backtrace

Documentation

Overview

Package backtrace defines a dataflow analysis that finds all the backwards dataflow paths from an entrypoint. This analysis finds data flows which means that a backtrace consists of the data flowing backwards from an argument to the "backtracepoint" (entrypoint) call.

Index

• func IsInterProceduralEntryPoint(state *df.AnalyzerState, ss *config.SlicingSpec, n ssa.Node) bool
• func IsStatic(node df.GraphNode) bool
• type AnalysisResult
  • func Analyze(logger *config.LogGroup, cfg *config.Config, prog *ssa.Program) (AnalysisResult, error)
• type Trace
  • func Traces(s *df.AnalyzerState, traces [][]df.GraphNode) []Trace
  • func (t Trace) String() string
• type TraceNode
  • func (n TraceNode) String() string
• type Visitor
  • func (v *Visitor) Visit(s *df.AnalyzerState, entrypoint df.NodeWithTrace)

Functions

func IsInterProceduralEntryPoint

func IsInterProceduralEntryPoint(state *df.AnalyzerState, ss *config.SlicingSpec, n ssa.Node) bool

IsInterProceduralEntryPoint returns true if cfg identifies n as a backtrace entrypoint.

func IsStatic

func IsStatic(node df.GraphNode) bool

IsStatic returns true if node is a constant value. TODO make this better

Types

type AnalysisResult

type AnalysisResult struct {
	// Graph is the cross function dataflow graph built by the dataflow analysis. It contains the linked summaries of
	// each function appearing in the program and analyzed.
	Graph df.InterProceduralFlowGraph

	// Traces represents all the paths where data flows out from the analysis entry points.
	Traces []Trace
}

An AnalysisResult from the backtrace analysis contains a constructed a Graph representing the inter-procedural graph along with the traces found by the backtrace analysis in Traces

func Analyze

func Analyze(logger *config.LogGroup, cfg *config.Config, prog *ssa.Program) (AnalysisResult, error)

Analyze runs the analysis on the program prog with the user-provided configuration config. If the analysis run successfully, an AnalysisResult is returned, containing all the information collected.

- cfg is the configuration that determines which functions are sources, sinks and sanitizers.

- prog is the built ssa representation of the program. The program must contain a main package and include all its dependencies, otherwise the pointer analysis will fail.

type Trace

type Trace []TraceNode

Trace represents a dataflow path (sequence of nodes) out of an analysis entrypoint.

The first node in the trace is the origin of the data flow.

The last node in the trace is an argument to the backtrace entrypoint function defined in the config.

func Traces

func Traces(s *df.AnalyzerState, traces [][]df.GraphNode) []Trace

Traces extracts a slice of Trace from the slice of slices of GraphNodes, in the context of an AnalyzerState

func (Trace) String

func (t Trace) String() string

type TraceNode

type TraceNode struct {
	df.GraphNode
	Pos    token.Position
	Values []string // TODO maybe
}

TraceNode represents a node in the trace.

func (TraceNode) String

func (n TraceNode) String() string

type Visitor

type Visitor struct {
	SlicingSpec *config.SlicingSpec
	Traces      [][]df.GraphNode
}

Visitor implements the dataflow.Visitor interface and holds the specification of the problem to solve in the SlicingSpec as well as the set of traces.

func (*Visitor) Visit

func (v *Visitor) Visit(s *df.AnalyzerState, entrypoint df.NodeWithTrace)

Visit runs an inter-procedural backwards analysis to add any detected backtraces to v.Traces.