369 lines · cpp
1//===----------------------------------------------------------------------===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8 9#include "UnsafeFunctionsCheck.h"10#include "../utils/OptionsUtils.h"11#include "clang/AST/ASTContext.h"12#include "clang/ASTMatchers/ASTMatchFinder.h"13#include "clang/Lex/PPCallbacks.h"14#include "clang/Lex/Preprocessor.h"15#include <cassert>16 17using namespace clang::ast_matchers;18using namespace llvm;19 20namespace clang::tidy::bugprone {21 22static constexpr llvm::StringLiteral OptionNameCustomFunctions =23 "CustomFunctions";24static constexpr llvm::StringLiteral OptionNameReportDefaultFunctions =25 "ReportDefaultFunctions";26static constexpr llvm::StringLiteral OptionNameReportMoreUnsafeFunctions =27 "ReportMoreUnsafeFunctions";28 29static constexpr llvm::StringLiteral FunctionNamesWithAnnexKReplacementId =30 "FunctionNamesWithAnnexKReplacement";31static constexpr llvm::StringLiteral FunctionNamesId = "FunctionsNames";32static constexpr llvm::StringLiteral AdditionalFunctionNamesId =33 "AdditionalFunctionsNames";34static constexpr llvm::StringLiteral CustomFunctionNamesId =35 "CustomFunctionNames";36static constexpr llvm::StringLiteral DeclRefId = "DRE";37 38static std::optional<std::string>39getAnnexKReplacementFor(StringRef FunctionName) {40 return StringSwitch<std::string>(FunctionName)41 .Case("strlen", "strnlen_s")42 .Case("wcslen", "wcsnlen_s")43 .Default((Twine{FunctionName} + "_s").str());44}45 46static StringRef getReplacementFor(StringRef FunctionName,47 bool IsAnnexKAvailable) {48 if (IsAnnexKAvailable) {49 // Try to find a better replacement from Annex K first.50 StringRef AnnexKReplacementFunction =51 StringSwitch<StringRef>(FunctionName)52 .Cases({"asctime", "asctime_r"}, "asctime_s")53 .Case("gets", "gets_s")54 .Default({});55 if (!AnnexKReplacementFunction.empty())56 return AnnexKReplacementFunction;57 }58 59 // FIXME: Some of these functions are available in C++ under "std::", and60 // should be matched and suggested.61 return StringSwitch<StringRef>(FunctionName)62 .Cases({"asctime", "asctime_r"}, "strftime")63 .Case("gets", "fgets")64 .Case("rewind", "fseek")65 .Case("setbuf", "setvbuf");66}67 68static StringRef getReplacementForAdditional(StringRef FunctionName,69 bool IsAnnexKAvailable) {70 if (IsAnnexKAvailable) {71 // Try to find a better replacement from Annex K first.72 StringRef AnnexKReplacementFunction = StringSwitch<StringRef>(FunctionName)73 .Case("bcopy", "memcpy_s")74 .Case("bzero", "memset_s")75 .Default({});76 77 if (!AnnexKReplacementFunction.empty())78 return AnnexKReplacementFunction;79 }80 81 return StringSwitch<StringRef>(FunctionName)82 .Case("bcmp", "memcmp")83 .Case("bcopy", "memcpy")84 .Case("bzero", "memset")85 .Case("getpw", "getpwuid")86 .Case("vfork", "posix_spawn");87}88 89/// \returns The rationale for replacing the function \p FunctionName with the90/// safer alternative.91static StringRef getRationaleFor(StringRef FunctionName) {92 return StringSwitch<StringRef>(FunctionName)93 .Cases({"asctime", "asctime_r", "ctime"},94 "is not bounds-checking and non-reentrant")95 .Cases({"bcmp", "bcopy", "bzero"}, "is deprecated")96 .Cases({"fopen", "freopen"}, "has