Merge pull request #1378 from WebFuzzing/finalize-taintable-gene

arcuri82 · web-flow · commit 0bf19a9829b4 · 2025-11-06T15:56:31.000+01:00
Finalize taintable gene
diff --git a/core/src/main/kotlin/org/evomaster/core/mongo/MongoInsertBuilder.kt b/core/src/main/kotlin/org/evomaster/core/mongo/MongoInsertBuilder.kt
@@ -2,6 +2,6 @@ package org.evomaster.core.mongo
 
 class MongoInsertBuilder {
     fun createMongoInsertionAction(database: String, collection: String, documentsType: String): MongoDbAction{
-        return MongoDbAction(database, collection, documentsType)
+        return MongoDbAction(database, collection, documentsType).apply { forceNewTaints() }
     }
 }
diff --git a/core/src/main/kotlin/org/evomaster/core/problem/httpws/service/HttpWsSampler.kt b/core/src/main/kotlin/org/evomaster/core/problem/httpws/service/HttpWsSampler.kt
@@ -37,6 +37,7 @@ abstract class HttpWsSampler<T> : ApiWsSampler<T>() where T : Individual{
         val action = randomness.choose(actionCluster).copy() as HttpWsAction
         action.doInitialize(randomness)
         action.auth = getRandomAuth(noAuthP)
+        action.forceNewTaints()
         return action
     }
 
diff --git a/core/src/main/kotlin/org/evomaster/core/problem/rest/resource/RestResourceNode.kt b/core/src/main/kotlin/org/evomaster/core/problem/rest/resource/RestResourceNode.kt
@@ -408,6 +408,7 @@ open class RestResourceNode(
         } else {
             copy.doInitialize(randomness)
         }
+        copy.forceNewTaints()
 
         val template = templates[copy.verb.toString()]
                 ?: throw IllegalArgumentException("${copy.verb} is not one of templates of ${this.path}")
@@ -558,14 +559,15 @@ open class RestResourceNode(
             action.randomize(randomness, false)
         else
             action.doInitialize(randomness)
+        action.forceNewTaints()
         return action
     }
 
 
     private fun templateSelected(callsTemplate: CallsTemplate){
         templates.getValue(callsTemplate.template).times += 1
     }
-    
+
     private fun selectTemplate(predicate: (CallsTemplate) -> Boolean, randomness: Randomness, chosen : Map<String, CallsTemplate>?=null, chooseLessVisit : Boolean = false) : CallsTemplate?{
         val ts = if(chosen == null) templates.filter { predicate(it.value) } else chosen.filter { predicate(it.value) }
         if(ts.isEmpty())
@@ -965,4 +967,4 @@ data class ParamInfo(
      * @return whether the param is possibly needed to refer to other params
      */
     fun possiblyReferToOthers() = probOfReferringToOther > 0.0
-}
+}
diff --git a/core/src/main/kotlin/org/evomaster/core/problem/rest/service/HttpSemanticsService.kt b/core/src/main/kotlin/org/evomaster/core/problem/rest/service/HttpSemanticsService.kt
@@ -179,6 +179,7 @@ class HttpSemanticsService {
                     ?: return@forEach // we have a DELETE but no GET on this endpoint?
                 val getOp = getDef.copy() as RestCallAction
                 getOp.doInitialize(randomness)
+                getOp.forceNewTaints()
                 getOp.bindToSamePathResolution(last)
                 getOp.auth = last.auth
                 //TODO: what if the GET needs WM handling?
@@ -197,4 +198,4 @@ class HttpSemanticsService {
         }
     }
 
-}
+}
diff --git a/core/src/main/kotlin/org/evomaster/core/problem/rest/service/RestIndividualBuilder.kt b/core/src/main/kotlin/org/evomaster/core/problem/rest/service/RestIndividualBuilder.kt
@@ -155,6 +155,7 @@ class RestIndividualBuilder {
             res.doInitialize(randomness)
         }
         res.auth = target.auth
+        res.forceNewTaints()
         res.bindToSamePathResolution(target)
 
