File | Kind | Size | Size w/o PC Chains | Method | Type of Infoflow Error | Cause | Resolution | Comments | |
various | {Secret} <= {} | various | various debugging messages behind DEBUG flag checks | needed to change each System.out behind a DEBUG flag into a Debug.println | 62 changes (mostly automatic w/find and replace) | ||||
dbfFileTable.java | {Secret} <= {} | 2 | 1 | getColumn | implicit | when specified row is null, debugging message | System.out changed to Debug.println | ||
{Secret} <= {} | 4 | 1 | getColumn | implicit | when specified row is empty, debugging message | System.out changed to Debug.println | |||
dbfFile.java | {Secret} <= {} | 11 | 8 | AlterTableDropCol | implicit | when value is received from cache, System.out | System.out changed to Debug.println | ||
tsColumn.java | {Secret} <= {} | 8 | 7 | compareTo | implicit | if sort type is unknown, System.out | System.out changed to Debug.println | ||
tinySQLGlobals.java | {Secret} <= {} | 10 | 8 | writeLongNames | implicit | if long column names can't be updated, System.out | System.out changed to Debug.println | ||
tinySQLCmd.java | {Secret} <= {} | 24 | 19 | main | false positive | field tokenizer used for both public data (tinyCmd) and secret data (tsRow) | parameterized FieldTokenizer to FieldTokenizer[label L] and labeled return values of methods | FALSE POSITIVE | |
tinySQLCmd.java | {Secret} <= {} | 24 | 19 | main | System.out behind DEBUG flag | Debug.println | |||
tinySQLCmd.java | {Secret} <= {} | 24 | 19 | displayResults | System.out behind DEBUG flag | Debug.println | |||
tinySQLCmd.java | {Secret} <= {} | 24 | 19 | main | System.out behind DEBUG flag | Debug.println | |||
tsRow.java | {Secret} <= {} | 22 | 16 | compareTo | if sort type is unknown, System.out | Debug.println | |||
tinySQLGlobals.java | {Secret} <= {} | 11 | 8 | writeLongNames | System.out behind DEBUG flag | Debug.println | |||
tinySQLParser.java | {Secret} <= {} | 35 | 21 | validateColumns | during table parsing, outputs if validation fails | ||||
tinySQLCmd.java | {Secret} <= {} | 14 | 13 | displayResults | outputs data from each column of result set to file output | encrypt | occurs on a SELECT and a SHOW TYPES – ideally we would like to declassify the result set at each individual point. | ||
tinySQLCmd.java | {Secret} <= {} | 20 | 15 | main | reused “i” variable for different loops | multiple loop counter variables | FALSE POSITIVE | ||
tinySQLCmd.java | {Secret} <= {} | 17 | 14 | displayResults | outputs data from table result set to file output during a DESCRIBE command | declassify | declassified individual data from result set | ||
tinySQLCmd.java | {Secret} <= {} | 20 | 17 | main | explicit | outputs database product version to user | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 21 | 17 | main | implicit | if SELECT command returns no results, output a message “Null ResultSet returned from query” | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 22 | 16 | displayResults | implicit | if displaying no results from SELECT, DESCRIBE, SHOW TYPES, output error message | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 27 | 23 | dbConnect | explicit | outputs the number of tinySQL tables upon connecting | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 28 | 23 | dbConnect | implicit | if there are no tinySQL tables when connecting, outputs ann appropriate message | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 27 | 23 | main | explicit | on SHOW TABLES, outputs table names | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 18 | 17 | main | explicit | on SELECT, display column metadata – column name, width, etc | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 21 | 20 | main | explicit | outputs database product type to user | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 29 | 26 | main | implicit | outputs a number of tables equal to the total tables in the program | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 11 | 11 | displayResults | explicit | outputs result metadata for column headers | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 13 | 11 | displayResults | implicit | outputs a number of lines equal to the contents of the result set | declassify | ||
tinySQLCmd.java | {Secret} <= {} | 13 | 11 | main | implicit | DESCRIBE writes out a number of lines equal to the contents of the result set | declassify | ||