search

pascal-lab / Tai-e

An easy-to-learn/use static analysis framework for Java
https://tai-e.pascal-lab.net/docs/index.html
GNU Lesser General Public License v3.0
1.45k stars 175 forks source link

pascal.taie.ir.proginfo.MethodResolutionFailedException error when customizing entrypoint #24

Closed Y4er closed 1 year ago

Y4er commented 1 year ago

Describe the bug

Exception in thread "main" pascal.taie.ir.proginfo.MethodResolutionFailedException: Cannot resolve <java.lang.invoke.StringConcatFactory: java.lang.invoke.CallSite makeConcatWithConstants(java.lang.invoke.MethodHandles$Lookup,java.lang.String,java.lang.invoke.MethodType,java.lang.String,java.lang.Object[])>
    at pascal.taie.ir.proginfo.MethodRef.resolve(MethodRef.java:180)
    at pascal.taie.analysis.pta.plugin.invokedynamic.LambdaAnalysis.isLambdaMetaFactory(LambdaAnalysis.java:122)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.AbstractList$RandomAccessSpliterator.forEachRemaining(AbstractList.java:720)
    at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
    at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
    at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
    at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
    at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
    at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
    at pascal.taie.analysis.pta.plugin.invokedynamic.LambdaAnalysis.onNewMethod(LambdaAnalysis.java:104)
    at pascal.taie.analysis.pta.plugin.CompositePlugin.lambda$onNewMethod$3(CompositePlugin.java:115)
    at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
    at pascal.taie.analysis.pta.plugin.CompositePlugin.onNewMethod(CompositePlugin.java:115)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.processNewMethod(DefaultSolver.java:497)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.addCSMethod(DefaultSolver.java:780)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.addEntryPoint(DefaultSolver.java:748)
    at pascal.taie.analysis.pta.plugin.taint.TaintAnalysis.lambda$onStart$2(TaintAnalysis.java:134)
    at java.base/java.util.LinkedHashMap$LinkedValues.forEach(LinkedHashMap.java:647)
    at java.base/java.util.Collections$UnmodifiableCollection.forEach(Collections.java:1092)
    at pascal.taie.analysis.pta.plugin.taint.TaintAnalysis.lambda$onStart$3(TaintAnalysis.java:111)
    at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
    at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
    at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
    at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
    at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
    at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
    at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
    at pascal.taie.analysis.pta.plugin.taint.TaintAnalysis.onStart(TaintAnalysis.java:109)
    at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
    at pascal.taie.analysis.pta.plugin.CompositePlugin.onStart(CompositePlugin.java:95)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.initialize(DefaultSolver.java:256)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.solve(DefaultSolver.java:237)
    at pascal.taie.analysis.pta.PointerAnalysis.runAnalysis(PointerAnalysis.java:118)
    at pascal.taie.analysis.pta.PointerAnalysis.analyze(PointerAnalysis.java:106)
    at pascal.taie.analysis.pta.PointerAnalysis.analyze(PointerAnalysis.java:63)
    at pascal.taie.analysis.AnalysisManager.runProgramAnalysis(AnalysisManager.java:147)
    at pascal.taie.analysis.AnalysisManager.runAnalysis(AnalysisManager.java:120)
    at pascal.taie.analysis.AnalysisManager.lambda$execute$0(AnalysisManager.java:104)
    at pascal.taie.util.Timer.runAndCount(Timer.java:93)
    at pascal.taie.analysis.AnalysisManager.lambda$execute$1(AnalysisManager.java:103)
    at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
    at pascal.taie.analysis.AnalysisManager.execute(AnalysisManager.java:102)
    at pascal.taie.Main.executePlan(Main.java:143)
    at pascal.taie.Main.lambda$main$0(Main.java:57)
    at pascal.taie.util.Timer.lambda$runAndCount$0(Timer.java:112)
    at pascal.taie.util.Timer.runAndCount(Timer.java:93)
    at pascal.taie.util.Timer.runAndCount(Timer.java:111)
    at pascal.taie.util.Timer.runAndCount(Timer.java:107)
    at pascal.taie.Main.main(Main.java:49)
resolve:180, MethodRef (pascal.taie.ir.proginfo)
isLambdaMetaFactory:122, LambdaAnalysis (pascal.taie.analysis.pta.plugin.invokedynamic)
test:-1, LambdaAnalysis$$Lambda$272/0x0000000800ea9a70 (pascal.taie.analysis.pta.plugin.invokedynamic)
accept:178, ReferencePipeline$2$1 (java.util.stream)
accept:179, ReferencePipeline$2$1 (java.util.stream)
accept:179, ReferencePipeline$2$1 (java.util.stream)
accept:197, ReferencePipeline$3$1 (java.util.stream)
accept:179, ReferencePipeline$2$1 (java.util.stream)
forEachRemaining:720, AbstractList$RandomAccessSpliterator (java.util)
copyInto:509, AbstractPipeline (java.util.stream)
wrapAndCopyInto:499, AbstractPipeline (java.util.stream)
evaluateSequential:150, ForEachOps$ForEachOp (java.util.stream)
evaluateSequential:173, ForEachOps$ForEachOp$OfRef (java.util.stream)
evaluate:234, AbstractPipeline (java.util.stream)
forEach:596, ReferencePipeline (java.util.stream)
onNewMethod:104, LambdaAnalysis (pascal.taie.analysis.pta.plugin.invokedynamic)
lambda$onNewMethod$3:115, CompositePlugin (pascal.taie.analysis.pta.plugin)
accept:-1, CompositePlugin$$Lambda$262/0x0000000800ea8240 (pascal.taie.analysis.pta.plugin)
forEach:1511, ArrayList (java.util)
onNewMethod:115, CompositePlugin (pascal.taie.analysis.pta.plugin)
processNewMethod:497, DefaultSolver (pascal.taie.analysis.pta.core.solver)
addCSMethod:780, DefaultSolver (pascal.taie.analysis.pta.core.solver)
addEntryPoint:748, DefaultSolver (pascal.taie.analysis.pta.core.solver)
lambda$onStart$2:134, TaintAnalysis (pascal.taie.analysis.pta.plugin.taint)
accept:-1, TaintAnalysis$$Lambda$300/0x0000000800ebc460 (pascal.taie.analysis.pta.plugin.taint)
forEach:647, LinkedHashMap$LinkedValues (java.util)
forEach:1092, Collections$UnmodifiableCollection (java.util)
lambda$onStart$3:111, TaintAnalysis (pascal.taie.analysis.pta.plugin.taint)
accept:-1, TaintAnalysis$$Lambda$297/0x0000000800eb7cb8 (pascal.taie.analysis.pta.plugin.taint)
accept:183, ForEachOps$ForEachOp$OfRef (java.util.stream)
accept:179, ReferencePipeline$2$1 (java.util.stream)
forEachRemaining:1625, ArrayList$ArrayListSpliterator (java.util)
copyInto:509, AbstractPipeline (java.util.stream)
wrapAndCopyInto:499, AbstractPipeline (java.util.stream)
evaluateSequential:150, ForEachOps$ForEachOp (java.util.stream)
evaluateSequential:173, ForEachOps$ForEachOp$OfRef (java.util.stream)
evaluate:234, AbstractPipeline (java.util.stream)
forEach:596, ReferencePipeline (java.util.stream)
onStart:109, TaintAnalysis (pascal.taie.analysis.pta.plugin.taint)
accept:-1, CompositePlugin$$Lambda$259/0x0000000800ea76c0 (pascal.taie.analysis.pta.plugin)
forEach:1511, ArrayList (java.util)
onStart:95, CompositePlugin (pascal.taie.analysis.pta.plugin)
initialize:256, DefaultSolver (pascal.taie.analysis.pta.core.solver)
solve:237, DefaultSolver (pascal.taie.analysis.pta.core.solver)
runAnalysis:118, PointerAnalysis (pascal.taie.analysis.pta)
analyze:106, PointerAnalysis (pascal.taie.analysis.pta)
analyze:63, PointerAnalysis (pascal.taie.analysis.pta)
runProgramAnalysis:147, AnalysisManager (pascal.taie.analysis)
runAnalysis:120, AnalysisManager (pascal.taie.analysis)
lambda$execute$0:104, AnalysisManager (pascal.taie.analysis)
get:-1, AnalysisManager$$Lambda$213/0x0000000800e50a80 (pascal.taie.analysis)
runAndCount:93, Timer (pascal.taie.util)
lambda$execute$1:103, AnalysisManager (pascal.taie.analysis)
accept:-1, AnalysisManager$$Lambda$212/0x0000000800e50638 (pascal.taie.analysis)
forEach:1511, ArrayList (java.util)
execute:102, AnalysisManager (pascal.taie.analysis)
executePlan:143, Main (pascal.taie)
lambda$main$0:57, Main (pascal.taie)
run:-1, Main$$Lambda$89/0x0000000800d17440 (pascal.taie)
lambda$runAndCount$0:112, Timer (pascal.taie.util)
get:-1, Timer$$Lambda$90/0x0000000800d17888 (pascal.taie.util)
runAndCount:93, Timer (pascal.taie.util)
runAndCount:111, Timer (pascal.taie.util)
runAndCount:107, Timer (pascal.taie.util)
main:49, Main (pascal.taie)