         return res
@@ -191,6 +192,7 @@ class RestIndividualBuilder {
             res.doInitialize(randomness)
         }
         res.auth = previous.auth
+        res.forceNewTaints()
         if(res.path.isEquivalent(previous.path)) {
             res.bindToSamePathResolution(previous)
         }
diff --git a/core/src/main/kotlin/org/evomaster/core/problem/rest/service/SecurityRest.kt b/core/src/main/kotlin/org/evomaster/core/problem/rest/service/SecurityRest.kt
@@ -214,6 +214,7 @@ class SecurityRest {
                             PUT /x BAR
                          */
                         val repeat = lastCall.copy() as RestCallAction
+                        repeat.forceNewTaints()
                         copy.addMainActionInEmptyEnterpriseGroup(action = repeat)
                         copy.resetLocalIdRecursively() //TODO what about links?
                         copy.doInitializeLocalId()
@@ -626,6 +627,7 @@ class SecurityRest {
 
         actions.forEach {
             it.resetLocalIdRecursively()
+            it.forceNewTaints()
             //make sure using same auth
             it.auth = lastAction.auth
             it.usePreviousLocationId = lastAction.usePreviousLocationId
@@ -819,7 +821,9 @@ class SecurityRest {
                 val copyNoAuthLast = copyLast.copy() as RestCallAction
 
                 copyLast.resetLocalIdRecursively()
+                copyLast.forceNewTaints()
                 copyNoAuthLast.resetLocalIdRecursively()
+                copyNoAuthLast.forceNewTaints()
 
 
                 val otherUsers = authSettings.getAllOthers(copyLast.auth.name, HttpWsAuthenticationInfo::class.java)
@@ -969,6 +973,7 @@ class SecurityRest {
         val targetAction = targetInd.seeMainExecutableActions()[targetActionIndex].copy() as RestCallAction
         assert(targetAction.verb == verb && targetAction.path.isEquivalent(path))
         targetAction.resetLocalIdRecursively()
+        targetAction.forceNewTaints()
         targetAction.auth =
             authSettings.getDifferentOne(creationAction.auth.name, HttpWsAuthenticationInfo::class.java, randomness)
 
diff --git a/core/src/main/kotlin/org/evomaster/core/problem/rest/service/sampler/RestSampler.kt b/core/src/main/kotlin/org/evomaster/core/problem/rest/service/sampler/RestSampler.kt
@@ -128,6 +128,7 @@ class RestSampler : AbstractRestSampler(){
             val copy = x.copy() as RestCallAction
             copy.doInitialize(randomness)
             copy.auth = rca.auth
+            copy.forceNewTaints()
             /*
                 This is bit tricky... the id does NOT uniquely identify the action inside an
                 individual, but rather its type.
@@ -338,6 +339,7 @@ class RestSampler : AbstractRestSampler(){
                     val copy = a.value.copy() as RestCallAction
                     copy.auth = auth
                     copy.doInitialize(randomness)
+                    copy.forceNewTaints()
                     val ind = createIndividual(SampleType.SMART, mutableListOf(copy))
                     adHocInitialIndividuals.add(ind)
                 }
diff --git a/core/src/main/kotlin/org/evomaster/core/problem/rpc/service/RPCSampler.kt b/core/src/main/kotlin/org/evomaster/core/problem/rpc/service/RPCSampler.kt
@@ -99,6 +99,7 @@ class RPCSampler: ApiWsSampler<RPCIndividual>() {
             action.setNoAuth()
         }else
             rpcHandler.actionWithRandomAuth(action)
+        action.forceNewTaints()
 
         rpcHandler.actionWithRandomSeeded(action, noSeedProbability)
 
@@ -114,6 +115,7 @@ class RPCSampler: ApiWsSampler<RPCIndividual>() {
             throw IllegalStateException("cannot sample schedule action with empty cluster")
         val action = randomness.choose(scheduleActionCluster).copy() as ScheduleTaskAction
         action.doInitialize(randomness)
+        action.forceNewTaints()
         rpcHandler.scheduleActionWithRandomSeeded(action, noSeedProbability)
         return action
     }
@@ -183,6 +185,7 @@ class RPCSampler: ApiWsSampler<RPCIndividual>() {
                 .forEach { a ->
                     val copy = a.value.copy() as RPCCallAction
                     copy.doInitialize(randomness)
+                    copy.forceNewTaints()
                     rpcHandler.actionWithAllAuth(copy).forEach { actionWithAuth->
                         rpcHandler.actionWithAllCandidates(actionWithAuth)
                             .forEach { actionWithSeeded->
diff --git a/core/src/main/kotlin/org/evomaster/core/search/Individual.kt b/core/src/main/kotlin/org/evomaster/core/search/Individual.kt
@@ -1,5 +1,6 @@
 package org.evomaster.core.search
 
