-
Notifications
You must be signed in to change notification settings - Fork 139
/
Heuristics.h
308 lines (272 loc) · 10.2 KB
/
Heuristics.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
/*
* Copyright (c) Meta Platforms, Inc. and affiliates.
*
* This source code is licensed under the MIT license found in the
* LICENSE file in the root directory of this source tree.
*/
#pragma once
#include <cstdint>
#include <filesystem>
#include <optional>
#include <json/json.h>
#include <mariana-trench/IncludeMacros.h>
namespace marianatrench {
class Heuristics final {
public:
explicit Heuristics();
DELETE_COPY_CONSTRUCTORS_AND_ASSIGNMENTS(Heuristics)
static void init_from_file(const std::filesystem::path& heuristics_path);
static const Heuristics& singleton();
/**
* When a method has a set of overrides greater than this threshold, we do not
* join all overrides at call sites.
*/
std::uint32_t join_override_threshold() const {
return join_override_threshold_;
}
/**
* When an android/java/google method has a set of overrides and greater than
* this threshold, we do not join all overrides at call sites.
*/
std::uint32_t android_join_override_threshold() const {
return android_join_override_threshold_;
}
/**
* When a method which has a set of overrides greater than this threshold that
* is not marked with `NoJoinVirtualOverrides` is called at least once, we
* print a warning.
*/
const std::optional<std::uint32_t> warn_override_threshold() const {
return warn_override_threshold_;
}
/**
* Maximum height of a taint (source or sink) tree after widening.
*
* When reaching the maximum, we collapse the leaves to reduce the height.
*/
std::uint32_t source_sink_tree_widening_height() const {
return source_sink_tree_widening_height_;
}
/**
* Maximum size of the port of a generation.
*
* This is the maximum depth of the generation taint tree. We truncate the
* ports upto this threshold when updating the tree. This is equivalent to
* collapsing all the subtrees exceeding this threshold to the node at this
* maximum depth.
*/
std::uint32_t generation_max_port_size() const {
return generation_max_port_size_;
}
/**
* Maximum number of leaves in the tree of output paths of generations.
*
* This is the maximum width of the generation taint tree. When the number of
* leaves exceeds this threshold, we compute the depth at which the tree
* exceeds the threshold and collapse all the subtrees into the nodes at this
* level.
*/
std::uint32_t generation_max_output_path_leaves() const {
return generation_max_output_path_leaves_;
}
/**
* Maximum size of the port of a parameter source.
*
* This is the maximum depth of the parameter source taint tree. We truncate
* the ports upto this threshold when updating the tree. This is equivalent
* to collapsing all the subtrees exceeding this threshold to the node at this
* maximum depth.
*/
std::uint32_t parameter_source_max_port_size() const {
return parameter_source_max_port_size_;
}
/**
* Maximum number of leaves in the tree of output paths of parameter sources.
*
* This is the maximum width of the parameter source taint tree. When the
* number of leaves exceeds this threshold, we compute the depth at which the
* tree exceeds the threshold and collapse all the subtrees into the nodes at
* this level.
*/
std::uint32_t parameter_source_max_output_path_leaves() const {
return parameter_source_max_output_path_leaves_;
}
/**
* Maximum size of the port of a sink.
*
* This is the maximum depth of the sink taint tree. We truncate the
* ports upto this threshold when updating the tree. This is equivalent to
* collapsing all the subtrees exceeding this threshold to the node at this
* maximum depth.
*/
std::uint32_t sink_max_port_size() const {
return sink_max_port_size_;
}
/**
* Maximum number of leaves in the tree of input paths of sinks.
*
* This is the maximum width of the sink taint tree. When the number of
* leaves exceeds this threshold, we compute the depth at which the tree
* exceeds the threshold and collapse all the subtrees into the nodes at this
* level.
*/
std::uint32_t sink_max_input_path_leaves() const {
return sink_max_input_path_leaves_;
}
/**
* Maximum size of the port of a call effect source.
*
* This is the maximum depth of the call effect source taint tree. We truncate
* the ports upto this threshold when updating the tree. This is equivalent
* to collapsing all the subtrees exceeding this threshold to the node at this
* maximum depth.
*/
std::uint32_t call_effect_source_max_port_size() const {
return call_effect_source_max_port_size_;
}
/**
* Maximum number of leaves in the tree of output paths of call effect
* sources.
*
* This is the maximum width of the call effect source taint tree. When the
* number of leaves exceeds this threshold, we compute the depth at which the
* tree exceeds the threshold and collapse all the subtrees into the nodes at
* this level.
*/
std::uint32_t call_effect_source_max_output_path_leaves() const {
return call_effect_source_max_output_path_leaves_;
}
/**
* Maximum size of the port of a call effect sink.
