secure-software-engineering / FlowDroid

FlowDroid Static Data Flow Tracker
GNU Lesser General Public License v2.1
1.02k stars 293 forks source link

jakarta.servlet differents compiled versions #574

Open Jclavo opened 1 year ago

Jclavo commented 1 year ago

Hi @StevenArzt

I am running mvn package and I am getting this problem:

image

It means that Jakarta classes were compiled with Java 11 but we are using Java 8 (As recommended). So do I need to upgrade to Java 11?

Pd: I saw that 3 weeks ago you upgraded "Javax" to "Jakarta".

My version are:

Maven: 3.8
Java: openjdk version "1.8.0_342"
Javac: javac 1.8.0_342

UPDATE: I have installed Java 11

I am trying to run the test from soot-infoflow so

I solve some problem in order to run the test from SecuriBench but I could not finished the workflow.

  1. Asked for bin folder in soot-infoflow root folder (I created it)
  2. Asked for a missing path ('/usr/local/openjdk-11/lib/rt.jar') It requires rt.jar, I think in Java 11 is not use anymore but in the code is imported. (I managed to copy rt.jar from java 8 and it run)

image

  1. After running the test in SecuriBench an error appears Cannot generate constructor for class. (I am stucked at this point)

image

StevenArzt commented 1 year ago

FlowDroid doesn't work with Java 8 anymore, we dropped the legacy support. You need to use a newer Java version to run FlowDroid.

Still, since we haven't adapted the JUnit test cases to the newer Java version, you still need a rt.jar file from Java 8. Once someone from the team finds the time, we will update the JUnit tests as well and get rid of the dependency on rt.jar. For the time being, we made a hack to look for rt.jar in the default installation location on Ubuntu (/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/rt.jar). Since our build system has Java 8 on disk, but runs Java 17, that works. That means we can still rely on the test cases, although the setup is far from optimal.

If you just want to use FlowDroid, skip the tests in your Maven build (mvn install -DskipTests) or use the official build from Maven Central: https://mvnrepository.com/artifact/de.fraunhofer.sit.sse.flowdroid.

Jclavo commented 1 year ago

Hi @StevenArzt, I managed to set up Java 17 keeping Java 8 on disk. In my case. In my case, I am interested in run the test suite for Java Files soot-infoflow

i did the next steps in folder flowdroid/soot-infoflow

  1. Built project (OK) image

  2. Run tests from Junit (app/flowdroid/soot-infoflow/test/soot/jimple/infoflow/test/junit) (OK) image

  3. Run tests from SecuriBench (app/flowdroid/soot-infoflow/test/soot/jimple/infoflow/test/securibench) (FAIL)

image

All tests fails. so I have run just a test to analyze:

Test: app/flowdroid/soot-infoflow/test/soot/jimple/infoflow/test/securibench/SessionTests.java Method: session1 image

error: Cannot generate constructor for class

This error is happening to all the tests, Do you know if it is something related to my setup or I need to do something more to run these test?