summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
Commit message (Collapse)AuthorAgeFilesLines
* [analyzer] Add support for namespaces to GenericTaintCheckerBorsik Gabor2019-12-151-58/+123
| | | | | | | | | | | | | This patch introduces the namespaces for the configured functions and also enables the use of the member functions. I added an optional Scope field for every configured function. Functions without Scope match for every function regardless of the namespace. Functions with Scope will match if the full name of the function starts with the Scope. Multiple functions can exist with the same name. Differential Revision: https://reviews.llvm.org/D70878
* [analyzer] Add custom filter functions for GenericTaintCheckerBorsik Gabor2019-11-231-33/+60
| | | | | | | | | | | This patch is the last of the series of patches which allow the user to annotate their functions with taint propagation rules. I implemented the use of the configured filtering functions. These functions can remove taintedness from the symbols which are passed at the specified arguments to the filters. Differential Revision: https://reviews.llvm.org/D59516
* [analyzer] NFC: Introduce sub-classes for path-sensitive and basic reports.Artem Dergachev2019-09-091-1/+1
| | | | | | | | | | | | | Checkers are now required to specify whether they're creating a path-sensitive report or a path-insensitive report by constructing an object of the respective type. This makes BugReporter more independent from the rest of the Static Analyzer because all Analyzer-specific code is now in sub-classes. Differential Revision: https://reviews.llvm.org/D66572 llvm-svn: 371450
* Move prop-sink branch to monorepo.Gabor Borsik2019-09-081-29/+65
| | | | llvm-svn: 371342
* [Clang] Migrate llvm::make_unique to std::make_uniqueJonas Devlieghere2019-08-141-2/+2
| | | | | | | | | | Now that we've moved to C++14, we no longer need the llvm::make_unique implementation from STLExtras.h. This patch is a mechanical replacement of (hopefully) all the llvm::make_unique instances across the monorepo. Differential revision: https://reviews.llvm.org/D66259 llvm-svn: 368942
* [analyzer] Don't delete TaintConfig copy constructorAlex Langford2019-08-141-2/+2
| | | | | | | | | | | | | | | | | | | | | Summary: Explicitly deleting the copy constructor makes compiling the function `ento::registerGenericTaintChecker` difficult with some compilers. When we construct an `llvm::Optional<TaintConfig>`, the optional is constructed with a const TaintConfig reference which it then uses to invoke the deleted TaintConfig copy constructor. I've observered this failing with clang 3.8 on Ubuntu 16.04. Reviewers: compnerd, Szelethus, boga95, NoQ, alexshap Subscribers: xazax.hun, baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy, dkrupp, Charusso, llvm-commits, cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D66192 llvm-svn: 368779
* Buildbot fix for r367190Gabor Borsik2019-07-281-1/+1
| | | | llvm-svn: 367193
* [analyzer] Add yaml parser to GenericTaintCheckerGabor Borsik2019-07-281-22/+156
| | | | | | | | | | | | | | | | | | | | | While we implemented taint propagation rules for several builtin/standard functions, there's a natural desire for users to add such rules to custom functions. A series of patches will implement an option that allows users to annotate their functions with taint propagation rules through a YAML file. This one adds parsing of the configuration file, which may be specified in the commands line with the analyzer config: alpha.security.taint.TaintPropagation:Config. The configuration may contain propagation rules, filter functions (remove taint) and sink functions (give a warning if it gets a tainted value). I also added a new header for future checkers to conveniently read YAML files as checker options. Differential Revision: https://reviews.llvm.org/D59555 llvm-svn: 367190
* [analyzer] Move taint API from ProgramState to a separate header. NFC.Artem Dergachev2019-03-291-6/+17
| | | | | | | | | | It is now an inter-checker communication API, similar to the one that connects MallocChecker/CStringChecker/InnerPointerChecker: simply a set of setters and getters for a state trait. Differential Revision: https://reviews.llvm.org/D59861 llvm-svn: 357326
* [analyzer] Use the new infrastructure of expressing taint propagation, NFCKristof Umann2019-03-081-126/+58
