A Type System for Format Strings Konstantin Weitz weitzkon@uw.edu - - PowerPoint PPT Presentation

▶
a type system for format strings
SMART_READER_LITE
LIVE PREVIEW

A Type System for Format Strings Konstantin Weitz weitzkon@uw.edu - - PowerPoint PPT Presentation

Sep 25, 2022 195 likes •795 views

A Type System for Format Strings Konstantin Weitz weitzkon@uw.edu Gene Kim genelkim@uw.edu Siwakorn Srisakaokul ping128@uw.edu Michael D. Ernst mernst@uw.edu 1 Format String APIs printf(name: %s age: %d, Konstantin, 25);

slide-1
SLIDE 1

1

A Type System for Format Strings

Konstantin Weitz Gene Kim Siwakorn Srisakaokul Michael D. Ernst weitzkon@uw.edu genelkim@uw.edu ping128@uw.edu mernst@uw.edu

slide-2
SLIDE 2

2

Format String APIs

printf(“name: %s age: %d”, “Konstantin”, 25); “name: Konstantin age: 25”

slide-3
SLIDE 3

3

Format String APIs

Problem: easy to misuse

printf(“name: %s age: %d”, “Konstantin”, 25); “name: Konstantin age: 25”

slide-4
SLIDE 4

4

Implications of Misuse

  • Unintelligible Output

printf(“cannot open %s”); > cannot open oN

slide-5
SLIDE 5

5

Implications of Misuse

  • Unintelligible Output
  • Program Crash

printf(“%d”, “str”);

slide-6
SLIDE 6

6

Implications of Misuse

  • Unintelligible Output
  • Program Crash
  • Security Vulnerability

printf(“%.*d%n”, attack_code, 0, return_addr);

slide-7
SLIDE 7

7

Root Causes of Misuse

  • Invalid Format String Syntax

printf(“%y”);

slide-8
SLIDE 8

8

Root Causes of Misuse

  • Invalid Format String Syntax
  • Wrong Number of Arguments

printf(“%d %s”, 42);

slide-9
SLIDE 9

9

Root Causes of Misuse

  • Invalid Format String Syntax
  • Wrong Number of Arguments
  • Wrong Type of Arguments

printf(“%d”, 7.0);

slide-10
SLIDE 10

10

Goal

Statically guarantee that format methods are not misused

slide-11
SLIDE 11

11

Goal

Statically guarantee that format methods are not misused

  • Verify Format String Syntax
slide-12
SLIDE 12

12

Goal

Statically guarantee that format methods are not misused

  • Verify Format String Syntax
  • Verify Number of Arguments
slide-13
SLIDE 13

13

Goal

Statically guarantee that format methods are not misused

  • Verify Format String Syntax
  • Verify Number of Arguments
  • Verify Type of Arguments
slide-14
SLIDE 14

14

Goal

Statically guarantee that format methods are not misused

  • Verify Format String Syntax
  • Verify Number of Arguments
  • Verify Type of Arguments
  • Ease of Use
slide-15
SLIDE 15

15

Types Prevent Errors

var fs; printf(fs, 5);

slide-16
SLIDE 16

16

Types Prevent Errors

var fs; fs = 42; fs = “%y”; fs = “%d %c”; fs = “%f”; fs = “%d”; printf(fs, 5);

slide-17
SLIDE 17

17

Types Prevent Errors

var fs; fs = 42; fs = “%y”; // invalid syntax fs = “%d %c”; // invalid number of args fs = “%f”; // invalid type of args fs = “%d”; printf(fs, 5);

slide-18
SLIDE 18

18

Types Prevent Errors

String fs; fs = 42; fs = “%y”; // invalid syntax fs = “%d %c”; // invalid number of args fs = “%f”; // invalid type of args fs = “%d”; printf(fs, 5);

slide-19
SLIDE 19

19

Types Prevent Errors

@Format String fs; fs = 42; fs = “%y”; // invalid syntax fs = “%d %c”; // invalid number of args fs = “%f”; // invalid type of args fs = “%d”; printf(fs, 5);

slide-20
SLIDE 20

20

Types Prevent Errors

@Format(INT) String fs; fs = 42; fs = “%y”; // invalid syntax fs = “%d %c”; // invalid number of args fs = “%f”; // invalid type of args fs = “%d”; printf(fs, 5);

slide-21
SLIDE 21

21

Types Prevent Errors

@Format(INT) String fs; fs = 42; fs = “%y”; // invalid syntax fs = “%d %c”; // invalid number of args fs = “%f”; // invalid type of args fs = “%d”; printf(fs, 5);

Conversion Category

slide-22
SLIDE 22

22

Java Conversion Categories

= {Byte, Short, Integer, Long}

printf(“%d”, (T)v );

T ∈

slide-23
SLIDE 23

23

Java Conversion Categories

= {Float, Double} = {Byte, Short, Integer, Long}

printf(“%f”, (T)v );

