ReadonlyanalysisThe abstract interpretation analysis performed by the visitor, defining the abstract domains, their abstract semantics, and the reductions between them.
ReadonlyconfigProtectedcurrentThe current abstract state domain at the currently processed AST node.
Protected ReadonlystateThe state abstract domain used by the abstract interpretation visitor.
Protected ReadonlytraceThe abstract trace of the abstract interpretation visitor mapping node IDs to the abstract state at the respective node.
Protected ReadonlyvisitedProtectedbindProtectedenterRuns the bodies the given call dispatches to, starting from the state at the call, and returns the state control comes back with: the states at their exit points joined. A call already being interpreted is not entered again, so recursion stops at the second entry.
the state at the exit points, or undefined if the call reaches nothing to step into
Gets the inferred abstract state at the location of a specific AST node. This requires that the abstract interpretation visitor has been completed, or at least started.
The abstract state at the node, or undefined if the node has no abstract state for the abstract domain
Gets the inferred abstract state at the location of a specific AST node. This requires that the abstract interpretation visitor has been completed, or at least started.
The ID of the node to get the abstract state at
The abstract state at the node, or undefined if the node has no abstract state for the abstract domain
Gets the inferred abstract state at the location of a specific AST node. This requires that the abstract interpretation visitor has been completed, or at least started.
The abstract state at the node, or undefined if the node has no abstract state for the abstract domain
Gets the inferred abstract trace mapping AST nodes to the inferred abstract state at the respective node.
The inferred abstract trace of the program
Resolves the inferred abstract value of an AST node for one of the abstract domains of the analysis,
by following symbols to their variable origins, arguments to their values, expression lists to their last expression,
and pipes and if expressions to their results.
This requires that the abstract interpretation visitor has been completed, or at least started.
The node (or ID of the node) to get the inferred abstract value for
The name of the abstract domain to get the inferred abstract value for
Optionalstate: StateDomain<AnyAbstractDomain>The inferred abstract value of the node, or undefined if no value was inferred for the node
Resolves the inferred abstract value of an AST node for one of the abstract domains of the analysis,
by following symbols to their variable origins, arguments to their values, expression lists to their last expression,
and pipes and if expressions to their results.
This requires that the abstract interpretation visitor has been completed, or at least started.
The node (or ID of the node) to get the inferred abstract value for
Optionaltype: undefined
The name of the abstract domain to get the inferred abstract value for
Optionalstate: MultiValueStateDomain<The inferred abstract value of the node, or undefined if no value was inferred for the node
Resolves the inferred abstract value of an AST node for one of the abstract domains of the analysis,
by following symbols to their variable origins, arguments to their values, expression lists to their last expression,
and pipes and if expressions to their results.
This requires that the abstract interpretation visitor has been completed, or at least started.
The node (or ID of the node) to get the inferred abstract value for
Optionaltype: Key
The name of the abstract domain to get the inferred abstract value for
Optionalstate: The inferred abstract value of the node, or undefined if no value was inferred for the node
ProtectedgetThe logical the call's only argument resolves to, undefined if the call does not take exactly one
argument or if that argument does not resolve to a single logical.
ProtectedgetProtectedgetCreates the abstract interpretation context that is passed to the abstract semantics of one of the abstract domains of the analysis. The context provides access to the analyzed program and to the abstract states and values inferred for the requested abstract domain so far.
The name of the abstract domain to create the context for
The abstract interpretation context for the requested abstract domain
ProtectedgetGet the dataflow graph vertex for the given id
ProtectedgetGets the inferred abstract state at the end of the program (exit nodes of the control flow graph). This requires that the abstract interpretation visitor has been completed, or at least started.
The name of the abstract domain to get the abstract state for
The inferred abstract state at the end of the program
Gets the inferred abstract state at the end of the program (exit nodes of the control flow graph). This requires that the abstract interpretation visitor has been completed, or at least started.
The inferred abstract state at the end of the program
ProtectedgetProtectedgetProtectedgetA helper function to get the normalized AST node for the given id or fail if it does not exist.
ProtectedgetProtectedgetEverything the control flow may come from to reach this vertex, together with the branch it took to get here. Skipped vertices hold no state of their own, so what led into them is reported instead.
ProtectedgetThe abstract state one predecessor contributes, joined into the state at the current vertex.
The condition semantics of the analysis are applied at branches: on the then-branch of if(u) a else b
the predecessor is u and branch.when is true, so u held.
