TaintTesterChecker.cpp revision 360784 
1//== TaintTesterChecker.cpp ----------------------------------- -*- C++ -*--=//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This checker can be used for testing how taint data is propagated.
10//
11//===----------------------------------------------------------------------===//
12
13#include "Taint.h"
14#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
16#include "clang/StaticAnalyzer/Core/Checker.h"
17#include "clang/StaticAnalyzer/Core/CheckerManager.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19
20using namespace clang;
21using namespace ento;
22using namespace taint;
23
24namespace {
25class TaintTesterChecker : public Checker< check::PostStmt<Expr> > {
26
27  mutable std::unique_ptr<BugType> BT;
28  void initBugType() const;
29
30  /// Given a pointer argument, get the symbol of the value it contains
31  /// (points to).
32  SymbolRef getPointedToSymbol(CheckerContext &C,
33                               const Expr* Arg,
34                               bool IssueWarning = true) const;
35
36public:
37  void checkPostStmt(const Expr *E, CheckerContext &C) const;
38};
39}
40
41inline void TaintTesterChecker::initBugType() const {
42  if (!BT)
43    BT.reset(new BugType(this, "Tainted data", "General"));
44}
45
46void TaintTesterChecker::checkPostStmt(const Expr *E,
47                                       CheckerContext &C) const {
48  ProgramStateRef State = C.getState();
49  if (!State)
50    return;
51
52  if (isTainted(State, E, C.getLocationContext())) {
53    if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
54      initBugType();
55      auto report = std::make_unique<PathSensitiveBugReport>(*BT, "tainted", N);
56      report->addRange(E->getSourceRange());
57      C.emitReport(std::move(report));
58    }
59  }
60}
61
62void ento::registerTaintTesterChecker(CheckerManager &mgr) {
63  mgr.registerChecker<TaintTesterChecker>();
64}
65
66bool ento::shouldRegisterTaintTesterChecker(const LangOptions &LO) {
67  return true;
68}
69