static-analysis-engineering · aemcgraw · Dec 3, 2020 · Oct 27, 2020 · Oct 27, 2020 · Dec 3, 2020
diff --git a/chj/cmdline/AnalysisManager.py b/chj/cmdline/AnalysisManager.py
@@ -28,6 +28,7 @@
 import os
 import shutil
 import subprocess
+import sys
 
 import chj.util.fileutil as UF
 
@@ -219,9 +220,10 @@ def create_taint_trail(self,taintindex,silent=False,space=False):
         if self.verbose: cmd.append('-verbose')
         if self.dbg: cmd.append('-dbg')
         self.add_jars(cmd)
-        print('Executing: ' + ' '.join(cmd))
+        if not silent: print('Executing: ' + ' '.join(cmd))
         try:
-            result = subprocess.call(cmd,cwd=self.apppath,stderr=subprocess.STDOUT)
+            stdout = subprocess.DEVNULL if silent else sys.stdout
+            result = subprocess.call(cmd,cwd=self.apppath,stdout=stdout,stderr=subprocess.STDOUT)
         except OSError as e:
             raise UF.CHJOSErrorInAnalyzer(cmd,e)
         except subprocess.CalledProcessError as e:

diff --git a/chj/index/TaintGraph.py b/chj/index/TaintGraph.py
@@ -0,0 +1,153 @@
+# ------------------------------------------------------------------------------
+# CodeHawk Java Analyzer
+# Author: Henny Sipma and Andrew McGraw
+# ------------------------------------------------------------------------------
+# The MIT License (MIT)
+#
+# Copyright (c) 2016-2020 Kestrel Technology LLC
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+# 
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+# ------------------------------------------------------------------------------
+
+from chj.util.DotGraph import DotGraph
+
+import chj.util.fileutil as UF
+import chj.util.dotutil as UD
+import chj.util.graphutil as UG
+
+class TaintGraph():
+
+    def __init__(self,app,appname,taintsourceid,loops=False,sink=None):
+        self.app = app                   # AppAccess
+        self.jd = self.app.jd            # DataDictionary
+        self.loops = loops
+        self.sink = sink
+
+        self.xnodes = None
+        self.xedges = None
+
+        self.pathnodes = []
+        self.nodes = []
+        self.edges = []
+
+        self._build_graph(appname, taintsourceid)
+
+    def _get_edges(self, appname, taintsourceid):
+        try:
+            (path,_) = UF.get_engagement_app_jars(appname)
+            UF.check_analysisdir(path)
+            xtrail = UF.get_data_taint_trail_xnode(path,int(taintsourceid))
+        except UF.CHJError as e:
+            print(str(e.wrap()))
+            return
+
+        self.xnodes = xtrail.find('node-dictionary')
+        self.xedges = xtrail.find('edges')
+
+        self.nodes = [ int(n.get('ix')) for n in self.xnodes.findall('tn') ]
+
+    def _get_root_node(self,nodes,enode):
+        tgts = []
+        for n in enode.findall('edge'):
+            tgts.append(int(n.get('src')))
+        for n in nodes:
+            if not n in tgts:
+                return n
+
+    def _build_graph(self, appname, taintsourceid):
+        self._get_edges(appname, taintsourceid)
+
+        pathnodes = set([])
+
+        if (not self.sink is None) or self.loops:
+            sinkids = []
+
+            if not self.sink is None:
+                for n in self.nodes:
+                    cms = self.jd.ttd.get_taint_node_type(n)
+                    if self.sink in str(cms):
+                        sinkids.append(n)
+                if len(sinkids) == 0:
+                    return
+
+            if self.loops:
+                for n in self.nodes:
+                    cms = self.jd.ttd.get_taint_node_type(n)
+                    if cms.is_var() and str(cms.get_variable()) == 'lc':
+                        sinkids.append(n)
+
+            edge_adjacencylists = {}
+            for n in self.xedges.findall('edge'):
+                src = int(n.get('src'))
+                tgts = [ int(x) for x in n.get('tgts').split(',') ]
+                for t in tgts:
+                    edge_adjacencylists.setdefault(t,[])
+                    edge_adjacencylists[t].append(src)
+
+            srcid = self._get_root_node(self.nodes,self.xedges)
+
+            srcname = str(self.jd.ttd.get_taint_node_type(srcid))
+            for sinkid in sinkids:
+                sinkname = str(self.jd.ttd.get_taint_node_type(sinkid))
+
+            for sinkid in sinkids:
+                if sinkid in pathnodes: continue
+                g = UG.DirectedGraph(self.nodes,edge_adjacencylists)
+                g.find_paths(srcid,sinkid)
+                for p in g.paths:
+                    pathnodes = pathnodes.union(p)
+
+        # if no restrictions include all nodes
+        if len(pathnodes) == 0:
+            pathnodes = self.nodes
+
+        edges = []
+        for n in self.xedges.findall('edge'):
+            src = int(n.get('src'))
+            if src in self.nodes:
+                tgts = [ int(x) for x in n.get('tgts').split(',') ]
+                for tgt in tgts:
+                    if tgt in self.nodes:
+                        edges.append((src,tgt))
+
+        self.pathnodes = pathnodes
+        self.edges = edges
+        return
+
+    def as_dot(self, taintsourceid):
+        graphname = 'trail_' + str(taintsourceid)
+        dotgraph = DotGraph(graphname)
+        for n in self.nodes:
+            if not n in self.pathnodes: continue
+            color = None
+            cms = self.app.jd.ttd.get_taint_node_type(n)
+            shaded = cms.is_call()
+            cmslabel = cms.dotlabel()
+            if cms.is_var():
+                if str(cms.get_variable()) == 'lc':
+                    color = 'red'
+                if str(cms.get_variable()) == 'return':
+                    color = 'green'
+            elif cms.is_conditional():
+                color = 'yellow'
+            dotgraph.add_node(str(n),str(cmslabel),shaded=shaded,fillcolor=color)
+        for (src,tgt) in self.edges:
+            if src in self.pathnodes and tgt in self.pathnodes:
+                dotgraph.add_edge(str(tgt),str(src))
+        return dotgraph 
diff --git a/chj/pyserver/flask_app.py b/chj/pyserver/flask_app.py
@@ -39,6 +39,9 @@
 import chj.index.AppAccess as AP
 import chj.util.dotutil as UD
 import chj.util.svgutil as UG
+import chj.util.analysisutil as UA
+
+from chj.index.TaintGraph import TaintGraph
 
