Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

About interpreting tainting related reports #12

Open
kanaksad opened this issue Jul 26, 2024 · 1 comment
Open

About interpreting tainting related reports #12

kanaksad opened this issue Jul 26, 2024 · 1 comment

Comments

@kanaksad
Copy link

I was trying to use PTaint on esapi-java-legacy following the steps here with this command,
./doop -i toScan.jar -a 2-object-sensitive+heap --information-flow webapps.

In the output directory, I see two tainting related .csv files; adding the outputs for your reference
LeakingTaintedInformation.csv
LeakingTaintedInformationVars.csv

According to the rules here, in LeakingTaintedInformation.csv output, the last column is the tainted source, and the next to last column is the sink. But this does not give the trace from the source to sink. After some manual inspection, for almost all the reports here, the flow seems to be infeasible from the mentioned source to the mentioned sink. Is it the correct way to look at the reports? Or is there a way to automatically build a source-sink information flow path?

I was wondering if LeakingTaintedInformationVars.csv is useful to build any information flow path from the reports using this script? But after running the script, the commands from it don't seem to be doing that either.

Am I missing something here?

@yanniss
Copy link
Contributor

yanniss commented Jul 29, 2024

I'm afraid you are not missing anything, in principle. Even if there may be a bug in current PTaint (preventing it from working optimally), what you are observing may be perfectly normal. There is no out-of-the-box support for establishing a source-sink information flow path. (You would need to create intermediate "breadcrumb" objects to do something like that yourself.) And PTaint has no more precision than what the underlying analysis gives it, so if you use 2objH, you have probably maxed out on that. (Again, modulo bugs, since this is functionality we haven't touched in years.)

I've pinged others @nevillegrech @anantoni who may have more to add.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants