clang-tools 20.0.0git
UnsafeFunctionsCheck.cpp
Go to the documentation of this file.
1//===--- UnsafeFunctionsCheck.cpp - clang-tidy ----------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
10#include "../utils/OptionsUtils.h"
11#include "clang/AST/ASTContext.h"
12#include "clang/ASTMatchers/ASTMatchFinder.h"
13#include "clang/Lex/PPCallbacks.h"
14#include "clang/Lex/Preprocessor.h"
15#include <cassert>
16
17using namespace clang::ast_matchers;
18using namespace llvm;
19
20namespace clang::tidy::bugprone {
21
22static constexpr llvm::StringLiteral OptionNameCustomFunctions =
23 "CustomFunctions";
24static constexpr llvm::StringLiteral OptionNameReportDefaultFunctions =
25 "ReportDefaultFunctions";
26static constexpr llvm::StringLiteral OptionNameReportMoreUnsafeFunctions =
27 "ReportMoreUnsafeFunctions";
28
29static constexpr llvm::StringLiteral FunctionNamesWithAnnexKReplacementId =
30 "FunctionNamesWithAnnexKReplacement";
31static constexpr llvm::StringLiteral FunctionNamesId = "FunctionsNames";
32static constexpr llvm::StringLiteral AdditionalFunctionNamesId =
33 "AdditionalFunctionsNames";
34static constexpr llvm::StringLiteral CustomFunctionNamesId =
35 "CustomFunctionNames";
36static constexpr llvm::StringLiteral DeclRefId = "DRE";
37
38static std::optional<std::string>
39getAnnexKReplacementFor(StringRef FunctionName) {
40 return StringSwitch<std::string>(FunctionName)
41 .Case("strlen", "strnlen_s")
42 .Case("wcslen", "wcsnlen_s")
43 .Default((Twine{FunctionName} + "_s").str());
44}
45
46static StringRef getReplacementFor(StringRef FunctionName,
47 bool IsAnnexKAvailable) {
48 if (IsAnnexKAvailable) {
49 // Try to find a better replacement from Annex K first.
50 StringRef AnnexKReplacementFunction =
51 StringSwitch<StringRef>(FunctionName)
52 .Cases("asctime", "asctime_r", "asctime_s")
53 .Case("gets", "gets_s")
54 .Default({});
55 if (!AnnexKReplacementFunction.empty())
56 return AnnexKReplacementFunction;
57 }
58
59 // FIXME: Some of these functions are available in C++ under "std::", and
60 // should be matched and suggested.
61 return StringSwitch<StringRef>(FunctionName)
62 .Cases("asctime", "asctime_r", "strftime")
63 .Case("gets", "fgets")
64 .Case("rewind", "fseek")
65 .Case("setbuf", "setvbuf");
66}
67
68static StringRef getReplacementForAdditional(StringRef FunctionName,
69 bool IsAnnexKAvailable) {
70 if (IsAnnexKAvailable) {
71 // Try to find a better replacement from Annex K first.
72 StringRef AnnexKReplacementFunction = StringSwitch<StringRef>(FunctionName)
73 .Case("bcopy", "memcpy_s")
74 .Case("bzero", "memset_s")
75 .Default({});
76
77 if (!AnnexKReplacementFunction.empty())
78 return AnnexKReplacementFunction;
79 }
80
81 return StringSwitch<StringRef>(FunctionName)
82 .Case("bcmp", "memcmp")
83 .Case("bcopy", "memcpy")
84 .Case("bzero", "memset")
85 .Case("getpw", "getpwuid")
86 .Case("vfork", "posix_spawn");
87}
88
89/// \returns The rationale for replacing the function \p FunctionName with the
90/// safer alternative.
91static StringRef getRationaleFor(StringRef FunctionName) {
92 return StringSwitch<StringRef>(FunctionName)
93 .Cases("asctime", "asctime_r", "ctime",
94 "is not bounds-checking and non-reentrant")
95 .Cases("bcmp", "bcopy", "bzero", "is deprecated")
96 .Cases("fopen", "freopen", "has no exclusive access to the opened file")
97 .Case("gets", "is insecure, was deprecated and removed in C11 and C++14")
98 .Case("getpw", "is dangerous as it may overflow the provided buffer")
99 .Cases("rewind", "setbuf", "has no error detection")
100 .Case("vfork", "is insecure as it can lead to denial of service "
101 "situations in the parent process")
102 .Default("is not bounds-checking");
103}
104
105/// Calculates whether Annex K is available for the current translation unit
106/// based on the macro definitions and the language options.
