CROSSINGTUD / CryptoAnalysis

CogniCrypt_SAST: CrySL-to-Static Analysis Compiler
Eclipse Public License 2.0
67 stars 40 forks source link

Incorrect number of occurrences for ConstraintError in a headless test #186

Closed enriozuni closed 11 months ago

enriozuni commented 5 years ago

The following project from Braga et al was headless tested.

public static void main(String[] args) throws Exception {

        // par de chaves de Ana e configurações do criptosistema
        KeyPairGenerator kpg = KeyPairGenerator.getInstance("EC","SunEC");
        System.out.println("KeyPairGen "+kpg.getProvider().getName());

        Signature signerAna = Signature.getInstance("SHA512WithECDSA","SunEC");
        System.out.println("Signer "+signerAna.getProvider().getName());

        // Beto configura seu criptosistema
        Signature verifierBeto = Signature.getInstance("SHA512WithECDSA","SunEC");
        System.out.println("Verifier "+verifierBeto.getProvider().getName());
}

I get an inconsistency between the error markers in the IDE console and the specification of expected errors in the headless test itself.

The error marker in the console shows:

ConstraintError violating CrySL rule for java.security.Signature (on Object #cdc10a3b31851aec5bfa5ba0d51d63d9cc0be3bf89fec1ba3fc1d1b3770cceba)
            First parameter (with value "SHA512WithECDSA") should be any of {SHA256withECDSA, SHA256withDSA, SHA256withRSA, SHA224withDSA, NONEwithDSA, SHA1withDSA}
            at statement: r2 = staticinvoke <java.security.Signature: java.security.Signature getInstance(java.lang.String,java.lang.String)>(varReplacer10, varReplacer11)

As seen above, the error marker shows only one ConstraintError violation for the Signature object, when in fact there are 2 in total for two different Signature objects.

On the other hand, when specifying the correct expected errors in the headless test itself, the test passes.

setErrorsCount("<example.DefinedProvider2: void main(java.lang.String[])>", ConstraintError.class, 2);

I have stated that the printed error markers are not complete for the ConstraintError for 2 or more objects of the same type (e.g Signature).

johspaeth commented 5 years ago

See comment to #187

smeyer198 commented 11 months ago

Fixed in #486