CROSSINGTUD / CryptoAnalysis

CogniCrypt_SAST: CrySL-to-Static Analysis Compiler
Eclipse Public License 2.0
63 stars 39 forks source link

Extend transformations when extracting variables #687

Open smeyer198 opened 1 month ago

smeyer198 commented 1 month ago

683 added required components to extract transformed values. On a high level, new Boomerang queries are triggered to collect all required values and then corresponding operations are executed to determine the correct values. For example, consider the following statement:

KeyGenerator kg = KeyGenerator.getInstance("AES".replace("A", "D");

Boomerang transforms this statement to

varReplacer0 = "A"
varReplacer1 = "D";
s1 = "AES"
s2 = s1.replace(varReplacer0, varReplaver1)
kg = staticInvoke.<getInstance(s2)>

Since getInstace is part of a rule and depends on a constraint, the ExtractParameterAnalysis triggers a Boomerang query to extract the parameter s2. Since s2 is not a concrete value (i.e. a constant or new expression), it cannot extract the correct value directly. The transformation components extend this query by triggering new queries to compute relevant variables, performs the operation replace with the collected value, and returns the result as allocation site. In total, the following steps are done:

Currently, the transformations for Integer.parseInt, String.replace, String.toCharArray, String.getBytes, BigInteger.valueOf, Array.length, Hex.decode, String.toUpperCase, and String.toLowerCase are implemented.

Tasks:

Obsoletes #269