Inconsistent taint propagation with lists resulting in false positive

[draftyfrog]

I found an inconsistency concerning taint propagation with lists. Please consider the following code:

List<Boolean> lvar = new ArrayList<Boolean>();
Boolean bvar = true;

lvar.add(source()); // Adds tainted data to the list
lvar.add(bvar);

sink(bvar); // Flagged as leak by FlowDroid

FlowDroid reports this as a leak, as it seems to taint bvar from the tainted list lvar. But if we reverse the order of the list add statements, no leaks are found:

List<Boolean> lvar = new ArrayList<Boolean>();
Boolean bvar = true;

lvar.add(bvar);
lvar.add(source()); // Adds tainted data to the list

sink(bvar); // NOT flagged as leak by FlowDroid

This issue seems to only affect the java wrapper classes for primitive types (I tested it with Boolean and Integer) as for example with String no false positive is reported.

If relevant, my SourcesAndSinks.xml looks like this

<sinkSources>
    <category id="NO_CATEGORY" description="no_category">
        <method signature="{package-name}.MainActivity: java.lang.Boolean source()&gt;">
            <return type="java.lang.Boolean">
                <accessPath isSource="true" isSink="false">
                </accessPath>
            </return>
        </method>
        <method signature="{package-name}.MainActivity: void sink(java.lang.Boolean)&gt;">
            <param index="0" type="java.lang.Boolean">
                <accessPath isSource="false" isSink="true"/>
            </param>
        </method>
    </category>
</sinkSources>

and I call FlowDroid via the command line

java -jar ./soot-infoflow-cmd-2.13.0-jar-with-dependencies.jar \
 -a {path-to-apk} \
 -s ./SourcesAndSinks.xml \
 -o ./out.xml \
 -p {path-to-android-platforms-folder} \
 --mergedexfiles 

Update: added category description to SourcesAndSinks.xml (was always there for this issue, I just posted an outdated version before)

[StevenArzt]

Have you tried with a more recent version of FlowDroid? 2.13.0 is fairly outdated. The last release is 2.14.0 with the current development being 2.15.0-SNAPSHOT.

I have added some test cases and they seem to work properly. Can you please dobule-check?

[draftyfrog]

Thanks for getting back!
I just tried it again with the latest release FlowDroid 2.14.1 as well as the last commit b5b8f75 and in both cases I get the false positive.
Might this be linked to my config?

[StevenArzt]

I found the problem. That's indeed a configuration issue that arises from a very recent feature we have added. FlowDroid can distinugish different elements in lists, which is disabled by default. However, with this feature disabled, some summaries seem to over-approximate aliases now. I have an idea how this could hopefully be fixed easily. Let me try a few things.

[t1mlange]

iirc I thought about that case:

FlowDroid/soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/data/summary/IsAliasType.java

Lines 8 to 9 in a137b4d

	/* Only valid if the incoming abstraction has a context */
	WITH_CONTEXT

By specifying isAlias="withContext" instead of isAlias="true" in the XML file, the analysis should only look for aliases for a list with a concrete context. That should still work unless I broke that during merging.

[StevenArzt]

@t1mlange I now added a heuristic. If we have an alias flow that is constrained but we don't run with a precise collection analysis, we ignore the alias. The tests are running to see whether this heuristic breaks anything. That should at least cover the case that precise analysis is disabled in general.

Fixing the summaries with isAlias="withContext" still makes sense, but takes more effort.

[StevenArzt]

OK, the heuristic seems to work without breaking any test cases.

@draftyfrog Can you test again with the newest develop branch, i.e., my commit from a couple of minutes ago?

[draftyfrog]

@StevenArzt I tested again with Commit a137b4d and now both cases presented in my original issue are not flagged as leaks, as expected.
Thank you for the fast resolution!