859bcf4e3b
Summary:
This patch introduces the `clang_analyzer_isTainted` expression inspection
check for checking taint.
Using this we could query the analyzer whether the expression used as the
argument is tainted or not. This would be useful in tests, where we don't want
to issue warning for all tainted expressions in a given file
(like the `debug.TaintTest` would do) but only for certain expressions.
Example usage:
```lang=c++
int read_integer() {
int n;
clang_analyzer_isTainted(n); // expected-warning{{NO}}
scanf("%d", &n);
clang_analyzer_isTainted(n); // expected-warning{{YES}}
clang_analyzer_isTainted(n + 2); // expected-warning{{YES}}
clang_analyzer_isTainted(n > 0); // expected-warning{{YES}}
int next_tainted_value = n; // no-warning
return n;
}
```
Reviewers: NoQ, Szelethus, baloghadamsoftware, xazax.hun, boga95
Reviewed By: Szelethus
Subscribers: martong, rnkovacs, whisperity, xazax.hun,
baloghadamsoftware, szepet, a.sidorin, mikhail.ramalho, donat.nagy,
Charusso, cfe-commits, boga95, dkrupp, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D74131
28 lines
996 B
C
28 lines
996 B
C
// RUN: %clang_analyze_cc1 -verify %s \
|
|
// RUN: -analyzer-checker=core \
|
|
// RUN: -analyzer-checker=debug.ExprInspection \
|
|
// RUN: -analyzer-checker=alpha.security.taint
|
|
|
|
int scanf(const char *restrict format, ...);
|
|
void clang_analyzer_isTainted(char);
|
|
void clang_analyzer_isTainted_any_suffix(char);
|
|
void clang_analyzer_isTainted_many_arguments(char, int, int);
|
|
|
|
void foo() {
|
|
char buf[32] = "";
|
|
clang_analyzer_isTainted(buf[0]); // expected-warning {{NO}}
|
|
clang_analyzer_isTainted_any_suffix(buf[0]); // expected-warning {{NO}}
|
|
scanf("%s", buf);
|
|
clang_analyzer_isTainted(buf[0]); // expected-warning {{YES}}
|
|
clang_analyzer_isTainted_any_suffix(buf[0]); // expected-warning {{YES}}
|
|
|
|
int tainted_value = buf[0]; // no-warning
|
|
}
|
|
|
|
void exactly_one_argument_required() {
|
|
char buf[32] = "";
|
|
scanf("%s", buf);
|
|
clang_analyzer_isTainted_many_arguments(buf[0], 42, 42);
|
|
// expected-warning@-1 {{clang_analyzer_isTainted() requires exactly one argument}}
|
|
}
|