Comments (4)
Our documentation needs to be improved quite a bit.
features
can be added on a user-declared source or sink.
attach_to_source
is used when you do not know what the source will be (or if there even is a source at all). It is added on inferred sources, i.e sources that the actual analysis finds.
For instance:
class A {
public String foo() {
// ...
}
public String bar() {
// ...
}
public String baz() {
if (cond()) {
return foo();
} else {
return bar();
}
}
}
If you want to mark foo
as returning a source UserControlled
with a feature, you would use a source with features:
{
"sources": [
{
"kind": "UserControlled",
"port": "Return",
"features": ["via-foo"]
}
]
}
If you want to add a feature to any sources flowing out of baz
, without knowing what source it could be (it could be a source from foo
or bar
), you would use attach_to_source
:
{
"attach_to_sources": [
{
"features": ["via-baz"],
"port": "Return"
}
]
}
from mariana-trench.
Hello @arthaud ! Thank you for the answer. Basically, you use attach_to_sources
to say "the flow passed through the baz
method" because when analyzing with SAPP UI you will find the via-baz
feature. This is what I understood.
However, I cannot find a use-case for features
, I mean, what is the purpose to add an info like the feature name to a source with a kind defined? If features names are used for filtering in SAPP UI, while not just filtering for kinds (that are needed to define rules)?
from mariana-trench.
That's right, it's not really useful in general.
from mariana-trench.
Okay thanks for the explanation! Now it's clear. As you said, the documentation needs to be improved, it has been hard many times for me to understand some "concepts", I mean, there are not detailed enough in my opinion. This is just a suggestion that I would like to give you. I belive Mariana is very powerful and you have been doing a great job!
from mariana-trench.
Related Issues (20)
- Does not compile with latest fmt 9.1 due to lack of formatter for types HOT 1
- How to check argument value with regex? HOT 1
- The latest version compiles, cannot be used, and various parameters are missing. MarianaTrench mariana_trench_error: the option '--output-directory' is required but missing???
- Example code does not work HOT 3
- Taint not flowing into a sink in Runnable
- Build from source fails. HOT 1
- Stuck creating generators: Found 0 issues
- Old macOS 10.15.7 failed to execute analysis HOT 4
- Tainted data not flowing through custom propagations HOT 14
- "No such file " log in sapp HOT 3
- Request for Features Description HOT 3
- Evaluate Profile-Guided Optimization (PGO) and LLVM BOLT HOT 4
- Release app with proguard HOT 1
- Error building mariana-trench HOT 1
- verifying propagations applied to the functions. HOT 2
- ImportError when using sapp HOT 3
- Default model generators missing from PyPI release HOT 2
- Flow analysis in a method.
- Sanitizer does not work, or something wrong
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from mariana-trench.