Hello,
for a test app, my sources and sinks contain okhttp3.Call: okhttp3.Response execute(), which in my case is considered as both (source and sink). However, FlowDroid reports (latest version) that no sink is found. After looking into the source code, it looks like this (BOTH source and sink) is not supported anymore, as in such a case, the statement is always considered as a source.
private int scanMethodForSourcesSinks(final ISourceSinkManager sourcesSinks, AbstractInfoflowProblem forwardProblem,
SootMethod m) {
//...
for (Unit u : units) {
Stmt s = (Stmt) u;
switch (scanStmtForSourcesSinks(sourcesSinks, s)) {
case SOURCE:
forwardProblem.addInitialSeeds(s, Collections.singleton(forwardProblem.zeroValue()));
if (getConfig().getLogSourcesAndSinks())
collectedSources.add(s);
break;
case SINK:
if (getConfig().getLogSourcesAndSinks())
collectedSinks.add(s);
sinkCount++;
break;
}
//...
}
Hello, for a test app, my sources and sinks contain
okhttp3.Call: okhttp3.Response execute()
, which in my case is considered as both (source and sink). However, FlowDroid reports (latest version) that no sink is found. After looking into the source code, it looks like this (BOTH source and sink) is not supported anymore, as in such a case, the statement is always considered as a source.