Add Spring DI and WEC analysis plugin

Co-authored-by: Yufei Liang <1078652310@qq.com>

Author: zhangt2333

CHANGELOG.md

@@ -7,6 +7,7 @@
   - Add a new Java frontend, which is faster and more reliable than the Soot frontend.
 - Add option `--ssa` to make the Java frontend generate IR in SSA form.
 - Add option `--jre-dir` to specify the JRE directory for the Java library selected by `-java`.
+- Add Spring DI and WEC analysis plugin.
 
 ### Breaking Changes
 - Change the default value of option `--world-builder` to

docs/en/pointer-analysis-framework.adoc

@@ -71,6 +71,13 @@ For the reflective calls specified in the log file, pointer analysis will resolv
 Taint analysis will be enabled when this file is given.
 See <<taint-analysis#taint-analysis,Taint Analysis>> for more details.
 
+* Spring analysis: `spring:[true|false]`
+** Default value: `false`
+** Enable the built-in Spring Framework analysis plugin.
+When enabled, pointer analysis models Spring dependency injection (DI) and web endpoint configuration (WEC):
+it collects bean definitions from configured annotations, `@Bean` methods, and XML bean configurations; models constructor, field, and method injection; collects Spring Web endpoint handlers; and adds endpoint handlers as entry points with mock parameters.
+The supported Spring annotations and XML tags are configured by `src/main/resources/spring-plugin-config.yaml`.
+
 * Plugins: `plugins:[<pluginClass>,...]`
 ** Default value: `[]`
 ** Activate plugins.To enable a plugin, just add fully-qualified name of the plugin class to this list.

src/main/java/pascal/taie/analysis/graph/flowgraph/ObjectFlowGraph.java

@@ -27,6 +27,7 @@
 import pascal.taie.analysis.pta.core.cs.element.ArrayIndex;
 import pascal.taie.analysis.pta.core.cs.element.CSVar;
 import pascal.taie.analysis.pta.core.cs.element.InstanceField;
+import pascal.taie.analysis.pta.core.cs.element.MockPointer;
 import pascal.taie.analysis.pta.core.cs.element.Pointer;
 import pascal.taie.analysis.pta.core.cs.element.StaticField;
 import pascal.taie.analysis.pta.core.solver.PointerFlowEdge;
@@ -78,6 +79,12 @@ public ObjectFlowGraph(PointerFlowGraph pfg,
     }
 
     private void addPointerFlowEdge(PointerFlowEdge edge) {
+        if (edge.source() instanceof MockPointer ||
+                edge.target() instanceof MockPointer) {
+            // MockPointer is an analysis-internal PFG placeholder and is not
+            // exposed as an OFG node.
+            return;
+        }
         FlowKind kind = edge.kind();
         Node source = toNode(edge.source());
         Node target = toNode(edge.target());

src/main/java/pascal/taie/analysis/pta/PointerAnalysis.java

@@ -42,6 +42,7 @@
 import pascal.taie.analysis.pta.plugin.ThreadHandler;
 import pascal.taie.analysis.pta.plugin.android.AndroidAnalysis;
 import pascal.taie.analysis.pta.plugin.exception.ExceptionAnalysis;
+import pascal.taie.analysis.pta.plugin.spring.SpringAnalysis;
 import pascal.taie.analysis.pta.plugin.invokedynamic.InvokeDynamicAnalysis;
 import pascal.taie.analysis.pta.plugin.invokedynamic.Java9StringConcatHandler;
 import pascal.taie.analysis.pta.plugin.invokedynamic.LambdaAnalysis;
@@ -159,6 +160,9 @@ private static void setPlugin(Solver solver, AnalysisOptions options) {
                 || !((List<String>) options.get("taint-config-providers")).isEmpty()) {
             plugin.addPlugin(new TaintAnalysis());
         }
+        if (options.getBoolean("spring")) {
+            plugin.addPlugin(new SpringAnalysis());
+        }
         plugin.addPlugin(new ResultProcessor());
         // add plugins specified in options
         // noinspection unchecked

src/main/java/pascal/taie/analysis/pta/core/cs/element/CSManager.java

@@ -28,6 +28,7 @@
 import pascal.taie.ir.stmt.Invoke;
 import pascal.taie.language.classes.JField;
 import pascal.taie.language.classes.JMethod;
+import pascal.taie.language.type.Type;
 import pascal.taie.util.Indexer;
 
 import java.util.Collection;
@@ -74,6 +75,12 @@ public interface CSManager {
      */
     ArrayIndex getArrayIndex(CSObj array);
 
+    /**
+     * @return the corresponding MockPointer pointer for given mock allocation.
+     */
+    MockPointer getMockPointer(PointerDescriptor descriptor, Object allocation,
+                               Type type);
+
     /**
      * @return all variables (without contexts).
      */
@@ -115,7 +122,8 @@ public interface CSManager {
     Collection<ArrayIndex> getArrayIndexes();
 
     /**
-     * @return all pointers managed by this manager.
+     * @return all ordinary pointers managed by this manager, excluding
+     * analysis-internal mock pointers.
      */
     Stream<Pointer> pointers();
 

src/main/java/pascal/taie/analysis/pta/core/cs/element/MapBasedCSManager.java

@@ -77,6 +77,12 @@ public ArrayIndex getArrayIndex(CSObj array) {
         return ptrManager.getArrayIndex(array);
     }
 
+    @Override
+    public MockPointer getMockPointer(PointerDescriptor descriptor,
+                                      Object allocation, Type type) {
+        return ptrManager.getMockPointer(descriptor, allocation, type);
+    }
+
     @Override
     public Collection<Var> getVars() {
         return ptrManager.getVars();
@@ -155,6 +161,13 @@ private static class PointerManager {
 
         private final Map<CSObj, ArrayIndex> arrayIndexes = Maps.newMap();
 
+        private final Map<MockPointerKey, MockPointer> mockPointers = Maps.newMap();
+
+        private record MockPointerKey(PointerDescriptor descriptor,
+                                      Object allocation,
+                                      Type type) {
+        }
+
         /**
          * Counter for assigning unique indexes to Pointers.
          */
@@ -180,6 +193,13 @@ private ArrayIndex getArrayIndex(CSObj array) {
                     a -> new ArrayIndex(a, counter++));
         }
 
+        private MockPointer getMockPointer(PointerDescriptor descriptor,
+                                           Object allocation, Type type) {
+            MockPointerKey key = new MockPointerKey(descriptor, allocation, type);
+            return mockPointers.computeIfAbsent(key,
+                    k -> new MockPointer(descriptor, allocation, type, counter++));
+        }
+
         private Collection<Var> getVars() {
             return vars.keySet();
         }

src/main/java/pascal/taie/analysis/pta/core/cs/element/MockPointer.java

@@ -0,0 +1,67 @@
+/*
+ * Tai-e: A Static Analysis Framework for Java
+ *
+ * Copyright (C) 2022 Tian Tan <tiantan@nju.edu.cn>
+ * Copyright (C) 2022 Yue Li <yueli@nju.edu.cn>
+ *
+ * This file is part of Tai-e.
+ *
+ * Tai-e is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation, either version 3
+ * of the License, or (at your option) any later version.
+ *
+ * Tai-e is distributed in the hope that it will be useful,but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
+ * Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Tai-e. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package pascal.taie.analysis.pta.core.cs.element;
+
+import pascal.taie.language.type.Type;
+
+/**
+ * A mock implementation of {@link AbstractPointer}.
+ */
+public final class MockPointer extends AbstractPointer {
+
+    private final PointerDescriptor descriptor;
+
+    private final Object allocation;
+
+    private final Type type;
+
+    MockPointer(PointerDescriptor descriptor, Object allocation, Type type,
+                int index) {
+        super(index);
+        this.descriptor = descriptor;
+        this.allocation = allocation;
+        this.type = type;
+    }
+
+    public PointerDescriptor getDescriptor() {
+        return descriptor;
+    }
+
+    public Object getAllocation() {
+        return allocation;
+    }
+
+    @Override
+    public Type getType() {
+        return type;
+    }
+
+    @Override
+    public String toString() {
+        return "MockPointer{"
+                + descriptor.description()
+                + ": " + allocation
+                + '}';
+    }
+
+}

