.solve(fwq).getInvokedMethodOnInstance();
  }

  static class ReproTransformer extends SceneTransformer {
    @Override
    protected void internalTransform(String name, Map<String, String> options) {
      BoomerangPretransformer.v().reset();
      BoomerangPretransformer.v().apply();

      SootMethod m = Scene.v().getMethod("<Test: java.util.List foos()>");
      Method method = JimpleMethod.of(m);

      System.out.println("All method units:");
      for (Unit u : m.getActiveBody().getUnits()) {
        System.out.println("\t" + u.toString());
      }
      AssignStmt newFoo = (AssignStmt) m.getActiveBody().getUnits().stream().filter(
          x -> x.toString().contains("$stack2 = new Foo")).findFirst().get();
      AssignStmt newList = (AssignStmt) m.getActiveBody().getUnits().stream().filter(
          x -> x.toString().contains("$stack4 = new java.util.LinkedList")).findFirst().get();

      // This will only show results if set_exclude above gets uncommented
      System.out.println("\nFoo invoked methods:");
      for (Map.Entry<Statement, DeclaredMethod> e : getMethodsInvokedFromInstanceInStatement(method, newFoo).entrySet()) {
        System.out.println("\t" + e.getKey().toString());
        System.out.println("\t\t" + e.getValue().toString());
      }

      // This will show results regardless of the exclusion
      System.out.println("\nList invoked methods:");
      for (Map.Entry<Statement, DeclaredMethod> e : getMethodsInvokedFromInstanceInStatement(method, newList).entrySet()) {
        System.out.println("\t" + e.getKey().toString());
        System.out.println("\t\t" + e.getValue().toString());
      }
    }
  }
}

import java.util.LinkedList;
import java.util.List;

class Foo {
	void bar() {
		System.out.println("zomg bar");
	}

	public void baz() {
		System.out.println("zomg baz");
	}
}

public class Test {
	public static List<Foo> foos() {
		Foo foo = new Foo();
		foo.baz();
		System.out.println(foo);
		List<Foo> x = new LinkedList<>();
		x.add(foo);
		foo.bar();
		return x;
	}

	public static void main(String[] args) {
		System.out.println(foos());
	}
}