107///
108/// The result is cached and saved in \p CacheVar.
109static bool isAnnexKAvailable(std::optional<bool> &CacheVar, Preprocessor *PP,
110 const LangOptions &LO) {
111 if (CacheVar.has_value())
112 return *CacheVar;
113
114 if (!LO.C11)
115 // TODO: How is "Annex K" available in C++ mode?
116 return (CacheVar = false).value();
117
118 assert(PP && "No Preprocessor registered.");
119
120 if (!PP->isMacroDefined("__STDC_LIB_EXT1__") ||
121 !PP->isMacroDefined("__STDC_WANT_LIB_EXT1__"))
122 return (CacheVar = false).value();
123
124 const auto *MI =
125 PP->getMacroInfo(PP->getIdentifierInfo("__STDC_WANT_LIB_EXT1__"));
126 if (!MI || MI->tokens_empty())
127 return (CacheVar = false).value();
128
129 const Token &T = MI->tokens().back();
130 if (!T.isLiteral() || !T.getLiteralData())
131 return (CacheVar = false).value();
132
133 CacheVar = StringRef(T.getLiteralData(), T.getLength()) == "1";
134 return CacheVar.value();
135}
136
137static std::vector<UnsafeFunctionsCheck::CheckedFunction>
138parseCheckedFunctions(StringRef Option, ClangTidyContext *Context) {
139 const std::vector<StringRef> Functions =
141 std::vector<UnsafeFunctionsCheck::CheckedFunction> Result;
142 Result.reserve(Functions.size());
143
144 for (StringRef Function : Functions) {
145 if (Function.empty())
146 continue;
147
148 const auto [Name, Rest] = Function.split(',');
149 const auto [Replacement, Reason] = Rest.split(',');
150
151 if (Name.trim().empty()) {
152 Context->configurationDiag("invalid configuration value for option '%0'; "
153 "expected the name of an unsafe function")
155 continue;
156 }
157
158 Result.push_back(
159 {Name.trim().str(),
161 Replacement.trim().str(), Reason.trim().str()});
162 }
163
164 return Result;
165}
166
167static std::string serializeCheckedFunctions(
168 const std::vector<UnsafeFunctionsCheck::CheckedFunction> &Functions) {
169 std::vector<std::string> Result;
170 Result.reserve(Functions.size());
171
172 for (const auto &Entry : Functions) {
173 if (Entry.Reason.empty())
174 Result.push_back(Entry.Name + "," + Entry.Replacement);
175 else
176 Result.push_back(Entry.Name + "," + Entry.Replacement + "," +
177 Entry.Reason);
178 }
179
180 return llvm::join(Result, ";");
181}
182
184 ClangTidyContext *Context)
185 : ClangTidyCheck(Name, Context),
186 CustomFunctions(parseCheckedFunctions(
187 Options.get(OptionNameCustomFunctions, ""), Context)),
188 ReportDefaultFunctions(
189 Options.get(OptionNameReportDefaultFunctions, true)),
190 ReportMoreUnsafeFunctions(
191 Options.get(OptionNameReportMoreUnsafeFunctions, true)) {}
192
195 serializeCheckedFunctions(CustomFunctions));
196 Options.store(Opts, OptionNameReportDefaultFunctions, ReportDefaultFunctions);
198 ReportMoreUnsafeFunctions);
199}
200
201void UnsafeFunctionsCheck::registerMatchers(MatchFinder *Finder) {
202 if (ReportDefaultFunctions) {
203 if (getLangOpts().C11) {
204 // Matching functions with safe replacements only in Annex K.