ProtectedgetCreates a view of a multi-value abstract state that only exposes the abstract values of one of the abstract domains of the analysis. All modifications of the returned view are applied to the underlying multi-value abstract state.
The name of the abstract domain to create the state view for
The multi-value abstract state to create the view for (defaults to the current abstract state)
The state abstract domain of the requested abstract domain
ProtectedgetProtectedhandleProtectedinterpretInterprets function bodies no call reached, from the state at their definition (e.g., a Shiny server).
ProtectedisChecks whether a node represents a unsupported (environment-changing) function call (e.g. eval, load, attach, rm, ...)
ProtectedisWe widen wherever the control flow comes back around, i.e. at the node a back edge leads to.
That is what makes the iteration terminate, and it is the loop head whichever loop the code used:
the condition of a while, the binding of a for, or the first statement of a repeat.
ProtectedonProtectedonFires for every call to a *apply function, e.g. lapply(1:10, function(x) { x + 1 }).
ProtectedonFires for every assignment call, e.g. <- in x <- 42, assign("x", 42), or the data.table assign := in DT[, x := 42].
Replacements with a function call on the target side, like names(x) <- 3, go through SemanticCfgGuidedVisitor#onReplacementCall|onReplacementCall instead.
ProtectedonProtectedonFires for every break call, e.g. repeat { break }.
ProtectedonFires for every named call not handled by a specific overload, e.g. foo(x) for a user-defined foo. flowR does not care about the dataflow
impact of these (currently); use SemanticCfgGuidedVisitor#getOrigins|getOrigins to get the call's origins. Anonymous calls, which cannot
be resolved via the active environment, go through SemanticCfgGuidedVisitor#onUnnamedCall|onUnnamedCall instead.
ProtectedonProtected
This function is responsible for dispatching the appropriate event based on a given dataflow vertex. The default serves as a backend for the event functions below, each of which relates to the corresponding BuiltInProcessorMapper handler.
onDispatchFunctionCallOrigins for the aggregation in case the function call target is ambiguous.
ProtectedonProtected
Given a function call that has multiple targets (e.g., two potential built-in definitions). This function is responsible for calling onDispatchFunctionCallOrigin for each of the origins, and aggregating their results (which is just additive by default). If you want to change the behavior in case of multiple potential function definition targets, simply overwrite this function with the logic you desire.
ProtectedonFires for every call to eval, e.g. eval(parse(text = "x + 1")).
ProtectedonFires for every expression list, implicit or explicit, other than the root program (see SemanticCfgGuidedVisitor#onProgram|onProgram
for that) - e.g. the { } block, or the implicit list x <- x + 1 forms in for(x in 1:10) x <- x + 1.
ProtectedonProtectedonFires for every for loop, e.g. for(i in 1:10) { print(i) }.
ProtectedonProtected
This event triggers for every function call that is not a condition, loop, assignment, replacement call, or access operation.
This bundles all function calls that are no conditions, loops, assignments, replacement calls, and access operations.
ProtectedonFires for every anonymous function definition, e.g. function(x) { x + 1 } in lapply(1:10, function(x) { x + 1 }).
ProtectedonFires for every call to get, e.g. get("x"), which is used to access variables in the global environment.
As flowR resolves get during the dataflow analysis, this may also trigger SemanticCfgGuidedVisitor#onVariableUse|onVariableUse.
ProtectedonProtectedonFires for every call that loads a library, e.g. library(dplyr).
ProtectedonFires for every call that (to flowR's knowledge) constructs a list, e.g. list(1, 2, 3).
ProtectedonProtectedonFires for every call that performs a local call, e.g. local({ x <- 1; y <- 2; x + y }).
ProtectedonFires for every constant logical, e.g. TRUE in if(TRUE) { ... }.
ProtectedonFires for every NULL occurrence; other symbols go through SemanticCfgGuidedVisitor#onSymbolConstant|onSymbolConstant instead.
ProtectedonFires for every constant number, e.g. 42 in print(42).
ProtectedonProtectedonFires for the root program node being analyzed.
ProtectedonProtectedonProtectedonFires for every call to Recall, used to recall the function closure (usually in recursive functions).
ProtectedonFires for every call that registers a hook, e.g. on.exit(print("exiting function")).
ProtectedonFires for every repeat loop, e.g. repeat { i <- i + 1; if(i >= 10) break }.
ProtectedonFires for every call that replaces a value in a container, e.g. names in names(x) <- 3 (but not for x <- 3).
Unlike SemanticCfgGuidedVisitor#onAssignmentCall|onAssignmentCall, this does not assign a value to a variable.
