clang 17.0.0git
Taint.h
Go to the documentation of this file.
1//=== Taint.h - Taint tracking and basic propagation rules. --------*- C++ -*-//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// Defines basic, non-domain-specific mechanisms for tracking tainted values.
10//
11//===----------------------------------------------------------------------===//
12
13#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAINT_H
14#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAINT_H
15
18
19namespace clang {
20namespace ento {
21namespace taint {
22
23/// The type of taint, which helps to differentiate between different types of
24/// taint.
26
27static constexpr TaintTagType TaintTagGeneric = 0;
28
29/// Create a new state in which the value of the statement is marked as tainted.
30[[nodiscard]] ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S,
31 const LocationContext *LCtx,
33
34/// Create a new state in which the value is marked as tainted.
35[[nodiscard]] ProgramStateRef addTaint(ProgramStateRef State, SVal V,
37
38/// Create a new state in which the symbol is marked as tainted.
39[[nodiscard]] ProgramStateRef addTaint(ProgramStateRef State, SymbolRef Sym,
41
42/// Create a new state in which the pointer represented by the region
43/// is marked as tainted.
44[[nodiscard]] ProgramStateRef addTaint(ProgramStateRef State,
45 const MemRegion *R,
47
49
51 const MemRegion *R);
52
54
55/// Create a new state in a which a sub-region of a given symbol is tainted.
56/// This might be necessary when referring to regions that can not have an
57/// individual symbol, e.g. if they are represented by the default binding of
58/// a LazyCompoundVal.
59[[nodiscard]] ProgramStateRef
61 const SubRegion *SubRegion,
63
64/// Check if the statement has a tainted value in the given state.
65bool isTainted(ProgramStateRef State, const Stmt *S,
66 const LocationContext *LCtx,
68
69/// Check if the value is tainted in the given state.
72
73/// Check if the symbol is tainted in the given state.
74bool isTainted(ProgramStateRef State, SymbolRef Sym,
76
77/// Check if the pointer represented by the region is tainted in the given
78/// state.
79bool isTainted(ProgramStateRef State, const MemRegion *Reg,
81
82void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl = "\n",
83 const char *sep = "");
84
85LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State);
86
87/// The bug visitor prints a diagnostic message at the location where a given
88/// variable was tainted.
89class TaintBugVisitor final : public BugReporterVisitor {
90private:
91 const SVal V;
92
93public:
94 TaintBugVisitor(const SVal V) : V(V) {}
95 void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); }
96
99 PathSensitiveBugReport &BR) override;
100};
101
102} // namespace taint
103} // namespace ento
104} // namespace clang
105
106#endif
#define V(N, I)
Definition: ASTContext.h:3217
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Stmt - This represents one statement.
Definition: Stmt.h:72
BugReporterVisitors are used to add custom diagnostics along a path.
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:72
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:442
Symbolic value.
Definition: SymExpr.h:29
The bug visitor prints a diagnostic message at the location where a given variable was tainted.
Definition: Taint.h:89
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Definition: Taint.cpp:235
void Profile(llvm::FoldingSetNodeID &ID) const override
Definition: Taint.h:95
ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Create a new state in which the value of the statement is marked as tainted.
Definition: Taint.cpp:45
bool isTainted(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Check if the statement has a tainted value in the given state.
Definition: Taint.cpp:147
ProgramStateRef removeTaint(ProgramStateRef State, SVal V)
Definition: Taint.cpp:98
void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl="\n", const char *sep="")
ProgramStateRef addPartialTaint(ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind=TaintTagGeneric)
Create a new state in a which a sub-region of a given symbol is tainted.
Definition: Taint.cpp:124
LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State)
Definition: Taint.cpp:41
static constexpr TaintTagType TaintTagGeneric
Definition: Taint.h:27
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef