import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
public MatchResult match(InstructionHandle handle, ConstantPoolGen cpg,
                         ValueNumberFrame before, ValueNumberFrame after, BindingSet bindingSet) throws DataflowAnalysisException {

	Variable field;
	Instruction ins = handle.getInstruction();
	FieldInstruction fieldIns;

	// The instruction must be GETFIELD or GETSTATIC
	if (ins instanceof GETFIELD) {
		fieldIns = (GETFIELD) ins;
		ValueNumber ref = before.getTopValue();
		field = new FieldVariable(ref, fieldIns.getClassName(cpg), fieldIns.getFieldName(cpg), fieldIns.getSignature(cpg));
	} else if (ins instanceof GETSTATIC) {
		fieldIns = (GETSTATIC) ins;
		field = new FieldVariable(fieldIns.getClassName(cpg), fieldIns.getFieldName(cpg), fieldIns.getSignature(cpg));
	} else
		return null;

	Variable result = snarfFieldValue(fieldIns, cpg, after);

	return checkConsistent(field, result, bindingSet);
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
public MatchResult match(InstructionHandle handle, ConstantPoolGen cpg,
                         ValueNumberFrame before, ValueNumberFrame after, BindingSet bindingSet) throws DataflowAnalysisException {

	Instruction ins = handle.getInstruction();
	FieldInstruction fieldIns;
	Variable field;

	// The instruction must be PUTFIELD or PUTSTATIC
	if (ins instanceof PUTFIELD) {
		fieldIns = (PUTFIELD) ins;
		int numSlots = before.getNumSlots();
		ValueNumber ref = before.getValue(isLongOrDouble(fieldIns, cpg)
		        ? numSlots - 3
		        : numSlots - 2);
		field = new FieldVariable(ref, fieldIns.getClassName(cpg), fieldIns.getFieldName(cpg), fieldIns.getSignature(cpg));
	} else if (ins instanceof PUTSTATIC) {
		fieldIns = (PUTSTATIC) ins;
		field = new FieldVariable(fieldIns.getClassName(cpg), fieldIns.getFieldName(cpg), fieldIns.getSignature(cpg));
	} else
		return null;

	Variable value = snarfFieldValue(fieldIns, cpg, before);

	return checkConsistent(field, value, bindingSet);
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
public void handleStoreInstruction(StoreInstruction obj) {
    try {
        int numConsumed = obj.consumeStack(cpg);
        if (numConsumed == Constants.UNPREDICTABLE) {
            throw new InvalidBytecodeException("Unpredictable stack consumption");
        }
        int index = obj.getIndex();
        while (numConsumed-- > 0) {
            Taint value = new Taint(getFrame().popValue());
            value.setVariableIndex(index);
            getFrame().setValue(index++, value);
        }
    } catch (DataflowAnalysisException ex) {
        throw new InvalidBytecodeException(ex.toString(), ex);
    }
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
public void visitAASTORE(AASTORE obj) {
    try {
        Taint valueTaint = getFrame().popValue();
        getFrame().popValue(); // array index
        Taint arrayTaint = getFrame().popValue();
        Taint merge = Taint.merge(valueTaint, arrayTaint);
        setLocalVariableTaint(merge, arrayTaint);
        Taint stackTop = null;
        if (getFrame().getStackDepth() > 0) {
            stackTop = getFrame().getTopValue();
        }
        // varargs use duplicated values
        if (stackTop == arrayTaint) {
            getFrame().popValue();
            getFrame().pushValue(new Taint(merge));
        }
    } catch (DataflowAnalysisException ex) {
        throw new InvalidBytecodeException("Not enough values on the stack", ex);
    }
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
public void visitCHECKCAST(CHECKCAST obj) {
    // cast to a safe object type
    ObjectType objectType = obj.getLoadClassType(cpg);
    if (objectType == null) {
        return;
    }

    String objectTypeSignature = objectType.getSignature();

    if(!taintConfig.isClassTaintSafe(objectTypeSignature)) {
        return;
    }

    try {
        getFrame().popValue();
        pushSafe();
    }
    catch (DataflowAnalysisException ex) {
        throw new InvalidBytecodeException("empty stack for checkcast", ex);
    }
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
protected int getPriorityFromTaintFrame(TaintFrame fact, int offset)
        throws DataflowAnalysisException {
    Taint valueTaint = fact.getStackValue(0);
    Taint parameterTaint = fact.getStackValue(1);

    if(valueTaint.getConstantValue() == null || parameterTaint.getConstantValue() == null) {
        return Priorities.IGNORE_PRIORITY;
    }

