1e5dd7070Spatrick //== GenericTaintChecker.cpp ----------------------------------- -*- C++ -*--=//
2e5dd7070Spatrick //
3e5dd7070Spatrick // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4e5dd7070Spatrick // See https://llvm.org/LICENSE.txt for license information.
5e5dd7070Spatrick // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6e5dd7070Spatrick //
7e5dd7070Spatrick //===----------------------------------------------------------------------===//
8e5dd7070Spatrick //
9e5dd7070Spatrick // This checker defines the attack surface for generic taint propagation.
10e5dd7070Spatrick //
11e5dd7070Spatrick // The taint information produced by it might be useful to other checkers. For
12e5dd7070Spatrick // example, checkers should report errors which involve tainted data more
13e5dd7070Spatrick // aggressively, even if the involved symbols are under constrained.
14e5dd7070Spatrick //
15e5dd7070Spatrick //===----------------------------------------------------------------------===//
16e5dd7070Spatrick
17e5dd7070Spatrick #include "Yaml.h"
18e5dd7070Spatrick #include "clang/AST/Attr.h"
19e5dd7070Spatrick #include "clang/Basic/Builtins.h"
20e5dd7070Spatrick #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
21*12c85518Srobert #include "clang/StaticAnalyzer/Checkers/Taint.h"
22e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
23e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/Checker.h"
24e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/CheckerManager.h"
25*12c85518Srobert #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
26ec727ea7Spatrick #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
27e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
28e5dd7070Spatrick #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
29e5dd7070Spatrick #include "llvm/Support/YAMLTraits.h"
30ec727ea7Spatrick
31e5dd7070Spatrick #include <limits>
32ec727ea7Spatrick #include <memory>
33*12c85518Srobert #include <optional>
34e5dd7070Spatrick #include <utility>
35e5dd7070Spatrick
36*12c85518Srobert #define DEBUG_TYPE "taint-checker"
37*12c85518Srobert
38e5dd7070Spatrick using namespace clang;
39e5dd7070Spatrick using namespace ento;
40e5dd7070Spatrick using namespace taint;
41e5dd7070Spatrick
42*12c85518Srobert using llvm::ImmutableSet;
43*12c85518Srobert
44e5dd7070Spatrick namespace {
45*12c85518Srobert
46*12c85518Srobert class GenericTaintChecker;
47*12c85518Srobert
48*12c85518Srobert /// Check for CWE-134: Uncontrolled Format String.
49*12c85518Srobert constexpr llvm::StringLiteral MsgUncontrolledFormatString =
50*12c85518Srobert "Untrusted data is used as a format string "
51*12c85518Srobert "(CWE-134: Uncontrolled Format String)";
52*12c85518Srobert
53*12c85518Srobert /// Check for:
54*12c85518Srobert /// CERT/STR02-C. "Sanitize data passed to complex subsystems"
55*12c85518Srobert /// CWE-78, "Failure to Sanitize Data into an OS Command"
56*12c85518Srobert constexpr llvm::StringLiteral MsgSanitizeSystemArgs =
57*12c85518Srobert "Untrusted data is passed to a system call "
58*12c85518Srobert "(CERT/STR02-C. Sanitize data passed to complex subsystems)";
59*12c85518Srobert
60*12c85518Srobert /// Check if tainted data is used as a buffer size in strn.. functions,
61*12c85518Srobert /// and allocators.
62*12c85518Srobert constexpr llvm::StringLiteral MsgTaintedBufferSize =
63*12c85518Srobert "Untrusted data is used to specify the buffer size "
64*12c85518Srobert "(CERT/STR31-C. Guarantee that storage for strings has sufficient space "
65*12c85518Srobert "for character data and the null terminator)";
66*12c85518Srobert
67*12c85518Srobert /// Check if tainted data is used as a custom sink's parameter.
