secure-software-engineering / FlowDroid

FlowDroid Static Data Flow Tracker
GNU Lesser General Public License v2.1
1.05k stars 298 forks source link

Except taint analysis, can I configure FlowDroid to resolve other data-flow problems? #466

Closed RichardHoOoOo closed 2 years ago

RichardHoOoOo commented 2 years ago

I am wondering does FlowDroid provide interfaces that I can implement to resolve other interprocedural data-flow problems?

Suppose In the following example, Activity A "writes" some data that will be finally "used" by Activity C

=====================Example======================= Activity A (set latitude and longitude fields of loc)

onClick() {
    loc.setLatitude("27.9");
    loc.setLongitude("10.8");
}

Activity B (transfer latitude and longitude with an intent)

onClick() {
   Intent i = new intent(this, ActivityC.class);
   i.putStringExtra("lat", loc.getLatitude());
   i.putStringExtra("lon", loc.getLongitude());
   startActivity(i);
}

Activity C (use latitude and longitude to form location)

onCreate() {
    String latitude = intent.getStringExtra("lat");
    String longitude = intent.getStringExtra("lon");
    String location = latitude + longitude;
    setLoc(location);
}

===================================================

Suppose I hope to know which method generates the data that may finally be used by the invocation of a specific api (e.g., setLoc()). In the example, activity A's onClick writes latitude and longitude, which finally constitute the location that is consumed by setLoc() in activity C's onCreate(). Therefore, activity A's onClick will be the output.

This sounds like a taint analysis (backward) but only sinks are given. I saw soot provide some IFDS examples that I can learn, I am wondering does FlowDroid provide similar examples that I can start with?