/// <summary>
/// Initializes a new instance of the <see cref="AssumptionExecuter" /> class.
///
/// Note that astElement can be n-ary expression with n > 1.
/// However, it cannot be logical expression (and, or, xor). Logical expressions are eliminated
/// in the stage of control-flow graph generation.
/// </summary>
/// <param name="conditionForm">The condition form. See <see cref="ConditionForm"/> for more details.</param>
/// <param name="astElement">The AST element corresponding to the condition.</param>
/// <param name="log">The log of evaluation the astElement and its sub-expressions.</param>
/// <param name="flowOutputSet">The Output set of a program point.</param>
public AssumptionExecuter(ConditionForm conditionForm, LangElement astElement, EvaluationLog log, FlowOutputSet flowOutputSet)
{
this.flowOutputSet = flowOutputSet;
this.astElement = astElement;
this.conditionForm = conditionForm;
this.log = log;
}
internal static void AssertVariable <T>(this FlowOutputSet outset, string variableName, string message, params T[] expectedValues)
where T : IComparable, IComparable <T>, IEquatable <T>
{
var variable = outset.ReadVariable(new VariableIdentifier(variableName));
var entry = variable.ReadMemory(outset.Snapshot);
foreach (var value in entry.PossibleValues)
{
if (value is UndefinedValue)
{
Assert.Fail("Undefined value is not allowed for variable ${0} in {1}", variableName, entry);
}
}
var actualValues = new List <T>();
foreach (Value value in entry.PossibleValues)
{
ScalarValue <T> scalar = value as ScalarValue <T>;
if (scalar != null)
{
actualValues.Add(scalar.Value);
}
}
if (message == null)
{
message = string.Format(" in variable ${0} containing {1}", variableName, entry);
}
CollectionAssert.AreEquivalent(expectedValues, actualValues.ToArray(), message);
}
/// <summary>
/// Tries to get constant value from FlowOutputSet
/// </summary>
/// <param name="outset">FlowOutputSet which contains values</param>
/// <param name="name">Constant name</param>
/// <param name="entry">Memory entry of possible values</param>
/// <returns><c>true</c> if constant is never defined, otherwise <c>true</c></returns>
public static bool TryGetConstant(FlowOutputSet outset, QualifiedName name,
out MemoryEntry entry)
{
var context = outset.Snapshot;
var values = new HashSet <Value>();
var constantArrays = outset.ReadControlVariable(constantVariable);
Debug.Assert(constantArrays.IsDefined(context), "Internal array of constants is always defined");
var caseInsensitiveConstant = constantArrays.ReadIndex(context, new MemberIdentifier("." + name.Name.LowercaseValue));
if (caseInsensitiveConstant.IsDefined(context))
{
entry = caseInsensitiveConstant.ReadMemory(context);
return(false);
}
//else there can be case sensitive constant
var caseSensitiveConstant = constantArrays.ReadIndex(context, new MemberIdentifier("#" + name.Name.Value));
if (caseSensitiveConstant.IsDefined(context))
{
entry = caseSensitiveConstant.ReadMemory(context);
return(false);
}
// Undefined constant is interpreted as a string
var stringValue = outset.CreateString(name.Name.Value);
entry = new MemoryEntry(stringValue);
return(true);
}
internal static ReadWriteSnapshotEntryBase GetNumberedArgument(FlowOutputSet outSet, int number)
{
var argId = new VariableIdentifier(argument(number));
var argVar = outSet.GetVariable(argId);
return(argVar);
}
