proguard.analysis.cpa.util

Class TaintAnalyzerResult

java.lang.Object

proguard.analysis.cpa.util.TaintAnalyzerResult

public class TaintAnalyzerResult
extends java.lang.Object

Provides results for a run of TaintAnalyzer.

The results are not intended as just for the last execution of TaintAnalyzer.analyze(MethodSignature), but as a view of the entire results extracted from the cache of the analysis.

Since the cache at the moment has no capability to remember the last execution, the result will change as the cache changes (i.e., after calling TaintAnalyzer.analyze(MethodSignature) on a new method with the same TaintAnalyzer, old instances of TaintAnalyzerResult will also be updated).

Another problem of not currently having snapshots of the cache for a single run of TaintAnalyzer.analyze(MethodSignature) is that some components of TaintAnalyzerResult that take a long time to compute might be recalculated several times for different runs. For this reason:

• Sink locations triggered by a valid source are not computed until needed. This happens when computing the witness traces or when calling TaintAnalyzerResult.TaintAnalysisResult.getEndpoints() or TaintAnalyzerResult.TaintAnalysisResult.getEndpointToTriggeredSinks().
• Witness traces are no calculated unless the trace reconstruction result has been explicitly requested via getTraceReconstructionResult().

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	TaintAnalyzerResult.TaintAnalysisResult Results for taint analysis.

Method Summary

Modifier and Type	Method and Description
TaintAnalyzerResult.TaintAnalysisResult	getTaintAnalysisResult() Get the result for the taint analysis.
TraceExtractor<SetAbstractState<JvmTaintSource>>	getTraceReconstructionResult() Get the result of trace reconstruction.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

getTaintAnalysisResult

public TaintAnalyzerResult.TaintAnalysisResult getTaintAnalysisResult()

Get the result for the taint analysis.

getTraceReconstructionResult

public TraceExtractor<SetAbstractState<JvmTaintSource>> getTraceReconstructionResult()

Get the result of trace reconstruction.

Trace reconstruction is a very expensive operation and does not run if not explicitly requested, calling this method for the first time on a specific TaintAnalyzerResult triggers running the witness traces creation.

The witness trace is based uniquely on the taint analysis cache, and at the moment the cache has no capability to remember a snapshot of the last run of TaintAnalyzer.analyze(MethodSignature). Until this holds true, if the same TaintAnalyzer has been used to analyze several methods (to exploit block abstraction memoization with the cache), the results of the trace reconstruction should be retrieved only once for the last call of TaintAnalyzer.analyze(MethodSignature), since doing otherwise would result in computing the same traces all over again.