no exclusive access to the opened file")97 .Case("gets", "is insecure, was deprecated and removed in C11 and C++14")98 .Case("getpw", "is dangerous as it may overflow the provided buffer")99 .Cases({"rewind", "setbuf"}, "has no error detection")100 .Case("vfork", "is insecure as it can lead to denial of service "101 "situations in the parent process")102 .Default("is not bounds-checking");103}104 105/// Calculates whether Annex K is available for the current translation unit106/// based on the macro definitions and the language options.107///108/// The result is cached and saved in \p CacheVar.109static bool isAnnexKAvailable(std::optional<bool> &CacheVar, Preprocessor *PP,110 const LangOptions &LO) {111 if (CacheVar.has_value())112 return *CacheVar;113 114 if (!LO.C11)115 // TODO: How is "Annex K" available in C++ mode?116 return (CacheVar = false).value();117 118 assert(PP && "No Preprocessor registered.");119 120 if (!PP->isMacroDefined("__STDC_LIB_EXT1__") ||121 !PP->isMacroDefined("__STDC_WANT_LIB_EXT1__"))122 return (CacheVar = false).value();123 124 const auto *MI =125 PP->getMacroInfo(PP->getIdentifierInfo("__STDC_WANT_LIB_EXT1__"));126 if (!MI || MI->tokens_empty())127 return (CacheVar = false).value();128 129 const Token &T = MI->tokens().back();130 if (!T.isLiteral() || !T.getLiteralData())131 return (CacheVar = false).value();132 133 CacheVar = StringRef(T.getLiteralData(), T.getLength()) == "1";134 return CacheVar.value();135}136 137static std::vector<UnsafeFunctionsCheck::CheckedFunction>138parseCheckedFunctions(StringRef Option, ClangTidyContext *Context) {139 const std::vector<StringRef> Functions =140 utils::options::parseStringList(Option);141 std::vector<UnsafeFunctionsCheck::CheckedFunction> Result;142 Result.reserve(Functions.size());143 144 for (const StringRef Function : Functions) {145 if (Function.empty())146 continue;147 148 const auto [Name, Rest] = Function.split(',');149 const auto [Replacement, Reason] = Rest.split(',');150 151 if (Name.trim().empty()) {152 Context->configurationDiag("invalid configuration value for option '%0'; "153 "expected the name of an unsafe function")154 << OptionNameCustomFunctions;155 continue;156 }157 158 Result.push_back(159 {Name.trim().str(),160 matchers::MatchesAnyListedNameMatcher::NameMatcher(Name.trim()),161 Replacement.trim().str(), Reason.trim().str()});162 }163 164 return Result;165}166 167static std::string serializeCheckedFunctions(168 const std::vector<UnsafeFunctionsCheck::CheckedFunction> &Functions) {169 std::vector<std::string> Result;170 Result.reserve(Functions.size());171 172 for (const auto &Entry : Functions) {173 if (Entry.Reason.empty())174 Result.push_back(Entry.Name + "," + Entry.Replacement);175 else176 Result.push_back(Entry.Name + "," + Entry.Replacement + "," +177 Entry.Reason);178 }179 180 return llvm::join(Result, ";");181}182 183UnsafeFunctionsCheck::UnsafeFunctionsCheck(StringRef Name,184 ClangTidyContext *Context)185 : ClangTidyCheck(Name, Context),186 CustomFunctions(parseCheckedFunctions(187 Options.get(OptionNameCustomFunctions, ""), Context)),188 ReportDefaultFunctions(189 Options.get(OptionNameReportDefaultFunctions, true)),190 ReportMoreUnsafeFunctions(191 