Analysis not finnishing

[StamesJames]

• I have searched open and closed issues for duplicates
• I made sure that I am not using an old project version (DO: pull PhASAR, update git submodules, rebuild the project and check if the bug is still there)

---

Bug description

I try to find a the unchecked passing of a path string in the rust webbrowser crate state here https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45299
for this I simply wrote the rust program

fn main() {
    webbrowser::open(".").expect("not opened");
}

and tried to analysis this by ifds-taint with the following analysis-config.json

{
    "name": "webbrowser_crate_analysis",
    "version": 1,
    "functions": [
        {
            "name": "_ZN10webbrowser4open17h0e8a15ef1f754f0bE",
            "params": {
                "source": [0]
            },
            "ret": "source"
        },
        {
            "name": "_ZN10webbrowser12open_browser17h8951a27df856dd11E",
            "params": {
                "sink": [1]
            }
        }
    ],
    "variables": []
  }

When I invoke a ifds-taint analysis with phasar-cli it seems to never stop runing

Steps to reproduce

• download the provided files
• run cargo build
• link the generated .ll files into one .bc file with llvm-link
• analysis the resulting file with

phasar-cli \
	-m path/to/your/llvm.bc \
	-D ifds-taint \
	--analysis-config=analysis-config.json \
	--entry-points _ZN20webbrowser_crate_vul4main17h90a227ee26bda623E

maybe the mangled names for the main and the analysed functions differ when you compile it.

Actual result: The analysis seems to not finish

Expected result: the analysis should find, that the parameter that is passed to the webbrowser open function is given unchecked to the open_browser function

Context (Environment)

• phasar: [de6d505]

Operating System:

• Linux
• Windows
• macOS

Build Type:

• cmake (in dockerfile)
• bootstrap.sh
• custom build

Example files

Files:
webbrowser-crate-vul.zip

[fabianbs96]

Hi @StamesJames, I could not reproduce your issue on my system. The analysis finishes very quickly, but does not find any vulnerabilities. I suppose, we are analyzing slightly different IR. Can you share the IR that you analyze?

[StamesJames]

those are the files I tried to analysis with
phasar-cli \ -m full.ll \ -D ifds-taint \ --analysis-config=analysis-config.json \ --entry-points _ZN20webbrowser_crate_vul4main17h90a227ee26bda623E

The full.ll I created by running llvm-link *.ll inside the build directory of my rust project. The webbrowser-full.ll was created by just linking the webbrowser-*.ll's

webbrowser-crate-analysis.zip

[StamesJames]

@fabianbs96 have you also set the entry-points for the analysis? Because when I don't do this my analysis also ends very quick but rust has some indirection in the main call and if the entry points aren't set to the real main function phasar doesn't analysis the program properly

[fabianbs96]

Hi @StamesJames, now I can reproduce your issue, thanks. I will debug it and see, what we can do