File | Kind | Size | Size w/o PC Chains | Method | Type of Infoflow Error | Cause | Resolution | Comments | |
POP3Processor.java | Secret <= Tainted | 13 | 13 | handleList | explicit | write size of each message in mailbox | declassify | ||
POP3Processor.java | Secret <= Tainted | 13 | 13 | handleList | explicit | write size of each message with # > argument | declassify | ||
POP3Processor.java | Secret <= Tainted | 17 | 17 | handleRetr | explicit | write specified message to user (outside while loop) | encrypt | could use one declassifier by rewriting as do/while loop | |
POP3Processor.java | Secret <= Tainted | 17 | 17 | handleRetr | explicit | write specified message to user (inside while loop) | encrypt | could use one declassifier by rewriting as do/while loop | |
POP3Processor.java | Secret <= Tainted | 17 | 17 | handleTop | explicit | write specified message headers to user (outside while loop) | encrypt | could use one declassifier by rewriting as do/while loop | |
POP3Processor.java | Secret <= Tainted | 17 | 17 | handleTop | explicit | write specified message headers to user (inside while loop) | encrypt | could use one declassifier by rewriting as do/while loop | |
POP3Processor.java | Secret <= Tainted | 17 | 17 | handleTop | explicit | write specified message to user (outside while loop) | encrypt | could use one declassifier by rewriting as do/while loop | |
POP3Processor.java | Secret <= Tainted | 17 | 17 | handleTop | explicit | write specified message to user (inside while loop) | encrypt | could use one declassifier by rewriting as do/while loop | |
POP3Processor.java | Secret <= Tainted | 29 | 23 | authenticate | implicit | if user tries to log on, check if the mailbox is locked or not – notify user if succeeds/fails in login attempt | declassify | ||
POP3Processor.java | Secret <= Tainted | 25 | 17 | handleList | implicit | if user attempts to LIST a declassified message, write MESSAGE_NO_SUCH_MESSAGE | declassify | ||
POP3Processor.java | Secret <= Tainted | 25 | 17 | handleRetr | implicit | if user attempts to RETR a declassified message, write MESSAGE_NO_SUCH_MESSAGE | declassify | ||
POP3Processor.java | Secret <= Tainted | 25 | 17 | handleDele | implicit | if user attempts to DELE a deleted message, write MESSAGE_ALREADY_DELETED | declassify | ||
POP3Processor.java | Secret <= Tainted | 25 | 17 | handleTop | implicit | if user attempts to TOP a deleted message, write MESSAGE_NO_SUCH_MESSAGE | declassify | ||
POP3Processor.java | Secret <= Tainted | 25 | 17 | handleUidl | implicit | if user attempts to UIDL a deleted message, write MESSAGE_ALREADY_DELETED (specified messages) | declassify | ||
POP3Processor.java | Secret <= Tainted | 24 | 17 | handleUidl | explicit | UIDL outputs a message's unique ID (specified messages) | declassify | could encrypt, though would need to handle decryption from user | |
POP3Processor.java | Secret <= Tainted | 28 | 20 | handleUidl | explicit | UIDL outputs a message's unique ID (no arguments) | declassify | ||
POP3Processor.java | Secret <= Tainted | 24 | 17 | handleUidl | implicit | if user calls UIDL, only give UIDL for a message if it is not deleted | declassify | ||
POP3Processor.java | Secret <= Tainted | 13 | 11 | authenticate | implicit | during login, accept or fail based on whether the entered password is correct | declassify | ||
POP3Processor.java | Secret <= Tainted | 12 | 12 | handleStat | explicit | writes the total number of messages | declassify | ||
POP3Processor.java | Secret <= Tainted | 13 | 13 | handleList | implicit | lists the total number of messages in the mailbox | declassify | ||
POP3Processor.java | Secret <= Tainted | 14 | 13 | handleList | implicit | lists the total number of messages in the mailbox (after specified message) | declassify | ||
POP3Processor.java | Secret <= Tainted | 14 | 13 | handleRetr | implicit | retrieves a message if it exists | declassify | ||
