1- # Module jacodb-analysis
1+ # The ` jacodb-analysis ` module
22
3- Analysis module allows launching dataflow analyses of applications .
4- It contains API to write custom analyses, along with several implemented ready-to-use analyses.
3+ The ` jacodb-analysis ` module allows launching application dataflow analyses.
4+ It contains an API to write custom analyses, and several ready-to-use analyses.
55
6- ## Concept of units
6+ ## Units
77
8- The [ IFDS] ( https://dx.doi.org/10.1145/199448.199462 ) framework is used as the basis for this module.
9- However, in order to be scalable, the analyzed code is split into so-called units, so that the framework
8+ The [ IFDS] ( https://dx.doi.org/10.1145/199448.199462 ) framework is the basis for this module.
9+ To make the implementation scalable, the analyzed code is split into the so-called units, so that the framework
1010can analyze them concurrently.
1111Information is shared between the units via summaries, but the lifecycle of each unit is controlled
1212separately.
1313
1414## Get started
1515
16- The entry point of the analysis is the [ runAnalysis] method. In order to call it, you have to provide:
16+ The analysis entry point is the [ runAnalysis] method. To call it, you have to provide:
1717* ` graph ` — an application graph that is used for analysis. To obtain this graph, one should call the [ newApplicationGraphForAnalysis] method.
1818* ` unitResolver ` — an object that groups methods into units. Choose one from ` UnitResolversLibrary ` .
19- Note that in general, larger units mean more precise but also more resource-consuming analysis.
19+ Note that, in general, larger units mean more precise but also more resource-consuming analysis.
2020* ` ifdsUnitRunner ` — an [ IfdsUnitRunner] instance, which is used to analyze each unit. This is what defines concrete analysis.
2121 Ready-to-use runners are located in ` RunnersLibrary ` .
2222* ` methods ` — a list of methods to analyze.
2323
24- For example, to detect unused variables in the given ` analyzedClass ` methods, you may run the following code
24+ For example, to detect the unused variables in the given ` analyzedClass ` methods, you may run the following code
2525(assuming that ` classpath ` is an instance of [ JcClasspath] ):
2626
2727``` kotlin
@@ -39,10 +39,11 @@ runAnalysis(applicationGraph, unitResolver, runner, methodsToAnalyze)
3939## Implemented runners
4040
4141By now, the following runners are implemented:
42- * ` UnusedVariableRunner ` that can detect issues like unused variable declaration, unused return value, etc.
43- * ` NpeRunner ` that can find instructions with possible null- value dereference.
42+ * ` UnusedVariableRunner ` that can detect issues like unused variable declaration, unused ` return ` value, etc.
43+ * ` NpeRunner ` that can find instructions with possible ` null ` value dereference.
4444* Generic ` TaintRunner ` that can perform taint analysis.
45- * ` SqlInjectionRunner ` which find places vulnerable to sql injections, thus performing a specific kind of taint analysis.
45+ * ` SqlInjectionRunner ` , which finds places vulnerable to SQL injections, thus performing a specific kind of taint
46+ analysis.
4647
4748## Implementing your own analysis
4849
@@ -52,22 +53,23 @@ To instantiate it, you need an [AnalyzerFactory] instance, which is an object th
5253
5354To instantiate an [ Analyzer] interface, you have to specify the following:
5455
55- * ` flowFunctions ` which describe dataflow facts and their transmissions during the analysis.
56+ * ` flowFunctions ` , which describe the dataflow facts and their transmissions during the analysis;
5657
57- * How vulnerabilities are produced by these facts, i.e. you have to implement ` getSummaryFacts ` and ` getSummaryFactsPostIfds ` methods.
58+ * how these facts produce vulnerabilities, i.e., you have to implement ` getSummaryFacts ` and
59+ ` getSummaryFactsPostIfds ` methods.
5860
5961To implement bidirectional analysis, you may use composite [ SequentialBidiIfdsUnitRunner] and [ ParallelBidiIfdsUnitRunner] .
6062
6163<!-- - MODULE jacodb-analysis -->
6264<!-- - INDEX org.jacodb.analysis -->
6365
6466[ runAnalysis ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis/run-analysis.html
65- [ newApplicationGraphForAnalysis ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis/new-application-graph-for-analysis.html
67+ [ newApplicationGraphForAnalysis ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis.graph /new-application-graph-for-analysis.html
6668[ IfdsUnitRunner ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis.engine/-ifds-unit-runner/index.html
6769[ JcClasspath ] : https://jacodb.org/docs/jacodb-api/org.jacodb.api/-jc-classpath/index.html
6870[ IfdsBaseUnitRunner ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis.engine/-ifds-base-unit-runner/index.html
6971[ AnalyzerFactory ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis.engine/-analyzer-factory/index.html
7072[ Analyzer ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis.engine/-analyzer/index.html
7173[ JcApplicationGraph ] : https://jacodb.org/docs/jacodb-api/org.jacodb.api.analysis/-jc-application-graph/index.html
72- [ SequentialBidiIfdsUnitRunner ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis.engine/-sequential-bidi-ifds-base- unit-runner/index.html
73- [ ParallelBidiIfdsUnitRunner ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis.engine/-parallel-bidi-ifds-base- unit-runner/index.html
74+ [ SequentialBidiIfdsUnitRunner ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis.engine/-sequential-bidi-ifds-unit-runner/index.html
75+ [ ParallelBidiIfdsUnitRunner ] : https://jacodb.org/docs/jacodb-analysis/org.jacodb.analysis.engine/-parallel-bidi-ifds-unit-runner/index.html
0 commit comments