public override IEnumerable <ThrowInfo> Throw(FlowController flow, FlowOutputSet outSet, ThrowStmt throwStmt, MemoryEntry throwedValue)
{
//TODO this is only simple implementation
var exceptionObj = (ObjectValue)throwedValue.PossibleValues.First();
var catchBlocks = outSet.ReadControlVariable(CatchBlocks_Storage).ReadMemory(outSet.Snapshot);
var throwBranches = new List <ThrowInfo>();
//find catch blocks with valid scope and matching catch condition
foreach (InfoValue <CatchBlockDescription> blockInfo in catchBlocks.PossibleValues)
{
var throwedType = outSet.ObjectType(exceptionObj).QualifiedName;
//check catch condition
if (blockInfo.Data.CatchedType.QualifiedName != throwedType)
{
continue;
}
var branch = new ThrowInfo(blockInfo.Data, throwedValue);
throwBranches.Add(branch);
}
return(throwBranches);
}
public override void CallDispatchMerge(ProgramPointBase beforeCall, FlowOutputSet afterCall, IEnumerable <ExtensionPoint> dispatchedExtensions)
{
var ends = (from callOutput in dispatchedExtensions where callOutput.Graph.End.OutSet != null select callOutput.Graph.End.OutSet as ISnapshotReadonly).ToArray();
//TODO determine correct extension type
var callType = dispatchedExtensions.First().Type;
switch (callType)
{
case ExtensionType.ParallelEval:
case ExtensionType.ParallelInclude:
//merging from includes behaves like usual
//program points extend
afterCall.Extend(ends);
break;
case ExtensionType.ParallelCall:
//merging from calls needs special behaviour
//from memory model (there are no propagation of locales e.g)
afterCall.MergeWithCallLevel(beforeCall, ends);
break;
default:
throw new NotImplementedException();
}
}
internal static void AssertHasTaintStatus(FlowOutputSet outSet, string variableName, string assertMessage, TaintStatus taintStatus, Analysis.FlagType flag)
{
var varID = new VariableIdentifier(variableName);
var variable = outSet.GetVariable(varID);
var values = variable.ReadMemory(outSet.Snapshot).PossibleValues.ToArray();
var computedTaintStatus = new TaintStatus(false, true);
if (values.Count() == 0)
{
computedTaintStatus.priority.setAll(false);
}
foreach (var value in values)
{
if (!(value is InfoValue <TaintInfo>))
{
continue;
}
TaintInfo valueTaintInfo = (value as InfoValue <TaintInfo>).Data;
TaintStatus valueTaintStatus = new TaintStatus(valueTaintInfo, flag);
computedTaintStatus.tainted.copyTaint(true, valueTaintStatus.tainted);
computedTaintStatus.priority.copyTaint(false, valueTaintStatus.priority);
computedTaintStatus.lines.AddRange(valueTaintStatus.lines);
}
String taintStatusString = taintStatus.ToString(flag);
String computedTaintStatusString = computedTaintStatus.ToString(flag);
Assert.IsTrue(taintStatus.EqualTo(computedTaintStatus, flag), "Taint status of the taint type {0} of variable ${1} should be {2}, taint analysis computed {3}", flag, variableName, taintStatusString, computedTaintStatusString);
}
/// <summary>
/// Gets constant value from FlowOutputSet
/// </summary>
/// <param name="outset">FlowOutputSet which contains values</param>
/// <param name="name">Constant name</param>
/// <returns>Memory entry of possible values</returns>
public static MemoryEntry GetConstant(FlowOutputSet outset, QualifiedName name)
{
MemoryEntry entry;
TryGetConstant(outset, name, out entry);
return(entry);
}
public void IncludeTest1()
{
// Run analysis