| | | | | | | | | | | | | | | | | | | | | | In D55734, we implemented a far more general way of describing taint propagation rules for functions, like being able to specify an unlimited amount of source and destination parameters. Previously, we didn't have a particularly elegant way of expressing the propagation rules for functions that always return (either through an out-param or return value) a tainted value. In this patch, we model these functions similarly to other ones, by assigning them a TaintPropagationRule that describes that they "create a tainted value out of nothing". The socket C function is somewhat special, because for certain parameters (for example, if we supply localhost as parameter), none of the out-params should be tainted. For this, we added a general solution of being able to specify custom taint propagation rules through function pointers. Patch by Gábor Borsik! Differential Revision: https://reviews.llvm.org/D59055 llvm-svn: 355703
* [analyzer] Fix taint propagation in GenericTaintCheckerKristof Umann2019-03-051-1/+1
| | | | | | | | | | | The gets function has no SrcArgs. Because the default value for isTainted was false, it didn't mark its DstArgs as tainted. Patch by Gábor Borsik! Differential Revision: https://reviews.llvm.org/D58828 llvm-svn: 355396
* [analyzer] NFC: GenericTaintChecker: Revise rule specification mechanisms.Artem Dergachev2019-01-301-112/+103
| | | | | | | | | | | | | | | | Provide a more powerful and at the same time more readable way of specifying taint propagation rules for known functions within the checker. Now it should be possible to specify an unlimited amount of source and destination parameters for taint propagation. No functional change intended just yet. Patch by Gábor Borsik! Differential Revision: https://reviews.llvm.org/D55734 llvm-svn: 352572
* [analyzer] Supply all checkers with a shouldRegister functionKristof Umann2019-01-261-0/+4
| | | | | | | | | | | | | | | | | | Introduce the boolean ento::shouldRegister##CHECKERNAME(const LangOptions &LO) function very similarly to ento::register##CHECKERNAME. This will force every checker to implement this function, but maybe it isn't that bad: I saw a lot of ObjC or C++ specific checkers that should probably not register themselves based on some LangOptions (mine too), but they do anyways. A big benefit of this is that all registry functions now register their checker, once it is called, registration is guaranteed. This patch is a part of a greater effort to reinvent checker registration, more info here: D54438#1315953 Differential Revision: https://reviews.llvm.org/D55424 llvm-svn: 352277
* Update the file headers across all of the LLVM projects in the monorepoChandler Carruth2019-01-191-4/+3
| | | | | | | | | | | | | | | | | to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
* [analyzer] GenericTaint: Fix formatting to prepare for incoming improvements.Artem Dergachev2018-12-191-107/+107
| | | | | | | | Patch by Gábor Borsik! Differential Revision: https://reviews.llvm.org/D54918 llvm-svn: 349698
* [analyzer][NFC] Move CheckerRegistry from the Core directory to FrontendKristof Umann2018-12-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ClangCheckerRegistry is a very non-obvious, poorly documented, weird concept. It derives from CheckerRegistry, and is placed in lib/StaticAnalyzer/Frontend, whereas it's base is located in lib/StaticAnalyzer/Core. It was, from what I can imagine, used to circumvent the problem that the registry functions of the checkers are located in the clangStaticAnalyzerCheckers library, but that library depends on clangStaticAnalyzerCore. However, clangStaticAnalyzerFrontend depends on both of those libraries. One can make the observation however, that CheckerRegistry has no place in Core, it isn't used there at all! The only place where it is used is Frontend, which is where it ultimately belongs. This move implies that since include/clang/StaticAnalyzer/Checkers/ClangCheckers.h only contained a single function: class CheckerRegistry; void registerBuiltinCheckers(CheckerRegistry &registry); it had to re purposed, as CheckerRegistry is no longer available to clangStaticAnalyzerCheckers. It was renamed to BuiltinCheckerRegistration.h, which actually describes it a lot better -- it does not contain the registration functions for checkers, but only those generated by the tblgen files. Differential Revision: https://reviews.llvm.org/D54436 llvm-svn: 349275
* Remove \brief commands from doxygen comments.Adrian Prantl2018-05-091-7/+7