src/main/java/pascal/taie/analysis/pta/core/cs/element/PointerDescriptor.java

@@ -0,0 +1,30 @@
+/*
+ * Tai-e: A Static Analysis Framework for Java
+ *
+ * Copyright (C) 2022 Tian Tan <tiantan@nju.edu.cn>
+ * Copyright (C) 2022 Yue Li <yueli@nju.edu.cn>
+ *
+ * This file is part of Tai-e.
+ *
+ * Tai-e is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation, either version 3
+ * of the License, or (at your option) any later version.
+ *
+ * Tai-e is distributed in the hope that it will be useful,but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
+ * Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Tai-e. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package pascal.taie.analysis.pta.core.cs.element;
+
+@FunctionalInterface
+public interface PointerDescriptor {
+
+    String description();
+
+}

src/main/java/pascal/taie/analysis/pta/plugin/spring/SpringAnalysis.java

@@ -0,0 +1,89 @@
+/*
+ * Tai-e: A Static Analysis Framework for Java
+ *
+ * Copyright (C) 2022 Tian Tan <tiantan@nju.edu.cn>
+ * Copyright (C) 2022 Yue Li <yueli@nju.edu.cn>
+ *
+ * This file is part of Tai-e.
+ *
+ * Tai-e is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation, either version 3
+ * of the License, or (at your option) any later version.
+ *
+ * Tai-e is distributed in the hope that it will be useful,but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
+ * Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with Tai-e. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package pascal.taie.analysis.pta.plugin.spring;
+
+import pascal.taie.World;
+import pascal.taie.analysis.pta.core.cs.element.CSObj;
+import pascal.taie.analysis.pta.core.solver.Solver;
+import pascal.taie.analysis.pta.plugin.CompositePlugin;
+import pascal.taie.util.collection.Sets;
+import pascal.taie.analysis.pta.plugin.spring.di.DiAnalysis;
+import pascal.taie.analysis.pta.plugin.spring.util.AnnotationManager;
+import pascal.taie.analysis.pta.plugin.spring.util.DirectoryTraverser;
+import pascal.taie.analysis.pta.plugin.spring.util.XmlConfiguration;
+import pascal.taie.analysis.pta.plugin.spring.wec.WecAnalysis;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.function.Consumer;
+
+public class SpringAnalysis extends CompositePlugin {
+
+    private DiAnalysis diAnalysis;
+
+    private WecAnalysis wecAnalysis;
+
+    private final List<Consumer<CSObj>> pendingBeanObjListeners = new ArrayList<>();
+
+    /**
+     * Registers a listener that will be notified when a new bean object is created.
+     * Can be called before or after {@link #setSolver(Solver)}.
+     */
+    public void addNewBeanObjListener(Consumer<CSObj> listener) {
+        pendingBeanObjListeners.add(listener);
+    }
+
+    @Override
+    public void setSolver(Solver solver) {
+        List<String> appClassPaths = World.get().getOptions().getAppClassPath();
+        Set<String> appClassNames = Sets.newSet();
+        appClassPaths.parallelStream()
+                .map(DirectoryTraverser::listClasses)
+                .forEach(classes -> {
+                    synchronized (appClassNames) {
+                        appClassNames.addAll(classes);
+                    }
+                });
+
+        AnnotationManager annotationManager = new AnnotationManager(appClassNames);
+        XmlConfiguration xmlConfiguration = new XmlConfiguration(appClassPaths);
+        annotationManager.initialize();
+        xmlConfiguration.initialize();
+
+        diAnalysis = new DiAnalysis(solver, annotationManager, xmlConfiguration);
+        wecAnalysis = new WecAnalysis(solver, annotationManager);
+
+        addPlugin(diAnalysis, wecAnalysis);
+        super.setSolver(solver);
+    }
+
+    @Override
+    public void onStart() {
+        diAnalysis.registerNewBeanObjListener(wecAnalysis::onNewBeanObj);
+        pendingBeanObjListeners.forEach(diAnalysis::registerNewBeanObjListener);
+        pendingBeanObjListeners.clear();
+        super.onStart();
+    }
+
+}