Architectural: Add Wala Framework Setup

pom.xml

@@ -166,6 +166,11 @@
             <artifactId>byte-buddy-agent</artifactId>
             <version>1.14.19</version>
         </dependency>
+        <dependency>
+            <groupId>com.ibm.wala</groupId>
+            <artifactId>com.ibm.wala.core</artifactId>
+            <version>1.6.7</version>
+        </dependency>
     </dependencies>
     <build>
         <plugins>

src/main/java/de/tum/cit/ase/ares/api/architecture/ArchitectureSecurityTestCase.java

@@ -39,5 +39,5 @@ public interface ArchitectureSecurityTestCase {
      *
      * @param classes a set of {@link JavaClasses} representing the codebase to which the test case will be applied.
      */
-    void executeArchitectureTestCase(JavaClasses classes);
+    void executeArchitectureTestCase(Object classes);
 }

src/main/java/de/tum/cit/ase/ares/api/architecture/java/CallGraphBuilderUtils.java

@@ -0,0 +1,161 @@
+package de.tum.cit.ase.ares.api.architecture.java;
+
+//<editor-fold desc="Imports">
+
+import com.ibm.wala.classLoader.IClass;
+import com.ibm.wala.classLoader.Language;
+import com.ibm.wala.core.java11.Java9AnalysisScopeReader;
+import com.ibm.wala.ipa.callgraph.*;
+import com.ibm.wala.ipa.callgraph.impl.DefaultEntrypoint;
+import com.ibm.wala.ipa.callgraph.impl.Util;
+import com.ibm.wala.ipa.callgraph.propagation.InstanceKey;
+import com.ibm.wala.ipa.cha.ClassHierarchy;
+import com.ibm.wala.ipa.cha.ClassHierarchyException;
+import com.ibm.wala.ipa.cha.ClassHierarchyFactory;
+import com.ibm.wala.types.ClassLoaderReference;
+import com.ibm.wala.types.TypeReference;
+import com.tngtech.archunit.core.domain.JavaClass;
+import com.tngtech.archunit.core.importer.ClassFileImporter;
+import de.tum.cit.ase.ares.api.architecture.java.wala.ReachabilityChecker;
+
+import java.io.IOException;
+import java.net.URL;
+import java.util.Collections;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import java.util.function.Predicate;
+import java.util.stream.Collectors;
+//</editor-fold>
+
+/**
+ * Utility class to build a call graph from a class path.
+ */
+public class CallGraphBuilderUtils {
+
+    private CallGraphBuilderUtils() {
+        throw new IllegalStateException("Utility class");
+    }
+
+    /**
+     * Class file importer to import the class files.
+     * This is used to import the class files from the URL.
+     */
+    private static final ClassFileImporter classFileImporter = new ClassFileImporter();
+
+    private static final ClassHierarchy classHierarchy;
+
+    private static final AnalysisScope scope;
+
+    static {
+        try {
+            scope = Java9AnalysisScopeReader.instance.makeJavaBinaryAnalysisScope(
+                    System.getProperty("java.class.path"),
+                    null
+            );
+
+            // Build the class hierarchy
+            classHierarchy = ClassHierarchyFactory.make(scope);
+        } catch (ClassHierarchyException | IOException e) {
+            throw new SecurityException("Could not create class hierarchy for student submission", e); // $NON-NLS-1$
+        }
+    }
+
+
+    /**
+     * Try to resolve the class by the given type name.
+     *
+     * @param typeName The type name of the class to resolve.
+     * @return The resolved class if it exists.
+     */
+    public static Optional<JavaClass> tryResolve(String typeName) {
+        // Advice definition uses Reflection and therefor should not be resolved
+        if (typeName.startsWith("de.tum.cit.ase.ares.api.aop.java.aspectj.adviceandpointcut.JavaAspectJFileSystemAdviceDefinitions")) {
+            return Optional.empty();
+        }
+        URL url = CallGraphBuilderUtils.class.getResource("/" + typeName.replace(".", "/") + ".class");
+        try {
+            if (url == null) {
+                return Optional.empty();
+            }
+            return Optional.of(classFileImporter.withImportOption(location -> !location.contains("jrt")).importUrl(url).get(typeName));
+        } catch (IllegalArgumentException e) {
+            return Optional.empty();
+        }
+    }
+
+    /**
+     * Get the immediate subclasses of the given type name.
+     *
+     * @param typeName The type name of the class to get the immediate subclasses.
+     * @return The immediate subclasses of the given type name.
+     */
+    public static Set<JavaClass> getImmediateSubclasses(String typeName) {
+        TypeReference reference = TypeReference.find(ClassLoaderReference.Application, convertTypeName(typeName));
+        if (reference == null) {
+            return Collections.emptySet();
+        }
+        IClass clazz = classHierarchy.lookupClass(reference);
+        if (clazz == null) {
+            return Collections.emptySet();
+        }
+        return classHierarchy
+                .getImmediateSubclasses(clazz)
+                .stream()
+                .map(IClass::getName)
+                .map(Object::toString)
+                .map(CallGraphBuilderUtils::tryResolve)
+                .filter(Optional::isPresent)
+                .map(Optional::get).collect(Collectors.toSet());
+    }
+
+    /**
+     * Convert the type name to the format that can be used in the class file.
+     *
+     * @param typeName The type name to convert.
+     * @return The converted type name.
+     */
+    public static String convertTypeName(String typeName) {
+        if (typeName == null || typeName.isEmpty()) {
+            throw new IllegalArgumentException("Type name cannot be null or empty");
+        }
+        return "L" + typeName.replace('.', '/');
+    }
+
+    /**
+     * Build a call graph from a class path.
+     */
+    public static CallGraph buildCallGraph(String classPathToAnalyze, Predicate<CGNode> securityViolationCheck) {
+        try {
+            // Create a list to store entry points
+            List<DefaultEntrypoint> customEntryPoints = ReachabilityChecker.getEntryPointsFromStudentSubmission(classPathToAnalyze, classHierarchy);
+
+            // Create AnalysisOptions for call graph
+            AnalysisOptions options = new AnalysisOptions(scope, customEntryPoints);
+            options.setTraceStringConstants(false);
+            options.setHandleZeroLengthArray(false);
+            options.setReflectionOptions(AnalysisOptions.ReflectionOptions.NONE);
+
+            // Create call graph builder (n-CFA, context-sensitive, etc.)
+            com.ibm.wala.ipa.callgraph.CallGraphBuilder<InstanceKey> builder = Util.makeZeroOneCFABuilder(Language.JAVA, options, new AnalysisCacheImpl(), classHierarchy);
+
+            // Generate the call graph
+            CallGraph callGraph = builder.makeCallGraph(options, null);
+
+            List<CGNode> violatingMethods = ReachabilityChecker.findReachableMethods(callGraph, callGraph.getEntrypointNodes().iterator(), securityViolationCheck);
+
+            if (violatingMethods != null && !violatingMethods.isEmpty()) {
+                throw new SecurityException(String.format(
+                        "Security violation: Detected %d unauthorized API call(s):%n%s",
+                        violatingMethods.size(),
+                        violatingMethods.stream()
+                                .map(node -> String.format("- %s", node.getMethod().getSignature()))
+                                .collect(Collectors.joining("%n"))
+                ));
+            }
+            return callGraph;
+        } catch (CallGraphBuilderCancelException e) {
+            throw new SecurityException("Error building call graph", e); //$NON-NLS-1$
+        }
+    }
+}