| | | | | | | | | | | | | | | | | | | This is similar to the LLVM change https://reviews.llvm.org/D46290. We've been running doxygen with the autobrief option for a couple of years now. This makes the \brief markers into our comments redundant. Since they are a visual distraction and we don't want to encourage more \brief markers in new code either, this patch removes them all. Patch produced by for i in $(git grep -l '\@brief'); do perl -pi -e 's/\@brief //g' $i & done for i in $(git grep -l '\\brief'); do perl -pi -e 's/\\brief //g' $i & done Differential Revision: https://reviews.llvm.org/D46320 llvm-svn: 331834
* [analyzer] Move `TaintBugVisitor` from `GenericTaintChecker.cpp` to ↵Henry Wong2018-04-231-39/+0
| | | | | | | | | | | | | | | | `BugReporterVisitors.h`. Summary: `TaintBugVisitor` is a universal visitor, and many checkers rely on it, such as `ArrayBoundCheckerV2.cpp`, `DivZeroChecker.cpp` and `VLASizeChecker.cpp`. Moving `TaintBugVisitor` to `BugReporterVisitors.h` enables other checker can also track where `tainted` value came from. Reviewers: NoQ, george.karpenkov, xazax.hun Reviewed By: george.karpenkov Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D45682 llvm-svn: 330596
* [analyzer] Improves the logic of GenericTaintChecker identifying stdin.Henry Wong2018-03-051-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: GenericTaintChecker can't recognize stdin in some cases. The reason is that `if (PtrTy->getPointeeType() == C.getASTContext().getFILEType()` does not hold when stdin is encountered. My platform is ubuntu16.04 64bit, gcc 5.4.0, glibc 2.23. The definition of stdin is as follows: ``` __BEGIN_NAMESPACE_STD /* The opaque type of streams. This is the definition used elsewhere. */ typedef struct _IO_FILE FILE; ___END_NAMESPACE_STD ... /* The opaque type of streams. This is the definition used elsewhere. */ typedef struct _IO_FILE __FILE; ... /* Standard streams. */ extern struct _IO_FILE *stdin; /* Standard input stream. */ extern struct _IO_FILE *stdout; /* Standard output stream. */ extern struct _IO_FILE *stderr; /* Standard error output stream. */ ``` The type of stdin is as follows AST: ``` ElaboratedType 0xc911170'struct _IO_FILE'sugar `-RecordType 0xc911150'struct _IO_FILE' `-CXXRecord 0xc923ff0'_IO_FILE' ``` `C.getASTContext().GetFILEType()` is as follows AST: ``` TypedefType 0xc932710 'FILE' sugar |-Typedef 0xc9111c0 'FILE' `-ElaboratedType 0xc911170 'struct _IO_FILE' sugar `-RecordType 0xc911150 'struct _IO_FILE' `-CXXRecord 0xc923ff0 '_IO_FILE' ``` So I think it's better to use `getCanonicalType()`. Reviewers: zaks.anna, NoQ, george.karpenkov, a.sidorin Reviewed By: zaks.anna, a.sidorin Subscribers: a.sidorin, cfe-commits, xazax.hun, szepet, MTC Differential Revision: https://reviews.llvm.org/D39159 llvm-svn: 326709
* [analyzer] introduce getSVal(Stmt *) helper on ExplodedNode, make sure the ↵George Karpenkov2018-01-171-2/+2
| | | | | | | | | | | | | | | | | | helper is used consistently In most cases using `N->getState()->getSVal(E, N->getLocationContext())` is ugly, verbose, and also opens up more surface area for bugs if an inconsistent location context is used. This patch introduces a helper on an exploded node, and ensures consistent usage of either `ExplodedNode::getSVal` or `CheckContext::getSVal` across the codebase. As a result, a large number of redundant lines is removed. Differential Revision: https://reviews.llvm.org/D42155 llvm-svn: 322753
* [analyzer] In getSVal() API, disable auto-detection of void type as char type.Artem Dergachev2017-12-121-4/+13
| | | | | | | | | | | | | | | | | | This is a follow-up from r314910. When a checker developer attempts to dereference a location in memory through ProgramState::getSVal(Loc) or ProgramState::getSVal(const MemRegion *), without specifying the second optional QualType parameter for the type of the value he tries to find at this location, the type is auto-detected from location type. If the location represents a value beyond a void pointer, we thought that auto-detecting the type as 'char' is a good idea. However, in most practical cases, the correct behavior would be to specify the type explicitly, as it is available from other sources, and the few cases where we actually need to take a 'char' are workarounds rather than an intended behavior. Therefore, try to fail with an easy-to-understand assertion when asked to read from a void pointer location. Differential Revision: https://reviews.llvm.org/D38801 llvm-svn: 320451
* [analyzer] Support partially tainted records.Artem Dergachev2017-05-291-59/+24
| | | | | | | | | | | | | | | | The analyzer's taint analysis can now reason about structures or arrays originating from taint sources in which only certain sections are tainted. In particular, it also benefits modeling functions like read(), which may read tainted data into a section of a structure, but RegionStore is incapable of expressing the fact that the rest of the structure remains intact, even if we try to model read() directly. Patch by Vlad Tsyrklevich! Differential revision: https://reviews.llvm.org/D28445 llvm-svn: 304162
