specification in inference usin ing context free language
play

Specification In Inference Usin ing Context-Free Language - PowerPoint PPT Presentation

Specification In Inference Usin ing Context-Free Language Reachability Osbert Bastani, Saswat Anand, and Alex Aiken Stanford University Specification In Inference Usin ing Context-Free Language Reachability Specification In Inference Usin


  1. Framework Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  2. Framework Specifications • Specification: over-approximates behavior of framework methods • Provided by the user • More precise than automated approaches

  3. Framework Specifications • Alias Specifications: describes aliasing • @Alias(x, y) means “x aliases y” • class List: @Alias(arg, this.val) void add(Object arg) {} @Alias(this.val, return) Object get(Integer index) {}

  4. Framework Specifications • Flow Specifications: describe information flows • @Flow(x, y) means “x tainted ⇒ y tainted” • class Double: @Flow(this, return) String toString() {}

  5. Framework Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  6. Missing Specifications • Specifications typically written as needed • ≈ 4,000 framework classes • A given app may use hundreds of classes • For a given app, only a few classes are relevant for finding information flows • Our experience: specifications for ≈ 175 classes over course of a year

  7. Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  8. Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  9. Step 1: Worst-case Analysis 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  10. Step 1: Worst-case Analysis 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  11. Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  12. Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  13. Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: minimal = easier to verify + more likely to be correct 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  14. Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  15. Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  16. Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  17. Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  18. Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  19. Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  20. Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  21. Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  22. Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  23. Interactive Refinement • Two problems to solve • Step 1: Worst-case analysis • Step 2: Specification inference

  24. CFL Reachability

  25. CFL Reachability 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); 6. sendSMS(latStr);

  26. CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); o lat 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New 6. sendSMS(latStr); arg add this add Assign list lat ret get this get latAlias this toString latString Assign text sendSMS ret toString

  27. CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); o lat 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString 4. @Alias(this.val, return) Assign 5. Object get(Integer index) {} text sendSMS ret toString

  28. CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); o lat 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString 7. @Flow(this, return) 8. String toString() {}

  29. CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); LOC 3. list.add(lat); o lat SrcRef 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString RefSink 7. @Flow(this, return) 8. String toString() {} SMS 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  30. CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  31. CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  32. CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  33. CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS SrcRef New New Assign Assign Put val Assign New New Assign ∈ 𝑀( ) Get Val Assign Assign RefRef New New Assign Assign RefSink

  34. Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); LOC 3. list.add(lat); o lat SrcRef 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString RefSink 7. @Flow(this, return) 8. String toString() {} SMS 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  35. Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); LOC 3. list.add(lat); o lat SrcRef 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString RefSink 7. @Flow(this, return) 8. String toString() {} SMS 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}

  36. Missing Specifications LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  37. Missing Specifications LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  38. Missing Specifications LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  39. Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  40. Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New Σ ∗ arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  41. Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New Σ ∗ arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS SrcRef New New Assign Assign Σ ∗ = Put val Assign New New Assign Get Val Assign Assign RefRef New New Assign Assign RefSink ∈ 𝑀( )

  42. Step 1: Worst-Case Analysis • Use “do anything” subgraph: 𝜗 𝜗 𝑢 Σ ∗ = Σ • Finite state automata that accepts Σ ∗

  43. Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  44. Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New 𝜗 𝜗 𝑢 arg add this add Assign Σ list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS

  45. Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New 𝜗 𝜗 𝑢 arg add this add Assign Σ list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS SrcRef New New Assign Assign 𝜗 Put val 𝜗 Assign New New Assign ∈ 𝑀( ) Get Val Assign Assign RefRef New New Assign Assign RefSink

Recommend


More recommend