at pascal.taie.analysis.pta.core.solver.DefaultSolver#processNewMethod

image

<com.vmware.vcops.casa.security.SecurityController: com.vmware.vcops.casa.support.HttpMapResponse[] manageCertOnCluster(java.lang.String,java.lang.String)>[5@L596] $r15 = invokedynamic <java.lang.invoke.StringConcatFactory: java.lang.invoke.CallSite makeConcatWithConstants(java.lang.invoke.MethodHandles$Lookup,java.lang.String,java.lang.invoke.MethodType,java.lang.String,java.lang.Object[])> "makeConcatWithConstants" <MethodType: java.lang.String (java.lang.String)>["Illegal enum for certificate action: "](action)

<java.lang.invoke.StringConcatFactory: java.lang.invoke.CallSite makeConcatWithConstants(java.lang.invoke.MethodHandles$Lookup,java.lang.String,java.lang.invoke.MethodType,java.lang.String,java.lang.invoke.MethodType); lang.Object[])> function does not exist in jdk1.8

Tai-e arguments

-cp E:\tools\code\casa\target\classes;xxx.jar -java 8 --input-classes=c.txt -m com.example.casa.Main -ap -a pta=action:dump;action-file:result.txt;taint-config:src\test\resources\pta\taint\taint-config.yml

c.txt is a collection of all class names of -cp

error analyzing com.vmware.vcops.casa.security.SecurityController#manageCertOnCluster function

    @ResponseStatus(HttpStatus.ACCEPTED)
    @ResponseBody
    @RequestMapping(
        value = {"/cluster/security/certificate"},
        method = {RequestMethod.POST}
    )
    @Auditable(
        category = Category.ACTIVATE_CERTIFICATE,
        auditMessage = "User activating certificate."
    )
    public HttpMapResponse[] manageCertOnCluster(@RequestParam(required = false,defaultValue = "ACTIVATE") String action, @RequestParam String certType) {
        WebServerCertificateAction certificateAction;
        try {
            certificateAction = WebServerCertificateAction.valueOf(action.toUpperCase());
        } catch (IllegalArgumentException var7) {
            this.log.error("Illegal enum for certificate action: " + action);
            throw new CasaException(var7);
        }

        WebServerCertificateType certificateType;
        try {
            certificateType = WebServerCertificateType.valueOf(certType.toUpperCase());
        } catch (IllegalArgumentException var6) {
            this.log.error("Illegal enum for certificate type: " + certType);
            throw new CasaException(var6);
        }

        return this.securityService.delegateActivateWebServerCert(certificateAction, certificateType);
    }

Override TaintAnalysis class to add entrypoint and source for my analysis

/*
 * Tai-e: A Static Analysis Framework for Java
 *
 * Copyright (C) 2022 Tian Tan <tiantan@nju.edu.cn>
 * Copyright (C) 2022 Yue Li <yueli@nju.edu.cn>
 *
 * This file is part of Tai-e.
 *
 * Tai-e is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation, either version 3
 * of the License, or (at your option) any later version.
 *
 * Tai-e is distributed in the hope that it will be useful,but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
 * Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with Tai-e. If not, see <https://www.gnu.org/licenses/>.
 */

package pascal.taie.analysis.pta.plugin.taint;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import pascal.taie.World;
import pascal.taie.analysis.graph.callgraph.Edge;
import pascal.taie.analysis.pta.PointerAnalysisResult;
import pascal.taie.analysis.pta.core.cs.context.Context;
import pascal.taie.analysis.pta.core.cs.element.*;
import pascal.taie.analysis.pta.core.heap.HeapModel;
import pascal.taie.analysis.pta.core.heap.Obj;
import pascal.taie.analysis.pta.core.solver.EntryPoint;
import pascal.taie.analysis.pta.core.solver.Solver;
import pascal.taie.analysis.pta.core.solver.SpecifiedParamProvider;
import pascal.taie.analysis.pta.plugin.Plugin;
import pascal.taie.analysis.pta.pts.PointsToSet;
import pascal.taie.ir.exp.InvokeExp;
import pascal.taie.ir.exp.InvokeInstanceExp;
import pascal.taie.ir.exp.Var;
import pascal.taie.ir.stmt.Invoke;
import pascal.taie.language.classes.JClass;
import pascal.taie.language.classes.JMethod;
import pascal.taie.language.type.ArrayType;
import pascal.taie.language.type.ClassType;
import pascal.taie.language.type.Type;
import pascal.taie.util.collection.Maps;
import pascal.taie.util.collection.MultiMap;
import pascal.taie.util.collection.Pair;

import java.util.HashSet;
import java.util.List;
import java.util.Set;
import java.util.TreeSet;

public class TaintAnalysis implements Plugin {

    private static final Logger logger = LogManager.getLogger(TaintAnalysis.class);

