xref: /freebsd/contrib/llvm-project/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp (revision 2f9966ff63d65bd474478888c9088eeae3f9c669)
1 //== GenericTaintChecker.cpp ----------------------------------- -*- C++ -*--=//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This checker defines the attack surface for generic taint propagation.
10 //
11 // The taint information produced by it might be useful to other checkers. For
12 // example, checkers should report errors which involve tainted data more
13 // aggressively, even if the involved symbols are under constrained.
14 //
15 //===----------------------------------------------------------------------===//
16 
17 #include "Yaml.h"
18 #include "clang/AST/Attr.h"
19 #include "clang/Basic/Builtins.h"
20 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
21 #include "clang/StaticAnalyzer/Checkers/Taint.h"
22 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
23 #include "clang/StaticAnalyzer/Core/Checker.h"
24 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
25 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
26 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
27 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
28 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
29 #include "llvm/ADT/StringExtras.h"
30 #include "llvm/Support/YAMLTraits.h"
31 
32 #include <limits>
33 #include <memory>
34 #include <optional>
35 #include <utility>
36 #include <vector>
37 
38 #define DEBUG_TYPE "taint-checker"
39 
40 using namespace clang;
41 using namespace ento;
42 using namespace taint;
43 
44 using llvm::ImmutableSet;
45 
46 namespace {
47 
48 class GenericTaintChecker;
49 
50 /// Check for CWE-134: Uncontrolled Format String.
51 constexpr llvm::StringLiteral MsgUncontrolledFormatString =
52     "Untrusted data is used as a format string "
53     "(CWE-134: Uncontrolled Format String)";
54 
55 /// Check for:
56 /// CERT/STR02-C. "Sanitize data passed to complex subsystems"
57 /// CWE-78, "Failure to Sanitize Data into an OS Command"
58 constexpr llvm::StringLiteral MsgSanitizeSystemArgs =
59     "Untrusted data is passed to a system call "
60     "(CERT/STR02-C. Sanitize data passed to complex subsystems)";
61 
62 /// Check if tainted data is used as a buffer size in strn.. functions,
63 /// and allocators.
64 constexpr llvm::StringLiteral MsgTaintedBufferSize =
65     "Untrusted data is used to specify the buffer size "
66     "(CERT/STR31-C. Guarantee that storage for strings has sufficient space "
67     "for character data and the null terminator)";
68 
69 /// Check if tainted data is used as a custom sink's parameter.
70 constexpr llvm::StringLiteral MsgCustomSink =
71     "Untrusted data is passed to a user-defined sink";
72 
73 using ArgIdxTy = int;
74 using ArgVecTy = llvm::SmallVector<ArgIdxTy, 2>;
75 
76 /// Denotes the return value.
77 constexpr ArgIdxTy ReturnValueIndex{-1};
78 
79 static ArgIdxTy fromArgumentCount(unsigned Count) {
80   assert(Count <=
81              static_cast<std::size_t>(std::numeric_limits<ArgIdxTy>::max()) &&
82          "ArgIdxTy is not large enough to represent the number of arguments.");
83   return Count;
84 }
85 
86 /// Check if the region the expression evaluates to is the standard input,
87 /// and thus, is tainted.
88 /// FIXME: Move this to Taint.cpp.
89 bool isStdin(SVal Val, const ASTContext &ACtx) {
90   // FIXME: What if Val is NonParamVarRegion?
91 
92   // The region should be symbolic, we do not know it's value.
93   const auto *SymReg = dyn_cast_or_null<SymbolicRegion>(Val.getAsRegion());
94   if (!SymReg)
95     return false;
96 
97   // Get it's symbol and find the declaration region it's pointing to.
98   const auto *DeclReg =
99       dyn_cast_or_null<DeclRegion>(SymReg->getSymbol()->getOriginRegion());
100   if (!DeclReg)
101     return false;
102 
103   // This region corresponds to a declaration, find out if it's a global/extern
104   // variable named stdin with the proper type.
105   if (const auto *D = dyn_cast_or_null<VarDecl>(DeclReg->getDecl())) {
106     D = D->getCanonicalDecl();
107     if (D->getName() == "stdin" && D->hasExternalStorage() && D->isExternC()) {
108       const QualType FILETy = ACtx.getFILEType().getCanonicalType();
109       const QualType Ty = D->getType().getCanonicalType();
110 
111       if (Ty->isPointerType())
112         return Ty->getPointeeType() == FILETy;
113     }
114   }
115   return false;
116 }
117 
118 SVal getPointeeOf(ProgramStateRef State, Loc LValue) {
119   const QualType ArgTy = LValue.getType(State->getStateManager().getContext());
120   if (!ArgTy->isPointerType() || !ArgTy->getPointeeType()->isVoidType())
121     return State->getSVal(LValue);
122 
123   // Do not dereference void pointers. Treat them as byte pointers instead.
124   // FIXME: we might want to consider more than just the first byte.
125   return State->getSVal(LValue, State->getStateManager().getContext().CharTy);
126 }
127 
128 /// Given a pointer/reference argument, return the value it refers to.
129 std::optional<SVal> getPointeeOf(ProgramStateRef State, SVal Arg) {
130   if (auto LValue = Arg.getAs<Loc>())
131     return getPointeeOf(State, *LValue);
132   return std::nullopt;
133 }
134 
135 /// Given a pointer, return the SVal of its pointee or if it is tainted,
136 /// otherwise return the pointer's SVal if tainted.
137 /// Also considers stdin as a taint source.
138 std::optional<SVal> getTaintedPointeeOrPointer(ProgramStateRef State,
139                                                SVal Arg) {
140   if (auto Pointee = getPointeeOf(State, Arg))
141     if (isTainted(State, *Pointee)) // FIXME: isTainted(...) ? Pointee : None;
142       return Pointee;
143 
144   if (isTainted(State, Arg))
145     return Arg;
146   return std::nullopt;
147 }
148 
149 bool isTaintedOrPointsToTainted(ProgramStateRef State, SVal ExprSVal) {
150   return getTaintedPointeeOrPointer(State, ExprSVal).has_value();
151 }
152 
153 /// Helps in printing taint diagnostics.
154 /// Marks the incoming parameters of a function interesting (to be printed)
155 /// when the return value, or the outgoing parameters are tainted.
