Problems detecting taint propogation about mariana-trench

[arthaud]

Hi @chuayupeng, thanks for reaching out.
This is because your model defines a source with port Argument(0).
This is something that we did not document well, but:

• A source with a Return port means the source is produced at the call site, i.e:
  x = source(); // x is tainted
• A source with an Argument port means the source is tainted in the body of the function, i.e:
  public void source(String x) { // x is tainted here }

Internally, we do differentiate between sources produced at call sites (called generations) and sources produces in the body (called parameter sources). You can also specify them in JSON.

TL, DR: Using "generations": {"kind": "IntentAsSource", "port": "Argument(0)"} instead of "sources": ... should fix the issue.

[chuayupeng]

Hi @arthaud, thanks for the easy to understand explanation! I changed the definition with the source and it worked like a charm!

[chuayupeng]

Source Definition (same as the implicitintentsourcegenerator):

{
    "model_generators": [
      {
        "find": "methods",
        "where": [
          {
            "constraint": "parent",
            "inner": {
              "constraint": "name",
              "pattern": "Landroid/content/Intent;"
            }
          },
          {
            "constraint": "name",
            "pattern": "\\<init\\>"
          },
          {
            "constraint": "not",
            "inner": {
              "constraint": "signature",
              "pattern": ".*Ljava/lang/Class;.*"
            }
          }
        ],
        "model": {
          "sources": [
            {
              "kind": "IntentAsSource",
              "port": "Argument(0)"
            }
            ]
        },
      "verbosity" : 1
      }
    ]
  }

Sink Definition:

{
  "model_generators": [
    {
      "find": "methods",
      "where": [
        {
          "constraint": "name",
          "pattern": "startActivityForResult"
        }
      ],
      "model": {
          "sinks": [
            {
                "kind": "IntentAsSink",
                "port": "Argument(1)"
            }
          ]
        },
        "verbosity" : 1
      }
    ]
}
  

rules.json:
{ "name": "IntentImplicitTest", "code":99, "description": "Test", "sources": ["IntentAsSource"], "sinks":["IntentAsSink"] }