68*12c85518Srobert constexpr llvm::StringLiteral MsgCustomSink =
69*12c85518Srobert "Untrusted data is passed to a user-defined sink";
70*12c85518Srobert
71*12c85518Srobert using ArgIdxTy = int;
72*12c85518Srobert using ArgVecTy = llvm::SmallVector<ArgIdxTy, 2>;
73*12c85518Srobert
74*12c85518Srobert /// Denotes the return value.
75*12c85518Srobert constexpr ArgIdxTy ReturnValueIndex{-1};
76*12c85518Srobert
fromArgumentCount(unsigned Count)77*12c85518Srobert static ArgIdxTy fromArgumentCount(unsigned Count) {
78*12c85518Srobert assert(Count <=
79*12c85518Srobert static_cast<std::size_t>(std::numeric_limits<ArgIdxTy>::max()) &&
80*12c85518Srobert "ArgIdxTy is not large enough to represent the number of arguments.");
81*12c85518Srobert return Count;
82e5dd7070Spatrick }
83e5dd7070Spatrick
84*12c85518Srobert /// Check if the region the expression evaluates to is the standard input,
85*12c85518Srobert /// and thus, is tainted.
86*12c85518Srobert /// FIXME: Move this to Taint.cpp.
isStdin(SVal Val,const ASTContext & ACtx)87*12c85518Srobert bool isStdin(SVal Val, const ASTContext &ACtx) {
88*12c85518Srobert // FIXME: What if Val is NonParamVarRegion?
89e5dd7070Spatrick
90*12c85518Srobert // The region should be symbolic, we do not know it's value.
91*12c85518Srobert const auto *SymReg = dyn_cast_or_null<SymbolicRegion>(Val.getAsRegion());
92*12c85518Srobert if (!SymReg)
93*12c85518Srobert return false;
94e5dd7070Spatrick
95*12c85518Srobert // Get it's symbol and find the declaration region it's pointing to.
96*12c85518Srobert const auto *DeclReg =
97*12c85518Srobert dyn_cast_or_null<DeclRegion>(SymReg->getSymbol()->getOriginRegion());
98*12c85518Srobert if (!DeclReg)
99*12c85518Srobert return false;
100e5dd7070Spatrick
101*12c85518Srobert // This region corresponds to a declaration, find out if it's a global/extern
102*12c85518Srobert // variable named stdin with the proper type.
103*12c85518Srobert if (const auto *D = dyn_cast_or_null<VarDecl>(DeclReg->getDecl())) {
104*12c85518Srobert D = D->getCanonicalDecl();
105*12c85518Srobert // FIXME: This should look for an exact match.
106*12c85518Srobert if (D->getName().contains("stdin") && D->isExternC()) {
107*12c85518Srobert const QualType FILETy = ACtx.getFILEType().getCanonicalType();
108*12c85518Srobert const QualType Ty = D->getType().getCanonicalType();
109*12c85518Srobert
110*12c85518Srobert if (Ty->isPointerType())
111*12c85518Srobert return Ty->getPointeeType() == FILETy;
112*12c85518Srobert }
113*12c85518Srobert }
114*12c85518Srobert return false;
115*12c85518Srobert }
116*12c85518Srobert
getPointeeOf(const CheckerContext & C,Loc LValue)117*12c85518Srobert SVal getPointeeOf(const CheckerContext &C, Loc LValue) {
118*12c85518Srobert const QualType ArgTy = LValue.getType(C.getASTContext());
119*12c85518Srobert if (!ArgTy->isPointerType() || !ArgTy->getPointeeType()->isVoidType())
120*12c85518Srobert return C.getState()->getSVal(LValue);
121*12c85518Srobert
122*12c85518Srobert // Do not dereference void pointers. Treat them as byte pointers instead.
123*12c85518Srobert // FIXME: we might want to consider more than just the first byte.