156 const NoteTag *taintOriginTrackerTag(CheckerContext &C,
157                                      std::vector<SymbolRef> TaintedSymbols,
158                                      std::vector<ArgIdxTy> TaintedArgs,
159                                      const LocationContext *CallLocation) {
160   return C.getNoteTag([TaintedSymbols = std::move(TaintedSymbols),
161                        TaintedArgs = std::move(TaintedArgs), CallLocation](
162                           PathSensitiveBugReport &BR) -> std::string {
163     SmallString<256> Msg;
164     // We give diagnostics only for taint related reports
165     if (!BR.isInteresting(CallLocation) ||
166         BR.getBugType().getCategory() != categories::TaintedData) {
167       return "";
168     }
169     if (TaintedSymbols.empty())
170       return "Taint originated here";
171 
172     for (auto Sym : TaintedSymbols) {
173       BR.markInteresting(Sym);
174     }
175     LLVM_DEBUG(for (auto Arg
176                     : TaintedArgs) {
177       llvm::dbgs() << "Taint Propagated from argument " << Arg + 1 << "\n";
178     });
179     return "";
180   });
181 }
182 
183 /// Helps in printing taint diagnostics.
184 /// Marks the function interesting (to be printed)
185 /// when the return value, or the outgoing parameters are tainted.
186 const NoteTag *taintPropagationExplainerTag(
187     CheckerContext &C, std::vector<SymbolRef> TaintedSymbols,
188     std::vector<ArgIdxTy> TaintedArgs, const LocationContext *CallLocation) {
189   assert(TaintedSymbols.size() == TaintedArgs.size());
190   return C.getNoteTag([TaintedSymbols = std::move(TaintedSymbols),
191                        TaintedArgs = std::move(TaintedArgs), CallLocation](
192                           PathSensitiveBugReport &BR) -> std::string {
193     SmallString<256> Msg;
194     llvm::raw_svector_ostream Out(Msg);
195     // We give diagnostics only for taint related reports
196     if (TaintedSymbols.empty() ||
197         BR.getBugType().getCategory() != categories::TaintedData) {
198       return "";
199     }
200     int nofTaintedArgs = 0;
201     for (auto [Idx, Sym] : llvm::enumerate(TaintedSymbols)) {
202       if (BR.isInteresting(Sym)) {
203         BR.markInteresting(CallLocation);
204         if (TaintedArgs[Idx] != ReturnValueIndex) {
205           LLVM_DEBUG(llvm::dbgs() << "Taint Propagated to argument "
206                                   << TaintedArgs[Idx] + 1 << "\n");
207           if (nofTaintedArgs == 0)
208             Out << "Taint propagated to the ";
209           else
210             Out << ", ";
211           Out << TaintedArgs[Idx] + 1
212               << llvm::getOrdinalSuffix(TaintedArgs[Idx] + 1) << " argument";
213           nofTaintedArgs++;
214         } else {
215           LLVM_DEBUG(llvm::dbgs() << "Taint Propagated to return value.\n");
216           Out << "Taint propagated to the return value";
217         }
218       }
219     }
220     return std::string(Out.str());
221   });
222 }
223 
224 /// ArgSet is used to describe arguments relevant for taint detection or
225 /// taint application. A discrete set of argument indexes and a variadic
226 /// argument list signified by a starting index are supported.
227 class ArgSet {
228 public:
229   ArgSet() = default;
230   ArgSet(ArgVecTy &&DiscreteArgs,
231          std::optional<ArgIdxTy> VariadicIndex = std::nullopt)
232       : DiscreteArgs(std::move(DiscreteArgs)),
233         VariadicIndex(std::move(VariadicIndex)) {}
234 
235   bool contains(ArgIdxTy ArgIdx) const {
236     if (llvm::is_contained(DiscreteArgs, ArgIdx))
237       return true;
238 
239     return VariadicIndex && ArgIdx >= *VariadicIndex;
240   }
241 
242   bool isEmpty() const { return DiscreteArgs.empty() && !VariadicIndex; }
243 
244 private:
245   ArgVecTy DiscreteArgs;
246   std::optional<ArgIdxTy> VariadicIndex;
247 };
248 
249 /// A struct used to specify taint propagation rules for a function.
250 ///
251 /// If any of the possible taint source arguments is tainted, all of the
252 /// destination arguments should also be tainted. If ReturnValueIndex is added
253 /// to the dst list, the return value will be tainted.
254 class GenericTaintRule {
255   /// Arguments which are taints sinks and should be checked, and a report
256   /// should be emitted if taint reaches these.
257   ArgSet SinkArgs;
258   /// Arguments which should be sanitized on function return.
259   ArgSet FilterArgs;
260   /// Arguments which can participate in taint propagation. If any of the
261   /// arguments in PropSrcArgs is tainted, all arguments in  PropDstArgs should
262   /// be tainted.
263   ArgSet PropSrcArgs;
264   ArgSet PropDstArgs;
265 
266   /// A message that explains why the call is sensitive to taint.
267   std::optional<StringRef> SinkMsg;
268 
269   GenericTaintRule() = default;
270 
271   GenericTaintRule(ArgSet &&Sink, ArgSet &&Filter, ArgSet &&Src, ArgSet &&Dst,
272                    std::optional<StringRef> SinkMsg = std::nullopt)
273       : SinkArgs(std::move(Sink)), FilterArgs(std::move(Filter)),
274         PropSrcArgs(std::move(Src)), PropDstArgs(std::move(Dst)),
275         SinkMsg(SinkMsg) {}
276 
277 public:
278   /// Make a rule that reports a warning if taint reaches any of \p FilterArgs
279   /// arguments.
280   static GenericTaintRule Sink(ArgSet &&SinkArgs,
281                                std::optional<StringRef> Msg = std::nullopt) {
282     return {std::move(SinkArgs), {}, {}, {}, Msg};
283   }
284 
285   /// Make a rule that sanitizes all FilterArgs arguments.
286   static GenericTaintRule Filter(ArgSet &&FilterArgs) {
287     return {{}, std::move(FilterArgs), {}, {}};
288   }
289 
290   /// Make a rule that unconditionally taints all Args.
291   /// If Func is provided, it must also return true for taint to propagate.
292   static GenericTaintRule Source(ArgSet &&SourceArgs) {
293     return {{}, {}, {}, std::move(SourceArgs)};
294   }
295 
296   /// Make a rule that taints all PropDstArgs if any of PropSrcArgs is tainted.
297   static GenericTaintRule Prop(ArgSet &&SrcArgs, ArgSet &&DstArgs) {
298     return {{}, {}, std::move(SrcArgs), std::move(DstArgs)};
299   }
300 
301   /// Make a rule that taints all PropDstArgs if any of PropSrcArgs is tainted.
302   static GenericTaintRule
303   SinkProp(ArgSet &&SinkArgs, ArgSet &&SrcArgs, ArgSet &&DstArgs,
304            std::optional<StringRef> Msg = std::nullopt) {
305     return {
306         std::move(SinkArgs), {}, std::move(SrcArgs), std::move(DstArgs), Msg};
307   }
308 
309   /// Process a function which could either be a taint source, a taint sink, a
310   /// taint filter or a taint propagator.
311   void process(const GenericTaintChecker &Checker, const CallEvent &Call,
312                CheckerContext &C) const;
313 
314   /// Handles the resolution of indexes of type ArgIdxTy to Expr*-s.
315   static const Expr *GetArgExpr(ArgIdxTy ArgIdx, const CallEvent &Call) {
316     return ArgIdx == ReturnValueIndex ? Call.getOriginExpr()
317                                       : Call.getArgExpr(ArgIdx);
318   };
319 
320   /// Functions for custom taintedness propagation.
321   static bool UntrustedEnv(CheckerContext &C);
322 };
323 
324 using RuleLookupTy = CallDescriptionMap<GenericTaintRule>;
325 
326 /// Used to parse the configuration file.
327 struct TaintConfiguration {
328   using NameScopeArgs = std::tuple<std::string, std::string, ArgVecTy>;
329   enum class VariadicType { None, Src, Dst };
330 
331   struct Common {
332     std::string Name;
333     std::string Scope;
334   };
335 
336   struct Sink : Common {
337     ArgVecTy SinkArgs;
338   };
339 
340   struct Filter : Common {
341     ArgVecTy FilterArgs;
342   };
343 
344   struct Propagation : Common {
345     ArgVecTy SrcArgs;
346     ArgVecTy DstArgs;
347     VariadicType VarType;
348     ArgIdxTy VarIndex;
349   };
350 
351   std::vector<Propagation> Propagations;
352   std::vector<Filter> Filters;
353   std::vector<Sink> Sinks;
354 
355   TaintConfiguration() = default;
356   TaintConfiguration(const TaintConfiguration &) = default;
357   TaintConfiguration(TaintConfiguration &&) = default;
358   TaintConfiguration &operator=(const TaintConfiguration &) = default;
359   TaintConfiguration &operator=(TaintConfiguration &&) = default;
360 };
361 
362 struct GenericTaintRuleParser {
363   GenericTaintRuleParser(CheckerManager &Mgr) : Mgr(Mgr) {}
364   /// Container type used to gather call identification objects grouped into
365   /// pairs with their corresponding taint rules. It is temporary as it is used
366   /// to finally initialize RuleLookupTy, which is considered to be immutable.
367   using RulesContTy = std::vector<std::pair<CallDescription, GenericTaintRule>>;
368   RulesContTy parseConfiguration(const std::string &Option,
369                                  TaintConfiguration &&Config) const;
370 
371 private:
372   using NamePartsTy = llvm::SmallVector<StringRef, 2>;
373 
374   /// Validate part of the configuration, which contains a list of argument
375   /// indexes.
376   void validateArgVector(const std::string &Option, const ArgVecTy &Args) const;
377 
378   template <typename Config> static NamePartsTy parseNameParts(const Config &C);
379 
380   // Takes the config and creates a CallDescription for it and associates a Rule
381   // with that.
382   template <typename Config>
383   static void consumeRulesFromConfig(const Config &C, GenericTaintRule &&Rule,
384                                      RulesContTy &Rules);
385 
386   void parseConfig(const std::string &Option, TaintConfiguration::Sink &&P,
387                    RulesContTy &Rules) const;
388   void parseConfig(const std::string &Option, TaintConfiguration::Filter &&P,
389                    RulesContTy &Rules) const;
390   void parseConfig(const std::string &Option,
391                    TaintConfiguration::Propagation &&P,
392                    RulesContTy &Rules) const;
393 
394   CheckerManager &Mgr;
395 };
396 
397 class GenericTaintChecker : public Checker<check::PreCall, check::PostCall> {
398 public:
399   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
400   void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
401 
402   void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
403                   const char *Sep) const override;
404 
405   /// Generate a report if the expression is tainted or points to tainted data.
406   bool generateReportIfTainted(const Expr *E, StringRef Msg,
407                                CheckerContext &C) const;
408 
409 private:
410   const BugType BT{this, "Use of Untrusted Data", categories::TaintedData};
411 
412   bool checkUncontrolledFormatString(const CallEvent &Call,
413                                      CheckerContext &C) const;
414 
415   void taintUnsafeSocketProtocol(const CallEvent &Call,
416                                  CheckerContext &C) const;
417 
418   /// Default taint rules are initalized with the help of a CheckerContext to
419   /// access the names of built-in functions like memcpy.
420   void initTaintRules(CheckerContext &C) const;
421 
422   /// CallDescription currently cannot restrict matches to the global namespace
423   /// only, which is why multiple CallDescriptionMaps are used, as we want to
424   /// disambiguate global C functions from functions inside user-defined
425   /// namespaces.
426   // TODO: Remove separation to simplify matching logic once CallDescriptions
427   // are more expressive.
428 
429   mutable std::optional<RuleLookupTy> StaticTaintRules;
430   mutable std::optional<RuleLookupTy> DynamicTaintRules;
431 };
432 } // end of anonymous namespace
433 
434 /// YAML serialization mapping.
435 LLVM_YAML_IS_SEQUENCE_VECTOR(TaintConfiguration::Sink)
436 LLVM_YAML_IS_SEQUENCE_VECTOR(TaintConfiguration::Filter)
437 LLVM_YAML_IS_SEQUENCE_VECTOR(TaintConfiguration::Propagation)
438 
439 namespace llvm {
440 namespace yaml {
441 template <> struct MappingTraits<TaintConfiguration> {
442   static void mapping(IO &IO, TaintConfiguration &Config) {
443     IO.mapOptional("Propagations", Config.Propagations);
444     IO.mapOptional("Filters", Config.Filters);
445     IO.mapOptional("Sinks", Config.Sinks);
446   }
447 };
448 
449 template <> struct MappingTraits<TaintConfiguration::Sink> {
450   static void mapping(IO &IO, TaintConfiguration::Sink &Sink) {
451     IO.mapRequired("Name", Sink.Name);
452     IO.mapOptional("Scope", Sink.Scope);
453     IO.mapRequired("Args", Sink.SinkArgs);
454   }
455 };
456 
457 template <> struct MappingTraits<TaintConfiguration::Filter> {
458   static void mapping(IO &IO, TaintConfiguration::Filter &Filter) {
459     IO.mapRequired("Name", Filter.Name);
460     IO.mapOptional("Scope", Filter.Scope);
461     IO.mapRequired("Args", Filter.FilterArgs);
462   }
463 };
464 
465 template <> struct MappingTraits<TaintConfiguration::Propagation> {
466   static void mapping(IO &IO, TaintConfiguration::Propagation &Propagation) {
467     IO.mapRequired("Name", Propagation.Name);
468     IO.mapOptional("Scope", Propagation.Scope);
469     IO.mapOptional("SrcArgs", Propagation.SrcArgs);
470     IO.mapOptional("DstArgs", Propagation.DstArgs);
471     IO.mapOptional("VariadicType", Propagation.VarType);
472     IO.mapOptional("VariadicIndex", Propagation.VarIndex);
473   }
474 };
475 
476 template <> struct ScalarEnumerationTraits<TaintConfiguration::VariadicType> {
477   static void enumeration(IO &IO, TaintConfiguration::VariadicType &Value) {
478     IO.enumCase(Value, "None", TaintConfiguration::VariadicType::None);
479     IO.enumCase(Value, "Src", TaintConfiguration::VariadicType::Src);
480     IO.enumCase(Value, "Dst", TaintConfiguration::VariadicType::Dst);
481   }
482 };
483 } // namespace yaml
484 } // namespace llvm
485 
486 /// A set which is used to pass information from call pre-visit instruction
487 /// to the call post-visit. The values are signed integers, which are either
488 /// ReturnValueIndex, or indexes of the pointer/reference argument, which
489 /// points to data, which should be tainted on return.
490 REGISTER_MAP_WITH_PROGRAMSTATE(TaintArgsOnPostVisit, const LocationContext *,
491                                ImmutableSet<ArgIdxTy>)
492 REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(ArgIdxFactory, ArgIdxTy)
493 
494 void GenericTaintRuleParser::validateArgVector(const std::string &Option,
495                                                const ArgVecTy &Args) const {
496   for (ArgIdxTy Arg : Args) {
497     if (Arg < ReturnValueIndex) {
498       Mgr.reportInvalidCheckerOptionValue(
499           Mgr.getChecker<GenericTaintChecker>(), Option,
500           "an argument number for propagation rules greater or equal to -1");
501     }
502   }
503 }
504 
505 template <typename Config>
506 GenericTaintRuleParser::NamePartsTy
507 GenericTaintRuleParser::parseNameParts(const Config &C) {
508   NamePartsTy NameParts;
509   if (!C.Scope.empty()) {
510     // If the Scope argument contains multiple "::" parts, those are considered
511     // namespace identifiers.
512     StringRef{C.Scope}.split(NameParts, "::", /*MaxSplit*/ -1,
513                              /*KeepEmpty*/ false);
514   }
515   NameParts.emplace_back(C.Name);
516   return NameParts;
517 }
518 
519 template <typename Config>
520 void GenericTaintRuleParser::consumeRulesFromConfig(const Config &C,
521                                                     GenericTaintRule &&Rule,
522                                                     RulesContTy &Rules) {
523   NamePartsTy NameParts = parseNameParts(C);
524   Rules.emplace_back(CallDescription(NameParts), std::move(Rule));
525 }
526 
527 void GenericTaintRuleParser::parseConfig(const std::string &Option,
528                                          TaintConfiguration::Sink &&S,
529                                          RulesContTy &Rules) const {
530   validateArgVector(Option, S.SinkArgs);
531   consumeRulesFromConfig(S, GenericTaintRule::Sink(std::move(S.SinkArgs)),
532                          Rules);
533 }
534 
535 void GenericTaintRuleParser::parseConfig(const std::string &Option,
536                                          TaintConfiguration::Filter &&S,
537                                          RulesContTy &Rules) const {
538   validateArgVector(Option, S.FilterArgs);
539   consumeRulesFromConfig(S, GenericTaintRule::Filter(std::move(S.FilterArgs)),
540                          Rules);
541 }
542 
543 void GenericTaintRuleParser::parseConfig(const std::string &Option,
544                                          TaintConfiguration::Propagation &&P,
545                                          RulesContTy &Rules) const {
546   validateArgVector(Option, P.SrcArgs);
547   validateArgVector(Option, P.DstArgs);
548   bool IsSrcVariadic = P.VarType == TaintConfiguration::VariadicType::Src;
549   bool IsDstVariadic = P.VarType == TaintConfiguration::VariadicType::Dst;
550   std::optional<ArgIdxTy> JustVarIndex = P.VarIndex;
551 
552   ArgSet SrcDesc(std::move(P.SrcArgs),
553                  IsSrcVariadic ? JustVarIndex : std::nullopt);
554   ArgSet DstDesc(std::move(P.DstArgs),
555                  IsDstVariadic ? JustVarIndex : std::nullopt);
556 
557   consumeRulesFromConfig(
558       P, GenericTaintRule::Prop(std::move(SrcDesc), std::move(DstDesc)), Rules);
559 }
560 
561 GenericTaintRuleParser::RulesContTy
562 GenericTaintRuleParser::parseConfiguration(const std::string &Option,
563                                            TaintConfiguration &&Config) const {
564 
565   RulesContTy Rules;
566 
567   for (auto &F : Config.Filters)
568     parseConfig(Option, std::move(F), Rules);
569 
570   for (auto &S : Config.Sinks)
571     parseConfig(Option, std::move(S), Rules);
572 
573   for (auto &P : Config.Propagations)
574     parseConfig(Option, std::move(P), Rules);
575 
576   return Rules;
577 }
578 
579 void GenericTaintChecker::initTaintRules(CheckerContext &C) const {
580   // Check for exact name match for functions without builtin substitutes.
581   // Use qualified name, because these are C functions without namespace.
582 
583   if (StaticTaintRules || DynamicTaintRules)
584     return;
585 
586   using RulesConstructionTy =
587       std::vector<std::pair<CallDescription, GenericTaintRule>>;
588   using TR = GenericTaintRule;
589 
590   const Builtin::Context &BI = C.getASTContext().BuiltinInfo;
591 
592   RulesConstructionTy GlobalCRules{
593       // Sources
594       {{{"fdopen"}}, TR::Source({{ReturnValueIndex}})},
595       {{{"fopen"}}, TR::Source({{ReturnValueIndex}})},
596       {{{"freopen"}}, TR::Source({{ReturnValueIndex}})},
597       {{{"getch"}}, TR::Source({{ReturnValueIndex}})},
598       {{{"getchar"}}, TR::Source({{ReturnValueIndex}})},
599       {{{"getchar_unlocked"}}, TR::Source({{ReturnValueIndex}})},
600       {{{"gets"}}, TR::Source({{0}, ReturnValueIndex})},
601       {{{"gets_s"}}, TR::Source({{0}, ReturnValueIndex})},
602       {{{"scanf"}}, TR::Source({{}, 1})},
603       {{{"scanf_s"}}, TR::Source({{}, {1}})},
604       {{{"wgetch"}}, TR::Source({{}, ReturnValueIndex})},
605       // Sometimes the line between taint sources and propagators is blurry.
606       // _IO_getc is choosen to be a source, but could also be a propagator.
607       // This way it is simpler, as modeling it as a propagator would require
608       // to model the possible sources of _IO_FILE * values, which the _IO_getc
609       // function takes as parameters.
610       {{{"_IO_getc"}}, TR::Source({{ReturnValueIndex}})},
611       {{{"getcwd"}}, TR::Source({{0, ReturnValueIndex}})},
612       {{{"getwd"}}, TR::Source({{0, ReturnValueIndex}})},
613       {{{"readlink"}}, TR::Source({{1, ReturnValueIndex}})},
614       {{{"readlinkat"}}, TR::Source({{2, ReturnValueIndex}})},
615       {{{"get_current_dir_name"}}, TR::Source({{ReturnValueIndex}})},
616       {{{"gethostname"}}, TR::Source({{0}})},
617       {{{"getnameinfo"}}, TR::Source({{2, 4}})},
618       {{{"getseuserbyname"}}, TR::Source({{1, 2}})},
619       {{{"getgroups"}}, TR::Source({{1, ReturnValueIndex}})},
620       {{{"getlogin"}}, TR::Source({{ReturnValueIndex}})},
621       {{{"getlogin_r"}}, TR::Source({{0}})},
622 
623       // Props
624       {{{"accept"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
625       {{{"atoi"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
626       {{{"atol"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
627       {{{"atoll"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
628       {{{"fgetc"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
629       {{{"fgetln"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
630       {{{"fgets"}}, TR::Prop({{2}}, {{0, ReturnValueIndex}})},
631       {{{"fgetws"}}, TR::Prop({{2}}, {{0, ReturnValueIndex}})},
632       {{{"fscanf"}}, TR::Prop({{0}}, {{}, 2})},
633       {{{"fscanf_s"}}, TR::Prop({{0}}, {{}, {2}})},
634       {{{"sscanf"}}, TR::Prop({{0}}, {{}, 2})},
635 
636       {{{"getc"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
637       {{{"getc_unlocked"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
638       {{{"getdelim"}}, TR::Prop({{3}}, {{0}})},
639       {{{"getline"}}, TR::Prop({{2}}, {{0}})},
640       {{{"getw"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
641       {{{"pread"}}, TR::Prop({{0, 1, 2, 3}}, {{1, ReturnValueIndex}})},
642       {{{"read"}}, TR::Prop({{0, 2}}, {{1, ReturnValueIndex}})},
643       {{{"strchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
644       {{{"strrchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
645       {{{"tolower"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
646       {{{"toupper"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
647       {{{"fread"}}, TR::Prop({{3}}, {{0, ReturnValueIndex}})},
648       {{{"recv"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
649       {{{"recvfrom"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
650 
651       {{{"ttyname"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
652       {{{"ttyname_r"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
653 
654       {{{"basename"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
655       {{{"dirname"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
656       {{{"fnmatch"}}, TR::Prop({{1}}, {{ReturnValueIndex}})},
657       {{{"memchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
658       {{{"memrchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
659       {{{"rawmemchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
660 
661       {{{"mbtowc"}}, TR::Prop({{1}}, {{0, ReturnValueIndex}})},
662       {{{"wctomb"}}, TR::Prop({{1}}, {{0, ReturnValueIndex}})},
663       {{{"wcwidth"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
664 
665       {{{"memcmp"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
666       {{{"memcpy"}}, TR::Prop({{1}}, {{0, ReturnValueIndex}})},
667       {{{"memmove"}}, TR::Prop({{1}}, {{0, ReturnValueIndex}})},
668       // If memmem was called with a tainted needle and the search was
669       // successful, that would mean that the value pointed by the return value
670       // has the same content as the needle. If we choose to go by the policy of
671       // content equivalence implies taintedness equivalence, that would mean
672       // haystack should be considered a propagation source argument.
673       {{{"memmem"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
674 
675       // The comment for memmem above also applies to strstr.
676       {{{"strstr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
677       {{{"strcasestr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
678 
679       {{{"strchrnul"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
680 
681       {{{"index"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
682       {{{"rindex"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
683 
684       // FIXME: In case of arrays, only the first element of the array gets
685       // tainted.
686       {{{"qsort"}}, TR::Prop({{0}}, {{0}})},
687       {{{"qsort_r"}}, TR::Prop({{0}}, {{0}})},
688 
689       {{{"strcmp"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
690       {{{"strcasecmp"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
691       {{{"strncmp"}}, TR::Prop({{0, 1, 2}}, {{ReturnValueIndex}})},
692       {{{"strncasecmp"}}, TR::Prop({{0, 1, 2}}, {{ReturnValueIndex}})},
693       {{{"strspn"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
694       {{{"strcspn"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
695       {{{"strpbrk"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
696       {{{"strndup"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
697       {{{"strndupa"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
698 
699       // strlen, wcslen, strnlen and alike intentionally don't propagate taint.
