Java: model taint for java.util.Arrays

[aibaars]

This pull request model taint propagation for the methods of the java.util.Arrays class.

[Marcono1234]

What is the general convention regarding Object.toString() of this project? It could be a taint step if it is overridden and includes the values of the fields of the object, but if it is not overridden or does not ouput the value of all fields or their values do not override toString() this would cause false positives.

So if this considers deepToString and toString as taint steps, Object.toString() should probably be considered as well.

[aschackmull]

Let's exclude "deepToString" and "toString" for now.

[aibaars]

OK

[aschackmull]

"parallelPrefix", "parallelSetAll", and "setAll" won't work like this. We have yet to set up a framework for data and taint flow in library methods designed to accept lambdas.

[aibaars]

I'll remove them for now.

[lcartey]

@aibaars I think we're missing Arrays.toString from this list.

[aschackmull]

@aibaars I think we're missing Arrays.toString from this list.

Has this sort of step come up? Including this suggests that we also include Object.toString() for all types, and I wasn't certain that was desirable? We currently only include this step for certain types, e.g. StringBuilder.toString().

[aibaars]

@lcartey I got a little push back on toString in other places. Perhaps we should make an issue to track how/if we'd like to support toString without introducing too many false positives. Apart from Arrays.toString and deepToString there is also Object.toString, any map or collection toString, String.valueOf and probably many more.

[lcartey]

@aschackmull I've seen this only in synthetic benchmarks so far. I do actually think Object.toString() is desirable, with certain caveats, but here we're talking about Arrays.toString(Object[] arg), which I think is a completely different API (these are static methods). We should be able to add this one without really introducing false positives.

[lcartey]

Actually, on reflection, you're right - the cases are inextricably linked for arrays of Objects other than String, because it will call Object.toString. @aibaars suggested special casing String arrays, which I think would work.