Java Code Examples for org.apache.bcel.Constants#INVOKESTATIC

The following examples show how to use org.apache.bcel.Constants#INVOKESTATIC . These examples are extracted from open source projects. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
@Override
public void sawOpcode(int seen) {
    if (seen == Constants.INVOKESTATIC
            && getClassConstantOperand().equals("javax/crypto/Cipher")
            && getNameConstantOperand().equals("getInstance")) {
        OpcodeStack.Item item = stack.getStackItem(getSigConstantOperand().contains(";L") ? 1 : 0);
        if (StackUtils.isConstantString(item)) {
            String cipherValue = (String) item.getConstant();
            // default padding for "RSA" only is PKCS1 so it is not reported
            if (cipherValue.startsWith("RSA/") && cipherValue.endsWith("/NoPadding")) {
                bugReporter.reportBug(new BugInstance(this, RSA_NO_PADDING_TYPE, Priorities.NORMAL_PRIORITY) //
                        .addClass(this).addMethod(this).addSourceLine(this));
            }
        }
    }
}
 
Example 2
@Override
    public void sawOpcode(int seen) {
//        printOpCode(seen);

        // getClassConstantOperand().equals("java/net/Socket")

        if (seen == Constants.INVOKEVIRTUAL && ( //List of method mark as external file access
                getNameConstantOperand().equals("getExternalCacheDir") ||
                getNameConstantOperand().equals("getExternalCacheDirs") ||
                getNameConstantOperand().equals("getExternalFilesDir") ||
                getNameConstantOperand().equals("getExternalFilesDirs") ||
                getNameConstantOperand().equals("getExternalMediaDirs")
            )) {
//            System.out.println(getSigConstantOperand());
            bugReporter.reportBug(new BugInstance(this, ANDROID_EXTERNAL_FILE_ACCESS_TYPE, Priorities.NORMAL_PRIORITY) //
                    .addClass(this).addMethod(this).addSourceLine(this));
        }
        else if(seen == Constants.INVOKESTATIC && getClassConstantOperand().equals("android/os/Environment") && (
                getNameConstantOperand().equals("getExternalStorageDirectory") ||
                getNameConstantOperand().equals("getExternalStoragePublicDirectory")
            )) {
            bugReporter.reportBug(new BugInstance(this, ANDROID_EXTERNAL_FILE_ACCESS_TYPE, Priorities.NORMAL_PRIORITY) //
                    .addClass(this).addMethod(this).addSourceLine(this));
        }
    }
 
Example 3
Source Project: ApkToolPlus   File: InstructionFactory.java    License: Apache License 2.0 6 votes vote down vote up
/** Create an invoke instruction.
 *
 * @param class_name name of the called class
 * @param name name of the called method
 * @param ret_type return type of method
 * @param arg_types argument types of method
 * @param kind how to invoke, i.e., INVOKEINTERFACE, INVOKESTATIC, INVOKEVIRTUAL,
 * or INVOKESPECIAL
 * @see Constants
 */
public InvokeInstruction createInvoke(String class_name, String name, Type ret_type,
			Type[] arg_types, short kind) {
  int    index;
  int    nargs      = 0;
  String signature  = Type.getMethodSignature(ret_type, arg_types);

  for(int i=0; i < arg_types.length; i++) // Count size of arguments
    nargs += arg_types[i].getSize();

  if(kind == Constants.INVOKEINTERFACE)
    index = cp.addInterfaceMethodref(class_name, name, signature);
  else
    index = cp.addMethodref(class_name, name, signature);

  switch(kind) {
  case Constants.INVOKESPECIAL:   return new INVOKESPECIAL(index);
  case Constants.INVOKEVIRTUAL:   return new INVOKEVIRTUAL(index);
  case Constants.INVOKESTATIC:    return new INVOKESTATIC(index);
  case Constants.INVOKEINTERFACE: return new INVOKEINTERFACE(index, nargs + 1);
  default:
    throw new RuntimeException("Oops: Unknown invoke kind:" + kind);
  }
}
 