Options.get(OptionNameReportMoreUnsafeFunctions, true)) {}192 193void UnsafeFunctionsCheck::storeOptions(ClangTidyOptions::OptionMap &Opts) {194 Options.store(Opts, OptionNameCustomFunctions,195 serializeCheckedFunctions(CustomFunctions));196 Options.store(Opts, OptionNameReportDefaultFunctions, ReportDefaultFunctions);197 Options.store(Opts, OptionNameReportMoreUnsafeFunctions,198 ReportMoreUnsafeFunctions);199}200 201void UnsafeFunctionsCheck::registerMatchers(MatchFinder *Finder) {202 if (ReportDefaultFunctions) {203 if (getLangOpts().C11) {204 // Matching functions with safe replacements only in Annex K.205 auto FunctionNamesWithAnnexKReplacementMatcher = hasAnyName(206 "::bsearch", "::ctime", "::fopen", "::fprintf", "::freopen",207 "::fscanf", "::fwprintf", "::fwscanf", "::getenv", "::gmtime",208 "::localtime", "::mbsrtowcs", "::mbstowcs", "::memcpy", "::memmove",209 "::memset", "::printf", "::qsort", "::scanf", "::snprintf",210 "::sprintf", "::sscanf", "::strcat", "::strcpy", "::strerror",211 "::strlen", "::strncat", "::strncpy", "::strtok", "::swprintf",212 "::swscanf", "::vfprintf", "::vfscanf", "::vfwprintf", "::vfwscanf",213 "::vprintf", "::vscanf", "::vsnprintf", "::vsprintf", "::vsscanf",214 "::vswprintf", "::vswscanf", "::vwprintf", "::vwscanf", "::wcrtomb",215 "::wcscat", "::wcscpy", "::wcslen", "::wcsncat", "::wcsncpy",216 "::wcsrtombs", "::wcstok", "::wcstombs", "::wctomb", "::wmemcpy",217 "::wmemmove", "::wprintf", "::wscanf");218 Finder->addMatcher(219 declRefExpr(to(functionDecl(FunctionNamesWithAnnexKReplacementMatcher)220 .bind(FunctionNamesWithAnnexKReplacementId)))221 .bind(DeclRefId),222 this);223 }224 225 // Matching functions with replacements without Annex K.226 auto FunctionNamesMatcher =227 hasAnyName("::asctime", "asctime_r", "::gets", "::rewind", "::setbuf");228 Finder->addMatcher(229 declRefExpr(230 to(functionDecl(FunctionNamesMatcher).bind(FunctionNamesId)))231 .bind(DeclRefId),232 this);233 234 if (ReportMoreUnsafeFunctions) {235 // Matching functions with replacements without Annex K, at user request.236 auto AdditionalFunctionNamesMatcher =237 hasAnyName("::bcmp", "::bcopy", "::bzero", "::getpw", "::vfork");238 Finder->addMatcher(239 declRefExpr(to(functionDecl(AdditionalFunctionNamesMatcher)240 .bind(AdditionalFunctionNamesId)))241 .bind(DeclRefId),242 this);243 }244 }245 246 if (!CustomFunctions.empty()) {247 std::vector<llvm::StringRef> FunctionNames;248 FunctionNames.reserve(CustomFunctions.size());249 250 for (const auto &Entry : CustomFunctions)251 FunctionNames.emplace_back(Entry.Name);252 253 auto CustomFunctionsMatcher = matchers::matchesAnyListedName(FunctionNames);254 255 Finder->addMatcher(declRefExpr(to(functionDecl(CustomFunctionsMatcher)256 .bind(CustomFunctionNamesId)))257 .bind(DeclRefId),258 this);259 // C++ member calls do not contain a DeclRefExpr to the function decl.260 // Instead, they contain a MemberExpr that refers to the decl.261 Finder->addMatcher(memberExpr(member(functionDecl(CustomFunctionsMatcher)262 .bind(CustomFunctionNamesId)))263 .bind(DeclRefId),264 this);265 }266}267 268void UnsafeFunctionsCheck::check(const MatchFinder::MatchResult &Result) {269 const Expr *SourceExpr;270 const FunctionDecl *FuncDecl;271 272 if (const auto *DeclRef = Result.Nodes.getNodeAs<DeclRefExpr>(DeclRefId)) {273 SourceExpr = DeclRef;274 FuncDecl = cast<FunctionDecl>(DeclRef->getDecl());275 } else if (const auto *Member =276 Result.Nodes.getNodeAs<MemberExpr>(DeclRefId)) {277 SourceExpr = Member;278 FuncDecl = cast<FunctionDecl>(Member->getMemberDecl());279 } else {280 llvm_unreachable("No valid matched node in check()");281 return;282 }283 284 assert(SourceExpr && FuncDecl && "No valid matched node in check()");285 286 // Only one of these are matched at a time.287 const auto *AnnexK = Result.Nodes.getNodeAs<FunctionDecl>(288 FunctionNamesWithAnnexKReplacementId);289 const auto *Normal = Result.Nodes.getNodeAs<FunctionDecl>(FunctionNamesId);290 const auto *Additional =291 Result.Nodes.getNodeAs<FunctionDecl>(AdditionalFunctionNamesId);292 const auto *Custom =293 Result.Nodes.getNodeAs<FunctionDecl>(CustomFunctionNamesId);294 assert((AnnexK || Normal || Additional || Custom) &&295 "No valid match category.");296 297 bool AnnexKIsAvailable =298 isAnnexKAvailable(IsAnnexKAvailable, PP, getLangOpts());299 StringRef FunctionName = FuncDecl->getName();300 301 if (Custom) {302 for (const auto &Entry : CustomFunctions) {303 if (Entry.Pattern.match(*FuncDecl)) {304 StringRef Reason =305 Entry.Reason.empty() ? "is marked as unsafe" : Entry.Reason.c_str();306 307 // Omit the replacement, when a fully-custom reason is given.308 if (Reason.consume_front(">")) {309 diag(SourceExpr->getExprLoc(), "function %0 %1")310 << FuncDecl << Reason.trim() << SourceExpr->getSourceRange();311 // Do not recommend a replacement when it is not present.312 } else if (Entry.Replacement.empty()) {313 diag(SourceExpr->getExprLoc(),314 "function %0 %1; it should not be used")315 << FuncDecl << Reason << Entry.Replacement316 << SourceExpr->getSourceRange();317 // Otherwise, emit the replacement.318 } else {319 diag(SourceExpr->getExprLoc(),320 "function %0 %1; '%2' should be used instead")321 << FuncDecl << Reason << Entry.Replacement322 << SourceExpr->getSourceRange();323 }324 325 return;326 }327 }328 329 llvm_unreachable("No custom function was matched.");330 return;331 }332 333 const std::optional<std::string> ReplacementFunctionName =334 [&]() -> std::optional<std::string> {335 if (AnnexK) {336 if (AnnexKIsAvailable)337 return getAnnexKReplacementFor(FunctionName);338 return std::nullopt;339 }340 341 if (Normal)342 return getReplacementFor(FunctionName, AnnexKIsAvailable).str();343 344 if (Additional)345 return getReplacementForAdditional(FunctionName, AnnexKIsAvailable).str();346 347 llvm_unreachable("Unhandled match category");348 }();349 if (!ReplacementFunctionName)350 return;351 352 diag(SourceExpr->getExprLoc(), "function %0 %1; '%2' should be used instead")353 << FuncDecl << getRationaleFor(FunctionName)354 << ReplacementFunctionName.value() << SourceExpr->getSourceRange();355}356 357void UnsafeFunctionsCheck::registerPPCallbacks(358 const SourceManager &SM, Preprocessor *PP,359 Preprocessor * /*ModuleExpanderPP*/) {360 this->PP = PP;361}362 363void UnsafeFunctionsCheck::onEndOfTranslationUnit() {364 this->PP = nullptr;365 IsAnnexKAvailable.reset();366}367 368} // namespace clang::tidy::bugprone369