<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi Rainkin,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I do not understand your question. In this code example, there is only a single context. The method “foo” is always called with a tainted element which originated from sourceOne(10). In terms of contexts, the two source-to-sink connections are equal. Moreover, there is only one call to “System.out.println()” in the code, so I’m not sure how you want to get two different statements out of that.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>The only thing you could do is to obtain two different propagation paths to record that one flow was propagated over the first call to “foo” and the other one over the second call. I’m not sure what the use case for that should be, though.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Best regards,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> Steven<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Von:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> soot-list-bounces@CS.McGill.CA [mailto:soot-list-bounces@CS.McGill.CA] <b>Im Auftrag von </b>???<br><b>Gesendet:</b> Mittwoch, 22. April 2015 10:50<br><b>An:</b> soot-list@CS.McGill.CA<br><b>Betreff:</b> [Soot-list] How to get context-sensitive result of flowdroid<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><div><div><div><p class=MsoNormal>Hi guys,<o:p></o:p></p></div><p class=MsoNormal> this is a example:<o:p></o:p></p><p class=MsoNormal> public void test(){<br> String sourceOne = sourceOne(10); // source<br> foo(sourceOne);<br> foo(sourceOne);<br> }<br><br> public String sourceOne(int number){<br> return number>0 ? "positive" : "negative";<br> }<br> <br> public void foo(String s){<br> System.out.println(s); // sink<br> }<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'> the method sourceOne is a source and System.out.println() is a sink.<o:p></o:p></p></div><p class=MsoNormal> After analysis, I get the following result:<o:p></o:p></p><p class=MsoNormal>[main] INFO soot.jimple.infoflow.Infoflow - Source lookup done, found 1 sources and 1 sinks.<br>[main] INFO soot.jimple.infoflow.Infoflow - IFDS problem with 14 forward and 0 backward edges solved, processing 1 results...<br>[main] INFO soot.jimple.infoflow.data.pathBuilders.ContextSensitivePathBuilder - Context-sensitive path reconstructor started<br>[main] INFO soot.jimple.infoflow.data.pathBuilders.ContextSensitivePathBuilder - Obtainted 1 connections between sources and sinks<br>[main] INFO soot.jimple.infoflow.data.pathBuilders.ContextSensitivePathBuilder - Building path 1<br>[main] INFO soot.jimple.infoflow.data.pathBuilders.ContextSensitivePathBuilder - Path processing took 0.008987293 seconds in total<br>[main] INFO soot.jimple.infoflow.Infoflow - The sink virtualinvoke $r2.<java.io.PrintStream: void println(java.lang.String)>(r1) in method <TestCode: void foo(java.lang.String)> was called with values from the following sources:<br>[main] INFO soot.jimple.infoflow.Infoflow - - r1 = virtualinvoke r0.<TestCode: java.lang.String sourceOne(int)>(10) in method <TestCode: void test()><br>[main] INFO soot.jimple.infoflow.Infoflow - on Path: <br>[main] INFO soot.jimple.infoflow.Infoflow - -> <TestCode: void foo(java.lang.String)><br>[main] INFO soot.jimple.infoflow.Infoflow - -> virtualinvoke $r2.<java.io.PrintStream: void println(java.lang.String)>(r1)<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'> I want to know how to get a context-sensitive result, in which sourceOne() will point to 2 different system.out.println()<o:p></o:p></p></div><div><p class=MsoNormal>Thx,<o:p></o:p></p></div><div><p class=MsoNormal>Rainkin<o:p></o:p></p></div></div></div></body></html>