Example 4
Source Project: ApkToolPlus   File: InvokeInstruction.java    License: Apache License 2.0 6 votes vote down vote up
/**
  * Also works for instructions whose stack effect depends on the
  * constant pool entry they reference.
  * @return Number of words consumed from stack by this instruction
  */
 public int consumeStack(ConstantPoolGen cpg) {
     String signature = getSignature(cpg);
     Type[] args      = Type.getArgumentTypes(signature);
     int    sum;

     if(opcode == Constants.INVOKESTATIC)
sum = 0;
     else
sum = 1;  // this reference

     int n = args.length;
     for (int i = 0; i < n; i++)
sum += args[i].getSize();

     return sum;
  }
 
Example 5
@Override
public void sawOpcode(int seen) {

    if (seen == Constants.INVOKESTATIC && FILENAMEUTILS_NULL_METHOD.matches(this)) {

        bugReporter.reportBug(new BugInstance(this, WEAK_FILENAMEUTILS_TYPE, Priorities.LOW_PRIORITY) //
                .addClass(this).addMethod(this).addSourceLine(this)
                .addString(getNameConstantOperand()));
    }
}
 
Example 6
@Override
public void sawOpcode(int seen) {
    //printOpCode(seen);

    //Important sample from \plugin\src\test\webapp\includes\jsp_include_1.jsp
    //org.apache.jasper.runtime.JspRuntimeLibrary
    //JspRuntimeLibrary.include(request, response, (String)PageContextImpl.evaluateExpression("${param.secret_param}", String.class, _jspx_page_context, null), out, false);
    //  JspIncludeDetector: [0119]  invokestatic   org/apache/jasper/runtime/JspRuntimeLibrary.include (Ljavax/servlet/ServletRequest;Ljavax/servlet/ServletResponse;Ljava/lang/String;Ljavax/servlet/jsp/JspWriter;Z)V

    //Important sample from \plugin\src\test\webapp\includes\jsp_include_3.jsp
    //ImportTag _jspx_th_c_import_0 = (ImportTag)this._jspx_tagPool_c_import_url_nobody.get(ImportTag.class);
    //_jspx_th_c_import_0.setUrl((String)PageContextImpl.evaluateExpression("${param.secret_param}", String.class, _jspx_page_context, null));
    //  JspIncludeDetector: [0051]  invokevirtual   org/apache/taglibs/standard/tag/rt/core/ImportTag.setUrl (Ljava/lang/String;)V


    if (seen == Constants.INVOKESTATIC && ("org/apache/jasper/runtime/JspRuntimeLibrary".equals(getClassConstantOperand()) || "org/apache/sling/scripting/jsp/jasper/runtime/JspRuntimeLibrary".equals(getClassConstantOperand()))
            && getNameConstantOperand().equals("include") && getSigConstantOperand().equals("(Ljavax/servlet/ServletRequest;Ljavax/servlet/ServletResponse;Ljava/lang/String;Ljavax/servlet/jsp/JspWriter;Z)V")) {

        bugReporter.reportBug(new BugInstance(this, JSP_INCLUDE_TYPE, Priorities.HIGH_PRIORITY) //
                .addClass(this).addMethod(this).addSourceLine(this));
    }
    else if (seen == Constants.INVOKEVIRTUAL && getClassConstantOperand().equals("org/apache/taglibs/standard/tag/rt/core/ImportTag")
            && getNameConstantOperand().equals("setUrl") && getSigConstantOperand().equals("(Ljava/lang/String;)V")) {

        bugReporter.reportBug(new BugInstance(this, JSP_INCLUDE_TYPE, Priorities.HIGH_PRIORITY) //
                .addClass(this).addMethod(this).addSourceLine(this));
    }

}
 
Example 7
@Override
public void sawOpcode(int seen) {
    if (seen == Constants.INVOKESPECIAL 
        && getClassConstantOperand().equals("org/apache/http/impl/client/DefaultHttpClient") 
        && getNameConstantOperand().equals("<init>") 
        && getSigConstantOperand().equals("()V")) {
      
        //DefaultHttpClient constructor with no parameter
        bugReporter.reportBug(new BugInstance(this, DEFAULT_HTTP_CLIENT, Priorities.NORMAL_PRIORITY)
                .addClass(this).addMethod(this).addSourceLine(this));
    }
    
    if (seen == Constants.INVOKESTATIC 
        && getClassConstantOperand().equals("javax/net/ssl/SSLContext") 
        && getNameConstantOperand().equals("getInstance")
        && getSigConstantOperand().equals("(Ljava/lang/String;)Ljavax/net/ssl/SSLContext;")) {
      
        //System.out.println("SSLContext.getInstance(" + this.getSigConstantOperand() + ")");
        final OpcodeStack.Item item = stack.getStackItem(0);              
        String sslContextName = (String) item.getConstant(); //Null if the value passed isn't constant
          
        if (sslContextName != null && sslContextName.equalsIgnoreCase("SSL")) {
            bugReporter.reportBug(new BugInstance(this, SSL_CONTEXT, Priorities.NORMAL_PRIORITY)
                       .addClass(this).addMethod(this).addSourceLine(this));
        }

