Framework Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Framework Specifications • Specification: over-approximates behavior of framework methods • Provided by the user • More precise than automated approaches
Framework Specifications • Alias Specifications: describes aliasing • @Alias(x, y) means “x aliases y” • class List: @Alias(arg, this.val) void add(Object arg) {} @Alias(this.val, return) Object get(Integer index) {}
Framework Specifications • Flow Specifications: describe information flows • @Flow(x, y) means “x tainted ⇒ y tainted” • class Double: @Flow(this, return) String toString() {}
Framework Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Missing Specifications • Specifications typically written as needed • ≈ 4,000 framework classes • A given app may use hundreds of classes • For a given app, only a few classes are relevant for finding information flows • Our experience: specifications for ≈ 175 classes over course of a year
Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Step 1: Worst-case Analysis 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Step 1: Worst-case Analysis 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: minimal = easier to verify + more likely to be correct 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Step 2: Specification Inference 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Interactive Refinement 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); Android Framework 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); Specification 6. sendSMS(latStr); getLatitude() 1. class List: 2. @Alias(arg, this.val) sendSMS (…) 3. void add(Object arg) {} add(…) get(…) toString() 4. @Alias(this.val, return) 5. Object get(Integer index) {} 6. class Double: 7. @Flow(this, return) 8. String toString() {} 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} Android App 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Interactive Refinement • Two problems to solve • Step 1: Worst-case analysis • Step 2: Specification inference
CFL Reachability
CFL Reachability 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); 4. Double latAlias = list.get(0); 5. String latStr = latAlias.toString(); 6. sendSMS(latStr);
CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); o lat 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New 6. sendSMS(latStr); arg add this add Assign list lat ret get this get latAlias this toString latString Assign text sendSMS ret toString
CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); o lat 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString 4. @Alias(this.val, return) Assign 5. Object get(Integer index) {} text sendSMS ret toString
CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); 3. list.add(lat); o lat 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString 7. @Flow(this, return) 8. String toString() {}
CFL Reachability: Stage 1 1. Double lat = getLatitude(); 2. List list = new List(); LOC 3. list.add(lat); o lat SrcRef 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString RefSink 7. @Flow(this, return) 8. String toString() {} SMS 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
CFL Reachability: Stage 2 LOC o lat SrcRef o list ret getLatitude New Put[ val ] arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS SrcRef New New Assign Assign Put val Assign New New Assign ∈ 𝑀( ) Get Val Assign Assign RefRef New New Assign Assign RefSink
Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); LOC 3. list.add(lat); o lat SrcRef 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New Put[ val ] 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString RefSink 7. @Flow(this, return) 8. String toString() {} SMS 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Missing Specifications 1. Double lat = getLatitude(); 2. List list = new List(); LOC 3. list.add(lat); o lat SrcRef 4. Double latAlias = list.get(0); o list 5. String latStr = latAlias.toString(); ret getLatitude New 6. sendSMS(latStr); arg add this add Assign list lat Get[ val ] ret get this get 1. class List: 2. @Alias(arg, this.val) latAlias 3. void add(Object arg) {} this toString latString o ret toString 4. @Alias(this.val, return) RefRef Assign 5. Object get(Integer index) {} 6. class Double: text sendSMS ret toString RefSink 7. @Flow(this, return) 8. String toString() {} SMS 9. class LocationManager: 10. @Flow(LOC, return) 11. static String getLatitude() {} 12. c lass SMS: 13. @Flow(text, SMS) 14. static void sendSMS(String text) {}
Missing Specifications LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
Missing Specifications LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
Missing Specifications LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New Σ ∗ arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New Σ ∗ arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS SrcRef New New Assign Assign Σ ∗ = Put val Assign New New Assign Get Val Assign Assign RefRef New New Assign Assign RefSink ∈ 𝑀( )
Step 1: Worst-Case Analysis • Use “do anything” subgraph: 𝜗 𝜗 𝑢 Σ ∗ = Σ • Finite state automata that accepts Σ ∗
Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New arg add this add Assign list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New 𝜗 𝜗 𝑢 arg add this add Assign Σ list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS
Step 1: Worst-Case Analysis LOC o lat SrcRef o list ret getLatitude New 𝜗 𝜗 𝑢 arg add this add Assign Σ list lat Get[ val ] ret get this get latAlias this toString latString o ret toString RefRef Assign text sendSMS ret toString RefSink SMS SrcRef New New Assign Assign 𝜗 Put val 𝜗 Assign New New Assign ∈ 𝑀( ) Get Val Assign Assign RefRef New New Assign Assign RefSink
Recommend
More recommend