97 lines · yaml
1# A list of source/propagation function2Propagations:3 # int x = mySource1(); // x is tainted4 - Name: mySource15 DstArgs: [-1] # Index for return value6 7 # int x;8 # mySource2(&x); // x is tainted9 - Name: mySource210 DstArgs: [0]11 12 # int x = myNamespace::mySource3(); // x is tainted13 - Name: mySource314 Scope: "myNamespace::"15 DstArgs: [-1]16 17 # int x = myAnotherNamespace::mySource3(); // x is tainted18 - Name: mySource319 Scope: "myAnotherNamespace::"20 DstArgs: [-1]21 22 # int x, y;23 # myScanf("%d %d", &x, &y); // x and y are tainted24 - Name: myScanf25 VariadicType: Dst26 VariadicIndex: 127 28 # int x, y;29 # Foo::myScanf("%d %d", &x, &y); // x and y are tainted30 - Name: myMemberScanf31 Scope: "Foo::"32 VariadicType: Dst33 VariadicIndex: 134 35 # int x; // x is tainted36 # int y;37 # myPropagator(x, &y); // y is tainted38 - Name: myPropagator39 SrcArgs: [0]40 DstArgs: [1]41 42 # constexpr unsigned size = 100;43 # char buf[size];44 # int x, y;45 # int n = mySprintf(buf, size, "%d %d", x, y); // If size, x or y is tainted46 # // the return value and the buf will be tainted47 - Name: mySnprintf48 SrcArgs: [1]49 DstArgs: [0, -1]50 VariadicType: Src51 VariadicIndex: 352 53# A list of filter functions54Filters:55 # int x; // x is tainted56 # isOutOfRange(&x); // x is not tainted anymore57 - Name: isOutOfRange58 Args: [0]59 60 # int x; // x is tainted61 # myNamespace::isOutOfRange(&x); // x is not tainted anymore62 - Name: isOutOfRange263 Scope: "myNamespace::"64 Args: [0]65 66 # int x; // x is tainted67 # myAnotherNamespace::isOutOfRange(&x); // x is not tainted anymore68 - Name: isOutOfRange269 Scope: "myAnotherNamespace::"70 Args: [0]71 72 # char *str; // str is tainted73 # sanitizeCmd(str) // str is not tainted anymore74 - Name: sanitizeCmd75 Args: [0]76 77# A list of sink functions78Sinks:79 # int x, y; // x and y are tainted80 # mySink(x, 0, 1); // It will warn81 # mySink(0, 1, y); // It will warn82 # mySink(0, x, 1); // It won't warn83 - Name: mySink84 Args: [0, 2]85 86 # int x; // x is tainted87 # myNamespace::mySink(x); // It will warn88 - Name: mySink289 Scope: "myNamespace::"90 Args: [0]91 92 # int x; // x is tainted93 # myAnotherNamespace::mySink(x); // It will warn94 - Name: mySink295 Scope: "myAnotherNamespace::"96 Args: [0]97