 from chj.reporting.BytecodeReport import BytecodeReport
 from chj.reporting.BranchConditions import BranchConditions
@@ -292,6 +295,45 @@ def loadtaintorigins(engagement, project):
         result['content'] = taintsummary
     return jsonify(result)
 
+@app.route('/taint/<engagement>/<project>/<index>', methods=['GET', 'POST'])
+def loadtaintgraph(engagement, project, index):
+    result = {}
+    result['meta'] = {}
+    loops = False
+    sink = None
+    try:
+        title = engagement + ":" + project + ":" + index
+        app = load_engagement_app(engagement, project)
+        name = str(app.jd.ttd.get_taint_origin(int(index)))
+        app = UA.analyze_taint_propagation(project, index)
+
+        if request.method == 'POST':
+            req = request.form
+            loops = True if 'loops' in req else False
+            sink = req['sinkid'] if 'sinkid' in req else None
+
+        taintgraph = TaintGraph(app, project, index, loops=loops, sink=sink)
+        dotgraph = taintgraph.as_dot(index)
+        svggraph = UG.get_svg(app.path, dotgraph)
+        svg = ET.tostring(svggraph.getroot(), encoding='unicode', method='html')
+
+        if request.method == 'GET':
+            template = render_template('taint.html', title=title, body=Markup(svg), name=name,
+                                        eng=engagement, proj=project, index=index)
+    except Exception as e:
+        result['meta']['status'] = 'fail'
+        result['meta']['reason'] = print(e)
+        traceback.print_exc()
+        return result
+    else:
+        if request.method == 'GET':
+            return template
+        if request.method == 'POST':
+            result['meta']['status'] = 'ok'
+            result['content'] = {}
+            result['content']['svg'] = Markup(svg)
+            return result
+
 def load_engagement_app(engagement, project):
     (path, jars) = UF.get_engagement_app_data(project)
     UF.check_analysisdir(path)

diff --git a/chj/pyserver/static/exceptions.js b/chj/pyserver/static/exceptions.js
@@ -39,7 +39,7 @@ var Exceptions = {
 
                     var dname = Util.add_table_data_with_link(methodname, drow, Util.get_method_link(cmsix));
                     dname.rowSpan = exceptions.length;
-                    //MethodBytecode.link_to_method_bytecode(dname, cmsix);
+                    dname.setAttribute('class', 'breakable');
                 }   
 
                 var dstartpc = document.createElement('td');
@@ -55,7 +55,8 @@ var Exceptions = {
                 dstartpc.setAttribute('class', 'rightalign');
                 dendpc.setAttribute('class', 'rightalign');
                 dhandlerpc.setAttribute('class', 'rightalign');
-
+                dsource.setAttribute('class', 'breakable');
+
                 drow.appendChild(dstartpc);
                 drow.appendChild(dendpc);
                 drow.appendChild(dhandlerpc);

diff --git a/chj/pyserver/static/globals.css b/chj/pyserver/static/globals.css
@@ -252,6 +252,10 @@ svg {
     -webkit-justify-content: flex-end;
 }
 
+.pb-5 {
+    padding-bottom: 5px;
+}
+
 .pl-10 {
     padding-left: 10px;
 }