1 //== TaintTesterChecker.cpp ----------------------------------- -*- C++ -*--=// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This checker can be used for testing how taint data is propagated. 10 // 11 //===----------------------------------------------------------------------===// 12 13 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 14 #include "clang/StaticAnalyzer/Checkers/Taint.h" 15 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 16 #include "clang/StaticAnalyzer/Core/Checker.h" 17 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 18 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 19 20 using namespace clang; 21 using namespace ento; 22 using namespace taint; 23 24 namespace { 25 class TaintTesterChecker : public Checker<check::PostStmt<Expr>> { 26 const BugType BT{this, "Tainted data", "General"}; 27 28 public: 29 void checkPostStmt(const Expr *E, CheckerContext &C) const; 30 }; 31 } 32 33 void TaintTesterChecker::checkPostStmt(const Expr *E, 34 CheckerContext &C) const { 35 ProgramStateRef State = C.getState(); 36 if (!State) 37 return; 38 39 if (isTainted(State, E, C.getLocationContext())) { 40 if (ExplodedNode *N = C.generateNonFatalErrorNode()) { 41 auto report = std::make_unique<PathSensitiveBugReport>(BT, "tainted", N); 42 report->addRange(E->getSourceRange()); 43 C.emitReport(std::move(report)); 44 } 45 } 46 } 47 48 void ento::registerTaintTesterChecker(CheckerManager &mgr) { 49 mgr.registerChecker<TaintTesterChecker>(); 50 } 51 52 bool ento::shouldRegisterTaintTesterChecker(const CheckerManager &mgr) { 53 return true; 54 } 55