POP3Processor.java | Secret <= Tainted | 14 | 13 | handleDele | implicit | deletes a message if it exists (tests if specified message is > than the total number of messages) | declassify | could refactor this to a “doesMessageNumber” exist and only use one declassify statement | |
POP3Processor.java | Secret <= Tainted | 14 | 13 | handleTop | implicit | does not TOP the message if it does not exist (tests if specified message is > than total number of messages) | declassify | ||
POP3Processor.java | Secret <= Tainted | 15 | 13 | handleUidl | implicit | gives # of UIDLs equal to the total number of messages | declassify | ||
POP3Processor.java | Secret <= Tainted | 14 | 13 | handleUidl | implicit | does not give UIDL for messages if it does not exist (tests if specified message is > than total number of messages) | declassify | ||
POP3Processor.java | Secret <= Tainted | 16 | 16 | handleStat | explicit | outputs the total size of user's mailbox | declassify | ||
POP3Processor.java | Secret <= Tainted | 17 | 17 | handleList | explicit | outputs the total size of user's mailbox | declassify | ||
POP3Processor.java | Secret <= Tainted | 27 | 20 | authenticate | implicit | only logs you in If you specify a valid user name | declassify | merged with password authenticate release (note: server does NOT give different messages for bad password/bad user) | |
SMTPProcessor.java | Secret <= Tainted | 15 | 13 | handleCommands | explicit | DATA command leaks size of message's to address | declassify | ||
SMTPProcessor.java | Secret <= Tainted | 23 | 19 | handleData | implicit | can't send a message larger than maximum size | declassify | ||
SMTPSender.java | Secret <= Tainted | 27 | 18 | deliver | implicit | deliver a message to a user either remotely or locally based on whether the message is to a remote or local user | declassify | of course | |
SMTPSender.java | Secret <= Tainted | 27 | 18 | deliver | implicit | deliver a number of messages equal to the to: addresses in a message's field | declassify | ||
SMTPSender.java | Secret <= Tainted | 37 | 25 | deliver | implicit | number of addresses that failed delivery | declassify | ||
SMTPSender.java | Secret <= Tainted | 48 | 35 | deliver | explicit | if the message has a delivery time less than the system time, don't deliver | declassify | ||
SMTPRemoteSender.java | Secret <= Tainted | 24 | 21 | sendData | explicit | send message data over the wires | encrypt | ||
26 | 22 | deliver | implicit | number of addresses that failed delivery – number of bounce messages sent | declassify | ||||
SMTPRemoteSender.java | Secret <= Tainted | 24 | 21 | sendData | implicit | send message data over the wires a number of times equal to the lines in the message | declassify | ||
SMTPSender.java | Secret <= Tainted | 34 | 22 | run | implicit | deliver a number of messages equal to the messages in the user directory – need to declassify file path, etc. | declassify | ??? | |
SMTPRemoteSender.java | Secret <= Tainted | 26 | 19 | sendIntro | explicit | ELHO intro contains one of configuration manager's local domains | declassify | ||
SMTPRemoteSender.java | Secret <= Tainted | 26 | 19 | sendIntro | explicit | HELO intro contains one of configuration manager's local domains | declassify | ||
SMTPSender.java | Secret <= Tainted | 27 | 20 | deliver | implicit | if the message deliver fails AND is from MAILER_DAEMON, then move message to a special folder rather than attempt resend | declassify | ||
SMTPSender.java | Secret <= Tainted | 25 | 20 | deliver | explicit | MAIL FROM contains sender | declassify | I sure hope so | |
SMTPRemoteSender.java | Secret <= Tainted | 25 | 20 | deliver | explicit | RCTP TO contains recipient | declassify |
| |
SMTPRemoteSender.java | Secret <= Tainted | 52 | 41 | connect | explicit | Socket is opened to a port specified by configuration manager | declassify | ||