    /**
     * Map from method (which is source method) to set of types of
     * taint objects returned by the method calls.
     */
    private final MultiMap<JMethod, Type> sources = Maps.newMultiMap();

    /**
     * Map from method (which causes taint transfer) to set of relevant
     * {@link TaintTransfer}.
     */
    private final MultiMap<JMethod, TaintTransfer> transfers = Maps.newMultiMap();
    private final Set<Sink> sinks = new HashSet<>();

    /**
     * Map from variable to taint transfer information.
     * The taint objects pointed to by the "key" variable are supposed
     * to be transferred to "value" variable with specified type.
     */
    private final MultiMap<Var, Pair<Var, Type>> varTransfers = Maps.newMultiMap();

    private Solver solver;

    private CSManager csManager;

    private Context emptyContext;

    private TaintManager manager;

    private TaintConfig config;

    /**
     * Retrieves variable from a call site and index.
     */
    private static Var getVar(Invoke callSite, int index) {
        InvokeExp invokeExp = callSite.getInvokeExp();
        return switch (index) {
            case TaintTransfer.BASE -> ((InvokeInstanceExp) invokeExp).getBase();
            case TaintTransfer.RESULT -> callSite.getResult();
            default -> invokeExp.getArg(index);
        };
    }

    @Override
    public void onStart() {
        HeapModel heapModel = solver.getHeapModel();
        JClass httpRequestWrapper = World.get().getClassHierarchy().getClass("javax.servlet.http.HttpServletRequestWrapper");
        JClass servletRequestWrapper = World.get().getClassHierarchy().getClass("javax.servlet.ServletRequestWrapper");

        World.get().getClassHierarchy().allClasses().filter(c -> c.hasAnnotation("org.springframework.stereotype.Controller")).forEach(clazz -> {
            System.out.println("found controller " + clazz.getName());
            clazz.getDeclaredMethods().forEach(method -> {
                if (method.hasAnnotation("org.springframework.web.bind.annotation.RequestMapping")) {
                    Obj mockObj = heapModel.getMockObj("<clazz>", clazz.getSimpleName(), clazz.getType());
                    SpecifiedParamProvider.Builder builder = new SpecifiedParamProvider.Builder(method).addThisObj(mockObj);
                    List<Type> paramTypes = method.getParamTypes();
                    for (int i = 0; i < paramTypes.size(); i++) {
                        Type type = paramTypes.get(i);
                        if (type.getName().equals("javax.servlet.http.HttpServletRequest")) {
                            type = World.get().getTypeSystem().getType("javax.servlet.http.HttpServletRequestWrapper");
                        } else if (type.getName().equals("javax.servlet.http.HttpServletResponse")) {
                            type = World.get().getTypeSystem().getType("javax.servlet.http.HttpServletResponseWrapper");
                        }
                        Obj mockParam = heapModel.getMockObj(method.getName() + ":" + type.getName(), method.getSignature(), type, method);
                        builder.addParamObj(i, mockParam);

                        if (type instanceof ArrayType) {
                            type = ((ArrayType) type).elementType();
                        }
                        if (type instanceof ClassType) {
                            World.get().getClassHierarchy().getClass(type.getName()).getDeclaredMethods().forEach(m -> sources.put(m, m.getReturnType()));
                        }
                    }
                    SpecifiedParamProvider provider = builder.build();
                    solver.addEntryPoint(new EntryPoint(method, provider));
                }
            });
        });

        httpRequestWrapper.getDeclaredMethods().stream().filter(jMethod -> jMethod.getName().startsWith("get")).forEach(m -> {
            sources.put(m, m.getReturnType());
        });
        servletRequestWrapper.getDeclaredMethods().stream().filter(jMethod -> jMethod.getName().startsWith("get")).forEach(m -> {
            sources.put(m, m.getReturnType());
        });

        World.get().getClassHierarchy().getClass("java.lang.Runtime").getDeclaredMethods().stream().filter(jMethod -> jMethod.getName().equals("exec")).forEach(this::add2Sink);
        World.get().getClassHierarchy().getClass("java.lang.ProcessBuilder").getDeclaredMethods().stream().filter(jMethod -> jMethod.getName().equals("<init>") || jMethod.getName().equals("start")).forEach(this::add2Sink);
//        World.get().getClassHierarchy().getClass("java.io.File").getDeclaredMethods().stream().filter(jMethod -> jMethod.getName().equals("<init>")).forEach(this::add2Sink);

        // print sources
        System.out.println("sources....");
        sources.forEach((k, v) -> System.out.println(k.getMethodSource() + "\t" + v.getName()));
        System.out.println();

        // print sink
        System.out.println("sinks....");
        sinks.forEach(s -> System.out.println(s));
        System.out.println();
    }

    Sink add2Sink(JMethod jMethod) {
        for (int i = 0; i < jMethod.getParamCount(); i++) {
            sinks.add(new Sink(jMethod, i));
        }
        return null;
    }

    @Override
    public void setSolver(Solver solver) {
        this.solver = solver;
        csManager = solver.getCSManager();
        emptyContext = solver.getContextSelector().getEmptyContext();
        manager = new TaintManager(solver.getHeapModel());
        config = TaintConfig.readConfig(solver.getOptions().getString("taint-config"), solver.getHierarchy(), solver.getTypeSystem());
//        logger.info(config);
        config.getSources().forEach(s -> sources.put(s.method(), s.type()));
        config.getTransfers().forEach(t -> transfers.put(t.method(), t));
        config.getSinks().forEach(s -> sinks.add(s));
    }

