1 //===- OSObjectCStyleCast.cpp ------------------------------------*- C++ -*-==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines OSObjectCStyleCast checker, which checks for C-style casts
10 // of OSObjects. Such casts almost always indicate a code smell,
11 // as an explicit static or dynamic cast should be used instead.
12 //===----------------------------------------------------------------------===//
13
14 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
15 #include "clang/ASTMatchers/ASTMatchFinder.h"
16 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
17 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
18 #include "clang/StaticAnalyzer/Core/Checker.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
20 #include "llvm/Support/Debug.h"
21
22 using namespace clang;
23 using namespace ento;
24 using namespace ast_matchers;
25
26 namespace {
27 static constexpr const char *const WarnAtNode = "WarnAtNode";
28 static constexpr const char *const WarnRecordDecl = "WarnRecordDecl";
29
30 class OSObjectCStyleCastChecker : public Checker<check::ASTCodeBody> {
31 public:
32 void checkASTCodeBody(const Decl *D, AnalysisManager &AM,
33 BugReporter &BR) const;
34 };
35 } // namespace
36
37 namespace clang {
38 namespace ast_matchers {
AST_MATCHER_P(StringLiteral,mentionsBoundType,std::string,BindingID)39 AST_MATCHER_P(StringLiteral, mentionsBoundType, std::string, BindingID) {
40 return Builder->removeBindings([this, &Node](const BoundNodesMap &Nodes) {
41 const auto &BN = Nodes.getNode(this->BindingID);
42 if (const auto *ND = BN.get<NamedDecl>()) {
43 return ND->getName() != Node.getString();
44 }
45 return true;
46 });
47 }
48 } // end namespace ast_matchers
49 } // end namespace clang
50
emitDiagnostics(const BoundNodes & Nodes,BugReporter & BR,AnalysisDeclContext * ADC,const OSObjectCStyleCastChecker * Checker)51 static void emitDiagnostics(const BoundNodes &Nodes,
52 BugReporter &BR,
53 AnalysisDeclContext *ADC,
54 const OSObjectCStyleCastChecker *Checker) {
55 const auto *CE = Nodes.getNodeAs<CastExpr>(WarnAtNode);
56 const CXXRecordDecl *RD = Nodes.getNodeAs<CXXRecordDecl>(WarnRecordDecl);
57 assert(CE && RD);
58
59 std::string Diagnostics;
60 llvm::raw_string_ostream OS(Diagnostics);
61 OS << "C-style cast of an OSObject is prone to type confusion attacks; "
62 << "use 'OSRequiredCast' if the object is definitely of type '"
63 << RD->getNameAsString() << "', or 'OSDynamicCast' followed by "
64 << "a null check if unsure",
65
66 BR.EmitBasicReport(
67 ADC->getDecl(),
68 Checker,
69 /*Name=*/"OSObject C-Style Cast",
70 categories::SecurityError,
71 OS.str(),
72 PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), ADC),
73 CE->getSourceRange());
74 }
75
hasTypePointingTo(DeclarationMatcher DeclM)76 static decltype(auto) hasTypePointingTo(DeclarationMatcher DeclM) {
77 return hasType(pointerType(pointee(hasDeclaration(DeclM))));
78 }
79
checkASTCodeBody(const Decl * D,AnalysisManager & AM,BugReporter & BR) const80 void OSObjectCStyleCastChecker::checkASTCodeBody(const Decl *D,
81 AnalysisManager &AM,
82 BugReporter &BR) const {
83
84 AnalysisDeclContext *ADC = AM.getAnalysisDeclContext(D);
85
86 auto DynamicCastM = callExpr(callee(functionDecl(hasName("safeMetaCast"))));
87 // 'allocClassWithName' allocates an object with the given type.
88 // The type is actually provided as a string argument (type's name).
89 // This makes the following pattern possible:
90 //
91 // Foo *object = (Foo *)allocClassWithName("Foo");
92 //
93 // While OSRequiredCast can be used here, it is still not a useful warning.
94 auto AllocClassWithNameM = callExpr(
95 callee(functionDecl(hasName("allocClassWithName"))),
96 // Here we want to make sure that the string argument matches the
97 // type in the cast expression.
98 hasArgument(0, stringLiteral(mentionsBoundType(WarnRecordDecl))));
99
100 auto OSObjTypeM =
101 hasTypePointingTo(cxxRecordDecl(isDerivedFrom("OSMetaClassBase")));
102 auto OSObjSubclassM = hasTypePointingTo(
103 cxxRecordDecl(isDerivedFrom("OSObject")).bind(WarnRecordDecl));
104
105 auto CastM =
106 cStyleCastExpr(
107 allOf(OSObjSubclassM,
108 hasSourceExpression(
109 allOf(OSObjTypeM,
110 unless(anyOf(DynamicCastM, AllocClassWithNameM))))))
111 .bind(WarnAtNode);
112
113 auto Matches =
114 match(stmt(forEachDescendant(CastM)), *D->getBody(), AM.getASTContext());
115 for (BoundNodes Match : Matches)
116 emitDiagnostics(Match, BR, ADC, this);
117 }
118
registerOSObjectCStyleCast(CheckerManager & Mgr)119 void ento::registerOSObjectCStyleCast(CheckerManager &Mgr) {
120 Mgr.registerChecker<OSObjectCStyleCastChecker>();
121 }
122
shouldRegisterOSObjectCStyleCast(const CheckerManager & mgr)123 bool ento::shouldRegisterOSObjectCStyleCast(const CheckerManager &mgr) {
124 return true;
125 }
126