124*12c85518Srobert return C.getState()->getSVal(LValue, C.getASTContext().CharTy);
125*12c85518Srobert }
126*12c85518Srobert
127*12c85518Srobert /// Given a pointer/reference argument, return the value it refers to.
getPointeeOf(const CheckerContext & C,SVal Arg)128*12c85518Srobert std::optional<SVal> getPointeeOf(const CheckerContext &C, SVal Arg) {
129*12c85518Srobert if (auto LValue = Arg.getAs<Loc>())
130*12c85518Srobert return getPointeeOf(C, *LValue);
131*12c85518Srobert return std::nullopt;
132*12c85518Srobert }
133*12c85518Srobert
134*12c85518Srobert /// Given a pointer, return the SVal of its pointee or if it is tainted,
135*12c85518Srobert /// otherwise return the pointer's SVal if tainted.
136*12c85518Srobert /// Also considers stdin as a taint source.
getTaintedPointeeOrPointer(const CheckerContext & C,SVal Arg)137*12c85518Srobert std::optional<SVal> getTaintedPointeeOrPointer(const CheckerContext &C,
138*12c85518Srobert SVal Arg) {
139*12c85518Srobert const ProgramStateRef State = C.getState();
140*12c85518Srobert
141*12c85518Srobert if (auto Pointee = getPointeeOf(C, Arg))
142*12c85518Srobert if (isTainted(State, *Pointee)) // FIXME: isTainted(...) ? Pointee : None;
143*12c85518Srobert return Pointee;
144*12c85518Srobert
145*12c85518Srobert if (isTainted(State, Arg))
146*12c85518Srobert return Arg;
147*12c85518Srobert
148*12c85518Srobert // FIXME: This should be done by the isTainted() API.
149*12c85518Srobert if (isStdin(Arg, C.getASTContext()))
150*12c85518Srobert return Arg;
151*12c85518Srobert
152*12c85518Srobert return std::nullopt;
153*12c85518Srobert }
154*12c85518Srobert
isTaintedOrPointsToTainted(const Expr * E,const ProgramStateRef & State,CheckerContext & C)155*12c85518Srobert bool isTaintedOrPointsToTainted(const Expr *E, const ProgramStateRef &State,
156*12c85518Srobert CheckerContext &C) {
157*12c85518Srobert return getTaintedPointeeOrPointer(C, C.getSVal(E)).has_value();
158*12c85518Srobert }
159*12c85518Srobert
160*12c85518Srobert /// ArgSet is used to describe arguments relevant for taint detection or
161*12c85518Srobert /// taint application. A discrete set of argument indexes and a variadic
162*12c85518Srobert /// argument list signified by a starting index are supported.
163*12c85518Srobert class ArgSet {
164*12c85518Srobert public:
165*12c85518Srobert ArgSet() = default;
ArgSet(ArgVecTy && DiscreteArgs,std::optional<ArgIdxTy> VariadicIndex=std::nullopt)166*12c85518Srobert ArgSet(ArgVecTy &&DiscreteArgs,
167*12c85518Srobert std::optional<ArgIdxTy> VariadicIndex = std::nullopt)
168*12c85518Srobert : DiscreteArgs(std::move(DiscreteArgs)),
169*12c85518Srobert VariadicIndex(std::move(VariadicIndex)) {}
170*12c85518Srobert
contains(ArgIdxTy ArgIdx) const171*12c85518Srobert bool contains(ArgIdxTy ArgIdx) const {
172*12c85518Srobert if (llvm::is_contained(DiscreteArgs, ArgIdx))
173*12c85518Srobert return true;
174*12c85518Srobert
175*12c85518Srobert return VariadicIndex && ArgIdx >= *VariadicIndex;
176*12c85518Srobert }
177*12c85518Srobert
isEmpty() const178*12c85518Srobert bool isEmpty() const { return DiscreteArgs.empty() && !VariadicIndex; }
179*12c85518Srobert
180*12c85518Srobert private:
181*12c85518Srobert ArgVecTy DiscreteArgs;
182*12c85518Srobert std::optional<ArgIdxTy> VariadicIndex;
183*12c85518Srobert };
184*12c85518Srobert
185*12c85518Srobert /// A struct used to specify taint propagation rules for a function.
186*12c85518Srobert ///
187*12c85518Srobert /// If any of the possible taint source arguments is tainted, all of the
188*12c85518Srobert /// destination arguments should also be tainted. If ReturnValueIndex is added
189*12c85518Srobert /// to the dst list, the return value will be tainted.
