taint analysis for org.bson.Document.parse(String) #1036
Conversation
...a/instrumentation/coverage/methodreplacement/thirdpartyclasses/DocumentClassReplacement.java
Outdated
Show resolved
Hide resolved
| // Load the Document class | ||
| Class<?> documentClass; | ||
| try { | ||
| documentClass = Class.forName("org.bson.Document"); |
There was a problem hiding this comment.
in instrumentation, a call to Class.forName is extremely tricky. for example, the classloader of Class and of Mongo driver could be different (eg in a SpringBoot application run with external driver).
have a look at all the shenanigans had to go through in ThirdPartyMethodReplacementClass.getOriginalConstructor.
in other words, this might work in E2E tests, but fail to work in the experiments.
likely would need to use UnitsInfoRecorder.getInstance().getClassLoaders
There was a problem hiding this comment.
I pushed a way of handling class loaders for static methods in ThirdPartyMethodReplacementClass. Please have a look at getOriginalStaticMethod(), specially how the callerName is obtained.
...rc/test/java/org/evomaster/e2etests/spring/rest/mongo/document/BsonDocumentWithMREMTest.java
Outdated
Show resolved
Hide resolved
...test/java/org/evomaster/e2etests/spring/rest/mongo/document/BsonDocumentWithoutMREMTest.java
Outdated
Show resolved
Hide resolved
|
@jgaleotti thx. I LL look at it next week |
No description provided.