    }
}
 
Example 8
@Override
public void sawOpcode(int seen) {
    if ((seen != Constants.INVOKESTATIC
            || !getClassConstantOperand().equals("javax/crypto/Cipher"))
            || !getNameConstantOperand().equals("getInstance")) {
        return;
    }
    OpcodeStack.Item item = stack.getStackItem(getSigConstantOperand().contains(";L") ? 1 : 0);
    String cipherValue;
    if (StackUtils.isConstantString(item)) {
        cipherValue = (String) item.getConstant();
    } else {
        return;
    }
    if (INSECURE_ECB_MODES.matcher(cipherValue).matches()) {
        reportBug(ECB_MODE_TYPE);
    }
    if (cipherValue.contains("/CBC/PKCS5Padding")) {
        reportBug(PADDING_ORACLE_TYPE);
    }

    //Some cipher will not have mode specified (ie: "RSA" .. issue GitHub #24)
    if (!AUTHENTICATED_CIPHER_MODES.matcher(cipherValue).matches()
            && !cipherValue.startsWith("RSA")) {
        reportBug(CIPHER_INTEGRITY_TYPE);
    }
}
 
Example 9
@Override
    public void sawOpcode(int seen) {
//        printOpCode(seen);

        if (seen == Constants.INVOKESTATIC && getClassConstantOperand().equals("org/apache/velocity/app/Velocity")
                && getNameConstantOperand().equals("evaluate")) {

            OpcodeStack.Item item = stack.getStackItem(0);
            if(!StackUtils.isConstantString(item)) {
                bugReporter.reportBug(new BugInstance(this, VELOCITY_TYPE, Priorities.NORMAL_PRIORITY) //
                        .addClass(this).addMethod(this).addSourceLine(this));
            }
        }
    }
 
Example 10
@Override
public void sawOpcode(int seen) {
    //printOpCode(seen);

    if (seen == Constants.INVOKESPECIAL && getClassConstantOperand().equals("java/util/Random")
            && getNameConstantOperand().equals("<init>")) {

        bugReporter.reportBug(new BugInstance(this, PREDICTABLE_RANDOM_TYPE, Priorities.NORMAL_PRIORITY) //
                .addClass(this).addMethod(this).addSourceLine(this) //
                .addString("java.util.Random"));

    } else if (seen == Constants.INVOKESTATIC && getClassConstantOperand().equals("java/lang/Math")
            && getNameConstantOperand().equals("random")) {

        bugReporter.reportBug(new BugInstance(this, PREDICTABLE_RANDOM_TYPE, Priorities.NORMAL_PRIORITY) //
                .addClass(this).addMethod(this).addSourceLine(this) //
                .addString("java.lang.Math.random()"));

    } else if (seen == Constants.INVOKESTATIC && getClassConstantOperand().equals("java/util/concurrent/ThreadLocalRandom")
            && getNameConstantOperand().equals("current")) {
        
        bugReporter.reportBug(new BugInstance(this, PREDICTABLE_RANDOM_TYPE, Priorities.NORMAL_PRIORITY) //
                .addClass(this).addMethod(this).addSourceLine(this) //
                .addString("java.util.concurrent.ThreadLocalRandom"));

    } else if (seen == Constants.INVOKESPECIAL && getClassConstantOperand().equals("scala/util/Random")
            && getNameConstantOperand().equals("<init>")) {

        bugReporter.reportBug(new BugInstance(this, PREDICTABLE_RANDOM_SCALA_TYPE, Priorities.NORMAL_PRIORITY) //
                .addClass(this).addMethod(this).addSourceLine(this) //
                .addString("scala.util.Random"));

    } else if (seen == Constants.INVOKEVIRTUAL && RANDOM_NEXT_METHODS.matches(this)) {

        bugReporter.reportBug(new BugInstance(this, PREDICTABLE_RANDOM_SCALA_TYPE, Priorities.NORMAL_PRIORITY) //
                .addClass(this).addMethod(this).addSourceLine(this) //
                .addString("scala.util.Random."+getNameConstantOperand()+"()"));
    }
}
 
Example 11
Source Project: ApkToolPlus   File: INVOKESTATIC.java    License: Apache License 2.0 4 votes vote down vote up
public INVOKESTATIC(int index) {
  super(Constants.INVOKESTATIC, index);
}