clang 20.0.0git
TaintTesterChecker.cpp
Go to the documentation of this file.
1//== TaintTesterChecker.cpp ----------------------------------- -*- C++ -*--=//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This checker can be used for testing how taint data is propagated.
10//
11//===----------------------------------------------------------------------===//
12
19
20using namespace clang;
21using namespace ento;
22using namespace taint;
23
24namespace {
25class TaintTesterChecker : public Checker<check::PostStmt<Expr>> {
26 const BugType BT{this, "Tainted data", "General"};
27
28public:
29 void checkPostStmt(const Expr *E, CheckerContext &C) const;
30};
31}
32
33void TaintTesterChecker::checkPostStmt(const Expr *E,
34 CheckerContext &C) const {
35 ProgramStateRef State = C.getState();
36 if (!State)
37 return;
38
39 if (isTainted(State, E, C.getLocationContext())) {
40 if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
41 auto report = std::make_unique<PathSensitiveBugReport>(BT, "tainted", N);
42 report->addRange(E->getSourceRange());
43 C.emitReport(std::move(report));
44 }
45 }
46}
47
48void ento::registerTaintTesterChecker(CheckerManager &mgr) {
49 mgr.registerChecker<TaintTesterChecker>();
50}
51
52bool ento::shouldRegisterTaintTesterChecker(const CheckerManager &mgr) {
53 return true;
54}
Expr * E
This represents one expression.
Definition: Expr.h:110
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:326
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
bool isTainted(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Check if the statement has a tainted value in the given state.
Definition: Taint.cpp:147
The JSON file list parser is used to communicate input to InstallAPI.