    @Override
    public void onNewCallEdge(Edge<CSCallSite, CSMethod> edge) {
        Invoke callSite = edge.getCallSite().getCallSite();
        JMethod callee = edge.getCallee().getMethod();
        // generate taint value from source call
        Var lhs = callSite.getLValue();
        if (lhs != null && sources.containsKey(callee)) {
            sources.get(callee).forEach(type -> {
                Obj taint = manager.makeTaint(callSite, type);
                solver.addVarPointsTo(edge.getCallSite().getContext(), lhs, emptyContext, taint);
            });
        }
        // process taint transfer
        transfers.get(callee).forEach(transfer -> {
            Var from = getVar(callSite, transfer.from());
            Var to = getVar(callSite, transfer.to());
            // when transfer to result variable, and the call site
            // does not have result variable, then "to" is null.
            if (to != null) {
                Type type = transfer.type();
                varTransfers.put(from, new Pair<>(to, type));
                Context ctx = edge.getCallSite().getContext();
                CSVar csFrom = csManager.getCSVar(ctx, from);
                transferTaint(solver.getPointsToSetOf(csFrom), ctx, to, type);
            }
        });
    }

    private void transferTaint(PointsToSet pts, Context ctx, Var to, Type type) {
        PointsToSet newTaints = solver.makePointsToSet();
        pts.objects().map(CSObj::getObject).filter(manager::isTaint).map(manager::getSourceCall).map(source -> manager.makeTaint(source, type)).map(taint -> csManager.getCSObj(emptyContext, taint)).forEach(newTaints::addObject);
        if (!newTaints.isEmpty()) {
            solver.addVarPointsTo(ctx, to, newTaints);
        }
    }

    @Override
    public void onNewPointsToSet(CSVar csVar, PointsToSet pts) {
        varTransfers.get(csVar.getVar()).forEach(p -> {
            Var to = p.first();
            Type type = p.second();
            transferTaint(pts, csVar.getContext(), to, type);
        });
    }

    @Override
    public void onFinish() {
        Set<TaintFlow> taintFlows = collectTaintFlows();
        solver.getResult().storeResult(getClass().getName(), taintFlows);
    }

    private Set<TaintFlow> collectTaintFlows() {
        PointerAnalysisResult result = solver.getResult();
        Set<TaintFlow> taintFlows = new TreeSet<>();
        sinks.forEach(sink -> {
            int i = sink.index();
            result.getCallGraph().getCallersOf(sink.method()).forEach(sinkCall -> {
                Var arg = sinkCall.getInvokeExp().getArg(i);
                result.getPointsToSet(arg).stream().filter(manager::isTaint).map(manager::getSourceCall).map(sourceCall -> new TaintFlow(sourceCall, sinkCall, i)).forEach(taintFlows::add);
            });
        });
        return taintFlows;
    }
}

Runtime environment infomation

win10 idea 0934e7979547a2877c749a8fdc0b0c4dc709c30d

Y4er commented 1 year ago

After debugging, it looks like tai-e is using the wrong version of jre when parsing ir, resulting in not finding the StringConcatFactory.makeConcatWithConstants function. But I clearly specified -java 8, that's weird.

Y4er commented 1 year ago 
    public com.vmware.vcops.casa.support.HttpMapResponse[] manageCertOnCluster(java.lang.String, java.lang.String)
    {
        com.vmware.vcops.casa.security.SecurityController r6;
        com.vmware.vcops.casa.security.WebServerCertificateAction $r2;
        java.lang.String r0, $r1, r3, $r4, $r11, $r15;
        com.vmware.vcops.casa.security.WebServerCertificateType $r5;
        org.slf4j.Logger $r10, $r14;
        com.vmware.vcops.casa.support.HttpMapResponse[] $r8;
        com.vmware.vcops.casa.exception.CasaException $r12, $r16;
        java.lang.IllegalArgumentException $r9, $r13;
        com.vmware.vcops.casa.security.SecurityService $r7;

        r6 := @this: com.vmware.vcops.casa.security.SecurityController;

        r0 := @parameter0: java.lang.String;

        r3 := @parameter1: java.lang.String;

     label1:
        $r1 = virtualinvoke r0.<java.lang.String: java.lang.String toUpperCase()>();

        $r2 = staticinvoke <com.vmware.vcops.casa.security.WebServerCertificateAction: com.vmware.vcops.casa.security.WebServerCertificateAction valueOf(java.lang.String)>($r1);

     label2:
        goto label4;

     label3:
        $r13 := @caughtexception;

        $r14 = r6.<com.vmware.vcops.casa.security.SecurityController: org.slf4j.Logger log>;

        $r15 = dynamicinvoke "makeConcatWithConstants" <java.lang.String (java.lang.String)>(r0) <java.lang.invoke.StringConcatFactory: java.lang.invoke.CallSite makeConcatWithConstants(java.lang.invoke.MethodHandles$Lookup,java.lang.String,java.lang.invoke.MethodType,java.lang.String,java.lang.Object[])>("Illegal enum for certificate action: \u0001");

        interfaceinvoke $r14.<org.slf4j.Logger: void error(java.lang.String)>($r15);

        $r16 = new com.vmware.vcops.casa.exception.CasaException;

        specialinvoke $r16.<com.vmware.vcops.casa.exception.CasaException: void <init>(java.lang.Throwable)>($r13);

        throw $r16;

     label4:
        $r4 = virtualinvoke r3.<java.lang.String: java.lang.String toUpperCase()>();

        $r5 = staticinvoke <com.vmware.vcops.casa.security.WebServerCertificateType: com.vmware.vcops.casa.security.WebServerCertificateType valueOf(java.lang.String)>($r4);

     label5:
        goto label7;

     label6:
        $r9 := @caughtexception;

        $r10 = r6.<com.vmware.vcops.casa.security.SecurityController: org.slf4j.Logger log>;

        $r11 = dynamicinvoke "makeConcatWithConstants" <java.lang.String (java.lang.String)>(r3) <java.lang.invoke.StringConcatFactory: java.lang.invoke.CallSite makeConcatWithConstants(java.lang.invoke.MethodHandles$Lookup,java.lang.String,java.lang.invoke.MethodType,java.lang.String,java.lang.Object[])>("Illegal enum for certificate type: \u0001");

        interfaceinvoke $r10.<org.slf4j.Logger: void error(java.lang.String)>($r11);

        $r12 = new com.vmware.vcops.casa.exception.CasaException;

        specialinvoke $r12.<com.vmware.vcops.casa.exception.CasaException: void <init>(java.lang.Throwable)>($r9);

        throw $r12;

     label7:
        $r7 = r6.<com.vmware.vcops.casa.security.SecurityController: com.vmware.vcops.casa.security.SecurityService securityService>;

        $r8 = virtualinvoke $r7.<com.vmware.vcops.casa.security.SecurityService: com.vmware.vcops.casa.support.HttpMapResponse[] delegateActivateWebServerCert(com.vmware.vcops.casa.security.WebServerCertificateAction,com.vmware.vcops.casa.security.WebServerCertificateType)>($r2, $r5);

        return $r8;

        catch java.lang.IllegalArgumentException from label1 to label2 with label3;
        catch java.lang.IllegalArgumentException from label4 to label5 with label6;
    }
silverbullettt commented 1 year ago

java.lang.invoke.StringConcatFactory does not exist in jdk1.8 (according to Java doc, this class was introduced since Java 9), which may be the cause. How about replace -java 8 by -pp (use JDK 17 as library)?

