1 //===- OSObjectCStyleCast.cpp ------------------------------------*- C++ -*-==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines OSObjectCStyleCast checker, which checks for C-style casts
10 // of OSObjects. Such casts almost always indicate a code smell,
11 // as an explicit static or dynamic cast should be used instead.
12 //===----------------------------------------------------------------------===//
13 
14 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
15 #include "clang/ASTMatchers/ASTMatchFinder.h"
16 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
17 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
18 #include "clang/StaticAnalyzer/Core/Checker.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
20 #include "llvm/Support/Debug.h"
21 
22 using namespace clang;
23 using namespace ento;
24 using namespace ast_matchers;
25 
26 namespace {
27 static constexpr const char *const WarnAtNode = "WarnAtNode";
28 static constexpr const char *const WarnRecordDecl = "WarnRecordDecl";
29 
30 class OSObjectCStyleCastChecker : public Checker<check::ASTCodeBody> {
31 public:
32   void checkASTCodeBody(const Decl *D, AnalysisManager &AM,
33                         BugReporter &BR) const;
34 };
35 }
36 
37 static void emitDiagnostics(const BoundNodes &Nodes,
38                             BugReporter &BR,
39                             AnalysisDeclContext *ADC,
40                             const OSObjectCStyleCastChecker *Checker) {
41   const auto *CE = Nodes.getNodeAs<CastExpr>(WarnAtNode);
42   const CXXRecordDecl *RD = Nodes.getNodeAs<CXXRecordDecl>(WarnRecordDecl);
43   assert(CE && RD);
44 
45   std::string Diagnostics;
46   llvm::raw_string_ostream OS(Diagnostics);
47   OS << "C-style cast of an OSObject is prone to type confusion attacks; "
48      << "use 'OSRequiredCast' if the object is definitely of type '"
49      << RD->getNameAsString() << "', or 'OSDynamicCast' followed by "
50      << "a null check if unsure",
51 
52   BR.EmitBasicReport(
53     ADC->getDecl(),
54     Checker,
55     /*Name=*/"OSObject C-Style Cast",
56     categories::SecurityError,
57     OS.str(),
58     PathDiagnosticLocation::createBegin(CE, BR.getSourceManager(), ADC),
59     CE->getSourceRange());
60 }
61 
62 static decltype(auto) hasTypePointingTo(DeclarationMatcher DeclM) {
63   return hasType(pointerType(pointee(hasDeclaration(DeclM))));
64 }
65 
66 void OSObjectCStyleCastChecker::checkASTCodeBody(const Decl *D, AnalysisManager &AM,
67                                                  BugReporter &BR) const {
68 
69   AnalysisDeclContext *ADC = AM.getAnalysisDeclContext(D);
70 
71   auto DynamicCastM = callExpr(callee(functionDecl(hasName("safeMetaCast"))));
72 
73   auto OSObjTypeM = hasTypePointingTo(cxxRecordDecl(isDerivedFrom("OSMetaClassBase")));
74   auto OSObjSubclassM = hasTypePointingTo(
75     cxxRecordDecl(isDerivedFrom("OSObject")).bind(WarnRecordDecl));
76 
77   auto CastM = cStyleCastExpr(
78           allOf(hasSourceExpression(allOf(OSObjTypeM, unless(DynamicCastM))),
79           OSObjSubclassM)).bind(WarnAtNode);
80 
81   auto Matches = match(stmt(forEachDescendant(CastM)), *D->getBody(), AM.getASTContext());
82   for (BoundNodes Match : Matches)
83     emitDiagnostics(Match, BR, ADC, this);
84 }
85 
86 void ento::registerOSObjectCStyleCast(CheckerManager &Mgr) {
87   Mgr.registerChecker<OSObjectCStyleCastChecker>();
88 }
89 
90 bool ento::shouldRegisterOSObjectCStyleCast(const CheckerManager &mgr) {
91   return true;
92 }
93