FileInfo entryFile = new FileInfo(TrunkStructure.PHP_SOURCES_DIR + @"\test_programs\include_tests\include_test_01\index.php");
ProgramPointGraph ppGraph = Analyzer.Run(entryFile, MemoryModels.MemoryModels.VirtualReferenceMM);
FlowOutputSet outSet = ppGraph.End.OutSet;
// For each variable test whether it has given value
testVariable(outSet, "include_main_dir", "In ./include_main_dir.php");
testVariable(outSet, "include_main_dir2", "In ./include_main_dir2.php");
testVariable(outSet, "include_included_dir", "In include_dir/include_included_dir.php");
testVariable(outSet, "test_main", "In ./test.php");
testVariable(outSet, "test_included", "");
testVariable(outSet, "test2_included", "In included_dir/test2.php");
testVariable(outSet, "test3_included", "In included_dir/test3.php");
testVariable(outSet, "test4_included", "");
testVariable(outSet, "test5_included", "In included_dir/test5.php");
testVariable(outSet, "test6_included", "");
testVariable(outSet, "test7_included", "");
testVariable(outSet, "in_func1", "In function func1");
testVariable(outSet, "in_func2", "");
testVariable(outSet, "in_func3", "In function func3");
testVariable(outSet, "in_meth1", "In method meth1 of class Cl");
testVariable(outSet, "in_meth2", "");
testVariable(outSet, "index1", "In ./index.php");
testVariable(outSet, "index2", "In ./index.php");
testVariable(outSet, "index3", "In ./index.php");
}
private void setNamedArguments(FlowOutputSet callInput, MemoryEntry[] arguments, Signature signature)
{
var callPoint = (Flow.CurrentProgramPoint as ExtensionPoint).Caller as RCallPoint;
var callSignature = callPoint.CallSignature;
var enumerator = callPoint.Arguments.GetEnumerator();
for (int i = 0; i < signature.FormalParams.Count; ++i)
{
enumerator.MoveNext();
var param = signature.FormalParams[i];
var callParam = callSignature.Value.Parameters[i];
var argumentVar = callInput.GetVariable(new VariableIdentifier(param.Name));
if (callParam.PublicAmpersand || param.PassedByRef)
{
argumentVar.SetAliases(callInput.Snapshot, enumerator.Current.Value);
}
else
{
argumentVar.WriteMemory(callInput.Snapshot, arguments[i]);
}
}
}
private void initTaintedVariable(FlowOutputSet outSet, String name)
{
outSet.Snapshot.SetMode(SnapshotMode.InfoLevel);
var TaintedVar = outSet.GetVariable(new VariableIdentifier(name), true);
var taint = new TaintInfo();
taint.taint = new Taint(true);
taint.priority = new TaintPriority(true);
taint.tainted = true;
var Taint = outSet.CreateInfo(taint);
//TaintedVar.WriteMemory(outSet.Snapshot, new MemoryEntry(Taint));
var entry = TaintedVar.ReadIndex(EntryInput.Snapshot, MemberIdentifier.getAnyMemberIdentifier());
entry.WriteMemory(EntryInput.Snapshot, new MemoryEntry(Taint));
/*
* TaintedVar = outSet.GetVariable(new VariableIdentifier(name), true);
* Taint = outSet.CreateInfo(taint);
*
* TaintedVar.WriteMemory(outSet.Snapshot, new MemoryEntry(Taint));*/
}
/// <summary>
/// Represents method which is used for confirming assumption condition. Assumption can be declined - it means that we can prove, that condition CANNOT be ever satisfied.
/// </summary>
/// <param name="outSet">Output set where condition will be assumed</param>
/// <param name="condition">Assumed condition</param>
/// <param name="log">The evaluation log of the code constructs.</param>
/// <returns>
/// <c>false</c> if condition cannot be ever satisfied, true otherwise.
