clang  14.0.0git
Taint.h
Go to the documentation of this file.
1 //=== Taint.h - Taint tracking and basic propagation rules. --------*- C++ -*-//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // Defines basic, non-domain-specific mechanisms for tracking tainted values.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAINT_H
14 #define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAINT_H
15 
18 
19 namespace clang {
20 namespace ento {
21 namespace taint {
22 
23 /// The type of taint, which helps to differentiate between different types of
24 /// taint.
26 
27 static constexpr TaintTagType TaintTagGeneric = 0;
28 
29 /// Create a new state in which the value of the statement is marked as tainted.
30 LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S,
31  const LocationContext *LCtx,
33 
34 /// Create a new state in which the value is marked as tainted.
37 
38 /// Create a new state in which the symbol is marked as tainted.
41 
42 /// Create a new state in which the pointer represented by the region
43 /// is marked as tainted.
45  const MemRegion *R,
47 
49 
51  const MemRegion *R);
52 
54  SymbolRef Sym);
55 
56 /// Create a new state in a which a sub-region of a given symbol is tainted.
57 /// This might be necessary when referring to regions that can not have an
58 /// individual symbol, e.g. if they are represented by the default binding of
59 /// a LazyCompoundVal.
60 LLVM_NODISCARD ProgramStateRef addPartialTaint(
63 
64 /// Check if the statement has a tainted value in the given state.
65 bool isTainted(ProgramStateRef State, const Stmt *S,
66  const LocationContext *LCtx,
68 
69 /// Check if the value is tainted in the given state.
72 
73 /// Check if the symbol is tainted in the given state.
76 
77 /// Check if the pointer represented by the region is tainted in the given
78 /// state.
79 bool isTainted(ProgramStateRef State, const MemRegion *Reg,
81 
82 void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl = "\n",
83  const char *sep = "");
84 
85 LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State);
86 
87 /// The bug visitor prints a diagnostic message at the location where a given
88 /// variable was tainted.
89 class TaintBugVisitor final : public BugReporterVisitor {
90 private:
91  const SVal V;
92 
93 public:
94  TaintBugVisitor(const SVal V) : V(V) {}
95  void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); }
96 
98  BugReporterContext &BRC,
99  PathSensitiveBugReport &BR) override;
100 };
101 
102 } // namespace taint
103 } // namespace ento
104 } // namespace clang
105 
106 #endif
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::PathDiagnosticPieceRef
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
Definition: PathDiagnostic.h:494
clang::ento::taint::printTaint
void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl="\n", const char *sep="")
clang::ento::taint::TaintBugVisitor::VisitNode
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Definition: Taint.cpp:232
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
clang::ento::taint::isTainted
bool isTainted(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Check if the statement has a tainted value in the given state.
clang::ento::BugReporterVisitor
BugReporterVisitors are used to add custom diagnostics along a path.
Definition: BugReporterVisitors.h:48
clang::ento::taint::TaintTagGeneric
static constexpr TaintTagType TaintTagGeneric
Definition: Taint.h:27
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
V
#define V(N, I)
Definition: ASTContext.h:3121
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::taint::addTaint
LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Create a new state in which the value of the statement is marked as tainted.
clang::ento::taint::TaintBugVisitor::TaintBugVisitor
TaintBugVisitor(const SVal V)
Definition: Taint.h:94
clang::ento::BugReporterContext
Definition: BugReporter.h:703
clang::ento::taint::removeTaint
LLVM_NODISCARD ProgramStateRef removeTaint(ProgramStateRef State, SVal V)
clang::ento::taint::TaintBugVisitor
The bug visitor prints a diagnostic message at the location where a given variable was tainted.
Definition: Taint.h:89
BugReporterVisitors.h
clang::ento::taint::TaintBugVisitor::Profile
void Profile(llvm::FoldingSetNodeID &ID) const override
Definition: Taint.h:95
clang::ento::taint::dumpTaint
LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State)
State
LineState State
Definition: UnwrappedLineFormatter.cpp:986
clang::ObjCPropertyAttribute::Kind
Kind
Definition: DeclObjCCommon.h:22
ProgramState.h
clang::ento::PathSensitiveBugReport
Definition: BugReporter.h:291
clang::Builtin::ID
ID
Definition: Builtins.h:48
clang
Definition: CalledOnceCheck.h:17
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
unsigned
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:75
clang::ento::SubRegion
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:435
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::taint::addPartialTaint
LLVM_NODISCARD ProgramStateRef addPartialTaint(ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind=TaintTagGeneric)
Create a new state in a which a sub-region of a given symbol is tainted.