190*12c85518Srobert class GenericTaintRule {
191*12c85518Srobert /// Arguments which are taints sinks and should be checked, and a report
192*12c85518Srobert /// should be emitted if taint reaches these.
193*12c85518Srobert ArgSet SinkArgs;
194*12c85518Srobert /// Arguments which should be sanitized on function return.
195*12c85518Srobert ArgSet FilterArgs;
196*12c85518Srobert /// Arguments which can participate in taint propagationa. If any of the
197*12c85518Srobert /// arguments in PropSrcArgs is tainted, all arguments in PropDstArgs should
198*12c85518Srobert /// be tainted.
199*12c85518Srobert ArgSet PropSrcArgs;
200*12c85518Srobert ArgSet PropDstArgs;
201*12c85518Srobert
202*12c85518Srobert /// A message that explains why the call is sensitive to taint.
203*12c85518Srobert std::optional<StringRef> SinkMsg;
204*12c85518Srobert
205*12c85518Srobert GenericTaintRule() = default;
206*12c85518Srobert
GenericTaintRule(ArgSet && Sink,ArgSet && Filter,ArgSet && Src,ArgSet && Dst,std::optional<StringRef> SinkMsg=std::nullopt)207*12c85518Srobert GenericTaintRule(ArgSet &&Sink, ArgSet &&Filter, ArgSet &&Src, ArgSet &&Dst,
208*12c85518Srobert std::optional<StringRef> SinkMsg = std::nullopt)
209*12c85518Srobert : SinkArgs(std::move(Sink)), FilterArgs(std::move(Filter)),
210*12c85518Srobert PropSrcArgs(std::move(Src)), PropDstArgs(std::move(Dst)),
211*12c85518Srobert SinkMsg(SinkMsg) {}
212*12c85518Srobert
213*12c85518Srobert public:
214*12c85518Srobert /// Make a rule that reports a warning if taint reaches any of \p FilterArgs
215*12c85518Srobert /// arguments.
Sink(ArgSet && SinkArgs,std::optional<StringRef> Msg=std::nullopt)216*12c85518Srobert static GenericTaintRule Sink(ArgSet &&SinkArgs,
217*12c85518Srobert std::optional<StringRef> Msg = std::nullopt) {
218*12c85518Srobert return {std::move(SinkArgs), {}, {}, {}, Msg};
219*12c85518Srobert }
220*12c85518Srobert
221*12c85518Srobert /// Make a rule that sanitizes all FilterArgs arguments.
Filter(ArgSet && FilterArgs)222*12c85518Srobert static GenericTaintRule Filter(ArgSet &&FilterArgs) {
223*12c85518Srobert return {{}, std::move(FilterArgs), {}, {}};
224*12c85518Srobert }
225*12c85518Srobert
226*12c85518Srobert /// Make a rule that unconditionally taints all Args.
227*12c85518Srobert /// If Func is provided, it must also return true for taint to propagate.
Source(ArgSet && SourceArgs)228*12c85518Srobert static GenericTaintRule Source(ArgSet &&SourceArgs) {
229*12c85518Srobert return {{}, {}, {}, std::move(SourceArgs)};
230*12c85518Srobert }
231*12c85518Srobert
232*12c85518Srobert /// Make a rule that taints all PropDstArgs if any of PropSrcArgs is tainted.
Prop(ArgSet && SrcArgs,ArgSet && DstArgs)233*12c85518Srobert static GenericTaintRule Prop(ArgSet &&SrcArgs, ArgSet &&DstArgs) {
234*12c85518Srobert return {{}, {}, std::move(SrcArgs), std::move(DstArgs)};
235*12c85518Srobert }
236*12c85518Srobert
237*12c85518Srobert /// Make a rule that taints all PropDstArgs if any of PropSrcArgs is tainted.