SMTPRemoteSender.java | Secret <= Tainted | 52 | 40 | connect | explicit | Socket is opened to a host specified by configuration manager | declassify | ||
SMTPRemoteSender.java | Secret <= Tainted | 50 | 39 | connect | implicit | Socket is tried to be opened a number of times equal to mxEntries.length | declassify | ||
SMTPRemoteSender.java | Secret <= Tainted | 55 | 42 | sendIntro | implicit | AUTH LOGIN only written if mxEntry username is non-null | declassify | ||
SMTPRemoteSender.java | Secret <= Tainted | 57 | 45 | sendIntro | explicit | mxEntry username written to socket during AUTH LOGIN | declassify | ||
SMTPRemoteSender.java | Secret <= Tainted | 57 | 45 | sendIntro | explicit | mxEntry password written to socket during AUTH LOGIN (hashed password, I hope?) | declassify or encrypt | ||
File | Kind | Size | Size w/o PC Chains | Method | Type of Infoflow Error | Cause | Resolution | Comments | |
SMTPProcessor.java | Tainted <= Secret | 19 | 14 | handleRcptTo | implicit | create delivery address if the rcpt address is valid (check delivery service to see if it accepts a client's IP and hostname) | endorse | FALSE POSITIVE. created email address is not stored in system. | |
SMTPProcessor.java | Tainted <= Secret | 23 | 23 | handleData | explicit | write client IP as a string into message which is added to user's mailbox | endorse | who cares? | |
SMTPProcessor.java | Tainted <= Secret | 25 | 25 | handleData | explicit | write information from socket into message which is added to user's mailbox | sanitize | MIGHT BE IMPORTANT | |
SMTPProcessor.java | Tainted <= Secret | 27 | 26 | handleData | implicit | keep writing data off the socket until a “.” is encountered (indicating the end of the message) | endorse | MIGHT BE IMPORTANT | |
POP3Processor.java | Tainted <= Secret | 22 | 20 | parseCommand | implicit/explicit | potentially quit POP3 session based off of input from client socket | sanitize | endorsed entire input | |
POP3Processor.java | Tainted <= Secret | 23 | 20 | authenticate | implicit | begin a login session if the user enters COMMAND_USER command | endorse | ||
POP3Processor.java | Tainted <= Secret | 24 | 21 | parseArgument | implicit/explicit | make decisions based on argument to command received from client (in particular, passwords, etc) | sanitize | endorsed entire input | |
SMTPProcessor.java | Tainted <= Secret | 24 | 23 | parseAddress | implicit/explicit | make decisions based on output email address | sanitize | endorsed entire input | |
SMTPProcessor.java | Tainted <= Secret | 24 | 23 | handleCommands | implicit | make decisions based on whether the input string is a FROM command | sanitize | needed to annotate return value as untainted | |
SMTPProcessor.java | Tainted <= Secret | 27 | 23 | handleData | implicit | make decisions based on checking if the input string starts with “RCTP TO” (no special sanitizer) | sanitize | ||
SMTPProcessor.java | Tainted <= Secret | 28 | 24 | parseCommand | implicit | command parser function | sanitize | ||
SMTPProcessor.java | Tainted <= Secret | 28 | 24 | handleCommands | implicit | make decisions based on checking if the input string starts with “MAIL FROM” (no special sanitizer) | sanitize | ||
SMTPProcessor.java | Tainted <= Secret | 32 | 28 | parseArgument | implicit/explicit | argument parser function | sanitize | ||
SMTPProcessor.java | Tainted <= Secret | acceptAddress | explicit | needed to explicitly declassify argument to a function that was called under different security contexts | FALSE POSITIVE ? | ||||
DeliveryService.java | Tainted <= Secret | 43 | 36 | isAuthenticated | explicit | needed to declassify clientIp for each use inside a method that checks if it is among the authenticated Ips | |||
SMTPRemoteSender.java | Tainted <= Secret | 37 | 34 | read | |||||