/// </returns>
public override bool ConfirmAssumption(FlowOutputSet outSet, AssumptionCondition condition, EvaluationLog log)
{
// Deprecated code that supported assumptions that are not decomposed using logical operators (&&, ||, xor)
// But it had very limited abstract state refinemend
/*
* AssumptionConditionExecuterDepr conditionParts = new AssumptionConditionExecuterDepr(condition.Form, outSet, log, condition.Parts);
* return conditionParts.MakeAssumption(null);
*/
// Non-primitive conditions in assumptions are now resolved on the level of control-flow graph
PHP.Core.Debug.Assert(condition.Parts.Count() == 1);
PHP.Core.Debug.Assert(condition.Form == ConditionForm.All || condition.Form == ConditionForm.None);
var assumptionExecuter = new AssumptionExecuter(condition.Form, condition.Parts.First().SourceElement, log, outSet);
AssumptionExecuter.PossibleValues enterAssumption = assumptionExecuter.IsSatisfied();
if (enterAssumption == AssumptionExecuter.PossibleValues.OnlyFalse)
{
return(false);
}
if (enterAssumption == AssumptionExecuter.PossibleValues.Unknown)
{
assumptionExecuter.RefineState();
}
return(true);
}
private void setNamedArguments(FlowOutputSet callInput, CallSignature?callSignature, Signature signature, IEnumerable <ValuePoint> arguments)
{
int i = 0;
foreach (var arg in arguments)
{
if (i >= signature.FormalParams.Count)
{
break;
}
var param = signature.FormalParams[i];
var argumentVar = callInput.GetVariable(new VariableIdentifier(param.Name));
// var argumentValue = arg.Value.ReadMemory(Output);
List <ValueInfo> values = new List <ValueInfo>();
var varID = getVariableIdentifier(arg.Value);
List <Value> argumentValues = new List <Value>(arg.Value.ReadMemory(Output).PossibleValues);
values.Add(new ValueInfo(argumentValues, varID));
bool nullValue = hasPossibleNullValue(arg);
TaintInfo argTaint = mergeTaint(values, nullValue);
setTaint(argumentVar, argTaint);
/*var argTaint = getTaint(arg.Value);
*
* setTaint(argumentVar, argTaint);
* //argumentVar.WriteMemory(callInput.Snapshot, argumentValue);*/
++i;
}
// TODO: if (arguments.Count() < signature.FormalParams.Count) and exists i > arguments.Count() signature.FormalParams[i].InitValue != null
}
private void setOrderedArguments(FlowOutputSet callInput, MemoryEntry[] arguments)
{
var argCount = new MemoryEntry(callInput.CreateInt(arguments.Length));
var argCountEntry = callInput.GetVariable(new VariableIdentifier(".argument_count"));
argCountEntry.WriteMemory(callInput.Snapshot, argCount);
var index = 0;
var callPoint = (Flow.CurrentProgramPoint as ExtensionPoint).Caller as RCallPoint;
foreach (var arg in callPoint.Arguments)
{
var argVar = argument(index);
var argumentEntry = callInput.GetVariable(new VariableIdentifier(argVar));
//determine that argument value is based on variable, so we can get it's alias
var aliasProvider = arg as LValuePoint;
if (aliasProvider == null)
{
//assign value for parameter
argumentEntry.WriteMemory(callInput.Snapshot, arguments[index]);
}
else
{
//join parameter with alias (for testing we join all possible arguments)
//be carefull here - Flow.OutSet belongs to call context already - so we has to read variable from InSet
argumentEntry.SetAliases(callInput.Snapshot, aliasProvider.LValue);
}
++index;
}
}
/// <summary>
/// Represents method which is used for confirming assumption condition. Assumption can be declined - it means that we can prove, that condition CANNOT be ever satisfied.
/// </summary>
/// <returns>False if you can prove that condition cannot be ever satisfied, true otherwise.</returns>
public override bool ConfirmAssumption(FlowOutputSet outSet, AssumptionCondition condition, EvaluationLog log)
{
_outSet = outSet;
_log = log;
bool willAssume;
switch (condition.Form)
{
case ConditionForm.All:
willAssume = needsAll(outSet.Snapshot, condition.Parts);
break;
case ConditionForm.None:
//willAssume = needsNone(outSet.Snapshot, condition.Parts);
//break;
case ConditionForm.SomeNot:
willAssume = needsSomeNot(outSet.Snapshot, condition.Parts);
break;
default:
//we has to assume, because we can't disprove assumption
willAssume = true;
break;
}
if (willAssume)
{
processAssumption(condition);
}
return(willAssume);
}
internal static void AssertVariableWithUndefined <T>(this FlowOutputSet outset, string variableName, string message, params T[] expectedValues)
where T : IComparable, IComparable <T>, IEquatable <T>
{
var variable = outset.ReadVariable(new VariableIdentifier(variableName));
var entry = variable.ReadMemory(outset.Snapshot);
var actualValues = new List <T>();
foreach (var value in entry.PossibleValues)
{
//filter undefined values
if (value is UndefinedValue)
{
continue;
}
if (!(value is ScalarValue <T>))
{
Assert.Fail("Cannot convert {0} to {1} for variable ${2} in {3}. {4}", value, typeof(T), variableName, entry, message);
}
actualValues.Add((value as ScalarValue <T>).Value);
}
if (message == null)
{
message = string.Format(" in variable ${0} containing {1}", variableName, entry);
}
CollectionAssert.AreEquivalent(expectedValues, actualValues, message);
}
/// <summary>
/// Return the singleton instance of NativeConstantAnalyzer. If it doesn't exist, it will be created here.