* [analyzer] Extend taint propagation and checking to support LazyCompoundValAnna Zaks2017-03-091-0/+37
| | | | | | | | A patch by Vlad Tsyrklevich! Differential Revision: https://reviews.llvm.org/D28445 llvm-svn: 297326
* [analyzer] Add bug visitor for taint checker.Anna Zaks2017-03-091-2/+46
| | | | | | | | | | | | Add a bug visitor to the taint checker to make it easy to distinguish where the tainted value originated. This is especially useful when the original taint source is obscured by complex data flow. A patch by Vlad Tsyrklevich! Differential Revision: https://reviews.llvm.org/D30289 llvm-svn: 297324
* Refactor: Simplify boolean conditional return statements in ↵Alexander Kornienko2015-12-281-14/+5
| | | | | | | | | | | | | | | | lib/StaticAnalyzer/Checkers Summary: Use clang-tidy to simplify boolean conditional return values Reviewers: dcoughlin, krememek Subscribers: krememek, cfe-commits Patch by Richard Thomson! Differential Revision: http://reviews.llvm.org/D10021 llvm-svn: 256491
* [analyzer] Add generateErrorNode() APIs to CheckerContext.Devin Coughlin2015-09-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The analyzer trims unnecessary nodes from the exploded graph before reporting path diagnostics. However, in some cases it can trim all nodes (including the error node), leading to an assertion failure (see https://llvm.org/bugs/show_bug.cgi?id=24184). This commit addresses the issue by adding two new APIs to CheckerContext to explicitly create error nodes. Unless the client provides a custom tag, these APIs tag the node with the checker's tag -- preventing it from being trimmed. The generateErrorNode() method creates a sink error node, while generateNonFatalErrorNode() creates an error node for a path that should continue being explored. The intent is that one of these two methods should be used whenever a checker creates an error node. This commit updates the checkers to use these APIs. These APIs (unlike addTransition() and generateSink()) do not take an explicit Pred node. This is because there are not any error nodes in the checkers that were created with an explicit different than the default (the CheckerContext's Pred node). It also changes generateSink() to require state and pred nodes (previously these were optional) to reduce confusion. Additionally, there were several cases where checkers did check whether a generated node could be null; we now explicitly check for null in these places. This commit also includes a test case written by Ying Yi as part of http://reviews.llvm.org/D12163 (that patch originally addressed this issue but was reverted because it introduced false positive regressions). Differential Revision: http://reviews.llvm.org/D12780 llvm-svn: 247859
* [analyzer] Apply whitespace cleanups by Honggyu Kim.Ted Kremenek2015-09-081-5/+5
| | | | llvm-svn: 246978
* Clarify pointer ownership semantics by hoisting the std::unique_ptr creation ↵Aaron Ballman2015-06-231-2/+2
| | | | | | to the caller instead of hiding it in emitReport. NFC. llvm-svn: 240400
* Fixes a typo in a comment.Enrico Pertoso2015-06-031-1/+1
| | | | llvm-svn: 238910
* [C++11] Use 'nullptr'. StaticAnalyzer edition.Craig Topper2014-05-271-7/+7
| | | | llvm-svn: 209642
* remove a bunch of unused private methodsNuno Lopes2014-03-231-1/+0
| | | | | | | | | | | | | | | | | | found with a smarter version of -Wunused-member-function that I'm playwing with. Appologies in advance if I removed someone's WIP code. ARCMigrate/TransProperties.cpp | 8 ----- AST/MicrosoftMangle.cpp | 1 Analysis/AnalysisDeclContext.cpp | 5 --- Analysis/LiveVariables.cpp | 14 ---------- Index/USRGeneration.cpp | 10 ------- Sema/Sema.cpp | 33 +++++++++++++++++++++--- Sema/SemaChecking.cpp | 3 -- Sema/SemaDecl.cpp | 20 ++------------ StaticAnalyzer/Checkers/GenericTaintChecker.cpp | 1 9 files changed, 34 insertions(+), 61 deletions(-) llvm-svn: 204561
* [C++11] Replacing DeclBase iterators specific_attr_begin() and ↵Aaron Ballman2014-03-101-5/+1
| | | | | | specific_attr_end() with iterator_range specific_attrs(). Updating all of the usages of the iterators with range-based for loops. llvm-svn: 203474
* Replace OwningPtr with std::unique_ptr.Ahmed Charles2014-03-071-1/+1
| | | | | | This compiles cleanly with lldb/lld/clang-tools-extra/llvm. llvm-svn: 203279
