F4FActions

Constructor Detail

F4FActions

public F4FActions()

Create an empty F4FActions object. Should not be needed for implementing a new framework handler, as the relevant F4FActions object will be passed to F4FHandler.handleApp(F4FApp, F4FActions).

addTaintedCallback

public void addTaintedCallback(IMethod method,
                               int numParams)

Same as addTaintedCallback (String, int), but takes an IMethod directly rather than a VDB signature

addTaintedCallback

public void addTaintedCallback(java.lang.String vdbMethodSig,
                               int numParams)

Make a method a tainted callback, with all parameters tainted.

Note: For .NET apps, we need fully-qualified VDB signatures. So, instead of int as a parameter type, we need System.Int32, etc. To see the full mapping from fully-qualified names to the names usually used in VDB, see DotNetVDBUtil.systemName2VDBShortName.

Parameters:

vdbMethodSig - the signature of the callback method
numParams - the number of parameters for the callback method, including the this parameter

replaceCalls

public void replaceCalls(java.lang.String oldVDBSig,
                         java.lang.String newVDBSig)

Replace all calls to one method with calls to another method. We require that the descriptors for the old and new method (i.e., the number of arguments, argument type, and return type) are identical.

Note: replacement will only occur when oldVDBSig is the _declared_ target at a call site. So, if oldVDBSig is Integer.toString(), and we see a call to Object.toString(), we will _not_ perform a replacement at that call site, even though it might invoke Integer.toString().

Note: for .NET apps, we need fully-qualified VDB signatures. So, instead of int as a parameter type, we need System.Int32, etc. To see the full mapping from fully-qualified names to the names usually used in VDB, see DotNetVDBUtil.systemName2VDBShortName

Parameters:

oldVDBSig - signature of method whose calls should be replaced
newVDBSig - signature of method to replace calls with

replaceCallsWithSyntheticExpr

public void replaceCallsWithSyntheticExpr(java.lang.String vdbSig,
    com.ibm.appscan.frameworks.specinfo.SyntheticExpr expr)

Replace all calls to a method with an arbitrary WAFL SyntheticExpr. For example, one could replace calls with an assignment via an AssignmentExpr.

Note: replacement will only occur when oldVDBSig is the _declared_ target at a call site. So, if oldVDBSig is Integer.toString(), and we see a call to Object.toString(), we will _not_ perform a replacement at that call site, even though it might invoke Integer.toString().

Note: for .NET apps, we need fully-qualified VDB signatures. So, instead of int as a parameter type, we need System.Int32, etc. To see the full mapping from fully-qualified names to the names usually used in VDB, see DotNetVDBUtil.systemName2VDBShortName

Parameters:

vdbSig - signature of method whose calls should be replaced
expr - synthetic expression to replace calls with

replaceCallsWithParamPattern

public void replaceCallsWithParamPattern(java.lang.String oldVDBSig,
                                         java.util.Map<java.lang.String,
                                         java.util.Map<java.lang.Integer,
                                         java.util.regex.Pattern>> 
                                         newSig2Pattern)

Replace calls to one method with calls to another method only if the parameters of String type are constants meeting specified patterns. We require that the descriptors for the old and new method (i.e., the number of arguments, argument type, and return type) are identical.

Note: replacement will only occur when oldVDBSig is the _declared_ target at a call site. So, if oldVDBSig is Integer.toString(), and we see a call to Object.toString(), we will _not_ perform a replacement at that call site, even though it might invoke Integer.toString().

Note: for .NET apps, we need fully-qualified VDB signatures. So, instead of int as a parameter type, we need System.Int32, etc. To see the full mapping from fully-qualified names to the names usually used in VDB, see DotNetVDBUtil.systemName2VDBShortName

Parameters:

oldVDBSig - signature of method whose calls should be replaced
newSig2Pattern - maps VDB signature of each possible replacement method m to a map M from integer parameter positions to Patterns. If the string constant parameters in the appropriate positions match the patterns in M at some call site, a replacement to m will be performed.

addFrameworkInfo

public void addFrameworkInfo
(com.ibm.appscan.frameworks.specinfo.IFrameworkInfo info)

Add arbitrary additional framework info. This method should only be needed for rare cases where the other APIs provided are insufficient.

addTaintedCallback

public void addTaintedCallback(java.lang.String vdbMethodSig,
                               java.util.Collection<TaintedParam> 
                               taintedParams)

Make some method a tainted callback, with only certain parameter access paths being treated as tainted.

Note: for .NET apps, we need fully-qualified VDB signatures. So, instead of int as a parameter type, we need System.Int32, etc. To see the full mapping from fully-qualified names to the names usually used in VDB, see DotNetVDBUtil.systemName2VDBShortName

Parameters:

vdbMethodSig - the signature of the callback method, in VDB format
taintedParams - information on which parameter access paths should be tainted

addHighLevelSyntheticMethod

public void addHighLevelSyntheticMethod(HighLevelSyntheticMethod m)

equivalent to addHighLevelSyntheticMethod(m, true)

addHighLevelSyntheticMethod

public void addHighLevelSyntheticMethod(HighLevelSyntheticMethod m,
                                        boolean isEntrypoint)

Add a high-level synthetic method. A corresponding WAFL synthetic method (possibly an entrypoint) will be generated.

Parameters:

m - the method
isEntrypoint - should the method be marked as an entrypoint in WAFL?

createGlobal

public Global createGlobal(java.lang.String name,
                           java.lang.String declaredVDBType,
                           boolean isEntrypointScoped)

Create a new global that can be accessed from HighLevelSyntheticMethods.

Parameters:

name - name for the global
declaredVDBType - the declared type of the global (e.g., java.lang.String).
Note: for .NET apps, we need a fully-qualified VDB type. So, instead of int as a parameter type, we need System.Int32, etc. To see the full mapping from fully-qualified names to the names usually used in VDB, see DotNetVDBUtil.systemName2VDBShortName
isEntrypointScoped - if true, the global is scoped to a single entrypoint (i.e., it is request-scoped). Otherwise, the global is scoped across entrypoints (i.e., it is "session" or "application" scoped)

Returns:

a Global object, which can be read/written inside a HighLevelSyntheticMethod

createGlobal

public Global createGlobal(java.lang.String name,
                           IClass declaredClass,
                           boolean isEntrypointScoped)

Just like createGlobal(String, String, boolean), but takes an IClass for the declared type instead of a type name

getGlobals

public java.util.Collection<Global> getGlobals()

For internal usage.

getAdditionalFrameworkInfo

public java.util.Collection
<com.ibm.appscan.frameworks.specinfo.IFrameworkInfo> 
getAdditionalFrameworkInfo()

For internal usage.

getCallReplacement2SigsInfo

public java.util.Map
<java.lang.String,java.util.Map
<java.lang.String,java.util.Map
<java.lang.Integer,java.util.regex.Pattern>>>
getCallReplacement2SigsInfo()

For internal usage.

getCallReplacement2ExprInfo

public java.util.Map
<java.lang.String,com.ibm.appscan.frameworks.specinfo.SyntheticExpr>
getCallReplacement2ExprInfo()

For internal usage.

getCallback2TaintedParams

public java.util.Map
<java.lang.String,java.util.Collection<TaintedParam>> 
getCallback2TaintedParams()

For internal usage.

getHighLevelSyntheticMethods

public java.util.List
<com.ibm.wala.util.collections.Pair
<HighLevelSyntheticMethod,java.lang.Boolean>> 
getHighLevelSyntheticMethods()

For internal usage.

toString

public java.lang.String toString()

Overrides:

toString in class java.lang.Object