secure-software-engineering / FlowDroid

FlowDroid Static Data Flow Tracker
GNU Lesser General Public License v2.1
1.02k stars 292 forks source link

Why this library lacks documentation? #683

Closed yamin8000 closed 5 months ago

yamin8000 commented 5 months ago

I looked everywhere in the readme but I can't find any documentation. I'm using this tool as a library instead of a command line tool, so I have to manually look for classes and packages and experiment with the code to find what I'm looking for.
I don't think this is right.

StevenArzt commented 5 months ago

The code has JavaDoc on almost all methods, even on the private ones. The main class of the command-line tool is fairly simple, so you can just look into the MainClass and see how it uses the FlowDroid API classes.

There are even some writeups for specific tasks, e.g., call graph generation: https://medium.com/geekculture/generating-call-graphs-in-android-using-flowdroid-pointsto-analysis-7b2e296e6697

In short, if you want to run a data flow analysis, have a look at the SetupApplication class and its computeInfoflow method. You may want to set a taint wrapper as well:

SetupApplication app = new SetupApplication(androidJarFolder, apkPath);
app.setTaintWrapper(new SummaryTaintWrapper(new LazySummaryProvider("summariesManual")));
InfoflowResults results = app.runInfoflow();

That should be the most basic configuration.

yamin8000 commented 5 months ago

The code has JavaDoc on almost all methods, even on the private ones. The main class of the command-line tool is fairly simple, so you can just look into the MainClass and see how it uses the FlowDroid API classes.

There are even some writeups for specific tasks, e.g., call graph generation: https://medium.com/geekculture/generating-call-graphs-in-android-using-flowdroid-pointsto-analysis-7b2e296e6697

In short, if you want to run a data flow analysis, have a look at the SetupApplication class and its computeInfoflow method. You may want to set a taint wrapper as well:

SetupApplication app = new SetupApplication(androidJarFolder, apkPath);
app.setTaintWrapper(new SummaryTaintWrapper(new LazySummaryProvider("summariesManual")));
InfoflowResults results = app.runInfoflow();

That should be the most basic configuration.

Right.
This is a very useful tool and I'm very thankful to you and other contributors. This is helping me and my fellow researchers.
Yeah, I missed the JavaDoc because by default my IDE showed decompiled sources instead of real sources and that's on me. Medium articles aside from being behind paywalls most of the time, however, not in this case are prone to be outdated so a more dependable source is always the project repository's readme or even wiki. I think the very same three-line code you provided here should be added to the readme as a first clue for people to know where to start, I don't see why this is not in the readme maybe this tool is more command-line centric or some other reasons. The problem with Javadoc is that when someone just tries to use your Library/API, its architecture is unknown to them so they may have difficulties where to start and this even slows down seasoned programmers. Javadoc is better suited for someone already familiar with the tool's architecture. That's just my two cents.

StevenArzt commented 5 months ago

Agreed. Unfortunately, we don't have spare capacity to write documentation.

I have added the simple example to the README (5683c50).

yamin8000 commented 5 months ago

Agreed. Unfortunately, we don't have spare capacity to write documentation.

I have added the simple example to the README (5683c50).

Thank you.