238*12c85518Srobert static GenericTaintRule
SinkProp(ArgSet && SinkArgs,ArgSet && SrcArgs,ArgSet && DstArgs,std::optional<StringRef> Msg=std::nullopt)239*12c85518Srobert SinkProp(ArgSet &&SinkArgs, ArgSet &&SrcArgs, ArgSet &&DstArgs,
240*12c85518Srobert std::optional<StringRef> Msg = std::nullopt) {
241*12c85518Srobert return {
242*12c85518Srobert std::move(SinkArgs), {}, std::move(SrcArgs), std::move(DstArgs), Msg};
243*12c85518Srobert }
244*12c85518Srobert
245*12c85518Srobert /// Process a function which could either be a taint source, a taint sink, a
246*12c85518Srobert /// taint filter or a taint propagator.
247*12c85518Srobert void process(const GenericTaintChecker &Checker, const CallEvent &Call,
248*12c85518Srobert CheckerContext &C) const;
249*12c85518Srobert
250*12c85518Srobert /// Handles the resolution of indexes of type ArgIdxTy to Expr*-s.
GetArgExpr(ArgIdxTy ArgIdx,const CallEvent & Call)251*12c85518Srobert static const Expr *GetArgExpr(ArgIdxTy ArgIdx, const CallEvent &Call) {
252*12c85518Srobert return ArgIdx == ReturnValueIndex ? Call.getOriginExpr()
253*12c85518Srobert : Call.getArgExpr(ArgIdx);
254*12c85518Srobert };
255*12c85518Srobert
256*12c85518Srobert /// Functions for custom taintedness propagation.
257*12c85518Srobert static bool UntrustedEnv(CheckerContext &C);
258*12c85518Srobert };
259*12c85518Srobert
260*12c85518Srobert using RuleLookupTy = CallDescriptionMap<GenericTaintRule>;
261e5dd7070Spatrick
262e5dd7070Spatrick /// Used to parse the configuration file.
263e5dd7070Spatrick struct TaintConfiguration {
264*12c85518Srobert using NameScopeArgs = std::tuple<std::string, std::string, ArgVecTy>;
265*12c85518Srobert enum class VariadicType { None, Src, Dst };
266e5dd7070Spatrick
267*12c85518Srobert struct Common {
268e5dd7070Spatrick std::string Name;
269e5dd7070Spatrick std::string Scope;
270*12c85518Srobert };
271*12c85518Srobert
272*12c85518Srobert struct Sink : Common {
273*12c85518Srobert ArgVecTy SinkArgs;
274*12c85518Srobert };
275*12c85518Srobert
276*12c85518Srobert struct Filter : Common {
277*12c85518Srobert ArgVecTy FilterArgs;
278*12c85518Srobert };
279*12c85518Srobert
280*12c85518Srobert struct Propagation : Common {
281*12c85518Srobert ArgVecTy SrcArgs;
282*12c85518Srobert ArgVecTy DstArgs;
283e5dd7070Spatrick VariadicType VarType;
284*12c85518Srobert ArgIdxTy VarIndex;
285e5dd7070Spatrick };
286e5dd7070Spatrick
287e5dd7070Spatrick std::vector<Propagation> Propagations;
288*12c85518Srobert std::vector<Filter> Filters;
289*12c85518Srobert std::vector<Sink> Sinks;
290e5dd7070Spatrick
291e5dd7070Spatrick TaintConfiguration() = default;
292e5dd7070Spatrick TaintConfiguration(const TaintConfiguration &) = default;
293e5dd7070Spatrick TaintConfiguration(TaintConfiguration &&) = default;
294e5dd7070Spatrick TaintConfiguration &operator=(const TaintConfiguration &) = default;
295e5dd7070Spatrick TaintConfiguration &operator=(TaintConfiguration &&) = default;
296e5dd7070Spatrick };
297e5dd7070Spatrick
298*12c85518Srobert struct GenericTaintRuleParser {
GenericTaintRuleParser__anonde603f4d0111::GenericTaintRuleParser299*12c85518Srobert GenericTaintRuleParser(CheckerManager &Mgr) : Mgr(Mgr) {}
300*12c85518Srobert /// Container type used to gather call identification objects grouped into
301*12c85518Srobert /// pairs with their corresponding taint rules. It is temporary as it is used
302*12c85518Srobert /// to finally initialize RuleLookupTy, which is considered to be immutable.
