I want to perform taint analysis on java programs. I want to do this by finding functions calls, variable being modified, variable being accessed. So my question is how do I do this? I think Java parsers can be used here. But I will have to implement my own logic to find variable being accessed and modified. So I want to know if there is any high level library already present for this?
closed as off-topic by S.L. Barth, multithr3at3d, forest, Tom K., Overmind Jun 7 '18 at 10:28
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product recommendations are off-topic as they become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – S.L. Barth, multithr3at3d, forest, Tom K., Overmind
You need a Java parser. Most exactly, a static Java code analyzer.
There is a lot from them, for example SonarQube.
It has already a lot of builtin rules, but also you can implement your own ones.
Its core follows the most common lexycal analyzer flow:
- it constructs a tree structure from the syntactical elements
- then walks this tree, and
- you can attach hooks (the instance of your lexycal analyzer classes will be called upon) entering or leaving the nodes of this tree.