[Soot-list] Spark Error with Flowdroid

[Marc-André Laverdière-Papineau]

Hello,

I don't mind so much that workaround - I don't have much code that
relies on the name, and I can code an easy utility to fetch it. And
while I'm at it, I can add what is needed to get the line number and the
like :)

As long as the tag is not messed up with in the rest of the soot pipeline...

My only concern is the 'probable' part. I need to report to the
programmer that there is a security issue, and I'm sure that they'd like
precise report. So whatever information is in the tag needs to be sound.
I am not super excited about an over-approximation, but that is better
than the alternative.

That being said, I don't really understand the technical reasons behind
this (but that's because I don't know the JVM spec much...)

Marc-André Laverdière-Papineau
Doctorant - PhD Candidate

On 16/06/13 03:35 PM, Saswat Anand wrote:
> 
> Quentin's proposal of storing the local var mapping as tags inside soot
> makes very good sense; it is consistent with how other metadata such as
> line number from the class file are stored in soot, and wont break soot
> when such metadata isnt consistent.
> 
> 
> On Jun 16, 2013 5:46 AM, "Quentin Sabah" <quentin.sabah at inria.fr
> <mailto:quentin.sabah at inria.fr>> wrote:
> 
>     So I managed to get the .class
> 
>     I think what we have here is the perfect example of the limits of
>     use-original-names in the current implementation.
> 
>     The local "l8" indicates that we are tracking the local slot #8.
>     However, the local variable name table isn't complete, the name
>     "part" is only flagged for 3 bytecodes [463:463+3]. There are many
>     other use of slot 8 that should be associated with "part", but they
>     aren't.
> 
>         LocalVariableTable:
>           Start  Length  Slot  Name   Signature
>                  0     467     0  this  
>     Lcom/oreilly/servlet/MultipartRequest;
>                  0     467     1 request  
>     Ljavax/servlet/http/HttpServletRequest;
>                  0     467     2 saveDirectory   Ljava/lang/String;
>                  0     467     3 maxPostSize   I
>                  0     467     4 encoding   Ljava/lang/String;
>                  0     467     5 policy  
>     Lcom/oreilly/servlet/multipart/FileRenamePolicy;
>                 78     388     6   dir   Ljava/io/File;
>                163     303     7 parser  
>     Lcom/oreilly/servlet/multipart/MultipartParser;
>                183      90     8 queryParameters   Ljava/util/Hashtable;
>                190      83     9 queryParameterNames  
>     Ljava/util/Enumeration;
>                202      61    10 paramName   Ljava/lang/Object;
>                214      49    11 values   [Ljava/lang/String;
>                223      40    12 newValues   Ljava/util/Vector;
>                226      37    13     i   I
>                463       3     8  part  
>     Lcom/oreilly/servlet/multipart/Part;
>                283     172     9  name   Ljava/lang/String;
>                298      54    10 paramPart  
>     Lcom/oreilly/servlet/multipart/ParamPart;
>                305      47    11 value   Ljava/lang/String;
>                319      33    12 existingValues   Ljava/util/Vector;
>                370      85    10 filePart  
>     Lcom/oreilly/servlet/multipart/FilePart;
>                377      78    11 fileName   Ljava/lang/String;
> 
>     Because in Soot we rely too much on this table when
>     use-original-names is enabled, we generate two Local for the same
>     local variable in this case. It can be corrected, the original name
>     should be some kind of Tag associated with each Unit, telling what
>     probable original name should be associated with each Local.
> 
>     --
>     Quentin Sabah, CIFRE Ph.D. student
>     Grenoble University
>     INRIA-SARDES                   | STMicroelectronics/AST
>     Montbonnot, France             | Grenoble, France
>     mailto:quentin.sabah at inria.fr <mailto:quentin.sabah at inria.fr>  |
>     mailto:quentin.sabah at st.com <mailto:quentin.sabah at st.com>
>     phone: +33 476 61 52 42 <tel:%2B33%20476%2061%2052%2042>        |
>     phone: +33 476 58 44 14 <tel:%2B33%20476%2058%2044%2014>
> 
>     _______________________________________________
>     Soot-list mailing list
>     Soot-list at sable.mcgill.ca <mailto:Soot-list at sable.mcgill.ca>
>     http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
> 
> 
> 
> _______________________________________________
> Soot-list mailing list
> Soot-list at sable.mcgill.ca
> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
>