700       // See the details here: https://github.com/llvm/llvm-project/pull/66086
701 
702       {{{"strtol"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
703       {{{"strtoll"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
704       {{{"strtoul"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
705       {{{"strtoull"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
706 
707       {{{"isalnum"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
708       {{{"isalpha"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
709       {{{"isascii"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
710       {{{"isblank"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
711       {{{"iscntrl"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
712       {{{"isdigit"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
713       {{{"isgraph"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
714       {{{"islower"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
715       {{{"isprint"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
716       {{{"ispunct"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
717       {{{"isspace"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
718       {{{"isupper"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
719       {{{"isxdigit"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
720 
721       {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrncat)}},
722        TR::Prop({{1, 2}}, {{0, ReturnValueIndex}})},
723       {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrlcpy)}},
724        TR::Prop({{1, 2}}, {{0}})},
725       {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrlcat)}},
726        TR::Prop({{1, 2}}, {{0}})},
727       {{CDF_MaybeBuiltin, {{"snprintf"}}},
728        TR::Prop({{1}, 3}, {{0, ReturnValueIndex}})},
729       {{CDF_MaybeBuiltin, {{"sprintf"}}},
730        TR::Prop({{1}, 2}, {{0, ReturnValueIndex}})},
731       {{CDF_MaybeBuiltin, {{"strcpy"}}},
732        TR::Prop({{1}}, {{0, ReturnValueIndex}})},
733       {{CDF_MaybeBuiltin, {{"stpcpy"}}},
734        TR::Prop({{1}}, {{0, ReturnValueIndex}})},
735       {{CDF_MaybeBuiltin, {{"strcat"}}},
736        TR::Prop({{1}}, {{0, ReturnValueIndex}})},
737       {{CDF_MaybeBuiltin, {{"wcsncat"}}},
738        TR::Prop({{1}}, {{0, ReturnValueIndex}})},
739       {{CDF_MaybeBuiltin, {{"strdup"}}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
740       {{CDF_MaybeBuiltin, {{"strdupa"}}},
741        TR::Prop({{0}}, {{ReturnValueIndex}})},
742       {{CDF_MaybeBuiltin, {{"wcsdup"}}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
743 
744       // Sinks
745       {{{"system"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
746       {{{"popen"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
747       {{{"execl"}}, TR::Sink({{}, {0}}, MsgSanitizeSystemArgs)},
748       {{{"execle"}}, TR::Sink({{}, {0}}, MsgSanitizeSystemArgs)},
749       {{{"execlp"}}, TR::Sink({{}, {0}}, MsgSanitizeSystemArgs)},
750       {{{"execv"}}, TR::Sink({{0, 1}}, MsgSanitizeSystemArgs)},
751       {{{"execve"}}, TR::Sink({{0, 1, 2}}, MsgSanitizeSystemArgs)},
752       {{{"fexecve"}}, TR::Sink({{0, 1, 2}}, MsgSanitizeSystemArgs)},
753       {{{"execvp"}}, TR::Sink({{0, 1}}, MsgSanitizeSystemArgs)},
754       {{{"execvpe"}}, TR::Sink({{0, 1, 2}}, MsgSanitizeSystemArgs)},
755       {{{"dlopen"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
756       {{CDF_MaybeBuiltin, {{"malloc"}}}, TR::Sink({{0}}, MsgTaintedBufferSize)},
757       {{CDF_MaybeBuiltin, {{"calloc"}}}, TR::Sink({{0}}, MsgTaintedBufferSize)},
758       {{CDF_MaybeBuiltin, {{"alloca"}}}, TR::Sink({{0}}, MsgTaintedBufferSize)},
759       {{CDF_MaybeBuiltin, {{"memccpy"}}},
760        TR::Sink({{3}}, MsgTaintedBufferSize)},
761       {{CDF_MaybeBuiltin, {{"realloc"}}},
762        TR::Sink({{1}}, MsgTaintedBufferSize)},
763       {{{{"setproctitle"}}}, TR::Sink({{0}, 1}, MsgUncontrolledFormatString)},
764       {{{{"setproctitle_fast"}}},
765        TR::Sink({{0}, 1}, MsgUncontrolledFormatString)},
766 
767       // SinkProps
768       {{CDF_MaybeBuiltin, BI.getName(Builtin::BImemcpy)},
769        TR::SinkProp({{2}}, {{1, 2}}, {{0, ReturnValueIndex}},
770                     MsgTaintedBufferSize)},
771       {{CDF_MaybeBuiltin, {BI.getName(Builtin::BImemmove)}},
772        TR::SinkProp({{2}}, {{1, 2}}, {{0, ReturnValueIndex}},
773                     MsgTaintedBufferSize)},
774       {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrncpy)}},
775        TR::SinkProp({{2}}, {{1, 2}}, {{0, ReturnValueIndex}},
776                     MsgTaintedBufferSize)},
777       {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrndup)}},
778        TR::SinkProp({{1}}, {{0, 1}}, {{ReturnValueIndex}},
779                     MsgTaintedBufferSize)},
780       {{CDF_MaybeBuiltin, {{"bcopy"}}},
781        TR::SinkProp({{2}}, {{0, 2}}, {{1}}, MsgTaintedBufferSize)}};
782 
783   // `getenv` returns taint only in untrusted environments.
784   if (TR::UntrustedEnv(C)) {
785     // void setproctitle_init(int argc, char *argv[], char *envp[])
786     GlobalCRules.push_back(
787         {{{"setproctitle_init"}}, TR::Sink({{1, 2}}, MsgCustomSink)});
788     GlobalCRules.push_back({{{"getenv"}}, TR::Source({{ReturnValueIndex}})});
789   }
790 
791   StaticTaintRules.emplace(std::make_move_iterator(GlobalCRules.begin()),
792                            std::make_move_iterator(GlobalCRules.end()));
793 
794   // User-provided taint configuration.
795   CheckerManager *Mgr = C.getAnalysisManager().getCheckerManager();
796   assert(Mgr);
797   GenericTaintRuleParser ConfigParser{*Mgr};
798   std::string Option{"Config"};
799   StringRef ConfigFile =
800       Mgr->getAnalyzerOptions().getCheckerStringOption(this, Option);
801   std::optional<TaintConfiguration> Config =
802       getConfiguration<TaintConfiguration>(*Mgr, this, Option, ConfigFile);
803   if (!Config) {
804     // We don't have external taint config, no parsing required.
805     DynamicTaintRules = RuleLookupTy{};
806     return;
807   }
808 
809   GenericTaintRuleParser::RulesContTy Rules{
810       ConfigParser.parseConfiguration(Option, std::move(*Config))};
811 
812   DynamicTaintRules.emplace(std::make_move_iterator(Rules.begin()),
813                             std::make_move_iterator(Rules.end()));
814 }
815 
816 void GenericTaintChecker::checkPreCall(const CallEvent &Call,
817                                        CheckerContext &C) const {
818   initTaintRules(C);
819 
820   // FIXME: this should be much simpler.
821   if (const auto *Rule =
822           Call.isGlobalCFunction() ? StaticTaintRules->lookup(Call) : nullptr)
823     Rule->process(*this, Call, C);
824   else if (const auto *Rule = DynamicTaintRules->lookup(Call))
825     Rule->process(*this, Call, C);
826 
827   // FIXME: These edge cases are to be eliminated from here eventually.
828   //
829   // Additional check that is not supported by CallDescription.
830   // TODO: Make CallDescription be able to match attributes such as printf-like
831   // arguments.
832   checkUncontrolledFormatString(Call, C);
833 
834   // TODO: Modeling sockets should be done in a specific checker.
835   // Socket is a source, which taints the return value.