Y4er commented 1 year ago

Exceptions are still thrown after replacing -java 8 with -pp

Exception in thread "main" pascal.taie.ir.proginfo.MethodResolutionFailedException: Cannot resolve <java.lang.runtime.ObjectMethods: java.lang.Object bootstrap(java.lang.invoke.MethodHandles$Lookup,java.lang.String,java.lang.invoke.TypeDescriptor,java.lang.Class,java.lang.String,java.lang.invoke.MethodHandle[])>
    at pascal.taie.ir.proginfo.MethodRef.resolve(MethodRef.java:180)
    at pascal.taie.analysis.pta.plugin.invokedynamic.LambdaAnalysis.isLambdaMetaFactory(LambdaAnalysis.java:122)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.AbstractList$RandomAccessSpliterator.forEachRemaining(AbstractList.java:720)
    at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
    at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
    at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
    at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
    at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
    at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
    at pascal.taie.analysis.pta.plugin.invokedynamic.LambdaAnalysis.onNewMethod(LambdaAnalysis.java:104)
    at pascal.taie.analysis.pta.plugin.CompositePlugin.lambda$onNewMethod$3(CompositePlugin.java:115)
    at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
    at pascal.taie.analysis.pta.plugin.CompositePlugin.onNewMethod(CompositePlugin.java:115)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.processNewMethod(DefaultSolver.java:497)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.addCSMethod(DefaultSolver.java:780)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.processCallEdge(DefaultSolver.java:453)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.analyze(DefaultSolver.java:300)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.solve(DefaultSolver.java:238)
    at pascal.taie.analysis.pta.PointerAnalysis.runAnalysis(PointerAnalysis.java:118)
    at pascal.taie.analysis.pta.PointerAnalysis.analyze(PointerAnalysis.java:106)
    at pascal.taie.analysis.pta.PointerAnalysis.analyze(PointerAnalysis.java:63)
    at pascal.taie.analysis.AnalysisManager.runProgramAnalysis(AnalysisManager.java:147)
    at pascal.taie.analysis.AnalysisManager.runAnalysis(AnalysisManager.java:120)
    at pascal.taie.analysis.AnalysisManager.lambda$execute$0(AnalysisManager.java:104)
    at pascal.taie.util.Timer.runAndCount(Timer.java:93)
    at pascal.taie.analysis.AnalysisManager.lambda$execute$1(AnalysisManager.java:103)
    at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
    at pascal.taie.analysis.AnalysisManager.execute(AnalysisManager.java:102)
    at pascal.taie.Main.executePlan(Main.java:143)
    at pascal.taie.Main.lambda$main$0(Main.java:57)
    at pascal.taie.util.Timer.lambda$runAndCount$0(Timer.java:112)
    at pascal.taie.util.Timer.runAndCount(Timer.java:93)
    at pascal.taie.util.Timer.runAndCount(Timer.java:111)
    at pascal.taie.util.Timer.runAndCount(Timer.java:107)
    at pascal.taie.Main.main(Main.java:49)
silverbullettt commented 1 year ago

Is java.lang.runtime.ObjectMethods a phantom class? Could you please show the content of this class? (You can call ClassHierarchy.getClass("java.lang.runtime.ObjectMethods") to obtain this class, and view its content in debugger).

Y4er commented 1 year ago

image

Y4er commented 1 year ago

my all lib https://mega.nz/file/qMthwYpB#lR1HIbuM81SV1msYPw_CA9k7rSrgRop0OeB20TAErlQ

first ClassNameExtractor get all classname

c.txt
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\classes.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\main.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.servlet-api-4.0.1.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\accessors-smart-1.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\activation-1.1.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\annotations-api.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\asm-5.0.4.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\aspectjrt-1.7.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\aspectjweaver-1.7.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\bc-fips-1.0.2.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\bcpkix-fips-1.0.6.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\casa-client-1.0-SNAPSHOT.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\casa-common-1.0.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\casa-rest-client-1.0-SNAPSHOT.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina-ant.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina-ha.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina-storeconfig.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina-tribes.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\classmate-1.3.1.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-cli-1.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-codec-1.5.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-collections-3.2.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-configuration-1.10.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-digester-1.8.1.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-fileupload-1.3.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-io-2.4.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-lang-2.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-lang3-3.12.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-logging-1.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-net-3.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-validator-1.4.1.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\ecj-4.6.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\el-api.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\gson-2.9.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\guava-18.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\hibernate-validator-6.0.14.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\hsqldb-2.2.9.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\httpclient-4.3.6.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\httpcore-4.3.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\install-upgrade-model-1.0.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\install-upgrade-server-1.0.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jackson-annotations-2.13.4.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jackson-core-2.13.4.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jackson-databind-2.13.4.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jasper-el.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jasper.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jaspic-api.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.activation-api-1.2.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.el-2.2.6.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.el-api-3.0.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.mail-1.6.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jaxb-api-2.3.1.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jboss-logging-3.3.2.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jjwt-api-0.11.5.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jjwt-impl-0.11.5.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jjwt-jackson-0.11.5.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\json-20090211.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\json-path-2.4.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\json-smart-2.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jsoup-1.14.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jsp-api.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\log4j-api-2.17.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\log4j-core-2.17.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\log4j-slf4j-impl-2.17.2.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\metrics-core-3.1.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-all-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-buffer-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-dns-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-haproxy-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-http-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-http2-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-memcache-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-mqtt-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-redis-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-smtp-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-socks-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-stomp-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-xml-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-common-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-handler-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-handler-proxy-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-dns-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-dns-classes-macos-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-dns-native-macos-4.1.80.Final-osx-aarch_64.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-dns-native-macos-4.1.80.Final-osx-x86_64.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-classes-epoll-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-classes-kqueue-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-epoll-4.1.80.Final-linux-aarch_64.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-epoll-4.1.80.Final-linux-x86_64.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-kqueue-4.1.80.Final-osx-aarch_64.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-kqueue-4.1.80.Final-osx-x86_64.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-unix-common-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-rxtx-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-sctp-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-udt-4.1.80.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\servlet-api.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\slf4j-api-1.7.13.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-aop-5.3.20.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-beans-5.3.20.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-context-5.3.20.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-core-5.3.20.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-expression-5.3.20.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-hateoas-0.19.0.RELEASE.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-jcl-5.3.20.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-plugin-core-1.2.0.RELEASE.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-plugin-metadata-1.2.0.RELEASE.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-restdocs-core-2.0.3.RELEASE.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-security-config-5.7.5.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-security-core-5.7.5.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-security-crypto-5.7.5.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-security-web-5.7.5.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-web-5.3.20.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-webmvc-5.3.20.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\springfox-core-2.4.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\springfox-schema-2.4.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\tomcat-util.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\tomcat-websocket.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\trove4j-3.0.3.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\validation-api-2.0.1.Final.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vcops-common-1.0-SNAPSHOT.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vcops-platform-1.0-SNAPSHOT.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vcops-security-1.0-SNAPSHOT.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-adapters-sdk-1.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-jmx-metrics-1.0.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-logging-1.0-SNAPSHOT.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-rmi-1.0-SNAPSHOT.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-trustmanager-3.0-SNAPSHOT.jar
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\websocket-api.jar

