55 lines · cpp
1//== TaintTesterChecker.cpp ----------------------------------- -*- C++ -*--=//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// This checker can be used for testing how taint data is propagated.10//11//===----------------------------------------------------------------------===//12 13#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"14#include "clang/StaticAnalyzer/Checkers/Taint.h"15#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"16#include "clang/StaticAnalyzer/Core/Checker.h"17#include "clang/StaticAnalyzer/Core/CheckerManager.h"18#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"19 20using namespace clang;21using namespace ento;22using namespace taint;23 24namespace {25class TaintTesterChecker : public Checker<check::PostStmt<Expr>> {26 const BugType BT{this, "Tainted data", "General"};27 28public:29 void checkPostStmt(const Expr *E, CheckerContext &C) const;30};31}32 33void TaintTesterChecker::checkPostStmt(const Expr *E,34 CheckerContext &C) const {35 ProgramStateRef State = C.getState();36 if (!State)37 return;38 39 if (isTainted(State, E, C.getLocationContext())) {40 if (ExplodedNode *N = C.generateNonFatalErrorNode()) {41 auto report = std::make_unique<PathSensitiveBugReport>(BT, "tainted", N);42 report->addRange(E->getSourceRange());43 C.emitReport(std::move(report));44 }45 }46}47 48void ento::registerTaintTesterChecker(CheckerManager &mgr) {49 mgr.registerChecker<TaintTesterChecker>();50}51 52bool ento::shouldRegisterTaintTesterChecker(const CheckerManager &mgr) {53 return true;54}55