*
* This is the maximum depth of the call effect sink taint tree. We truncate
* the ports upto this threshold when updating the tree. This is equivalent
* to collapsing all the subtrees exceeding this threshold to the node at this
* maximum depth.
*/
std::uint32_t call_effect_sink_max_port_size() const {
return call_effect_sink_max_port_size_;
}
/**
* Maximum number of leaves in the tree of input paths of call effect sinks.
*
* This is the maximum width of the call effect sink taint tree. When the
* number of leaves exceeds this threshold, we compute the depth at which the
* tree exceeds the threshold and collapse all the subtrees into the nodes at
* this level.
*/
std::uint32_t call_effect_sink_max_input_path_leaves() const {
return call_effect_sink_max_input_path_leaves_;
}
/**
* Maximum number of global iterations before we abort the analysis.
*/
std::uint32_t max_number_iterations() const {
return max_number_iterations_;
}
/**
* Maximum number of local positions per frame.
*
* This parameter cannot be set a runtime, as it used at compile time.
*/
constexpr static std::uint32_t kMaxNumberLocalPositions = 20;
/**
* Maximum depth of dependency graph traversal to find class properties.
*/
std::uint32_t max_depth_class_properties() const {
return max_depth_class_properties_;
}
/**
* Maximum number of hops that can be tracked for a call chain issue.
*/
std::uint32_t max_call_chain_source_sink_distance() const {
return max_call_chain_source_sink_distance_;
}
/**
* Maximum size of the input access path of a propagation.
*
* This is the maximum depth of the propagation taint tree. We truncate the
* ports upto this threshold when updating the tree. This is equivalent to
* collapsing all the subtrees exceeding this threshold to the node at this
* maximum depth.
*/
std::uint32_t propagation_max_input_path_size() const {
return propagation_max_input_path_size_;
}
/**
* Maximum number of leaves in input access path of a propagation.
*
* This is the maximum width of the propagation taint tree. When the number of
* leaves exceeds this threshold, we compute the depth at which the tree
* exceeds the threshold and collapse all the subtrees into the nodes at this
* level.
*/
std::uint32_t propagation_max_input_path_leaves() const {
return propagation_max_input_path_leaves_;
}
/**
* Maximum size of the output access path of propagations.
*
* This is the maximum depth of the propagation output paths tree. We truncate
* the ports upto this threshold when updating the tree. This is equivalent
* to collapsing all the subtrees exceeding this threshold to the node at this
* maximum depth.
*/
std::uint32_t propagation_max_output_path_size() const {
return propagation_max_output_path_size_;
}
/**
* Maximum number of leaves in the propagations output paths tree.
*
* This is the maximum width of the propagation output paths tree. When the
* number of leaves exceeds this threshold, we compute the depth at which the
* tree exceeds the threshold and collapse all the subtrees into the nodes at
* this level.
*/
std::uint32_t propagation_max_output_path_leaves() const {
return propagation_max_output_path_leaves_;
}
/**
* Maximum height of the output path tree of propagations after widening.
*
* When reaching the maximum, we collapse the leaves to reduce the height.
*/
std::uint32_t propagation_output_path_tree_widening_height() const {
return propagation_output_path_tree_widening_height_;
}
/**
* Maximum height of the input taint tree when applying propagations.
*
* This is also the maximum collapse depth for inferred propagations.
*/
std::uint32_t propagation_max_collapse_depth() const {
return propagation_max_collapse_depth_;
}
private:
void enforce_heuristics_consistency();
private:
std::uint32_t join_override_threshold_;
std::uint32_t android_join_override_threshold_;
std::optional<std::uint32_t> warn_override_threshold_;
std::uint32_t source_sink_tree_widening_height_;
std::uint32_t generation_max_port_size_;
std::uint32_t generation_max_output_path_leaves_;
std::uint32_t parameter_source_max_port_size_;
std::uint32_t parameter_source_max_output_path_leaves_;
std::uint32_t sink_max_port_size_;
std::uint32_t sink_max_input_path_leaves_;
std::uint32_t call_effect_source_max_port_size_;
std::uint32_t call_effect_source_max_output_path_leaves_;
std::uint32_t call_effect_sink_max_port_size_;
std::uint32_t call_effect_sink_max_input_path_leaves_;
std::uint32_t max_number_iterations_;
std::uint32_t max_depth_class_properties_;
std::uint32_t max_call_chain_source_sink_distance_;
std::uint32_t propagation_max_input_path_size_;
std::uint32_t propagation_max_input_path_leaves_;
std::uint32_t propagation_max_output_path_size_;
std::uint32_t propagation_max_output_path_leaves_;
std::uint32_t propagation_output_path_tree_widening_height_;
std::uint32_t propagation_max_collapse_depth_;
};
} // namespace marianatrench