get c.txt

pascal.taie.analysis.pta.plugin.taint.TaintAnalysis

/*
 * Tai-e: A Static Analysis Framework for Java
 *
 * Copyright (C) 2022 Tian Tan <tiantan@nju.edu.cn>
 * Copyright (C) 2022 Yue Li <yueli@nju.edu.cn>
 *
 * This file is part of Tai-e.
 *
 * Tai-e is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation, either version 3
 * of the License, or (at your option) any later version.
 *
 * Tai-e is distributed in the hope that it will be useful,but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
 * Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with Tai-e. If not, see <https://www.gnu.org/licenses/>.
 */

package pascal.taie.analysis.pta.plugin.taint;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import pascal.taie.World;
import pascal.taie.analysis.graph.callgraph.Edge;
import pascal.taie.analysis.pta.PointerAnalysisResult;
import pascal.taie.analysis.pta.core.cs.context.Context;
import pascal.taie.analysis.pta.core.cs.element.*;
import pascal.taie.analysis.pta.core.heap.HeapModel;
import pascal.taie.analysis.pta.core.heap.Obj;
import pascal.taie.analysis.pta.core.solver.EntryPoint;
import pascal.taie.analysis.pta.core.solver.Solver;
import pascal.taie.analysis.pta.core.solver.SpecifiedParamProvider;
import pascal.taie.analysis.pta.plugin.Plugin;
import pascal.taie.analysis.pta.pts.PointsToSet;
import pascal.taie.ir.exp.InvokeExp;
import pascal.taie.ir.exp.InvokeInstanceExp;
import pascal.taie.ir.exp.Var;
import pascal.taie.ir.stmt.Invoke;
import pascal.taie.language.classes.JClass;
import pascal.taie.language.classes.JMethod;
import pascal.taie.language.type.ClassType;
import pascal.taie.language.type.Type;
import pascal.taie.util.collection.Maps;
import pascal.taie.util.collection.MultiMap;
import pascal.taie.util.collection.Pair;

import java.util.*;

public class TaintAnalysis implements Plugin {

    private static final Logger logger = LogManager.getLogger(TaintAnalysis.class);

    /**
     * Map from method (which is source method) to set of types of
     * taint objects returned by the method calls.
     */
    private final MultiMap<JMethod, Type> sources = Maps.newMultiMap();

    /**
     * Map from method (which causes taint transfer) to set of relevant
     * {@link TaintTransfer}.
     */
    private final MultiMap<JMethod, TaintTransfer> transfers = Maps.newMultiMap();
    private final Set<Sink> sinks = new HashSet<>();

    /**
     * Map from variable to taint transfer information.
     * The taint objects pointed to by the "key" variable are supposed
     * to be transferred to "value" variable with specified type.
     */
    private final MultiMap<Var, Pair<Var, Type>> varTransfers = Maps.newMultiMap();

    private Solver solver;

    private CSManager csManager;

    private Context emptyContext;

    private TaintManager manager;

    private TaintConfig config;

    /**
     * Retrieves variable from a call site and index.
     */
    private static Var getVar(Invoke callSite, int index) {
        InvokeExp invokeExp = callSite.getInvokeExp();
        return switch (index) {
            case TaintTransfer.BASE -> ((InvokeInstanceExp) invokeExp).getBase();
            case TaintTransfer.RESULT -> callSite.getResult();
            default -> invokeExp.getArg(index);
        };
    }

    @Override
    public void onStart() {
        HeapModel heapModel = solver.getHeapModel();
        JClass httpRequestWrapper = World.get().getClassHierarchy().getClass("javax.servlet.http.HttpServletRequestWrapper");
        JClass servletRequestWrapper = World.get().getClassHierarchy().getClass("javax.servlet.ServletRequestWrapper");

        World.get().getClassHierarchy().allClasses().filter(c -> c.hasAnnotation("org.springframework.stereotype.Controller")).forEach(clazz -> {
            clazz.getDeclaredMethods().forEach(method -> {
                if (method.getName().equals("manageCertOnCluster")) {
                    Obj mockObj = heapModel.getMockObj(UUID.randomUUID().toString(), UUID.randomUUID().toString(), clazz.getType());
                    SpecifiedParamProvider.Builder builder = new SpecifiedParamProvider.Builder(method).addThisObj(mockObj);
                    List<Type> paramTypes = method.getParamTypes();
                    for (int i = 0; i < paramTypes.size(); i++) {
                        Type type = paramTypes.get(i);
                        Obj mockParam = heapModel.getMockObj(UUID.randomUUID().toString(), UUID.randomUUID().toString(), type, method);
                        builder.addParamObj(i, mockParam);
                        if (type instanceof ClassType) {
                            World.get().getClassHierarchy().getClass(type.getName()).getDeclaredMethods().forEach(m -> sources.put(m, m.getReturnType()));
                        }
                    }

                    SpecifiedParamProvider provider = builder.build();
                    solver.addEntryPoint(new EntryPoint(method, provider));
                }
            });
        });

        httpRequestWrapper.getDeclaredMethods().stream().filter(jMethod -> jMethod.getName().startsWith("get")).forEach(m -> {
            sources.put(m, m.getReturnType());
        });
        servletRequestWrapper.getDeclaredMethods().stream().filter(jMethod -> jMethod.getName().startsWith("get")).forEach(m -> {
            sources.put(m, m.getReturnType());
        });

        World.get().getClassHierarchy().getClass("java.lang.Runtime").getDeclaredMethods().stream().filter(jMethod -> jMethod.getName().equals("exec")).forEach(this::add2Sink);
        World.get().getClassHierarchy().getClass("java.lang.ProcessBuilder").getDeclaredMethods().stream().filter(jMethod -> jMethod.getName().equals("<init>") || jMethod.getName().equals("start")).forEach(this::add2Sink);

        // print sources
        System.out.println("sources....");
        sources.forEach((k, v) -> System.out.println(k.getMethodSource() + "\t" + v.getName()));
        System.out.println();

        // print sink
        System.out.println("sinks....");
        sinks.forEach(s -> System.out.println(s));
        System.out.println();
    }