    String parameterValue = parameterTaint.getConstantValue().toLowerCase();
    if(parameterValue.equals("java.naming.security.credentials")) {
        return Priorities.NORMAL_PRIORITY;
    }
    for (String password : PASSWORD_WORDS) {
        if (parameterValue.contains(password)) {//Is a constant value
            return Priorities.NORMAL_PRIORITY;
        }
    }
    return Priorities.IGNORE_PRIORITY;
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
protected int getPriorityFromTaintFrame(TaintFrame fact, int offset)
        throws DataflowAnalysisException {
    Taint mvcResultTaint = fact.getStackValue(offset);

    // The MVC Result object was tainted - This could still be safe if the content-type is a safe one
    if (!mvcResultTaint.isSafe()) {
        // Get the value of the content-type parameter
        Taint parameterTaint = fact.getStackValue(0);

        if ( !parameterTaint.isSafe()
                || VULNERABLE_CONTENT_TYPE.equalsIgnoreCase(parameterTaint.getConstantValue())) {
            return getPriority(mvcResultTaint);
        }
    }

    return Priorities.IGNORE_PRIORITY;
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
/**
 * Check if the readObject is doing multiple external call beyond the basic readByte, readBoolean, etc..
 * @param m
 * @param classContext
 * @return
 * @throws CFGBuilderException
 * @throws DataflowAnalysisException
 */
private boolean hasCustomReadObject(Method m, ClassContext classContext,List<String> classesToIgnore)
        throws CFGBuilderException, DataflowAnalysisException {
    ConstantPoolGen cpg = classContext.getConstantPoolGen();
    CFG cfg = classContext.getCFG(m);
    int count = 0;
    for (Iterator<Location> i = cfg.locationIterator(); i.hasNext(); ) {
        Location location = i.next();
        Instruction inst = location.getHandle().getInstruction();
        //ByteCode.printOpCode(inst,cpg);
        if(inst instanceof InvokeInstruction) {
            InvokeInstruction invoke = (InvokeInstruction) inst;
            if (!READ_DESERIALIZATION_METHODS.contains(invoke.getMethodName(cpg))
                    && !classesToIgnore.contains(invoke.getClassName(cpg))) {
                count +=1;
            }
        }
    }
    return count > 3;
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
public void visitClassContext(ClassContext classContext) {
    JavaClass javaClass = classContext.getJavaClass();
    if (OBJECT_MAPPER_CLASSES.contains(javaClass.getClassName())) {
        return;
    }
    for (Field field : javaClass.getFields()) {
        analyzeField(field, javaClass);
    }
    for (Method m : javaClass.getMethods()) {
        try {
            analyzeMethod(m, classContext);
        }
        catch (CFGBuilderException | DataflowAnalysisException e) {
        }
    }
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
private void analyzeMethod(Method m, ClassContext classContext) throws CFGBuilderException, DataflowAnalysisException {
    MethodGen methodGen = classContext.getMethodGen(m);
    ConstantPoolGen cpg = classContext.getConstantPoolGen();
    CFG cfg = classContext.getCFG(m);

    if (methodGen == null || methodGen.getInstructionList() == null) {
        return; //No instruction .. nothing to do
    }
    for (Iterator<Location> i = cfg.locationIterator(); i.hasNext(); ) {
        Location location = i.next();
        Instruction inst = location.getHandle().getInstruction();
        if (inst instanceof InvokeInstruction) {
            InvokeInstruction invoke = (InvokeInstruction) inst;
            String methodName = invoke.getMethodName(cpg);
            if ("enableDefaultTyping".equals(methodName)) {
                JavaClass clz = classContext.getJavaClass();
                bugReporter.reportBug(new BugInstance(this, DESERIALIZATION_TYPE, HIGH_PRIORITY)
                        .addClass(clz)
                        .addMethod(clz, m)
                        .addCalledMethod(cpg, invoke)
                        .addSourceLine(classContext, m, location)
                );
            }
        }
    }
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
private void analyzeMethod(Method m, ClassContext classContext) throws CFGBuilderException, DataflowAnalysisException {

        ConstantPoolGen cpg = classContext.getConstantPoolGen();
        CFG cfg = classContext.getCFG(m);
        
        for (Iterator<Location> i = cfg.locationIterator(); i.hasNext(); ) {
            Location location = i.next();