* Expose the name of the checker producing each diagnostic message.Alexander Kornienko2014-02-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Summary: In clang-tidy we'd like to know the name of the checker producing each diagnostic message. PathDiagnostic has BugType and Category fields, which are both arbitrary human-readable strings, but we need to know the exact name of the checker in the form that can be used in the CheckersControlList option to enable/disable the specific checker. This patch adds the CheckName field to the CheckerBase class, and sets it in the CheckerManager::registerChecker() method, which gets them from the CheckerRegistry. Checkers that implement multiple checks have to store the names of each check in the respective registerXXXChecker method. Reviewers: jordan_rose, krememek Reviewed By: jordan_rose CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D2557 llvm-svn: 201186
* Switched FormatAttr to using an IdentifierArgument instead of a ↵Aaron Ballman2013-09-031-1/+2
| | | | | | StringArgument since that is a more accurate modeling. llvm-svn: 189851
* Include llvm::Optional in clang/Basic/LLVM.hDavid Blaikie2013-02-201-1/+1
| | | | | | Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175679
* Replace SVal llvm::cast support to be well-defined.David Blaikie2013-02-201-1/+1
| | | | | | See r175462 for another example/more details. llvm-svn: 175594
* Remove useless 'llvm::' qualifier from names like StringRef and others that areDmitri Gribenko2013-01-121-1/+1
| | | | | | brought into 'clang' namespace by clang/Basic/LLVM.h llvm-svn: 172323
* Sort all of Clang's files under 'lib', and fix up the broken headersChandler Carruth2012-12-041-3/+3
| | | | | | | | | | | | | uncovered. This required manually correcting all of the incorrect main-module headers I could find, and running the new llvm/utils/sort_includes.py script over the files. I also manually added quite a few missing headers that were uncovered by shuffling the order or moving headers up to be main-module-headers. llvm-svn: 169237
* Pull the Attr iteration parts out of Attr.h, so including DeclBase.h doesn't ↵Benjamin Kramer2012-12-011-0/+1
| | | | | | | | | pull in all the generated Attr code. Required to pull some functions out of line, but this shouldn't have a perf impact. No functionality change. llvm-svn: 169092
* [analyzer] Use nice macros for the common ProgramStateTraits (map, set, list).Jordan Rose2012-11-021-8/+2
| | | | | | | | | Also, move the REGISTER_*_WITH_PROGRAMSTATE macros to ProgramStateTrait.h. This doesn't get rid of /all/ explicit uses of ProgramStatePartialTrait, but it does get a lot of them. llvm-svn: 167276
* [analyzer] Rename 'EmitReport' to 'emitReport'.Jordan Rose2012-11-021-1/+1
| | | | | | No functionality change. llvm-svn: 167275
* Remove trivial destructor from SVal.Benjamin Kramer2012-07-181-1/+0
| | | | | | | | | | This enables the faster SmallVector in clang and also allows clang's unused variable warnings to be more effective. Fix the two instances that popped up. The RetainCountChecker change actually changes functionality, it would be nice if someone from the StaticAnalyzer folks could look at it. llvm-svn: 160444
* [analyzer] Guard against C++ member functions that look like system functions.Jordan Rose2012-07-101-1/+11
| | | | | | | | | C++ method calls and C function calls both appear as CallExprs in the AST. This was causing crashes for an object that had a 'free' method. <rdar://problem/11822244> llvm-svn: 160029
* Fix typos found by http://github.com/lyda/misspell-checkBenjamin Kramer2012-06-021-1/+1
| | | | llvm-svn: 157886
* [analyzer] Don't crash even when the system functions are redefined.Anna Zaks2012-04-101-7/+13
| | | | | | | | | | (Applied changes to CStringAPI, Malloc, and Taint.) This might almost never happen, but we should not crash even if it does. This fixes a crash on the internal analyzer buildbot, where postgresql's configure was redefining memmove (radar://11219852). llvm-svn: 154451
* [analyzer] Change naming in bug reports "tainted" -> "untrusted"Anna Zaks2012-02-221-4/+5
| | | | llvm-svn: 151120
* Basic: import OwningPtr<> into clang namespaceDylan Noblesmith2012-02-051-1/+1
| | | | llvm-svn: 149798
* Change references to 'const ProgramState *' to typedef 'ProgramStateRef'.Ted Kremenek2012-01-261-22/+22
| | | | | | | | At this point this is largely cosmetic, but it opens the door to replace ProgramStateRef with a smart pointer that more eagerly acts in the role of reclaiming unused ProgramState objects. llvm-svn: 149081
* [analyzer] Add more C taint sources/sinks.Anna Zaks2012-01-241-22/+45
| | | | llvm-svn: 148844
OpenPOWER on IntegriCloud