    Sink add2Sink(JMethod jMethod) {
        for (int i = 0; i < jMethod.getParamCount(); i++) {
            sinks.add(new Sink(jMethod, i));
        }
        return null;
    }

    @Override
    public void setSolver(Solver solver) {
        this.solver = solver;
        csManager = solver.getCSManager();
        emptyContext = solver.getContextSelector().getEmptyContext();
        manager = new TaintManager(solver.getHeapModel());
        config = TaintConfig.readConfig(solver.getOptions().getString("taint-config"), solver.getHierarchy(), solver.getTypeSystem());
//        logger.info(config);
        config.getSources().forEach(s -> sources.put(s.method(), s.type()));
        config.getTransfers().forEach(t -> transfers.put(t.method(), t));
        config.getSinks().forEach(s -> sinks.add(s));
    }

    @Override
    public void onNewCallEdge(Edge<CSCallSite, CSMethod> edge) {
        Invoke callSite = edge.getCallSite().getCallSite();
        JMethod callee = edge.getCallee().getMethod();
        // generate taint value from source call
        Var lhs = callSite.getLValue();
        if (lhs != null && sources.containsKey(callee)) {
            sources.get(callee).forEach(type -> {
                Obj taint = manager.makeTaint(callSite, type);
                solver.addVarPointsTo(edge.getCallSite().getContext(), lhs, emptyContext, taint);
            });
        }
        // process taint transfer
        transfers.get(callee).forEach(transfer -> {
            Var from = getVar(callSite, transfer.from());
            Var to = getVar(callSite, transfer.to());
            // when transfer to result variable, and the call site
            // does not have result variable, then "to" is null.
            if (to != null) {
                Type type = transfer.type();
                varTransfers.put(from, new Pair<>(to, type));
                Context ctx = edge.getCallSite().getContext();
                CSVar csFrom = csManager.getCSVar(ctx, from);
                transferTaint(solver.getPointsToSetOf(csFrom), ctx, to, type);
            }
        });
    }

    private void transferTaint(PointsToSet pts, Context ctx, Var to, Type type) {
        PointsToSet newTaints = solver.makePointsToSet();
        pts.objects().map(CSObj::getObject).filter(manager::isTaint).map(manager::getSourceCall).map(source -> manager.makeTaint(source, type)).map(taint -> csManager.getCSObj(emptyContext, taint)).forEach(newTaints::addObject);
        if (!newTaints.isEmpty()) {
            solver.addVarPointsTo(ctx, to, newTaints);
        }
    }

    @Override
    public void onNewPointsToSet(CSVar csVar, PointsToSet pts) {
        varTransfers.get(csVar.getVar()).forEach(p -> {
            Var to = p.first();
            Type type = p.second();
            transferTaint(pts, csVar.getContext(), to, type);
        });
    }

    @Override
    public void onFinish() {
        Set<TaintFlow> taintFlows = collectTaintFlows();
        solver.getResult().storeResult(getClass().getName(), taintFlows);
    }

    private Set<TaintFlow> collectTaintFlows() {
        PointerAnalysisResult result = solver.getResult();
        Set<TaintFlow> taintFlows = new TreeSet<>();
        sinks.forEach(sink -> {
            int i = sink.index();
            result.getCallGraph().getCallersOf(sink.method()).forEach(sinkCall -> {
                Var arg = sinkCall.getInvokeExp().getArg(i);
                result.getPointsToSet(arg).stream().filter(manager::isTaint).map(manager::getSourceCall).map(sourceCall -> new TaintFlow(sourceCall, sinkCall, i)).forEach(taintFlows::add);
            });
        });
        return taintFlows;
    }
}

then run tai-e

-cp
E:\tools\code\casa\src\main\webapp\WEB-INF\lib\classes.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\main.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.servlet-api-4.0.1.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\accessors-smart-1.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\activation-1.1.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\annotations-api.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\asm-5.0.4.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\aspectjrt-1.7.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\aspectjweaver-1.7.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\bc-fips-1.0.2.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\bcpkix-fips-1.0.6.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\casa-client-1.0-SNAPSHOT.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\casa-common-1.0.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\casa-rest-client-1.0-SNAPSHOT.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina-ant.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina-ha.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina-storeconfig.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina-tribes.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\catalina.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\classmate-1.3.1.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-cli-1.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-codec-1.5.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-collections-3.2.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-configuration-1.10.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-digester-1.8.1.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-fileupload-1.3.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-io-2.4.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-lang-2.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-lang3-3.12.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-logging-1.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-net-3.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\commons-validator-1.4.1.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\ecj-4.6.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\el-api.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\gson-2.9.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\guava-18.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\hibernate-validator-6.0.14.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\hsqldb-2.2.9.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\httpclient-4.3.6.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\httpcore-4.3.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\install-upgrade-model-1.0.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\install-upgrade-server-1.0.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jackson-annotations-2.13.4.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jackson-core-2.13.4.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jackson-databind-2.13.4.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jasper-el.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jasper.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jaspic-api.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.activation-api-1.2.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.el-2.2.6.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.el-api-3.0.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\javax.mail-1.6.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jaxb-api-2.3.1.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jboss-logging-3.3.2.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jjwt-api-0.11.5.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jjwt-impl-0.11.5.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jjwt-jackson-0.11.5.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\json-20090211.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\json-path-2.4.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\json-smart-2.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jsoup-1.14.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\jsp-api.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\log4j-api-2.17.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\log4j-core-2.17.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\log4j-slf4j-impl-2.17.2.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\metrics-core-3.1.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-all-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-buffer-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-dns-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-haproxy-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-http-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-http2-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-memcache-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-mqtt-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-redis-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-smtp-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-socks-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-stomp-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-codec-xml-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-common-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-handler-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-handler-proxy-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-dns-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-dns-classes-macos-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-dns-native-macos-4.1.80.Final-osx-aarch_64.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-resolver-dns-native-macos-4.1.80.Final-osx-x86_64.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-classes-epoll-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-classes-kqueue-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-epoll-4.1.80.Final-linux-aarch_64.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-epoll-4.1.80.Final-linux-x86_64.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-kqueue-4.1.80.Final-osx-aarch_64.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-kqueue-4.1.80.Final-osx-x86_64.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-native-unix-common-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-rxtx-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-sctp-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\netty-transport-udt-4.1.80.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\servlet-api.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\slf4j-api-1.7.13.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-aop-5.3.20.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-beans-5.3.20.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-context-5.3.20.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-core-5.3.20.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-expression-5.3.20.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-hateoas-0.19.0.RELEASE.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-jcl-5.3.20.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-plugin-core-1.2.0.RELEASE.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-plugin-metadata-1.2.0.RELEASE.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-restdocs-core-2.0.3.RELEASE.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-security-config-5.7.5.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-security-core-5.7.5.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-security-crypto-5.7.5.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-security-web-5.7.5.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-web-5.3.20.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\spring-webmvc-5.3.20.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\springfox-core-2.4.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\springfox-schema-2.4.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\tomcat-util.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\tomcat-websocket.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\trove4j-3.0.3.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\validation-api-2.0.1.Final.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vcops-common-1.0-SNAPSHOT.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vcops-platform-1.0-SNAPSHOT.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vcops-security-1.0-SNAPSHOT.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-adapters-sdk-1.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-jmx-metrics-1.0.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-logging-1.0-SNAPSHOT.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-rmi-1.0-SNAPSHOT.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\vrops-trustmanager-3.0-SNAPSHOT.jar;E:\tools\code\casa\src\main\webapp\WEB-INF\lib\websocket-api.jar
-pp
--input-classes=c.txt
-m
com.example.casa.Main
-ap
-a
pta=action:dump;action-file:result.txt;taint-config:src\test\resources\pta\taint\taint-config.yml

