Home | History | Annotate | Line # | Download | only in Checkers 
      1 //=== Taint.h - Taint tracking and basic propagation rules. --------*- C++ -*-//
      2 //
      3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
      4 // See https://llvm.org/LICENSE.txt for license information.
      5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
      6 //
      7 //===----------------------------------------------------------------------===//
      8 //
      9 // Defines basic, non-domain-specific mechanisms for tracking tainted values.
     10 //
     11 //===----------------------------------------------------------------------===//
     12 
     13 #ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAINT_H
     14 #define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAINT_H
     15 
     16 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h"
     17 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
     18 
     19 namespace clang {
     20 namespace ento {
     21 namespace taint {
     22 
     23 /// The type of taint, which helps to differentiate between different types of
     24 /// taint.
     25 using TaintTagType = unsigned;
     26 
     27 static constexpr TaintTagType TaintTagGeneric = 0;
     28 
     29 /// Create a new state in which the value of the statement is marked as tainted.
     30 LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S,
     31                                         const LocationContext *LCtx,
     32                                         TaintTagType Kind = TaintTagGeneric);
     33 
     34 /// Create a new state in which the value is marked as tainted.
     35 LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, SVal V,
     36                                         TaintTagType Kind = TaintTagGeneric);
     37 
     38 /// Create a new state in which the symbol is marked as tainted.
     39 LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, SymbolRef Sym,
     40                                         TaintTagType Kind = TaintTagGeneric);
     41 
     42 /// Create a new state in which the pointer represented by the region
     43 /// is marked as tainted.
     44 LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State,
     45                                         const MemRegion *R,
     46                                         TaintTagType Kind = TaintTagGeneric);
     47 
     48 LLVM_NODISCARD ProgramStateRef removeTaint(ProgramStateRef State, SVal V);
     49 
     50 LLVM_NODISCARD ProgramStateRef removeTaint(ProgramStateRef State,
     51                                            const MemRegion *R);
     52 
     53 LLVM_NODISCARD ProgramStateRef removeTaint(ProgramStateRef State,
     54                                            SymbolRef Sym);
     55 
     56 /// Create a new state in a which a sub-region of a given symbol is tainted.
     57 /// This might be necessary when referring to regions that can not have an
     58 /// individual symbol, e.g. if they are represented by the default binding of
     59 /// a LazyCompoundVal.
     60 LLVM_NODISCARD ProgramStateRef addPartialTaint(
     61     ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion,
     62     TaintTagType Kind = TaintTagGeneric);
     63 
     64 /// Check if the statement has a tainted value in the given state.
     65 bool isTainted(ProgramStateRef State, const Stmt *S,
     66                const LocationContext *LCtx,
     67                TaintTagType Kind = TaintTagGeneric);
     68 
     69 /// Check if the value is tainted in the given state.
     70 bool isTainted(ProgramStateRef State, SVal V,
     71                TaintTagType Kind = TaintTagGeneric);
     72 
     73 /// Check if the symbol is tainted in the given state.
     74 bool isTainted(ProgramStateRef State, SymbolRef Sym,
     75                TaintTagType Kind = TaintTagGeneric);
     76 
     77 /// Check if the pointer represented by the region is tainted in the given
     78 /// state.
     79 bool isTainted(ProgramStateRef State, const MemRegion *Reg,
     80                TaintTagType Kind = TaintTagGeneric);
     81 
     82 void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl = "\n",
     83                 const char *sep = "");
     84 
     85 LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State);
     86 
     87 /// The bug visitor prints a diagnostic message at the location where a given
     88 /// variable was tainted.
     89 class TaintBugVisitor final : public BugReporterVisitor {
     90 private:
     91   const SVal V;
     92 
     93 public:
     94   TaintBugVisitor(const SVal V) : V(V) {}
     95   void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); }
     96 
     97   PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
     98                                    BugReporterContext &BRC,
     99                                    PathSensitiveBugReport &BR) override;
    100 };
    101 
    102 } // namespace taint
    103 } // namespace ento
    104 } // namespace clang
    105 
    106 #endif
    107