T ∈

slide-24
SLIDE 24

24

Java Conversion Categories

= {Object, ...} = {Float, Double} = {Byte, Short, Integer, Long}

printf(“%s”, (T)v );

T ∈

slide-25
SLIDE 25

25

Java Conversion Categories

= {Object, ...} = {Float, Double} = {Byte, Short, Integer, Long}

slide-26
SLIDE 26

26

Java Conversion Categories

= {Object, ...} = {Float, Double} = {Byte, Short, Integer, Long}

slide-27
SLIDE 27

27

Java Conversion Categories

slide-28
SLIDE 28

28

Subtyping

@Format(FLOAT) String fs;

printf(fs, 3.14);

slide-29
SLIDE 29

29

Subtyping

@Format(FLOAT) String fs;

printf(fs, 3.14);

fs = “%f” // ok fs = “%s” // ok: %s weaker than %f fs = “ ” // ok: argument ignored

slide-30
SLIDE 30

30

Subtyping

@Format(FLOAT) String fs;

printf(fs, 3.14);

fs = “%f” // ok fs = “%s” // ok: %s weaker than %f fs = “ ” // ok: argument ignored

slide-31
SLIDE 31

31

Subtyping

@Format(FLOAT) String fs;

printf(fs, 3.14);

fs = “%f” // ok fs = “%s” // ok: %s weaker than %f fs = “ ” // ok: argument ignored

slide-32
SLIDE 32

32

Polymorphism

void log(String fs, Object... args) { printf(fs, args); } log(“%f”, 3.14); log(“%d”, 1337);

slide-33
SLIDE 33

33

Polymorphism

void log(@FormatFor(“args”) String fs, Object... args) { printf(fs, args); } log(“%f”, 3.14); log(“%d”, 1337);

slide-34
SLIDE 34

34

Complex Format Strings

@Format(FLOAT,GENERAL) String fs = “%2$s = %1$+10.4f”; printf(fs, 3.14, “pi”);

slide-35
SLIDE 35

35

Type System Instantiation

  • C's printf API

“%s”

  • Go's fmt module

“%[1]s”

  • Java's i18n API

“{0}”

  • Java's Formatter API

“%1$s”

slide-36
SLIDE 36

36

Goal

Statically guarantee that format methods are not misused

  • Verify Format String Syntax
  • Verify Number of Arguments
  • Verify Type of Arguments
  • Ease of Use
slide-37
SLIDE 37

37

Goal

Statically guarantee that format methods are not misused ✔ Verify Format String Syntax

  • Verify Number of Arguments
  • Verify Type of Arguments
  • Ease of Use
slide-38
SLIDE 38

38

Goal

Statically guarantee that format methods are not misused ✔ Verify Format String Syntax ✔ Verify Number of Arguments ✔ Verify Type of Arguments

  • Ease of Use
slide-39
SLIDE 39

39

Goal

Statically guarantee that format methods are not misused ✔ Verify Format String Syntax ✔ Verify Number of Arguments ✔ Verify Type of Arguments

  • Ease of Use ?
slide-40
SLIDE 40

40

Evaluation

Project LoC Bugs Submit Fixed Hadoop 678k 3 2 Hive 538k 1 Lucene 664k HBase 569k 2 2 Daikon 205k 95 95 FindBugs 122k 3 3 Total Total 2777k 104 102

slide-41
SLIDE 41

41

Evaluation - Usage Efgort

Project Format Calls Type Annotations False Positives Bugs @Format @FormatFor @Suppress Warnings Hadoop 332 20 6 22 3 Hive 213 1 7 1 Lucene 148 2 HBase 96 1 2 Daikon 1583 30 7 95 FindBugs 133 7 1 3 3 Total Total 2505 29 38 40 104

slide-42
SLIDE 42

42

Evaluation - Usage Efgort

Project Format Calls Type Annotations False Positives Bugs @Format @FormatFor @Suppress Warnings Hadoop 332 20 6 22 3 Hive 213 1 7 1 Lucene 148 2 HBase 96 1 2 Daikon 1583 30 7 95 FindBugs 133 7 1 3 3 Total Total 2505 29 38 40 104

Annotation Burden 107

slide-43
SLIDE 43

43

Evaluation - Usage Efgort

Project Format Calls Type Annotations False Positives Bugs @Format @FormatFor @Suppress Warnings Hadoop 332 20 6 22 3 Hive 213 1 7 1 Lucene 148 2 HBase 96 1 2 Daikon 1583 30 7 95 FindBugs 133 7 1 3 3 Total Total 2505 29 38 40 104

Annotation Burden 107 Bugs Revealed 104

slide-44
SLIDE 44

44

Evaluation - Usage Efgort

Project Format Calls Type Annotations False Positives Bugs @Format @FormatFor @Suppress Warnings Hadoop 332 20 6 22 3 Hive 213 1 7 1 Lucene 148 2 HBase 96 1 2 Daikon 1583 30 7 95 FindBugs 133 7 1 3 3 Total Total 2505 29 38 40 104