+import org.evomaster.client.java.instrumentation.shared.TaintInputName
 import org.evomaster.core.EMConfig
 import org.evomaster.core.sql.SqlAction
 import org.evomaster.core.sql.SqlActionUtils
@@ -196,8 +197,14 @@ abstract class Individual(
             }
         }
 
-        if(!areAllValidLocalIds()){
-            throw IllegalStateException("There are invalid local ids")
+        val localIdErrors = verifyAllLocalIds()
+        if(localIdErrors.isNotEmpty()){
+            throw IllegalStateException("There are invalid local ids:\n" + localIdErrors.joinToString("\n"))
+        }
+
+        val taintIdErrors = verifyTaintIds()
+        if(taintIdErrors.isNotEmpty()){
+            throw IllegalStateException("There are invalid taint ids:\n" + taintIdErrors.joinToString("\n"))
         }
     }
 
@@ -496,15 +503,53 @@ abstract class Individual(
                 && flatView().run { this.map { it.getLocalId() }.toSet().size == this.size }
     }
 
-    fun areAllValidLocalIds() : Boolean{
+
+    fun verifyTaintIds(): List<String>{
+
+        val all = flatViewAllStructuralElements()
+
+        val taintableGenes = all.filterIsInstance<TaintableGene>()
+            .filter { TaintInputName.isTaintInput(it.getPossiblyTaintedValue()) }
+            .filter { !it.isDependentTaint() }
+
+        val duplicates = CollectionUtils.duplicates(taintableGenes.map { it.getPossiblyTaintedValue() })
+
+        if(duplicates.isEmpty()){
+            return listOf()
+        }
+
+        val errors = mutableListOf<String>()
+
+        duplicates.entries.forEach { d ->
+           val same = taintableGenes.filter { it.getPossiblyTaintedValue() == d.key }.map { it as Gene }
+           if(same.any{ x ->
+               same.any { y ->
+                      y !=x && !y.hasAnyBindingRelationship(x)
+               }
+           }){
+               errors.add("Taint id ${d.key} has duplicate genes that are not related}")
+           }
+        }
+        return errors
+    }
+
+    /**
+     * Return error messages in case of problems.
+     * If all valid, returned list is empty
+     */
+    fun verifyAllLocalIds() : List<String>{
+        val errors = mutableListOf<String>()
         val all = flatViewAllStructuralElements()
         val ids = all.map { it.getLocalId() }
         if(ids.contains(NONE_LOCAL_ID)){
-            return false
+            errors.add("Containing NONE_LOCAL_ID")
         }
         val duplicates = CollectionUtils.duplicates(ids)
         //check for duplicates
-        return duplicates.isEmpty()
+        if(duplicates.isNotEmpty()){
+            duplicates.entries.forEach { errors.add("Id ${it.key} is repeated ${it.value} times") }
+        }
+        return errors
     }
 
 
diff --git a/core/src/main/kotlin/org/evomaster/core/search/StructuralElement.kt b/core/src/main/kotlin/org/evomaster/core/search/StructuralElement.kt
@@ -475,4 +475,21 @@ abstract class StructuralElement (
     fun <T:StructuralElement> getFirstParent(klass: Class<T>) : T? {
         return getFirstParent { klass.isAssignableFrom(it.javaClass) } as T?
     }
+
+    /**
+     * Check if there is any ancestor-descendant relationship between
+     * [this] and [other], or vice-versa
+     */
+    fun areAncestorDescendantRelated(other: StructuralElement) : Boolean{
+        if(this == other){
+            return false
+        }
+        if(this.existAnyParent { it == other }){
+            return true
+        }
+        if(other.existAnyParent { it == this }){
+            return true
+        }
+        return false
+    }
 }
diff --git a/core/src/main/kotlin/org/evomaster/core/search/action/Action.kt b/core/src/main/kotlin/org/evomaster/core/search/action/Action.kt
@@ -3,6 +3,7 @@ package org.evomaster.core.search.action
 import org.evomaster.core.search.Individual
 import org.evomaster.core.search.StructuralElement
 import org.evomaster.core.search.gene.Gene
+import org.evomaster.core.search.gene.interfaces.TaintableGene
 import org.evomaster.core.search.service.Randomness
 import org.slf4j.Logger
 import org.slf4j.LoggerFactory
@@ -76,6 +77,16 @@ abstract class Action(children: List<StructuralElement>) : ActionComponent(
         postRandomizedChecks(randomness)
     }
 
