程序包 proguard.analysis.cpa.util

类 TaintAnalyzerResult.TaintAnalysisResult

java.lang.Object

proguard.analysis.cpa.util.TaintAnalyzerResult.TaintAnalysisResult

封闭类:

TaintAnalyzerResult

public static class TaintAnalyzerResult.TaintAnalysisResult
extends Object

Results for taint analysis. Provides the reached states and which sinks were triggered, but no witness trace on how the sink was reached from a source (use TaintAnalyzerResult.getTraceReconstructionResult() for that).

方法概要

修饰符和类型	方法	说明
Collection<BamLocationDependentJvmMemoryLocation<SetAbstractState<TaintSource>>>	getEndpoints()	Get locations where sinks have been triggered by a valid source.
Map<BamLocationDependentJvmMemoryLocation<SetAbstractState<TaintSource>>,List<JvmTaintSink>>	getEndpointToTriggeredSinks()	Maps locations where sinks have been triggered by valid sources to the triggered sink.
ProgramLocationDependentReachedSet<JvmAbstractState<SetAbstractState<TaintSource>>>	getMainMethodReachedSet()	Returns the reached states for the entry method of the analysis.
BamCache<SetAbstractState<TaintSource>>	getTaintResultCache()	Returns the analysis cache, containing the analyzed taints for each reached method invocation with unique tainted parameters.

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

方法详细资料

getTaintResultCache

public BamCache<SetAbstractState<TaintSource>> getTaintResultCache()

Returns the analysis cache, containing the analyzed taints for each reached method invocation with unique tainted parameters.

getMainMethodReachedSet

public ProgramLocationDependentReachedSet<JvmAbstractState<SetAbstractState<TaintSource>>> getMainMethodReachedSet()

Returns the reached states for the entry method of the analysis.

getEndpoints

public Collection<BamLocationDependentJvmMemoryLocation<SetAbstractState<TaintSource>>> getEndpoints()

Get locations where sinks have been triggered by a valid source.

The endpoints are computed lazily, since it can be an expensive operation, and multiple runs of TaintAnalyzer.analyze(MethodSignature) just update the same cache. So, if the same TaintAnalyzer performs several runs, it's better to get the endpoints only after all runs have been executed.

getEndpointToTriggeredSinks

public Map<BamLocationDependentJvmMemoryLocation<SetAbstractState<TaintSource>>,List<JvmTaintSink>> getEndpointToTriggeredSinks()

Maps locations where sinks have been triggered by valid sources to the triggered sink.

The endpoints are computed lazily, since it can be an expensive operation, and multiple runs of TaintAnalyzer.analyze(MethodSignature) just update the same cache. So, if the same TaintAnalyzer performs several runs, it's better to get the endpoints only after all runs have been executed.