1//== TaintTesterChecker.cpp ----------------------------------- -*- C++ -*--=//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This checker can be used for testing how taint data is propagated.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
14#include "clang/StaticAnalyzer/Checkers/Taint.h"
15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
16#include "clang/StaticAnalyzer/Core/Checker.h"
17#include "clang/StaticAnalyzer/Core/CheckerManager.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19
20using namespace clang;
21using namespace ento;
22using namespace taint;
23
24namespace {
25class TaintTesterChecker : public Checker<check::PostStmt<Expr>> {
26 const BugType BT{this, "Tainted data", "General"};
27
28public:
29 void checkPostStmt(const Expr *E, CheckerContext &C) const;
30};
31}
32
33void TaintTesterChecker::checkPostStmt(const Expr *E,
34 CheckerContext &C) const {
35 ProgramStateRef State = C.getState();
36 if (!State)
37 return;
38
39 if (isTainted(State, S: E, LCtx: C.getLocationContext())) {
40 if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
41 auto report = std::make_unique<PathSensitiveBugReport>(args: BT, args: "tainted", args&: N);
42 report->addRange(R: E->getSourceRange());
43 C.emitReport(R: std::move(report));
44 }
45 }
46}
47
48void ento::registerTaintTesterChecker(CheckerManager &mgr) {
49 mgr.registerChecker<TaintTesterChecker>();
50}
51
52bool ento::shouldRegisterTaintTesterChecker(const CheckerManager &mgr) {
53 return true;
54}
55