+    fun forceNewTaints(){
+        seeTopGenes().forEach { g ->
+            g.flatView().forEach { r ->
+                if(r is TaintableGene && !r.isDependentTaint()){
+                    r.forceNewTaintId()
+                }
+            }
+        }
+    }
+
     fun isInitialized(): Boolean {
         return seeTopGenes().all { it.initialized }
     }
@@ -107,4 +118,4 @@ abstract class Action(children: List<StructuralElement>) : ActionComponent(
      * once an action is mounted inside an initialized individual
      */
     open fun resolveTempData() : Boolean = true
-}
+}
diff --git a/core/src/main/kotlin/org/evomaster/core/search/gene/Gene.kt b/core/src/main/kotlin/org/evomaster/core/search/gene/Gene.kt
@@ -1076,6 +1076,17 @@ abstract class Gene(
         }
     }
 
+    fun hasAnyBindingRelationship(other: Gene): Boolean {
+        if (other == this) {
+            return false
+        }
+
+        return other.isDirectBoundWith(this)
+                || other.is2DepthDirectBoundWith(this)
+                || other.isAnyParentBoundWith(this)
+                || this.isAnyParentBoundWith(other)
+    }
+
     /**
      * @return whether [this] is directly bound with [gene]
      */
diff --git a/core/src/main/kotlin/org/evomaster/core/search/gene/collection/TaintedArrayGene.kt b/core/src/main/kotlin/org/evomaster/core/search/gene/collection/TaintedArrayGene.kt
@@ -1,6 +1,7 @@
 package org.evomaster.core.search.gene.collection
 
 import org.evomaster.client.java.instrumentation.shared.TaintInputName
+import org.evomaster.core.StaticCounter
 import org.evomaster.core.output.OutputFormat
 import org.evomaster.core.search.gene.Gene
 import org.evomaster.core.search.gene.interfaces.TaintableGene
@@ -17,8 +18,6 @@ import org.evomaster.core.search.service.mutator.genemutation.SubsetGeneMutation
  *
  * This is needed in 2-phase marshalling, where a string is marshalled into an array of maps,
  * and then each map value is marshalled into a DTO.
- *
- * TODO needs refactoring
  */
 class TaintedArrayGene(
 
@@ -158,10 +157,17 @@ class TaintedArrayGene(
     }
 
     override fun hasDormantGenes(): Boolean {
-        return isResolved() && !isActive //TODO double-check
+        return isResolved() && !isActive
     }
 
     override fun forceNewTaintId() {
-        //TODO
+        taintedValue = TaintInputName.getTaintName(StaticCounter.getAndIncrease())
+    }
+
+    override fun evolve() {
+        if(!hasDormantGenes()){
+            return
+        }
+        activate()
     }
 }
diff --git a/core/src/main/kotlin/org/evomaster/core/search/gene/collection/TaintedMapGene.kt b/core/src/main/kotlin/org/evomaster/core/search/gene/collection/TaintedMapGene.kt
@@ -73,12 +73,7 @@ class TaintedMapGene(
         }
     }
 
-    fun evolve(){
-        learnedKeys.forEach { addNewKey(it) }
-        learnedKeys.clear()
-        learnedTypes.entries.forEach { specifyValueTypeForKey(it.key, it.value) }
-        learnedTypes.clear()
-    }
+
 
     fun registerKey(key: String){
         learnedKeys.add(key)
@@ -256,5 +251,14 @@ class TaintedMapGene(
         idGene.second.getWrappedGene(StringGene::class.java)?.value = taintId
     }
 
+    override fun evolve(){
+        if(!hasDormantGenes()){
+            return
+        }
+        learnedKeys.forEach { addNewKey(it) }
+        learnedKeys.clear()
+        learnedTypes.entries.forEach { specifyValueTypeForKey(it.key, it.value) }
+        learnedTypes.clear()
+    }
 