src/main/java/de/tum/cit/ase/ares/api/architecture/java/archunit/JavaArchUnitTestCaseSupported.java → src/main/java/de/tum/cit/ase/ares/api/architecture/java/JavaArchitecturalTestCaseSupported.java

@@ -1,4 +1,4 @@
-package de.tum.cit.ase.ares.api.architecture.java.archunit;
+package de.tum.cit.ase.ares.api.architecture.java;
 
 /**
  * Supported architecture test cases in Java programming language.
@@ -7,7 +7,7 @@
  * @version 2.0.0
  * @since 2.0.0
  */
-public enum JavaArchUnitTestCaseSupported {
+public enum JavaArchitecturalTestCaseSupported {
     /**
      * Architecture test case for the file system interaction.
      */
@@ -27,5 +27,14 @@ public enum JavaArchUnitTestCaseSupported {
     /**
      * Architecture test case for the package import.
      */
-    PACKAGE_IMPORT
+    PACKAGE_IMPORT,
+    /**
+     * Architecture test case for the premature jvm termination.
+     */
+    TERMINATE_JVM,
+    /**
+     * Architecture test case for the reflection.
+     */
+    REFLECTION,
+
 }

src/main/java/de/tum/cit/ase/ares/api/architecture/java/archunit/postcompile/JavaArchitectureTestCaseCollection.java → src/main/java/de/tum/cit/ase/ares/api/architecture/java/JavaArchitectureTestCaseCollection.java

