Instruction Tier

The instruction tier uses the set of data flow paths found at the basic block tier to construct a data flow graph that shows the data flow relationships between formal input and formal output parameters passed between instructions. Like the basic block tier, instruction tier data flow paths also explicitly identify the formal parameter index that data is being passed to. The graph is generated using the one-to-many table that was populated during generalization which conveys the instruction data flow paths that were generalized by the set of qualified basic block data flow paths. The graph that is generated as a result is shown in figure 19. The instruction tier data flow paths represent the final step taken by the algorithm as they contain the most specific description of data flow paths.

Figure 19: Instruction tier data flow graph for the web application representing potentially reachable paths between the source and sink flow descriptor. These paths were qualified by reachable paths found at the basic block tier.

Using the graph, the algorithm is again employed to find paths between the source and sink flow descriptor at the instruction tier. Due to the simplicity of the example application, only a few data flow paths were rendered. The complete data flow path from fout(get_QueryString, 0) to fin(Start, 0) can be clearly seen along with source lines that are encountered along the way.