Annotation Burden 107 Bugs Revealed 104 = = 1.0

slide-45
SLIDE 45

45

Evaluation - Usage Efgort

Project Format Calls Type Annotations False Positives Bugs @Format @FormatFor @Suppress Warnings Hadoop 332 20 6 22 3 Hive 213 1 7 1 Lucene 148 2 HBase 96 1 2 Daikon 1583 30 7 95 FindBugs 133 7 1 3 3 Total Total 2505 29 38 40 104

slide-46
SLIDE 46

46

Project Constant Propagation Dynamic Width Exception Handled Misc Hadoop 10 6 6 Hive 3 2 1 1 Lucene 2 HBase 1 Daikon 6 1 FindBugs 3 Total Total 13 14 4 9

Evaluation – False Positives

slide-47
SLIDE 47

47

Project Constant Propagation Dynamic Width Exception Handled Misc Hadoop 10 6 6 Hive 3 2 1 1 Lucene 2 HBase 1 Daikon 6 1 FindBugs 3 Total Total 13 14 4 9

Evaluation – False Positives

printf(“%”+“d”, 42);

slide-48
SLIDE 48

48

Project Constant Propagation Dynamic Width Exception Handled Misc Hadoop 10 6 6 Hive 3 2 1 1 Lucene 2 HBase 1 Daikon 6 1 FindBugs 3 Total Total 13 14 4 9

Evaluation – False Positives

String fs = “%” + width + “d”; printf(fs, 42);

slide-49
SLIDE 49

49

Project Constant Propagation Dynamic Width Exception Handled Misc Hadoop 10 6 6 Hive 3 2 1 1 Lucene 2 HBase 1 Daikon 6 1 FindBugs 3 Total Total 13 14 4 9

Evaluation – False Positives

try { printf(userInput, 4.12); } catch (FormatExp e) {/*error handling*/}

slide-50
SLIDE 50

50

Project Constant Propagation Dynamic Width Exception Handled Misc Hadoop 10 6 6 Hive 3 2 1 1 Lucene 2 HBase 1 Daikon 6 1 FindBugs 3 Total Total 13 14 4 9

Evaluation – False Positives

<T> void f(String fs, Iterator<T> iter) { System.out.format(fs, iter.next()); }

slide-51
SLIDE 51

51

Goal

Statically guarantee that format methods are not misused ✔ Verify Format String Syntax ✔ Verify Number of Arguments ✔ Verify Type of Arguments

  • Ease of Use
slide-52
SLIDE 52

52

Goal

Statically guarantee that format methods are not misused ✔ Verify Format String Syntax ✔ Verify Number of Arguments ✔ Verify Type of Arguments ✔ Ease of Use

slide-53
SLIDE 53

53

Related Work

  • Dynamic Checking[0][1][2]

☺ ☹ No compile time guarantee Easy to use

[0] C. Cowan, et al. USENIX Security Symposium. 2001. [1] T. Tsai, et al. Avaya Labs. 2001. [2] M. F. Ringenburg and D. Grossman. CCS 2005

slide-54
SLIDE 54

54

Related Work

  • Dynamic Checking[0][1][2]
  • Alternative APIs[3][4]

☺ Guarantees no misuse ☹

  • No i18n
  • Less readable

[3] Danvy. Journal of FP. 1998. [4] ISO/IEC 14882:2011. C++, 2011.

cout << “We detected ” << setw(10) << n << “bugs”;

slide-55
SLIDE 55

55

Related Work

  • Dynamic Checking[0][1][2]
  • Alternative APIs[3][4]
  • Dependent Type Systems[5]

☺ ☹ ●No mainstream language support

  • Hard to use
  • Expressive
  • Guarantees

no misuse

[5] J. Gronski, et.al. SFP Workshop, 2006.

slide-56
SLIDE 56

56

Related Work

  • Dynamic Checking[0][1][2]
  • Alternative APIs[3][4]
  • Dependent Type Systems[5]
  • Lightweight Analysis[6][7][8]

☺ ☹ … for constant format strings

  • nly

[6] Leroy, et al. The OCaml system release 4.01. [7] GCC -Wformat. gcc.gnu.org/onlinedocs/gcc/Warning-Options.html [8] Edward Aftandilian, et al. SCAM 2012.

Guarantees no misuse ...

slide-57
SLIDE 57

57

Related Work

  • Dynamic Checking[0][1][2]
  • Alternative APIs[3][4]
  • Dependent Type Systems[5]
  • Lightweight Analysis[6][7][8]
  • Static Taint Analysis[9]

☺ ☹ Type/number of arguments and syntax not verifjed

[9] U. Shankar, et al. USENIX Security Symposium. 2001.

Guards against format strings from input

slide-58
SLIDE 58

58

Contributions

  • Type system with guarantee that

format methods are not misused

  • Instantiation for Java
  • Evaluation shows type system:

– Finds bugs (104 bugs, 102 fjxed) – Easy to use (1.0 annotations / bug)

http://checkerframework.org

weitzkon@uw.edu