error

Exception in thread "main" pascal.taie.ir.proginfo.MethodResolutionFailedException: Cannot resolve <java.lang.runtime.ObjectMethods: java.lang.Object bootstrap(java.lang.invoke.MethodHandles$Lookup,java.lang.String,java.lang.invoke.TypeDescriptor,java.lang.Class,java.lang.String,java.lang.invoke.MethodHandle[])>
    at pascal.taie.ir.proginfo.MethodRef.resolve(MethodRef.java:180)
    at pascal.taie.analysis.pta.plugin.invokedynamic.LambdaAnalysis.isLambdaMetaFactory(LambdaAnalysis.java:122)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
    at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
    at java.base/java.util.AbstractList$RandomAccessSpliterator.forEachRemaining(AbstractList.java:720)
    at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
    at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
    at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
    at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
    at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
    at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
    at pascal.taie.analysis.pta.plugin.invokedynamic.LambdaAnalysis.onNewMethod(LambdaAnalysis.java:104)
    at pascal.taie.analysis.pta.plugin.CompositePlugin.lambda$onNewMethod$3(CompositePlugin.java:115)
    at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
    at pascal.taie.analysis.pta.plugin.CompositePlugin.onNewMethod(CompositePlugin.java:115)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.processNewMethod(DefaultSolver.java:497)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.addCSMethod(DefaultSolver.java:780)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.processCallEdge(DefaultSolver.java:453)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.analyze(DefaultSolver.java:300)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.solve(DefaultSolver.java:238)
    at pascal.taie.analysis.pta.PointerAnalysis.runAnalysis(PointerAnalysis.java:118)
    at pascal.taie.analysis.pta.PointerAnalysis.analyze(PointerAnalysis.java:106)
    at pascal.taie.analysis.pta.PointerAnalysis.analyze(PointerAnalysis.java:63)
    at pascal.taie.analysis.AnalysisManager.runProgramAnalysis(AnalysisManager.java:147)
    at pascal.taie.analysis.AnalysisManager.runAnalysis(AnalysisManager.java:120)
    at pascal.taie.analysis.AnalysisManager.lambda$execute$0(AnalysisManager.java:104)
    at pascal.taie.util.Timer.runAndCount(Timer.java:93)
    at pascal.taie.analysis.AnalysisManager.lambda$execute$1(AnalysisManager.java:103)
    at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
    at pascal.taie.analysis.AnalysisManager.execute(AnalysisManager.java:102)
    at pascal.taie.Main.executePlan(Main.java:143)
    at pascal.taie.Main.lambda$main$0(Main.java:57)
    at pascal.taie.util.Timer.lambda$runAndCount$0(Timer.java:112)
    at pascal.taie.util.Timer.runAndCount(Timer.java:93)
    at pascal.taie.util.Timer.runAndCount(Timer.java:111)
    at pascal.taie.util.Timer.runAndCount(Timer.java:107)
    at pascal.taie.Main.main(Main.java:49)
silverbullettt commented 1 year ago

@Y4er Thank you for your info. As shown in your screenshot, java.lang.runtime.ObjectMethods is a phantom class, thus its methods cannot be resolved. It looks like an issue of soot-based front end, and we did not expect such cases before.

I just updated LambdaAnalysis.isLambdaMetaFactory() in commit 7ece279, which should be able to fix the exception.

Y4er commented 1 year ago

Another error was reported with -pp

Exception in thread "main" pascal.taie.util.AnalysisException: void cannot be dispatched
    at pascal.taie.language.classes.ClassHierarchyImpl.dispatch(ClassHierarchyImpl.java:321)
    at pascal.taie.analysis.graph.callgraph.CallGraphs.resolveCallee(CallGraphs.java:91)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.lambda$processCall$5(DefaultSolver.java:426)
    at java.base/java.lang.Iterable.forEach(Iterable.java:75)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.processCall(DefaultSolver.java:424)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.analyze(DefaultSolver.java:296)
    at pascal.taie.analysis.pta.core.solver.DefaultSolver.solve(DefaultSolver.java:238)
    at pascal.taie.analysis.pta.PointerAnalysis.runAnalysis(PointerAnalysis.java:118)
    at pascal.taie.analysis.pta.PointerAnalysis.analyze(PointerAnalysis.java:106)
    at pascal.taie.analysis.pta.PointerAnalysis.analyze(PointerAnalysis.java:63)
    at pascal.taie.analysis.AnalysisManager.runProgramAnalysis(AnalysisManager.java:147)
    at pascal.taie.analysis.AnalysisManager.runAnalysis(AnalysisManager.java:120)
    at pascal.taie.analysis.AnalysisManager.lambda$execute$0(AnalysisManager.java:104)
    at pascal.taie.util.Timer.runAndCount(Timer.java:93)
    at pascal.taie.analysis.AnalysisManager.lambda$execute$1(AnalysisManager.java:103)
    at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
    at pascal.taie.analysis.AnalysisManager.execute(AnalysisManager.java:102)
    at pascal.taie.Main.executePlan(Main.java:143)
    at pascal.taie.Main.lambda$main$0(Main.java:57)
    at pascal.taie.util.Timer.lambda$runAndCount$0(Timer.java:112)
    at pascal.taie.util.Timer.runAndCount(Timer.java:93)
    at pascal.taie.util.Timer.runAndCount(Timer.java:111)
    at pascal.taie.util.Timer.runAndCount(Timer.java:107)
    at pascal.taie.Main.main(Main.java:49)

Using -java 8 instead of -pp parameter does not give this exception.

Y4er commented 1 year ago

Resolved, update tai-e to 7ece279 and use -java 8. thanks! @silverbullettt

silverbullettt commented 1 year ago

@Y4er No worries ;-)