            Instruction inst = location.getHandle().getInstruction();
            
            if (inst instanceof LDC) {
                LDC ldc = (LDC) inst;
                if (ldc != null) {
                    if("java.naming.security.authentication".equals(ldc.getValue(cpg)) &&
                       "none".equals(ByteCode.getConstantLDC(location.getHandle().getNext(), cpg, String.class))){
                        JavaClass clz = classContext.getJavaClass();
                        bugReporter.reportBug(new BugInstance(this, LDAP_ANONYMOUS, Priorities.LOW_PRIORITY) //
                        .addClass(clz)
                        .addMethod(clz, m)
                        .addSourceLine(classContext, m, location));
                        break;
                    }
                }
            }            
        }
    }
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
protected ReferenceType mergeReferenceTypes(ReferenceType aRef, ReferenceType bRef) throws DataflowAnalysisException {
    byte aType = aRef.getType();
    byte bType = bRef.getType();

    if (isExtendedStringType(aType) || isExtendedStringType(bType)) {
        // If both types are the same extended String type,
        // then the same type is returned. Otherwise, extended
        // types are downgraded to plain java.lang.String,
        // and a standard merge is applied.
        if (aType == bType) {
            return aRef;
        }

        if (isExtendedStringType(aType)) {
            aRef = Type.STRING;
        }
        if (isExtendedStringType(bType)) {
            bRef = Type.STRING;
        }
    }

    return super.mergeReferenceTypes(aRef, bRef);
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
/**
 * Hook indicating that a new (possibly-null) value is on the top of the
 * stack.
 */
private void newValueOnTOS() {
    IsNullValueFrame frame = getFrame();
    if (frame.getStackDepth() < 1) {
        return;
    }
    int tosSlot = frame.getNumSlots() - 1;
    IsNullValue tos = frame.getValue(tosSlot);
    if (tos.isDefinitelyNull()) {
        slotContainingNewNullValue = tosSlot;
    }
    if (trackValueNumbers) {
        try {
            ValueNumberFrame vnaFrameAfter = vnaDataflow.getFactAfterLocation(getLocation());
            if (vnaFrameAfter.isValid()) {
                ValueNumber tosVN = vnaFrameAfter.getTopValue();
                getFrame().setKnownValue(tosVN, tos);
            }
        } catch (DataflowAnalysisException e) {
            AnalysisContext.logError("error", e);
        }
    }
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
public void refresh(ValueNumberFrame vnaFrame, DefinitelyNullSet definitelyNullSet) throws DataflowAnalysisException {
    valueNumber = vnaFrame.getTopValue();

    NullnessValue nullnessValue = definitelyNullSet.getNulllessValue(valueNumber);
    short opcode = getLocation().getHandle().getInstruction().getOpcode();

    if (nullnessValue.isDefinitelyNull() || nullnessValue.isDefinitelyNotNull()) {
        // Comparison is redundant.

        boolean ifcmpFeasible = nullnessValue.isDefinitelyNull() == (opcode == Constants.IFNULL);
        ifcmpDecision = new Decision(ifcmpFeasible, ifcmpFeasible ? nullnessValue.toCheckedValue() : null);

        boolean fallThroughFeasible = nullnessValue.isDefinitelyNull() != (opcode == Constants.IFNONNULL);
        fallThroughDecision = new Decision(fallThroughFeasible, fallThroughFeasible ? nullnessValue.toCheckedValue() : null);

        return;
    }

    NullnessValue definitelyNull = NullnessValue.definitelyNullValue().toCheckedValue();
    NullnessValue definitelyNotNull = NullnessValue.definitelyNotNullValue().toCheckedValue();

