jacodb开发版本中关于,classpath加载UnknownClasses和UnknownClassMethodsAndFields特性后报“Expected static field” 错误问题

分析对象jar包的所依赖的第三发jar包都为导入到jacodb中,所以设置了UnknownClasses和UnknownClassMethodsAndFields特性。

class path特性设置

database.asyncClasspath(classpath,
                    List.of(UnknownClasses.INSTANCE,
                            UnknownClassMethodsAndFields.INSTANCE)).get();

执行jacodb自带的npe和unused分析:

NpeManager npeManager = new NpeManager(applicationGraph, unitResolver);
                         List<TaintVulnerability> npeVulnerabilities =
                         npeManager.analyze(entryMethodList,
                         toDuration(ifdsAnalysisParameter.getTimeout(),
                         DurationUnit.SECONDS));
UnusedVariableManager unusedVariableManager = 
    new UnusedVariableManager(applicationGraph, unitResolver);
List<UnusedVariableVulnerability> vulnerabilities =
unusedVariableManager.analyze(entryMethodList, 
toDuration(ifdsAnalysisParameter.getTimeout(), DurationUnit.SECONDS));

错误日志

Expected static field
java.lang.IllegalArgumentException: Expected static field
	at org.jacodb.analysis.ifds.AccessPath$Companion.from(AccessPath.kt:85)
	at org.jacodb.analysis.ifds.AccessPathKt.toPathOrNull(AccessPath.kt:109)
	at org.jacodb.analysis.ifds.AccessPathKt.toPathOrNull(AccessPath.kt:92)
	at org.jacodb.analysis.unused.UnusedVariableFlowFunctions$obtainSequentFlowFunction$1.compute(UnusedVariableFlowFunctions.kt:65)
	at org.jacodb.analysis.unused.UnusedVariableFlowFunctions$obtainSequentFlowFunction$1.compute(UnusedVariableFlowFunctions.kt:48)
	at org.jacodb.analysis.ifds.UniRunner.tabulationAlgorithmStep(Runner.kt:216)
	at org.jacodb.analysis.ifds.UniRunner.access$tabulationAlgorithmStep(Runner.kt:42)
	at org.jacodb.analysis.ifds.UniRunner$tabulationAlgorithm$2.invokeSuspend(Runner.kt:128)
	at org.jacodb.analysis.ifds.UniRunner$tabulationAlgorithm$2.invoke(Runner.kt)
	at org.jacodb.analysis.ifds.UniRunner$tabulationAlgorithm$2.invoke(Runner.kt)
	at kotlinx.coroutines.intrinsics.UndispatchedKt.startUndispatchedOrReturn(Undispatched.kt:89)
	at kotlinx.coroutines.CoroutineScopeKt.coroutineScope(CoroutineScope.kt:264)
	at org.jacodb.analysis.ifds.UniRunner.tabulationAlgorithm(Runner.kt:120)
	at org.jacodb.analysis.ifds.UniRunner.run(Runner.kt:67)
	at org.jacodb.analysis.unused.UnusedVariableManager$analyze$1$allJobs$1$1.invokeSuspend(UnusedVariableManager.kt:139)
	(Coroutine boundary)
	at org.jacodb.analysis.unused.UnusedVariableManager$analyze$1$allJobs$1$1.invokeSuspend(UnusedVariableManager.kt:139)
	(Coroutine creation stacktrace)
	at kotlin.coroutines.intrinsics.IntrinsicsKt__IntrinsicsJvmKt.createCoroutineUnintercepted(IntrinsicsJvm.kt:122)
	at kotlinx.coroutines.LazyStandaloneCoroutine.<init>(Builders.common.kt:205)
	at kotlinx.coroutines.BuildersKt__Builders_commonKt.launch$default(Builders.common.kt:47)
	at kotlinx.coroutines.BuildersKt.launch$default(Unknown Source)
	at org.jacodb.analysis.unused.UnusedVariableManager$analyze$1.invokeSuspend(UnusedVariableManager.kt:137)
	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
	at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:106)
	at kotlinx.coroutines.BuildersKt__BuildersKt.runBlocking$default(Builders.kt:38)
	at kotlinx.coroutines.BuildersKt.runBlocking$default(Unknown Source)
	at org.jacodb.analysis.unused.UnusedVariableManager.analyze(UnusedVariableManager.kt:115)

解决方方案1:

报错代码在analysis模块的org.jacodb.analysis.ifds.AccessPath
    companion object {
        fun from(value: JcSimpleValue): AccessPath = AccessPath(value, emptyList())

        fun from(field: JcField): AccessPath {
            require(field.isStatic) { "Expected static field" }
            return AccessPath(null, listOf(FieldAccessor(field)))
        }
    }

在调用该方法前判断field是否为static字段。

analysis模块的org.jacodb.analysis.ifds.AccessPath.kt
    is JcFieldRef -> {
        val instance = instance
        if (instance == null) {
            if (field.field is JcUnknownField) { // 增加判断
                null
            } else {
                AccessPath.from(field.field)
            }
        } else {
            instance.toPathOrNull()?.let {
                it / FieldAccessor(field.field)
            }
        }
    }

修改之后不再报错,但是结果中会出现大量误报。

解决方方案2: 

        在构建graph时,将未加载到jacodb中的依赖类的包名设置到bannedPackagePrefixes中,这样即可解决报错问题,也不会影响到分析结果。这里比较麻烦的是找出在分析目标中使用了的,但是未加载到jacodb中的类的包名。如果需要准确找出,需要遍历jar包中的所有class文件,找出jar包中不存在的依赖类。

bannedPackagePrefixes的设置函数
ApplicationGraphFactory.newApplicationGraphForAnalysisAsync(
classpath, bannedPackagePrefixes).get()

  • 2
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值