/// </summary>
/// <param name="outset">FlowOutputSet used for creating constant values.</param>
/// <returns>Instance</returns>
public static NativeConstantAnalyzer Create(FlowOutputSet outset)
{
if (instance == null)
{
instance = new NativeConstantAnalyzer(outset);
}
return(instance);
}
private static void SetInputArray(FlowOutputSet entryInput)
{
for (var i = 0; i < inputVariables.Length; ++i)
{
var identifier = new VariableIdentifier(inputVariables[i]);
var snapshotEntry = entryInput.GetVariable(identifier, true);
snapshotEntry.WriteMemoryWithoutCopy(entryInput.Snapshot, new MemoryEntry(inputValues[i]));
}
}
/// <summary>
/// Return singleton instance of NativeObjectAnalyzer
/// </summary>
/// <param name="outSet">FlowOutputSet</param>
/// <returns>singleton instance of NativeObjectAnalyzer</returns>
public static NativeObjectAnalyzer GetInstance(FlowOutputSet outSet)
{
if (instance == null)
{
instance = new NativeObjectAnalyzer(outSet);
}
return(instance);
}
internal static void AssertIsXSSDirty(FlowOutputSet outSet, string variableName, string assertMessage)
{
var variable = outSet.GetVariable(new VariableIdentifier(variableName));
var values = variable.ReadMemory(outSet.Snapshot).PossibleValues.ToArray();
if (!FlagsHandler.IsDirty(values, FlagType.SQLDirty))
{
Assert.Fail("No possible value for variable ${0} is dirty", variableName);
}
}
/// <inheritdoc />
public override void TryScopeStart(FlowOutputSet outSet, IEnumerable <CatchBlockDescription> catchBlockStarts)
{
var catchBlocks = outSet.GetControlVariable(new VariableName(".catchBlocks"));
List <Value> result = new List <Value>();
foreach (var stack in catchBlocks.ReadMemory(outSet.Snapshot).PossibleValues)
{
result.Add(outSet.CreateInfo(new TryBlockStack((stack as InfoValue <TryBlockStack>).Data, catchBlockStarts)));
}
catchBlocks.WriteMemory(outSet.Snapshot, new MemoryEntry(result));
}
internal static void AssertHasTaintStatus(FlowOutputSet outSet, string variableName, string assertMessage, bool taintStatus)
{
var variable = outSet.GetVariable(new VariableIdentifier(variableName));
var values = variable.ReadMemory(outSet.Snapshot).PossibleValues.ToArray();
var computedTaintStatus = false;
foreach (var value in values)
{
computedTaintStatus = computedTaintStatus || (value as InfoValue <bool>).Data;
}
Assert.IsTrue(taintStatus == computedTaintStatus, "Taint status of the variable ${0} should be {1}, taint analysis computed {2}", variableName, taintStatus, computedTaintStatus);
}
/// <summary>
/// Gets the value of return storage located in given output set.
/// </summary>
/// <param name="outSet">the output set in which the return storage is located</param>
/// <returns>The memoryEntry of returned value</returns>
protected static MemoryEntry GetReturn(FlowOutputSet outSet)
{
if (outSet == null)
{
return(null);
}
var outSnapshot = outSet.Snapshot;
var returnVar = outSnapshot.GetLocalControlVariable(SnapshotBase.ReturnValue);
return(returnVar.ReadMemory(outSnapshot));
}
private void TaintInitializer()
{
FlowOutputSet outSet = this.EntryInput;
initTaintedVariable(outSet, "_POST");
initTaintedVariable(outSet, "_GET");
initTaintedVariable(outSet, "_SERVER");
initTaintedVariable(outSet, "_COOKIE");
initTaintedVariable(outSet, "_SESSION");
initTaintedVariable(outSet, "_FILES");
initTaintedVariable(outSet, "_REQUEST");
initTaintedVariable(outSet, "GLOBALS");
}
/// <summary>
/// Initializer which sets environment for tests before analyzing
/// </summary>
/// <param name="outSet"></param>
private static void initialize(FlowOutputSet outSet)
{
outSet.Snapshot.SetMode(SnapshotMode.InfoLevel);
var POSTVar = outSet.GetVariable(new VariableIdentifier("_POST"), true);
var POST = outSet.CreateInfo(true);
POSTVar.WriteMemory(outSet.Snapshot, new MemoryEntry(POST));
POSTVar = outSet.GetVariable(new VariableIdentifier("_POST"), true);
POST = outSet.CreateInfo(true);
POSTVar.WriteMemory(outSet.Snapshot, new MemoryEntry(POST));
}
public override void Catch(CatchPoint catchPoint, FlowOutputSet outSet)
{
//TODO this is simple catch demonstration - there should be catch stack unrolling
var catchVariable = catchPoint.CatchDescription.CatchVariable;
var hasCatchVariable = catchVariable != null;
if (hasCatchVariable)
{
var catchVar = outSet.GetVariable(catchPoint.CatchDescription.CatchVariable);
catchVar.WriteMemory(outSet.Snapshot, catchPoint.ThrowedValue);
}
}
internal static void AssertIsXSSClean(FlowOutputSet outSet, string variableName, string assertMessage)
{
var variable = outSet.GetVariable(new VariableIdentifier(variableName));
var values = variable.ReadMemory(outSet.Snapshot).PossibleValues.ToArray();
foreach (var value in values)
{
var info = value.GetInfo <SimpleInfo>();
if (info != null && !info.XssSanitized)
{
Assert.IsTrue(info.XssSanitized, "Variable ${0} with value {1} is not sanitized", variableName, value);
}
}
}
public static bool ContainsSecurityWarning(FlowOutputSet outset, FlagType cause)
{
var warnings = AnalysisWarningHandler.ReadWarnings <AnalysisSecurityWarning>(outset);
foreach (var value in warnings)
{
var infoValue = (InfoValue <AnalysisSecurityWarning>)value;
if (infoValue.Data.Flag == cause)
{
return(true);
}
}
return(false);
}
public override void TryScopeStart(FlowOutputSet outSet, IEnumerable <CatchBlockDescription> catchBlockStarts)
{
var blockStarts = new List <InfoValue>();
//NOTE this is only simple implementation without resolving try block stack
foreach (var blockStart in catchBlockStarts)
{
var blockValue = outSet.CreateInfo(blockStart);
blockStarts.Add(blockValue);
}
var catchBlocks = outSet.GetControlVariable(CatchBlocks_Storage);
catchBlocks.WriteMemory(outSet.Snapshot, new MemoryEntry(blockStarts));
}
private static void TestVariableResults(FlowOutputSet outSet, Value[] results,
Func <int, string> nameGenerator)
{
for (var i = 0; i < results.Length; ++i)
{
var identifier = new VariableIdentifier(nameGenerator(i));
var snapshotEntry = outSet.GetVariable(identifier, true);
var entry = snapshotEntry.ReadMemory(outSet.Snapshot);
var enumerator = entry.PossibleValues.GetEnumerator();
enumerator.MoveNext();
var value = enumerator.Current as Value;
Assert.AreEqual(results[i], value);
}
}
