allows multiple debugRule

bytedance · Nov 7, 2023 · fe2626d · fe2626d
1 parent 22dffd8
commit fe2626d
Show file tree

Hide file tree

Showing 5 changed files with 41 additions and 30 deletions.
diff --git a/config/config.json5 b/config/config.json5
@@ -11,8 +11,8 @@
   //specifies the rule's parent directory, default is ./config/rules
   //  "rulePath": "config/rules",
 
-  //print more info about this rule
-  //  "debugRule": "unZipSlip",
+  //print more info about rules, specify "all" for all rules
+  //  "debugRule": "unZipSlip.json",
 
   //output log level
   //  "logLevel": 0,

diff --git a/src/main/kotlin/net/bytedance/security/app/AnalyzeStepByStep.kt b/src/main/kotlin/net/bytedance/security/app/AnalyzeStepByStep.kt
@@ -36,14 +36,17 @@ import kotlin.io.path.pathString
 import kotlin.streams.toList
 
 class AnalyzeStepByStep {
-    suspend fun loadRules(ruleList: String, targetSdk: Int): Rules {
-        val rulePathList = if (ruleList.isNotEmpty())
-            ruleList.split(",").map { "${getConfig().rulePath}/${it.trim()}" }.toList()
-        else
-            withContext(Dispatchers.IO) {
-                Files.walk(Paths.get(getConfig().rulePath), 1)
-            }.filter { it.pathString.endsWith(".json") }.map { it.pathString }
-                .toList()
+    suspend fun loadRules(targetSdk: Int): Rules {
+        val config = getConfig()
+        if (config.rules.isEmpty()) {
+            config.rules = withContext(Dispatchers.IO) {
+                Files.walk(Paths.get(config.rulePath), 1) }
+                .filter { it.pathString.endsWith(".json")}
+                .map { it.fileName }.toList().joinToString(separator = ",")
+        }
+        val rulePathList = config.rules.split(",")
+            .map { "${config.rulePath}/${it.trim()}" }.toList()
+
         val rules = Rules(rulePathList, RuleFactory())
         rules.loadRules(targetSdk)
         return rules

diff --git a/src/main/kotlin/net/bytedance/security/app/StaticAnalyzeMain.kt b/src/main/kotlin/net/bytedance/security/app/StaticAnalyzeMain.kt
@@ -54,7 +54,7 @@ object StaticAnalyzeMain {
         profiler.parseApk.end()
 
         profiler.preProcessor.start()
-        val rules = v3.loadRules(argumentConfig.rules, AndroidUtils.TargetSdk)
+        val rules = v3.loadRules(AndroidUtils.TargetSdk)
         logInfo("rules loaded")
         val ctx = v3.createContext(rules)
         profiler.preProcessor.end()

diff --git a/src/main/kotlin/net/bytedance/security/app/pathfinder/TaintPathFinder.kt b/src/main/kotlin/net/bytedance/security/app/pathfinder/TaintPathFinder.kt
@@ -41,6 +41,8 @@ import soot.jimple.IntConstant
 import soot.jimple.LongConstant
 import soot.jimple.NumericConstant
 import soot.jimple.StringConstant
+import java.nio.file.Files
+import java.nio.file.Paths
 import java.util.*
 
 /**
@@ -149,10 +151,7 @@ class TaintPathFinder(
         if (constNumberModeRule.targetNumberArr == null) {
             return true
         }
-        if (constNumberModeRule.targetNumberArr.contains(constNumber.toInt())) {
-            return true
-        }
-        return false
+        return constNumberModeRule.targetNumberArr.contains(constNumber.toInt())
     }
 
     /**
@@ -264,32 +263,35 @@ class TaintPathFinder(
     ) {
         if (isThisSolverNeedLog()) {
             val sb = StringBuilder()
+            val outPath = "${getConfig().outPath}/log/${this.rule.name}"
+            Files.createDirectories(Paths.get(outPath))
+
             val sinkTaintedSet = HashSet<PLPointer>()
             for (sink in sinkPtrSet) {
                 sinkTaintedSet.addAll(analyzeContext.collectReversePropagation(sink, rule.primTypeAsTaint))
             }
             sb.append("sinkPtrSet=${sinkPtrSet.toSortedSet()}, taint sinkNodeSet: ${sinkTaintedSet.toSortedSet()}\n")
-            PLUtils.writeFile(getConfig().outPath + "/sink.log", sb.toString())
+            PLUtils.writeFile("$outPath/sink.log", sb.toString())
             sb.clear()
-            sb.append("\n\n\n\n\n\nsrcPtr=${srcPtr}, taint sourceNodeSet:\n")
+
+            sb.append("srcPtr=${srcPtr}, taint sourceNodeSet:\n")
             val srcTaintedSet = analyzeContext.collectPropagation(srcPtr, rule.primTypeAsTaint)
             sb.append("\n\nsrcTaintedSet=${srcTaintedSet.toSortedSet()}")
-            PLUtils.writeFile(getConfig().outPath + "/source.log", sb.toString())
+            PLUtils.writeFile("$outPath/source.log", sb.toString())
             sb.clear()
+
+            PLUtils.writeFile(
+                "$outPath/ptrToSet.log",
+                analyzeContext.pointerToObjectSet.toSortedMap().toFormatedString())
             PLUtils.writeFile(
-                getConfig().outPath + "/ptrToSet.log",
-                analyzeContext.pointerToObjectSet.toSortedMap().toFormatedString()
-            )
+                "$outPath/taintPtrFlowGraph.log",
+                analyzeContext.variableFlowGraph.toSortedMap().toFormatedString())
             PLUtils.writeFile(
-                getConfig().outPath + "/taintPtrFlowGraph.log",
-                analyzeContext.variableFlowGraph.toSortedMap().toFormatedString()
-            )
+                "$outPath/ptrFlowGraph.log",
+                analyzeContext.pointerFlowGraph.toSortedMap().toFormatedString())
             PLUtils.writeFile(
-                getConfig().outPath + "/ptrFlowGraph.log",
-                analyzeContext.pointerFlowGraph.toSortedMap().toFormatedString()
-            )
-            PLUtils.writeFile(getConfig().outPath + "rm.log", analyzeContext.rm.toSortedSet().toFormatedString())
-//            exitProcess(3)
+                "$outPath/rm.log",
+                analyzeContext.rm.toSortedSet().toFormatedString())
         }
         val g = analyzeContext.variableFlowGraph
         val path = bfsSearch(srcPtr, sinkPtrSet, g, getConfig().maxPathLength, rule.name) ?: return

diff --git a/src/main/kotlin/net/bytedance/security/app/rules/TaintFlowRule.kt b/src/main/kotlin/net/bytedance/security/app/rules/TaintFlowRule.kt
@@ -45,7 +45,13 @@ abstract class TaintFlowRule(name: String, ruleData: RuleData) : AbstractRule(na
     }
 
     fun isThisRuleNeedLog(): Boolean {
-        return getConfig().debugRule == this.name
+        val config = getConfig()
+        val ruleNameList = when (config.debugRule) {
+            "" -> emptyList()
+            "all" -> config.rules.split(",").map { it.trim() }
+            else -> config.debugRule.split(",").map { it.trim() }
+        }
+        return ruleNameList.contains("${this.name}.json")
     }
 
     fun isThroughEnable(): Boolean {