205 auto FunctionNamesWithAnnexKReplacementMatcher = hasAnyName(
206 "::bsearch", "::ctime", "::fopen", "::fprintf", "::freopen",
207 "::fscanf", "::fwprintf", "::fwscanf", "::getenv", "::gmtime",
208 "::localtime", "::mbsrtowcs", "::mbstowcs", "::memcpy", "::memmove",
209 "::memset", "::printf", "::qsort", "::scanf", "::snprintf",
210 "::sprintf", "::sscanf", "::strcat", "::strcpy", "::strerror",
211 "::strlen", "::strncat", "::strncpy", "::strtok", "::swprintf",
212 "::swscanf", "::vfprintf", "::vfscanf", "::vfwprintf", "::vfwscanf",
213 "::vprintf", "::vscanf", "::vsnprintf", "::vsprintf", "::vsscanf",
214 "::vswprintf", "::vswscanf", "::vwprintf", "::vwscanf", "::wcrtomb",
215 "::wcscat", "::wcscpy", "::wcslen", "::wcsncat", "::wcsncpy",
216 "::wcsrtombs", "::wcstok", "::wcstombs", "::wctomb", "::wmemcpy",
217 "::wmemmove", "::wprintf", "::wscanf");
218 Finder->addMatcher(
219 declRefExpr(to(functionDecl(FunctionNamesWithAnnexKReplacementMatcher)
221 .bind(DeclRefId),
222 this);
223 }
224
225 // Matching functions with replacements without Annex K.
226 auto FunctionNamesMatcher =
227 hasAnyName("::asctime", "asctime_r", "::gets", "::rewind", "::setbuf");
228 Finder->addMatcher(
229 declRefExpr(
230 to(functionDecl(FunctionNamesMatcher).bind(FunctionNamesId)))
231 .bind(DeclRefId),
232 this);
233
234 if (ReportMoreUnsafeFunctions) {
235 // Matching functions with replacements without Annex K, at user request.
236 auto AdditionalFunctionNamesMatcher =
237 hasAnyName("::bcmp", "::bcopy", "::bzero", "::getpw", "::vfork");
238 Finder->addMatcher(
239 declRefExpr(to(functionDecl(AdditionalFunctionNamesMatcher)
241 .bind(DeclRefId),
242 this);
243 }
244 }
245
246 if (!CustomFunctions.empty()) {
247 std::vector<llvm::StringRef> FunctionNames;
248 FunctionNames.reserve(CustomFunctions.size());
249
250 for (const auto &Entry : CustomFunctions)
251 FunctionNames.push_back(Entry.Name);
252
253 auto CustomFunctionsMatcher = matchers::matchesAnyListedName(FunctionNames);
254
255 Finder->addMatcher(declRefExpr(to(functionDecl(CustomFunctionsMatcher)
256 .bind(CustomFunctionNamesId)))
257 .bind(DeclRefId),
258 this);
259 }
260}
261
262void UnsafeFunctionsCheck::check(const MatchFinder::MatchResult &Result) {
263 const auto *DeclRef = Result.Nodes.getNodeAs<DeclRefExpr>(DeclRefId);
264 const auto *FuncDecl = cast<FunctionDecl>(DeclRef->getDecl());
265 assert(DeclRef && FuncDecl && "No valid matched node in check()");
266
267 // Only one of these are matched at a time.
268 const auto *AnnexK = Result.Nodes.getNodeAs<FunctionDecl>(
270 const auto *Normal = Result.Nodes.getNodeAs<FunctionDecl>(FunctionNamesId);
271 const auto *Additional =
272 Result.Nodes.getNodeAs<FunctionDecl>(AdditionalFunctionNamesId);
273 const auto *Custom =
274 Result.Nodes.getNodeAs<FunctionDecl>(CustomFunctionNamesId);
275 assert((AnnexK || Normal || Additional || Custom) &&
276 "No valid match category.");
277
278 bool AnnexKIsAvailable =
279 isAnnexKAvailable(IsAnnexKAvailable, PP, getLangOpts());
280 StringRef FunctionName = FuncDecl->getName();
281
282 if (Custom) {
283 for (const auto &Entry : CustomFunctions) {
284 if (Entry.Pattern.match(*FuncDecl)) {
285 StringRef Reason =
286 Entry.Reason.empty() ? "is marked as unsafe" : Entry.Reason.c_str();
287
288 if (Entry.Replacement.empty()) {
289 diag(DeclRef->getExprLoc(), "function %0 %1; it should not be used")
290 << FuncDecl << Reason << Entry.Replacement
291 << DeclRef->getSourceRange();
292 } else {
293 diag(DeclRef->getExprLoc(),
294 "function %0 %1; '%2' should be used instead")
295 << FuncDecl << Reason << Entry.Replacement
296 << DeclRef->getSourceRange();
297 }
298
299 return;
300 }
301 }
302
303 llvm_unreachable("No custom function was matched.");
304 return;
305 }
306
307 const std::optional<std::string> ReplacementFunctionName =
