I want to perform taint analysis on java programs. I want to do this by finding functions calls, variable being modified, variable being accessed. So my question is how do I do this? I think Java parsers can be used here. But I will have to implement my own logic to find variable being accessed and modified. So I want to know if there is any high level library already present for this?

  • Can you run the code, if so the Java debugging protocol may help – jrtapsell May 31 '18 at 10:38
  • @jrtapsell yeah ! – WSS May 31 '18 at 10:39
  • @jrtapsell I have worked on JDI layer of JPDA and it does not support those things. – WSS May 31 '18 at 11:12

You need a Java parser. Most exactly, a static Java code analyzer.

There is a lot from them, for example SonarQube.

It has already a lot of builtin rules, but also you can implement your own ones.

Its core follows the most common lexycal analyzer flow:

  • it constructs a tree structure from the syntactical elements
  • then walks this tree, and
  • you can attach hooks (the instance of your lexycal analyzer classes will be called upon) entering or leaving the nodes of this tree.
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.