@@ -1,11 +1,12 @@
-package de.tum.cit.ase.ares.api.architecture.java.archunit.postcompile;
+package de.tum.cit.ase.ares.api.architecture.java;
 
 import com.tngtech.archunit.base.DescribedPredicate;
 import com.tngtech.archunit.core.domain.JavaAccess;
 import com.tngtech.archunit.core.domain.JavaClass;
 import com.tngtech.archunit.lang.ArchRule;
 import com.tngtech.archunit.lang.syntax.ArchRuleDefinition;
 import de.tum.cit.ase.ares.api.architecture.java.archunit.FileHandlerConstants;
+import de.tum.cit.ase.ares.api.architecture.java.archunit.postcompile.TransitivelyAccessesMethodsCondition;
 import de.tum.cit.ase.ares.api.util.FileTools;
 
 import java.io.IOException;
@@ -26,7 +27,7 @@ public class JavaArchitectureTestCaseCollection {
      * This method checks if any class in the given package accesses the file system.
      */
     public static final ArchRule NO_CLASS_SHOULD_ACCESS_FILE_SYSTEM = createNoClassShouldHaveMethodRule(
-            "accesses file system",
+            "Accesses file system",
             FileHandlerConstants.JAVA_FILESYSTEM_INTERACTION_METHODS
     );
     //</editor-fold>
@@ -36,7 +37,7 @@ public class JavaArchitectureTestCaseCollection {
      * This method checks if any class in the given package accesses the network.
      */
     public static final ArchRule NO_CLASSES_SHOULD_ACCESS_NETWORK = createNoClassShouldHaveMethodRule(
-            "accesses network",
+            "Accesses network",
             FileHandlerConstants.JAVA_NETWORK_ACCESS_METHODS
     );
     //</editor-fold>
@@ -47,7 +48,7 @@ public class JavaArchitectureTestCaseCollection {
      * This method checks if any class in the given package uses the command line.
      */
     public static final ArchRule NO_CLASSES_SHOULD_TERMINATE_JVM = createNoClassShouldHaveMethodRule(
-            "terminates JVM",
+            "Terminates JVM",
             FileHandlerConstants.JAVA_JVM_TERMINATION_METHODS
     );
     //</editor-fold>
@@ -101,7 +102,8 @@ public static ArchRule noClassesShouldImportForbiddenPackages(Set<String> allowe
                     public boolean test(JavaClass javaClass) {
                         return allowedPackages.stream().noneMatch(allowedPackage -> javaClass.getPackageName().startsWith(allowedPackage));
                     }
-                });
+                })
+                .as("Imports forbidden packages");
     }
 
     private static ArchRule createNoClassShouldHaveMethodRule(
@@ -126,7 +128,8 @@ public boolean test(JavaAccess<?> javaAccess) {
                                                 .startsWith(method)
                                 );
                     }
-                }));
+                }))
+                .as(ruleName);
     }
     //</editor-fold>
 
@@ -135,21 +138,21 @@ public boolean test(JavaAccess<?> javaAccess) {
      * This method checks if any class in the given package uses reflection.
      */
     public static final ArchRule NO_CLASSES_SHOULD_USE_REFLECTION = createNoClassShouldHaveMethodRule(
-            "uses Reflection",
+            "Uses Reflection",
             FileHandlerConstants.JAVA_REFLECTION_METHODS
     );
     //</editor-fold>
 
     //<editor-fold desc="Command Execution related rule">
     public static final ArchRule NO_CLASSES_SHOULD_EXECUTE_COMMANDS = createNoClassShouldHaveMethodRule(
-            "executes commands",
+            "Executes commands",
             FileHandlerConstants.JAVA_COMMAND_EXECUTION_METHODS
     );
     //</editor-fold>
 
     //<editor-fold desc="Thread Creation related rule">
     public static final ArchRule NO_CLASSES_SHOULD_CREATE_THREADS = createNoClassShouldHaveMethodRule(
-            "creates threads",
+            "Manipulates threads",
             FileHandlerConstants.JAVA_THREAD_CREATION_METHODS
     );
     //</editor-fold>

src/main/java/de/tum/cit/ase/ares/api/architecture/java/archunit/JavaArchUnitSecurityTestCase.java

@@ -3,14 +3,15 @@
 //<editor-fold desc="Imports">
 import com.tngtech.archunit.core.domain.JavaClasses;
 import de.tum.cit.ase.ares.api.architecture.ArchitectureSecurityTestCase;
-import de.tum.cit.ase.ares.api.architecture.java.archunit.postcompile.JavaArchitectureTestCaseCollection;
+import de.tum.cit.ase.ares.api.architecture.java.JavaArchitecturalTestCaseSupported;
+import de.tum.cit.ase.ares.api.architecture.java.JavaArchitectureTestCaseCollection;
 import de.tum.cit.ase.ares.api.policy.SecurityPolicy.PackagePermission;
 
 import java.util.HashSet;
 import java.util.Set;
 import java.util.stream.Collectors;
 
-import static de.tum.cit.ase.ares.api.architecture.java.archunit.postcompile.JavaArchitectureTestCaseCollection.getArchitectureRuleFileContent;
+import static de.tum.cit.ase.ares.api.architecture.java.JavaArchitectureTestCaseCollection.getArchitectureRuleFileContent;
 import static de.tum.cit.ase.ares.api.localization.Messages.localized;
 //</editor-fold>
 