308 [&]() -> std::optional<std::string> {
309 if (AnnexK) {
310 if (AnnexKIsAvailable)
311 return getAnnexKReplacementFor(FunctionName);
312 return std::nullopt;
313 }
314
315 if (Normal)
316 return getReplacementFor(FunctionName, AnnexKIsAvailable).str();
317
318 if (Additional)
319 return getReplacementForAdditional(FunctionName, AnnexKIsAvailable).str();
320
321 llvm_unreachable("Unhandled match category");
322 }();
323 if (!ReplacementFunctionName)
324 return;
325
326 diag(DeclRef->getExprLoc(), "function %0 %1; '%2' should be used instead")
327 << FuncDecl << getRationaleFor(FunctionName)
328 << ReplacementFunctionName.value() << DeclRef->getSourceRange();
329}
330
332 const SourceManager &SM, Preprocessor *PP,
333 Preprocessor * /*ModuleExpanderPP*/) {
334 this->PP = PP;
335}
336
338 this->PP = nullptr;
339 IsAnnexKAvailable.reset();
340}
341
342} // namespace clang::tidy::bugprone
llvm::SmallString< 256U > Name
const DeclRefExpr * DeclRef
void store(ClangTidyOptions::OptionMap &Options, StringRef LocalName, StringRef Value) const
Stores an option with the check-local name LocalName with string value Value to Options.
Base class for all clang-tidy checks.
DiagnosticBuilder diag(SourceLocation Loc, StringRef Description, DiagnosticIDs::Level Level=DiagnosticIDs::Warning)
Add a diagnostic with the check's name.
const LangOptions & getLangOpts() const
Returns the language options from the context.
Every ClangTidyCheck reports errors through a DiagnosticsEngine provided by this context.
void registerPPCallbacks(const SourceManager &SM, Preprocessor *PP, Preprocessor *ModuleExpanderPP) override
Override this to register PPCallbacks in the preprocessor.
void check(const ast_matchers::MatchFinder::MatchResult &Result) override
ClangTidyChecks that register ASTMatchers should do the actual work in here.
void storeOptions(ClangTidyOptions::OptionMap &Opts) override
Should store all options supported by this check with their current values or default values for opti...
UnsafeFunctionsCheck(StringRef Name, ClangTidyContext *Context)
void registerMatchers(ast_matchers::MatchFinder *Finder) override
Override this to register AST matchers with Finder.
static StringRef getReplacementForAdditional(StringRef FunctionName, bool IsAnnexKAvailable)
static constexpr llvm::StringLiteral FunctionNamesWithAnnexKReplacementId
static constexpr llvm::StringLiteral CustomFunctionNamesId
static StringRef getRationaleFor(StringRef FunctionName)
static bool isAnnexKAvailable(std::optional< bool > &CacheVar, Preprocessor *PP, const LangOptions &LO)
Calculates whether Annex K is available for the current translation unit based on the macro definitio...
static std::optional< std::string > getAnnexKReplacementFor(StringRef FunctionName)
static StringRef getReplacementFor(StringRef FunctionName, bool IsAnnexKAvailable)
static constexpr llvm::StringLiteral AdditionalFunctionNamesId
static constexpr llvm::StringLiteral OptionNameReportMoreUnsafeFunctions
static std::vector< UnsafeFunctionsCheck::CheckedFunction > parseCheckedFunctions(StringRef Option, ClangTidyContext *Context)
static constexpr llvm::StringLiteral OptionNameReportDefaultFunctions
static constexpr llvm::StringLiteral FunctionNamesId
static constexpr llvm::StringLiteral OptionNameCustomFunctions
static constexpr llvm::StringLiteral DeclRefId
static std::string serializeCheckedFunctions(const std::vector< UnsafeFunctionsCheck::CheckedFunction > &Functions)
inline ::clang::ast_matchers::internal::Matcher< NamedDecl > matchesAnyListedName(llvm::ArrayRef< StringRef > NameList)
std::vector< StringRef > parseStringList(StringRef Option)
Parse a semicolon separated list of strings.
Some operations such as code completion produce a set of candidates.
Definition: Generators.h:58
llvm::StringMap< ClangTidyValue > OptionMap
static constexpr const char FuncDecl[]