ProtectedonFires for every return call, e.g. f <- function() { return(42) }.
ProtectedonFires for every call to rm, e.g. rm(x), which removes variables from the environment.
ProtectedonFires for every call that performs an S3-like dispatch, e.g. UseMethod("print").
ProtectedonFires for every call that performs an S3-like next dispatch, e.g. NextMethod().
ProtectedonFires for every call that performs an S7 dispatch, e.g. S7_dispatch.
ProtectedonFires for every call that creates a new S7 generic, e.g. new_generic.
ProtectedonFires for every call to source, e.g. source("script.R"). Does not provide the resolved source file by default;
use the DataflowGraph to ask for sourced files.
ProtectedonFires for every special binary operator call, i.e. a binary call whose name starts and ends with %, e.g. x %in% y.
ProtectedonProtectedonProtectedonProtectedonFires for every constant string, e.g. "Hello World" in print("Hello World").
ProtectedonFires for every constant symbol used as itself (non-standard evaluation, not resolved to a value), e.g. foo in library(foo) or a in l$a.
NULL goes through SemanticCfgGuidedVisitor#onNullConstant|onNullConstant instead.
ProtectedonFires for every call to try, e.g. try(stop("error")), which catches possible errors.
ProtectedonFires for every anonymous call, e.g. (function(x) { x + 1 })(42) or the second call in a()(), whose target cannot be inferred from a name
(use SemanticCfgGuidedVisitor#getOrigins|getOrigins). Named calls go through SemanticCfgGuidedVisitor#onDefaultFunctionCall|onDefaultFunctionCall instead.
ProtectedonFires for every variable write, e.g. x in x <- 42 or assign("x", 42). Use getOrigins for its origins.
See SemanticCfgGuidedVisitor#onAssignmentCall|onAssignmentCall for the assignment call itself, which also carries the source.
ProtectedonFires for every variable read, e.g. x in print(x). Use getOrigins for its origins.
ProtectedonFires for every call that (to flowR's knowledge) constructs a vector, e.g. c(1, 2, 3).
ProtectedonProtectedonFires for every while loop, e.g. while(i < 10) { i <- i + 1 }.
ProtectedshouldWhether to step into what the given call dispatches to, which is what makes the analysis interprocedural.
Defaults to abstractInterpretation.followCalls; override it to decide per call. A call that reaches no
definition is left alone either way.
ProtectedshouldChecks whether a control flow graph vertex should be skipped during visitation. Every node has exactly one vertex, reached once its operands are evaluated, so nothing is skipped by default; overriding this lets an analysis ignore parts of the program.
ProtectedshouldWhether widening should be performed at a widening point. By default, we perform widening when the number of visits of the widening point reaches the widening threshold of the config.
Start the visiting process.
ProtectedstartProtectedvisitProtectedvisitDispatches SemanticCfgGuidedVisitor#onUnnamedCall|onUnnamedCall for anonymous calls, or SemanticCfgGuidedVisitor#onDispatchFunctionCallOrigins|onDispatchFunctionCallOrigins for named ones; overwrite those instead of this base-dispatch override.
ProtectedvisitDispatches SemanticCfgGuidedVisitor#onFunctionDefinition|onFunctionDefinition; overwrite that instead of this base-dispatch override.
Protectedvisitcall this function to indicate that a node is to be considered visited.
true if the node was not visited before, false otherwise
ProtectedvisitDispatches SemanticCfgGuidedVisitor#onProgram|onProgram for the root program node.
If you overwrite this, call the base implementation too so onProgram keeps firing.
ProtectedvisitSee DataflowAwareCfgGuidedVisitor#visitValue for the base implementation. This now dispatches the value to the appropriate event handler based on its type.
ProtectedvisitDispatches SemanticCfgGuidedVisitor#onVariableDefinition|onVariableDefinition; overwrite that instead of this base-dispatch override.
ProtectedvisitDispatches SemanticCfgGuidedVisitor#onVariableUse|onVariableUse; overwrite that instead of this base-dispatch override.
Abstract interpreter conducting taint analyses, i.e. applying finite taint lattices on the control-flow graph. All components are evaluated simultaneously during a single control-flow traversal and their taints are combined into a product of the lattice values per CFG node, joined (and widened) component-wise. Optional reductions turn the otherwise direct product into a reduced product, allowing the component analyses to refine each other. A node reaching Bottom marks a finding, so it does not collapse the state.
Please prefer using the FlowrAnalyzer.taint method to create a taint analysis.