---
# System prepended metadata

title: Case studies
tags: [partial analysis]

---

---
tags: partial analysis
title: Case studies
---

# False-Positive Case Study

## Index
1. Get the list of types of tests (unique cases)
2. Provide a 1~3 lines of each examples for each tests
3. For each tool whether they can handle or not
4. Can't handle -> change the code to let it handle


---

## 1 & 2. List of types of tests
<!-- try unique cases -->
### Array with foreach case
Over-approximation because one of index in array is tained

```php=
    $temp_array[0][0] = $_POST['abcd']; // Source
    $temp_array[0][1] = non-sensitive;
    
    foreach($temp_array as $x => $y){
        sink($y[0]); // TP
        sink($y[1]); // False-positive occurs (ground truth: not detected)
    }
```
<!--* Foreach statement case
    blah blah -->
    
### Unreachable function case
When there is function between the Sink and the Source, false positive occurs because the tool cannot go into the function code. 
For example, even though the function returns null(line1~4, external_function), tools detect XSS vulnerability since Sink(echo in the line 9) is used with Source($GET[] in the line 6)

```php=
function external_function($user_input)
{
    return null; 
}

$user_input = $_GET['url'];      //Source
$tainted_array = external_function($user_input)

echo $tainted_array[0];   //Sink, False positive occurs
``` 

### If-statement case
The tool cannot execute if statements so that it should be detected if sink is in the predicates
```php=
$data_0 = '';
$data_1 = '';
function my_func(){
    global $data_0, $data_1;
    ... 
}
$url = $_GET['url']; // Source
$data = my_func($url) // propagate

if(!empty($data_1))
    echo $data_1 // Sink -> FP: cannot detect 
```

---

## 3. Whether tools can handle or not

| Case | RIPS | psalm | phan | phpstan | PHPVuln | Progpilot |
| - | - | - | - | - | - | - |
| Array with foreach  | X | X | X | X | X | X |
| Unreachable Function | X | X | X | X | X | X |
| If-statement | V | X | X | X | X | X |
* 1. remove ip exposure
    * We shall focus on the program structures. Need to consider what particular program structure/language primitives would cause issues.
* 2. For array, foreach, function, if-statement => make their name more descriptive (try to capture what's the root cause of the issue)
    * e.g., function(arg=>ret): blindly propagating function args to return
        * May use a simple way `function(arg=>ret)` after defining its meaning (i.e., blindly ...)
---

## 4. Cases that cannot be handled by the tool (which tool?)
<!-- if a tool can't handle, what will be the closest way to change the code to let it handle. -->
###  Case NAME with tool X,Y,Z 

why?? cannot detect 
```php=
function temp_func(){
    this code block is for php 
    // comment here
    foreach(array as key=>val){
        coool
    }
}
``` - Modified code to be detected by the tool


###  Case NAME with tool Y

```php=
function temp_func(){
    this code block is for php 
    // comment here
    foreach(array as key=>val){
        coool
    }
}
```



---


## Appendix
### Static Analysis Tool for PHP

| Tool | Taint Analysis | Open-source | Year |
| - | - | - | - |
| [RIPS](https://sourceforge.net/projects/rips-scanner/files/) | O | O | 2013 |
| [psalm](https://psalm.dev/) | O (not default) | O | |
| [PHPStan](https://phpstan.org/) | X | O | |
| [Phan](https://phpqa.io/projects/phan.html) | O (couldn't apply plugin) | O | |
| Scrutinizer | O (not default) | X | |
| PHPVuln | O | O | |
| PHP Vul. Hunter | O | O | |
| PHPmetrics | X | O | |
| PMF | O | O | |
| Progpilot | O | O | |


### Sample file list 
- Array with foreach case
    website-1437958\plugins\jetpack\class.jetpack-debugger.php
- Unreachable function case 
       website-1437958-wp-contents-plug-ins/jetpack/modules/after-the-deadline/proxy.php 
- If-statement case
    website-1437958\plugins\jetpack\modules\after-the-deadline\proxy.php
- IP exposure (reg. expression) case
    website-1437958\plugins\all-in-one-seo-pack\all_in_one_seo_pack.php
    


