I want to perform taint analysis on java programs. I want to do this by finding functions calls, variable being modified, variable being accessed. So my question is how do I do this? I think Java parsers can be used here. But I will have to implement my own logic to find variable being accessed and modified. So I want to know if there is any high level library already present for this?
You need a Java parser. Most exactly, a static Java code analyzer.
There is a lot from them, for example SonarQube.
It has already a lot of builtin rules, but also you can implement your own ones.
Its core follows the most common lexycal analyzer flow:
- it constructs a tree structure from the syntactical elements
- then walks this tree, and
- you can attach hooks (the instance of your lexycal analyzer classes will be called upon) entering or leaving the nodes of this tree.