303*12c85518Srobert using RulesContTy = std::vector<std::pair<CallDescription, GenericTaintRule>>;
304*12c85518Srobert RulesContTy parseConfiguration(const std::string &Option,
305*12c85518Srobert TaintConfiguration &&Config) const;
306e5dd7070Spatrick
307e5dd7070Spatrick private:
308*12c85518Srobert using NamePartsTy = llvm::SmallVector<StringRef, 2>;
309e5dd7070Spatrick
310*12c85518Srobert /// Validate part of the configuration, which contains a list of argument
311*12c85518Srobert /// indexes.
312*12c85518Srobert void validateArgVector(const std::string &Option, const ArgVecTy &Args) const;
313e5dd7070Spatrick
314*12c85518Srobert template <typename Config> static NamePartsTy parseNameParts(const Config &C);
315ec727ea7Spatrick
316*12c85518Srobert // Takes the config and creates a CallDescription for it and associates a Rule
317*12c85518Srobert // with that.
318*12c85518Srobert template <typename Config>
319*12c85518Srobert static void consumeRulesFromConfig(const Config &C, GenericTaintRule &&Rule,
320*12c85518Srobert RulesContTy &Rules);
321e5dd7070Spatrick
322*12c85518Srobert void parseConfig(const std::string &Option, TaintConfiguration::Sink &&P,
323*12c85518Srobert RulesContTy &Rules) const;
324*12c85518Srobert void parseConfig(const std::string &Option, TaintConfiguration::Filter &&P,
325*12c85518Srobert RulesContTy &Rules) const;
326*12c85518Srobert void parseConfig(const std::string &Option,
327*12c85518Srobert TaintConfiguration::Propagation &&P,
328*12c85518Srobert RulesContTy &Rules) const;
329e5dd7070Spatrick
330*12c85518Srobert CheckerManager &Mgr;
331e5dd7070Spatrick };
332e5dd7070Spatrick
333*12c85518Srobert class GenericTaintChecker : public Checker<check::PreCall, check::PostCall> {
334*12c85518Srobert public:
335*12c85518Srobert void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
336*12c85518Srobert void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
337e5dd7070Spatrick
338*12c85518Srobert void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
339*12c85518Srobert const char *Sep) const override;
340e5dd7070Spatrick
341e5dd7070Spatrick /// Generate a report if the expression is tainted or points to tainted data.
342e5dd7070Spatrick bool generateReportIfTainted(const Expr *E, StringRef Msg,
343e5dd7070Spatrick CheckerContext &C) const;
344e5dd7070Spatrick
345*12c85518Srobert private:
346*12c85518Srobert const BugType BT{this, "Use of Untrusted Data", "Untrusted Data"};
347e5dd7070Spatrick
348*12c85518Srobert bool checkUncontrolledFormatString(const CallEvent &Call,
349*12c85518Srobert CheckerContext &C) const;
350e5dd7070Spatrick
351*12c85518Srobert void taintUnsafeSocketProtocol(const CallEvent &Call,
352*12c85518Srobert CheckerContext &C) const;
353e5dd7070Spatrick
354*12c85518Srobert /// Default taint rules are initilized with the help of a CheckerContext to
355*12c85518Srobert /// access the names of built-in functions like memcpy.
356*12c85518Srobert void initTaintRules(CheckerContext &C) const;
357e5dd7070Spatrick
358*12c85518Srobert /// CallDescription currently cannot restrict matches to the global namespace
359*12c85518Srobert /// only, which is why multiple CallDescriptionMaps are used, as we want to
360*12c85518Srobert /// disambiguate global C functions from functions inside user-defined
361*12c85518Srobert /// namespaces.
362*12c85518Srobert // TODO: Remove separation to simplify matching logic once CallDescriptions
363*12c85518Srobert // are more expressive.