836   taintUnsafeSocketProtocol(Call, C);
837 }
838 
839 void GenericTaintChecker::checkPostCall(const CallEvent &Call,
840                                         CheckerContext &C) const {
841   // Set the marked values as tainted. The return value only accessible from
842   // checkPostStmt.
843   ProgramStateRef State = C.getState();
844   const StackFrameContext *CurrentFrame = C.getStackFrame();
845 
846   // Depending on what was tainted at pre-visit, we determined a set of
847   // arguments which should be tainted after the function returns. These are
848   // stored in the state as TaintArgsOnPostVisit set.
849   TaintArgsOnPostVisitTy TaintArgsMap = State->get<TaintArgsOnPostVisit>();
850 
851   const ImmutableSet<ArgIdxTy> *TaintArgs = TaintArgsMap.lookup(CurrentFrame);
852   if (!TaintArgs)
853     return;
854   assert(!TaintArgs->isEmpty());
855 
856   LLVM_DEBUG(for (ArgIdxTy I
857                   : *TaintArgs) {
858     llvm::dbgs() << "PostCall<";
859     Call.dump(llvm::dbgs());
860     llvm::dbgs() << "> actually wants to taint arg index: " << I << '\n';
861   });
862 
863   const NoteTag *InjectionTag = nullptr;
864   std::vector<SymbolRef> TaintedSymbols;
865   std::vector<ArgIdxTy> TaintedIndexes;
866   for (ArgIdxTy ArgNum : *TaintArgs) {
867     // Special handling for the tainted return value.
868     if (ArgNum == ReturnValueIndex) {
869       State = addTaint(State, Call.getReturnValue());
870       std::vector<SymbolRef> TaintedSyms =
871           getTaintedSymbols(State, Call.getReturnValue());
872       if (!TaintedSyms.empty()) {
873         TaintedSymbols.push_back(TaintedSyms[0]);
874         TaintedIndexes.push_back(ArgNum);
875       }
876       continue;
877     }
878     // The arguments are pointer arguments. The data they are pointing at is
879     // tainted after the call.
880     if (auto V = getPointeeOf(State, Call.getArgSVal(ArgNum))) {
881       State = addTaint(State, *V);
882       std::vector<SymbolRef> TaintedSyms = getTaintedSymbols(State, *V);
883       if (!TaintedSyms.empty()) {
884         TaintedSymbols.push_back(TaintedSyms[0]);
885         TaintedIndexes.push_back(ArgNum);
886       }
887     }
888   }
889   // Create a NoteTag callback, which prints to the user where the taintedness
890   // was propagated to.
891   InjectionTag = taintPropagationExplainerTag(C, TaintedSymbols, TaintedIndexes,
892                                               Call.getCalleeStackFrame(0));
893   // Clear up the taint info from the state.
894   State = State->remove<TaintArgsOnPostVisit>(CurrentFrame);
895   C.addTransition(State, InjectionTag);
896 }
897 
898 void GenericTaintChecker::printState(raw_ostream &Out, ProgramStateRef State,
899                                      const char *NL, const char *Sep) const {
900   printTaint(State, Out, NL, Sep);
901 }
902 
903 void GenericTaintRule::process(const GenericTaintChecker &Checker,
904                                const CallEvent &Call, CheckerContext &C) const {
905   ProgramStateRef State = C.getState();
906   const ArgIdxTy CallNumArgs = fromArgumentCount(Call.getNumArgs());
907 
908   /// Iterate every call argument, and get their corresponding Expr and SVal.
909   const auto ForEachCallArg = [&C, &Call, CallNumArgs](auto &&Fun) {
910     for (ArgIdxTy I = ReturnValueIndex; I < CallNumArgs; ++I) {
911       const Expr *E = GetArgExpr(I, Call);
912       Fun(I, E, C.getSVal(E));
913     }
914   };
915 
916   /// Check for taint sinks.
917   ForEachCallArg([this, &Checker, &C, &State](ArgIdxTy I, const Expr *E, SVal) {
918     // Add taintedness to stdin parameters
919     if (isStdin(C.getSVal(E), C.getASTContext())) {
920       State = addTaint(State, C.getSVal(E));
921     }
922     if (SinkArgs.contains(I) && isTaintedOrPointsToTainted(State, C.getSVal(E)))
923       Checker.generateReportIfTainted(E, SinkMsg.value_or(MsgCustomSink), C);
924   });
925 
926   /// Check for taint filters.
927   ForEachCallArg([this, &State](ArgIdxTy I, const Expr *E, SVal S) {
928     if (FilterArgs.contains(I)) {
929       State = removeTaint(State, S);
930       if (auto P = getPointeeOf(State, S))
931         State = removeTaint(State, *P);
932     }
933   });
934 
935   /// Check for taint propagation sources.
936   /// A rule will make the destination variables tainted if PropSrcArgs
937   /// is empty (taints the destination
938   /// arguments unconditionally), or if any of its signified
939   /// args are tainted in context of the current CallEvent.
940   bool IsMatching = PropSrcArgs.isEmpty();
941   std::vector<SymbolRef> TaintedSymbols;
942   std::vector<ArgIdxTy> TaintedIndexes;
943   ForEachCallArg([this, &C, &IsMatching, &State, &TaintedSymbols,
944                   &TaintedIndexes](ArgIdxTy I, const Expr *E, SVal) {
945     std::optional<SVal> TaintedSVal =
946         getTaintedPointeeOrPointer(State, C.getSVal(E));
947     IsMatching =
948         IsMatching || (PropSrcArgs.contains(I) && TaintedSVal.has_value());
949 
950     // We track back tainted arguments except for stdin
951     if (TaintedSVal && !isStdin(*TaintedSVal, C.getASTContext())) {
952       std::vector<SymbolRef> TaintedArgSyms =
953           getTaintedSymbols(State, *TaintedSVal);
954       if (!TaintedArgSyms.empty()) {
955         llvm::append_range(TaintedSymbols, TaintedArgSyms);
956         TaintedIndexes.push_back(I);
957       }
958     }
959   });
960 
961   // Early return for propagation rules which dont match.
962   // Matching propagations, Sinks and Filters will pass this point.
963   if (!IsMatching)
964     return;
965 
966   const auto WouldEscape = [](SVal V, QualType Ty) -> bool {
967     if (!isa<Loc>(V))
968       return false;
969 
970     const bool IsNonConstRef = Ty->isReferenceType() && !Ty.isConstQualified();
971     const bool IsNonConstPtr =
972         Ty->isPointerType() && !Ty->getPointeeType().isConstQualified();
973 
974     return IsNonConstRef || IsNonConstPtr;
975   };
976 
977   /// Propagate taint where it is necessary.
