Information flow missing data

[trombonehero]

In the linked test program, there is a private data access in f(), which propagates the data to its caller e(), and from there up to main(). Then main() calls a(), which calls b(), etc. Data accesses in c() and d() should be allowed, since c() is annotated as an ephemeral "mysandbox" sandbox.

So, I expected SOAAP to report the following data flow:

f -> e -> main -> a -> b

In the SOAAP-generated JSON file, however, there are no such traces. I do get some correct information about the private accesses in a, b, f and main: in all four cases, the data source is correctly shown as line 10 (which is in f()). However, there is no trace showing how the data propagates from f() to b(), and there is no indication at all of a private data access in e(). Now, there might be a valid argument that e() doesn’t “access” the private data, but it is definitely involved in conducting the data along the path to main(), a() and b().

[trombonehero]

For posterity, the test program was:

#include "soaap.h"

class Foo {
    public:
    int x __soaap_private("mysandbox");
};

int f() {
    Foo f;
    return f.x;
}

int e() {
    return f();
}

__soaap_vuln_fn("CVE xxx-yyyy-00001")
void d(int i) {
}

__soaap_sandbox_ephemeral("mysandbox")
void c(int i) {
      d(i);
}

void b(int i) {
      c(i);
}

__soaap_vuln_fn("CVE xxx-yyyy-00002")
void a(int i) {
      b(i);
}

int main(int arg, char** argv) {
    int x = e();
    a(x);
    return 0;
}

and SOAAP generated the following JSON:

{
  "soaap": {
    "vulnerability_warning": [
      {
        "function": "d(int)",
        "sandbox": "mysandbox",
        "location": {
          "file": "test.cc",
          "line": 18
        },
        "type": "cve",
        "cve": [
          {
            "id": "CVE xxx-yyyy-00001"
          }
        ],
        "restricted_rights": "true",
        "rights_leaked": {
          "private": [
            {
              "type": "struct_member",
              "name": "f"
            }
          ]
        },
        "trace_ref": "!trace0"
      },
      {
        "function": "a(int)",
        "sandbox": null,
        "location": {
          "file": "test.cc",
          "line": 31
        },
        "restricted_rights": false,
        "type": "cve",
        "cve": [
          {
            "id": "CVE xxx-yyyy-00002"
          }
        ],
        "trace_ref": "!trace1"
      }
    ],
    "global_access_warning": [
    ],
    "global_lost_update": [
    ],
    "syscall_warning": [
    ],
    "cap_rights_warning": [
    ],
    "privileged_call": [
    ],
    "sandboxed_func": [
    ],
    "access_origin_warning": [
    ],
    "classified_warning": [
    ],
    "private_access": [
      {
        "function": "main",
        "sandbox_private": [
          {
            "name": "mysandbox"
          }
        ],
        "sources": [
          {
            "location": {
              "line": 10,
              "file": "test.cc"
            }
          }
        ],
        "location": {
          "line": 37,
          "file": "test.cc"
        }
      },
      {
        "function": "f()",
        "sandbox_private": [
          {
            "name": "mysandbox"
          }
        ],
        "sources": [
          {
            "location": {
              "line": 10,
              "file": "test.cc"
            }
          }
        ],
        "location": {
          "line": 10,
          "file": "test.cc"
        }
      },
      {
        "function": "a(int)",
        "sandbox_private": [
          {
            "name": "mysandbox"
          }
        ],
        "sources": [
          {
            "location": {
              "line": 10,
              "file": "test.cc"
            }
          }
        ],
        "location": {
          "line": 32,
          "file": "test.cc"
        }
      },
      {
        "function": "b(int)",
        "sandbox_private": [
          {
            "name": "mysandbox"
          }
        ],
        "sources": [
          {
            "location": {
              "line": 10,
              "file": "test.cc"
            }
          }
        ],
        "location": {
          "line": 27,
          "file": "test.cc"
        }
      }
    ],
    "private_leak": [
    ],
    "!trace0": {
      "name": "!trace0",
      "trace": [
        {
          "function": "c(int)",
          "location": {
            "file": "test.cc",
            "line": 23
          }
        },
        {
          "function": "b(int)",
          "location": {
            "file": "test.cc",
            "line": 27
          }
        },
        {
          "function": "a(int)",
          "location": {
            "file": "test.cc",
            "line": 32
          }
        },
        {
          "trace_ref": "!trace1"
        }
      ]
    },
    "!trace1": {
      "name": "!trace1",
      "trace": [
        {
          "function": "main",
          "location": {
            "file": "test.cc",
            "line": 37
          }
        }
      ]
    }
  }
}