Tai-e icon indicating copy to clipboard operation
Tai-e copied to clipboard

Temp variables not cleared when reinitializing in interactive mode of taint analysis

Open zhangt2333 opened this issue 5 months ago • 1 comments

📝 Overall Description

When re-initialize Taint Analysis, the temporary variables added during the previous round of taint analysis have not been cleared. This causes the number of pointers to continuously increase when repeatedly re-running taint analysis.

🎯 Expected Behavior

-------------- Pointer analysis statistics: --------------
#var pointers:                39 (insens) / 39 (sens)
#objects:                     15 (insens) / 15 (sens)
#var points-to:               61 (insens) / 61 (sens)
#static field points-to:      0 (sens)
#instance field points-to:    4 (sens)
#array points-to:             1 (sens)
#reachable methods:           16 (insens) / 16 (sens)
#call graph edges:            27 (insens) / 27 (sens)
----------------------------------------
...
...
-------------- Pointer analysis statistics: --------------
#var pointers:                39 (insens) / 39 (sens)
#objects:                     15 (insens) / 15 (sens)
#var points-to:               61 (insens) / 61 (sens)
#static field points-to:      0 (sens)
#instance field points-to:    4 (sens)
#array points-to:             1 (sens)
#reachable methods:           16 (insens) / 16 (sens)
#call graph edges:            27 (insens) / 27 (sens)
----------------------------------------

🐛 Current Behavior

-------------- Pointer analysis statistics: --------------
#var pointers:                39 (insens) / 39 (sens)
#objects:                     15 (insens) / 15 (sens)
#var points-to:               61 (insens) / 61 (sens)
#static field points-to:      0 (sens)
#instance field points-to:    4 (sens)
#array points-to:             1 (sens)
#reachable methods:           16 (insens) / 16 (sens)
#call graph edges:            27 (insens) / 27 (sens)
----------------------------------------
...
...
-------------- Pointer analysis statistics: --------------
#var pointers:                49 (insens) / 49 (sens)
#objects:                     15 (insens) / 15 (sens)
#var points-to:               65 (insens) / 65 (sens)
#static field points-to:      0 (sens)
#instance field points-to:    4 (sens)
#array points-to:             1 (sens)
#reachable methods:           16 (insens) / 16 (sens)
#call graph edges:            27 (insens) / 27 (sens)
----------------------------------------

🔄 Reproducible Example

    @org.junit.jupiter.api.Test
    void testBackPropagation() {
        String ptaOpts = """
            pta=
            implicit-entries:false;
            only-app:true;
            distinguish-string-constants:all;
            taint-config:src/test/resources/pta/taint/taint-config.yml;
            taint-interactive-mode:%s;
            """;

        // run in non-interactive mode
        pascal.taie.Main.main(
                "-pp",
                "-cp", "src/test/resources/pta/taint",
                "-m", "BackPropagation",
                "-a", String.format(ptaOpts, "false")
        );

        // run in interactive mode
        InputStream originalSystemIn = System.in;
        try {
            String simulatedStdin = "r\ne\n";
            System.setIn(new ByteArrayInputStream(simulatedStdin.getBytes()));
            pascal.taie.Main.main(
                    "-pp",
                    "-cp", "src/test/resources/pta/taint",
                    "-m", "BackPropagation",
                    "-a", String.format(ptaOpts, "true")
            );
        } finally {
            System.setIn(originalSystemIn);
        }
    }

zhangt2333 avatar Aug 11 '25 06:08 zhangt2333