978   auto &F = State->getStateManager().get_context<ArgIdxFactory>();
979   ImmutableSet<ArgIdxTy> Result = F.getEmptySet();
980   ForEachCallArg(
981       [&](ArgIdxTy I, const Expr *E, SVal V) {
982         if (PropDstArgs.contains(I)) {
983           LLVM_DEBUG(llvm::dbgs() << "PreCall<"; Call.dump(llvm::dbgs());
984                      llvm::dbgs()
985                      << "> prepares tainting arg index: " << I << '\n';);
986           Result = F.add(Result, I);
987         }
988 
989         // Taint property gets lost if the variable is passed as a
990         // non-const pointer or reference to a function which is
991         // not inlined. For matching rules we want to preserve the taintedness.
992         // TODO: We should traverse all reachable memory regions via the
993         // escaping parameter. Instead of doing that we simply mark only the
994         // referred memory region as tainted.
995         if (WouldEscape(V, E->getType()) && getTaintedPointeeOrPointer(State, V)) {
996           LLVM_DEBUG(if (!Result.contains(I)) {
997             llvm::dbgs() << "PreCall<";
998             Call.dump(llvm::dbgs());
999             llvm::dbgs() << "> prepares tainting arg index: " << I << '\n';
1000           });
1001           Result = F.add(Result, I);
1002         }
1003       });
1004 
1005   if (!Result.isEmpty())
1006     State = State->set<TaintArgsOnPostVisit>(C.getStackFrame(), Result);
1007   const NoteTag *InjectionTag = taintOriginTrackerTag(
1008       C, std::move(TaintedSymbols), std::move(TaintedIndexes),
1009       Call.getCalleeStackFrame(0));
1010   C.addTransition(State, InjectionTag);
1011 }
1012 
1013 bool GenericTaintRule::UntrustedEnv(CheckerContext &C) {
1014   return !C.getAnalysisManager()
1015               .getAnalyzerOptions()
1016               .ShouldAssumeControlledEnvironment;
1017 }
1018 
1019 bool GenericTaintChecker::generateReportIfTainted(const Expr *E, StringRef Msg,
1020                                                   CheckerContext &C) const {
1021   assert(E);
1022   std::optional<SVal> TaintedSVal =
1023       getTaintedPointeeOrPointer(C.getState(), C.getSVal(E));
1024 
1025   if (!TaintedSVal)
1026     return false;
1027 
1028   // Generate diagnostic.
1029   if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
1030     auto report = std::make_unique<PathSensitiveBugReport>(BT, Msg, N);
1031     report->addRange(E->getSourceRange());
1032     for (auto TaintedSym : getTaintedSymbols(C.getState(), *TaintedSVal)) {
1033       report->markInteresting(TaintedSym);
1034     }
1035 
1036     C.emitReport(std::move(report));
1037     return true;
1038   }
1039   return false;
1040 }
1041 
1042 /// TODO: remove checking for printf format attributes and socket whitelisting
1043 /// from GenericTaintChecker, and that means the following functions:
1044 /// getPrintfFormatArgumentNum,
1045 /// GenericTaintChecker::checkUncontrolledFormatString,
1046 /// GenericTaintChecker::taintUnsafeSocketProtocol
1047 
1048 static bool getPrintfFormatArgumentNum(const CallEvent &Call,
1049                                        const CheckerContext &C,
1050                                        ArgIdxTy &ArgNum) {
1051   // Find if the function contains a format string argument.
1052   // Handles: fprintf, printf, sprintf, snprintf, vfprintf, vprintf, vsprintf,
1053   // vsnprintf, syslog, custom annotated functions.
1054   const Decl *CallDecl = Call.getDecl();
1055   if (!CallDecl)
1056     return false;
1057   const FunctionDecl *FDecl = CallDecl->getAsFunction();
1058   if (!FDecl)
1059     return false;
1060 
1061   const ArgIdxTy CallNumArgs = fromArgumentCount(Call.getNumArgs());
1062 
1063   for (const auto *Format : FDecl->specific_attrs<FormatAttr>()) {
1064     ArgNum = Format->getFormatIdx() - 1;
1065     if ((Format->getType()->getName() == "printf") && CallNumArgs > ArgNum)
1066       return true;
1067   }
1068 
1069   return false;
1070 }
1071 
1072 bool GenericTaintChecker::checkUncontrolledFormatString(
1073     const CallEvent &Call, CheckerContext &C) const {
1074   // Check if the function contains a format string argument.
1075   ArgIdxTy ArgNum = 0;
1076   if (!getPrintfFormatArgumentNum(Call, C, ArgNum))
1077     return false;
1078 
1079   // If either the format string content or the pointer itself are tainted,
1080   // warn.
1081   return generateReportIfTainted(Call.getArgExpr(ArgNum),
1082                                  MsgUncontrolledFormatString, C);
1083 }
1084 
1085 void GenericTaintChecker::taintUnsafeSocketProtocol(const CallEvent &Call,
1086                                                     CheckerContext &C) const {
1087   if (Call.getNumArgs() < 1)
1088     return;
1089   const IdentifierInfo *ID = Call.getCalleeIdentifier();
1090   if (!ID)
1091     return;
1092   if (!ID->getName().equals("socket"))
1093     return;
1094 
1095   SourceLocation DomLoc = Call.getArgExpr(0)->getExprLoc();
1096   StringRef DomName = C.getMacroNameOrSpelling(DomLoc);
1097   // Allow internal communication protocols.
1098   bool SafeProtocol = DomName.equals("AF_SYSTEM") ||
1099                       DomName.equals("AF_LOCAL") || DomName.equals("AF_UNIX") ||
1100                       DomName.equals("AF_RESERVED_36");
1101   if (SafeProtocol)
1102     return;
1103 
1104   ProgramStateRef State = C.getState();
1105   auto &F = State->getStateManager().get_context<ArgIdxFactory>();
1106   ImmutableSet<ArgIdxTy> Result = F.add(F.getEmptySet(), ReturnValueIndex);
1107   State = State->set<TaintArgsOnPostVisit>(C.getStackFrame(), Result);
1108   C.addTransition(State);
1109 }
1110 
1111 /// Checker registration
1112 void ento::registerGenericTaintChecker(CheckerManager &Mgr) {
1113   Mgr.registerChecker<GenericTaintChecker>();
1114 }
1115 
1116 bool ento::shouldRegisterGenericTaintChecker(const CheckerManager &mgr) {
1117   return true;
1118 }
1119