@@ -28,7 +29,7 @@ public class JavaArchUnitSecurityTestCase implements ArchitectureSecurityTestCas
     /**
      * Selects the supported architecture test case in the Java programming language.
      */
-    private final JavaArchUnitTestCaseSupported javaArchitectureTestCaseSupported;
+    private final JavaArchitecturalTestCaseSupported javaArchitectureTestCaseSupported;
 
     /**
      * List of allowed packages to be imported.
@@ -42,13 +43,13 @@ public class JavaArchUnitSecurityTestCase implements ArchitectureSecurityTestCas
      *
      * @param javaArchitectureTestCaseSupported Selects the supported architecture test case in the Java programming language
      */
-    public JavaArchUnitSecurityTestCase(JavaArchUnitTestCaseSupported javaArchitectureTestCaseSupported) {
+    public JavaArchUnitSecurityTestCase(JavaArchitecturalTestCaseSupported javaArchitectureTestCaseSupported) {
         super();
         this.javaArchitectureTestCaseSupported = javaArchitectureTestCaseSupported;
         this.allowedPackages = new HashSet<>();
     }
 
-    public JavaArchUnitSecurityTestCase(JavaArchUnitTestCaseSupported javaArchitectureTestCaseSupported, Set<PackagePermission> packages) {
+    public JavaArchUnitSecurityTestCase(JavaArchitecturalTestCaseSupported javaArchitectureTestCaseSupported, Set<PackagePermission> packages) {
         super();
         this.javaArchitectureTestCaseSupported = javaArchitectureTestCaseSupported;
         this.allowedPackages = packages.stream().map(PackagePermission::importTheFollowingPackage).collect(Collectors.toSet());
@@ -74,32 +75,47 @@ public String writeArchitectureTestCase() {
      * Runs the architecture test case in the Java programming language.
      */
     @Override
-    public void executeArchitectureTestCase(JavaClasses classes) {
+    public void executeArchitectureTestCase(Object classes) {
+        // check if instance of object
+        if (!(classes instanceof JavaClasses javaClasses)) {
+            throw new IllegalArgumentException(localized("security.archunit.invalid.argument"));
+        }
+
         try {
             switch (this.javaArchitectureTestCaseSupported) {
                 case PACKAGE_IMPORT ->
                         JavaArchitectureTestCaseCollection
                                 .noClassesShouldImportForbiddenPackages(allowedPackages)
-                                .check(classes);
+                                .check(javaClasses);
+                case REFLECTION ->
+                        JavaArchitectureTestCaseCollection
+                                .NO_CLASSES_SHOULD_USE_REFLECTION
+                                .check(javaClasses);
+                case TERMINATE_JVM ->
+                        JavaArchitectureTestCaseCollection
+                                .NO_CLASSES_SHOULD_TERMINATE_JVM
+                                .check(javaClasses);
                 case FILESYSTEM_INTERACTION ->
                         JavaArchitectureTestCaseCollection
                                 .NO_CLASS_SHOULD_ACCESS_FILE_SYSTEM
-                                .check(classes);
+                                .check(javaClasses);
                 case NETWORK_CONNECTION ->
                         JavaArchitectureTestCaseCollection
                                 .NO_CLASSES_SHOULD_ACCESS_NETWORK
-                                .check(classes);
+                                .check(javaClasses);
                 case THREAD_CREATION ->
-                        JavaArchitectureTestCaseCollection.NO_CLASSES_SHOULD_CREATE_THREADS.check(classes);
+                        JavaArchitectureTestCaseCollection.NO_CLASSES_SHOULD_CREATE_THREADS.check(javaClasses);
                 case COMMAND_EXECUTION ->
-                        JavaArchitectureTestCaseCollection.NO_CLASSES_SHOULD_EXECUTE_COMMANDS.check(classes);
+                        JavaArchitectureTestCaseCollection.NO_CLASSES_SHOULD_EXECUTE_COMMANDS.check(javaClasses);
                 default -> throw new UnsupportedOperationException("Not implemented yet");
             }
         } catch (AssertionError e) {
+            String[] split = null;
             if (e.getMessage() == null || e.getMessage().split("\n").length < 2) {
                 throw new SecurityException(localized("security.archunit.illegal.execution", e.getMessage()));
             }
-            throw new SecurityException(localized("security.archunit.illegal.execution", e.getMessage().split("\n")[1]));
+            split = e.getMessage().split("\n");
+            throw new SecurityException(localized("security.archunit.violation.error", split[0].replaceAll(".*?'(.*?)'.*\r", "$1"), split[1]));
         }
     }
     //</editor-fold>