364e5dd7070Spatrick
365*12c85518Srobert mutable std::optional<RuleLookupTy> StaticTaintRules;
366*12c85518Srobert mutable std::optional<RuleLookupTy> DynamicTaintRules;
367e5dd7070Spatrick };
368e5dd7070Spatrick } // end of anonymous namespace
369e5dd7070Spatrick
370*12c85518Srobert /// YAML serialization mapping.
371*12c85518Srobert LLVM_YAML_IS_SEQUENCE_VECTOR(TaintConfiguration::Sink)
372*12c85518Srobert LLVM_YAML_IS_SEQUENCE_VECTOR(TaintConfiguration::Filter)
373*12c85518Srobert LLVM_YAML_IS_SEQUENCE_VECTOR(TaintConfiguration::Propagation)
374e5dd7070Spatrick
375e5dd7070Spatrick namespace llvm {
376e5dd7070Spatrick namespace yaml {
377*12c85518Srobert template <> struct MappingTraits<TaintConfiguration> {
mappingllvm::yaml::MappingTraits378*12c85518Srobert static void mapping(IO &IO, TaintConfiguration &Config) {
379e5dd7070Spatrick IO.mapOptional("Propagations", Config.Propagations);
380e5dd7070Spatrick IO.mapOptional("Filters", Config.Filters);
381e5dd7070Spatrick IO.mapOptional("Sinks", Config.Sinks);
382e5dd7070Spatrick }
383e5dd7070Spatrick };
384e5dd7070Spatrick
385*12c85518Srobert template <> struct MappingTraits<TaintConfiguration::Sink> {
mappingllvm::yaml::MappingTraits386*12c85518Srobert static void mapping(IO &IO, TaintConfiguration::Sink &Sink) {
387*12c85518Srobert IO.mapRequired("Name", Sink.Name);
388*12c85518Srobert IO.mapOptional("Scope", Sink.Scope);
389*12c85518Srobert IO.mapRequired("Args", Sink.SinkArgs);
390*12c85518Srobert }
391*12c85518Srobert };
392*12c85518Srobert
393*12c85518Srobert template <> struct MappingTraits<TaintConfiguration::Filter> {
mappingllvm::yaml::MappingTraits394*12c85518Srobert static void mapping(IO &IO, TaintConfiguration::Filter &Filter) {
395*12c85518Srobert IO.mapRequired("Name", Filter.Name);
396*12c85518Srobert IO.mapOptional("Scope", Filter.Scope);
397*12c85518Srobert IO.mapRequired("Args", Filter.FilterArgs);
398*12c85518Srobert }
399*12c85518Srobert };
400*12c85518Srobert
401*12c85518Srobert template <> struct MappingTraits<TaintConfiguration::Propagation> {
mappingllvm::yaml::MappingTraits402*12c85518Srobert static void mapping(IO &IO, TaintConfiguration::Propagation &Propagation) {
403e5dd7070Spatrick IO.mapRequired("Name", Propagation.Name);
404e5dd7070Spatrick IO.mapOptional("Scope", Propagation.Scope);
405e5dd7070Spatrick IO.mapOptional("SrcArgs", Propagation.SrcArgs);
406e5dd7070Spatrick IO.mapOptional("DstArgs", Propagation.DstArgs);
407*12c85518Srobert IO.mapOptional("VariadicType", Propagation.VarType);
408*12c85518Srobert IO.mapOptional("VariadicIndex", Propagation.VarIndex);
409e5dd7070Spatrick }
410e5dd7070Spatrick };
411e5dd7070Spatrick
412*12c85518Srobert template <> struct ScalarEnumerationTraits<TaintConfiguration::VariadicType> {
enumerationllvm::yaml::ScalarEnumerationTraits413*12c85518Srobert static void enumeration(IO &IO, TaintConfiguration::VariadicType &Value) {
414*12c85518Srobert IO.enumCase(Value, "None", TaintConfiguration::VariadicType::None);
415*12c85518Srobert IO.enumCase(Value, "Src", TaintConfiguration::VariadicType::Src);
416*12c85518Srobert IO.enumCase(Value, "Dst", TaintConfiguration::VariadicType::Dst);
417e5dd7070Spatrick }
418e5dd7070Spatrick };
419e5dd7070Spatrick } // namespace yaml
420e5dd7070Spatrick } // namespace llvm
421e5dd7070Spatrick
422e5dd7070Spatrick /// A set which is used to pass information from call pre-visit instruction
423*12c85518Srobert /// to the call post-visit. The values are signed integers, which are either
424e5dd7070Spatrick /// ReturnValueIndex, or indexes of the pointer/reference argument, which
425e5dd7070Spatrick /// points to data, which should be tainted on return.