 }
diff --git a/core/src/main/kotlin/org/evomaster/core/search/gene/interfaces/TaintableGene.kt b/core/src/main/kotlin/org/evomaster/core/search/gene/interfaces/TaintableGene.kt
@@ -18,10 +18,16 @@ interface TaintableGene {
      * Make sure the taint id for this gene, if any is in place, is replaced with a new unique one.
      * This is needed for example when copying and pasting actions, to avoid having same id repeated
      * more than once.
-     *
-     * //TODO once properly implemented, should have check unique id as invariant in Individual
      */
     fun forceNewTaintId()
 
-    //TODO evolve()
-}
+    /**
+     * Specify that this taint value is bound to another tainted value
+     */
+    fun isDependentTaint() = false
+
+    /**
+     * If the individual has any dormant gene, do evolve, ie., resolve the taint
+     */
+    fun evolve()
+}
diff --git a/core/src/main/kotlin/org/evomaster/core/search/gene/string/StringGene.kt b/core/src/main/kotlin/org/evomaster/core/search/gene/string/StringGene.kt
diff --git a/core/src/main/kotlin/org/evomaster/core/seeding/service/rest/PirToRest.kt b/core/src/main/kotlin/org/evomaster/core/seeding/service/rest/PirToRest.kt
diff --git a/core/src/main/kotlin/org/evomaster/core/taint/TaintAnalysis.kt b/core/src/main/kotlin/org/evomaster/core/taint/TaintAnalysis.kt

Original file line number	Diff line number	Diff line change
`@@ -2,6 +2,6 @@ package org.evomaster.core.mongo`
`2`	`2`
`3`	`3`	`class MongoInsertBuilder {`
`4`	`4`	`fun createMongoInsertionAction(database: String, collection: String, documentsType: String): MongoDbAction{`
`5`		`- return MongoDbAction(database, collection, documentsType)`
	`5`	`+ return MongoDbAction(database, collection, documentsType).apply { forceNewTaints() }`
`6`	`6`	`}`
`7`	`7`	`}`
Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,7 @@ abstract class HttpWsSampler<T> : ApiWsSampler<T>() where T : Individual{`
`37`	`37`	`val action = randomness.choose(actionCluster).copy() as HttpWsAction`
`38`	`38`	`action.doInitialize(randomness)`
`39`	`39`	`action.auth = getRandomAuth(noAuthP)`
	`40`	`+ action.forceNewTaints()`
`40`	`41`	`return action`
`41`	`42`	`}`
`42`	`43`
Original file line number	Diff line number	Diff line change
`@@ -179,6 +179,7 @@ class HttpSemanticsService {`
`179`	`179`	`?: return@forEach // we have a DELETE but no GET on this endpoint?`
`180`	`180`	`val getOp = getDef.copy() as RestCallAction`
`181`	`181`	`getOp.doInitialize(randomness)`
	`182`	`+ getOp.forceNewTaints()`
`182`	`183`	`getOp.bindToSamePathResolution(last)`
`183`	`184`	`getOp.auth = last.auth`
`184`	`185`	`//TODO: what if the GET needs WM handling?`
`@@ -197,4 +198,4 @@ class HttpSemanticsService {`
`197`	`198`	`}`
`198`	`199`	`}`
`199`	`200`
`200`		`-}`
	`201`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -155,6 +155,7 @@ class RestIndividualBuilder {`
`155`	`155`	`res.doInitialize(randomness)`
`156`	`156`	`}`
`157`	`157`	`res.auth = target.auth`
	`158`	`+ res.forceNewTaints()`
`158`	`159`	`res.bindToSamePathResolution(target)`
`159`	`160`
`160`	`161`	`return res`
`@@ -191,6 +192,7 @@ class RestIndividualBuilder {`
`191`	`192`	`res.doInitialize(randomness)`
`192`	`193`	`}`
`193`	`194`	`res.auth = previous.auth`
	`195`	`+ res.forceNewTaints()`
`194`	`196`	`if(res.path.isEquivalent(previous.path)) {`
`195`	`197`	`res.bindToSamePathResolution(previous)`
`196`	`198`	`}`