    // Nullness is unknown, assume both branches are feasible.
    ifcmpDecision = new Decision(true, (opcode == Constants.IFNULL) ? definitelyNull : definitelyNotNull);
    fallThroughDecision = new Decision(true, (opcode == Constants.IFNULL) ? definitelyNotNull : definitelyNull);
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
public void visitDUP(DUP obj) {
    try {
        TypeFrame frame = getFrame();
        boolean isExact = isTopOfStackExact();
        Type value = frame.popValue();
        frame.pushValue(value);
        if (isExact)
            setTopOfStackIsExact();
        frame.pushValue(value);
        if (isExact)
            setTopOfStackIsExact();
    } catch (DataflowAnalysisException e) {
        throw new InvalidBytecodeException(e.toString());
    }
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
/**
 * Get the ConditionDecision providing information about the branch at the
 * end of the given basic block.
 * 
 * @param basicBlock
 * @return the ConditionDecision, or null if the basic block does not end in
 *         a reference comparison
 */
private Condition getCondition(BasicBlock basicBlock) throws DataflowAnalysisException {
    Condition condition = conditionMap.get(basicBlock);
    if (condition == null) {
        Location location = new Location(basicBlock.getLastInstruction(), basicBlock);
        short opcode = basicBlock.getLastInstruction().getInstruction().getOpcode();
        if (IFNULL_OPCODE_SET.get(opcode)) {
            condition = new IfNullCondition(location);
        } else if (IFACMP_OPCODE_SET.get(opcode)) {
            // condition = new AcmpCondition(location);
            return null;
        } else {
            return null;
        }
        conditionMap.put(basicBlock, condition);
    }
    return condition;
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
private void killLoadsOfObjectsPassed(InvokeInstruction ins) {
    try {

        XMethod called = Hierarchy2.findExactMethod(ins, methodGen.getConstantPool(), Hierarchy.ANY_METHOD);
        FieldSummary fieldSummary = AnalysisContext.currentAnalysisContext().getFieldSummary();
        Set<XField> touched = fieldSummary.getFieldsWritten(called);
        if (!touched.isEmpty()) {
            getFrame().killLoadsOf(touched);
        }


        int passed = getNumWordsConsumed(ins);
        ValueNumber[] arguments = allocateValueNumberArray(passed);
        getFrame().killLoadsWithSimilarName(ins.getClassName(cpg), ins.getMethodName(cpg));
        getFrame().getTopStackWords(arguments);
        for (ValueNumber v : arguments)
            getFrame().killAllLoadsOf(v);

    } catch (DataflowAnalysisException e) {
        AnalysisContext.logError("Error in killLoadsOfObjectsPassed", e);
    }
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
@Override
public void visitAALOAD(AALOAD obj) {
    // To determine the type pushed on the stack,
    // we look at the type of the array reference which was
    // popped off of the stack.
    TypeFrame frame = getFrame();
    try {
        frame.popValue(); // index
        Type arrayType = frame.popValue(); // arrayref
        if (arrayType instanceof ArrayType) {
            ArrayType arr = (ArrayType) arrayType;
            pushValue(arr.getElementType());
        } else {
            pushValue(TypeFrame.getBottomType());
        }
    } catch (DataflowAnalysisException e) {
        throw new InvalidBytecodeException("Stack underflow: " + e.getMessage());
    }
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
private Type nullCheck(short opcode, Edge edge, InstructionHandle last, BasicBlock sourceBlock)
        throws DataflowAnalysisException {
    if (DEBUG_NULL_CHECK) {
        System.out.println("checking for nullcheck on edge " + edge);
    }
    Type type = null;
    if ((opcode == Constants.IFNULL && edge.getType() == EdgeTypes.IFCMP_EDGE)
            || (opcode == Constants.IFNONNULL && edge.getType() == EdgeTypes.FALL_THROUGH_EDGE)) {
        Location location = new Location(last, sourceBlock);
        TypeFrame typeFrame = typeDataflow.getFactAtLocation(location);
        if (typeFrame.isValid()) {
            type = typeFrame.getTopValue();
            if (DEBUG_NULL_CHECK) {
                System.out.println("ifnull comparison of " + type + " to null at " + last);
            }
        }
    }
    return type;
}
 

import edu.umd.cs.findbugs.ba.DataflowAnalysisException; //导入依赖的package包/类
/**
 * Constructor.
 * 
 * @param pattern
 *            the ByteCodePattern to look for examples of
 * @param classContext
 *            ClassContext for the class to analyze
 * @param method
 *            the Method to analyze
 */
public PatternMatcher(ByteCodePattern pattern, ClassContext classContext, Method method) throws CFGBuilderException,
        DataflowAnalysisException {
    this.pattern = pattern;
    this.cfg = classContext.getCFG(method);
    this.cpg = classContext.getConstantPoolGen();
    this.dfs = classContext.getDepthFirstSearch(method);
    this.vnaDataflow = classContext.getValueNumberDataflow(method);
    this.domAnalysis = classContext.getNonExceptionDominatorsAnalysis(method);
    this.workList = new LinkedList<BasicBlock>();
    this.visitedBlockMap = new IdentityHashMap<BasicBlock, BasicBlock>();
    this.resultList = new LinkedList<ByteCodePatternMatch>();
}