REGISTER_MAP_WITH_PROGRAMSTATE(TaintArgsOnPostVisit,const LocationContext *,ImmutableSet<ArgIdxTy>)426*12c85518Srobert REGISTER_MAP_WITH_PROGRAMSTATE(TaintArgsOnPostVisit, const LocationContext *,
427*12c85518Srobert ImmutableSet<ArgIdxTy>)
428*12c85518Srobert REGISTER_SET_FACTORY_WITH_PROGRAMSTATE(ArgIdxFactory, ArgIdxTy)
429e5dd7070Spatrick
430*12c85518Srobert void GenericTaintRuleParser::validateArgVector(const std::string &Option,
431*12c85518Srobert const ArgVecTy &Args) const {
432*12c85518Srobert for (ArgIdxTy Arg : Args) {
433*12c85518Srobert if (Arg < ReturnValueIndex) {
434e5dd7070Spatrick Mgr.reportInvalidCheckerOptionValue(
435*12c85518Srobert Mgr.getChecker<GenericTaintChecker>(), Option,
436e5dd7070Spatrick "an argument number for propagation rules greater or equal to -1");
437e5dd7070Spatrick }
438e5dd7070Spatrick }
439e5dd7070Spatrick }
440e5dd7070Spatrick
441*12c85518Srobert template <typename Config>
442*12c85518Srobert GenericTaintRuleParser::NamePartsTy
parseNameParts(const Config & C)443*12c85518Srobert GenericTaintRuleParser::parseNameParts(const Config &C) {
444*12c85518Srobert NamePartsTy NameParts;
445*12c85518Srobert if (!C.Scope.empty()) {
446*12c85518Srobert // If the Scope argument contains multiple "::" parts, those are considered
447*12c85518Srobert // namespace identifiers.
448*12c85518Srobert StringRef{C.Scope}.split(NameParts, "::", /*MaxSplit*/ -1,
449*12c85518Srobert /*KeepEmpty*/ false);
450*12c85518Srobert }
451*12c85518Srobert NameParts.emplace_back(C.Name);
452*12c85518Srobert return NameParts;
453e5dd7070Spatrick }
454e5dd7070Spatrick
455*12c85518Srobert template <typename Config>
consumeRulesFromConfig(const Config & C,GenericTaintRule && Rule,RulesContTy & Rules)456*12c85518Srobert void GenericTaintRuleParser::consumeRulesFromConfig(const Config &C,
457*12c85518Srobert GenericTaintRule &&Rule,
458*12c85518Srobert RulesContTy &Rules) {
459*12c85518Srobert NamePartsTy NameParts = parseNameParts(C);
460*12c85518Srobert Rules.emplace_back(CallDescription(NameParts), std::move(Rule));
461*12c85518Srobert }
462e5dd7070Spatrick
parseConfig(const std::string & Option,TaintConfiguration::Sink && S,RulesContTy & Rules) const463*12c85518Srobert void GenericTaintRuleParser::parseConfig(const std::string &Option,
464*12c85518Srobert TaintConfiguration::Sink &&S,
465*12c85518Srobert RulesContTy &Rules) const {
466*12c85518Srobert validateArgVector(Option, S.SinkArgs);
467*12c85518Srobert consumeRulesFromConfig(S, GenericTaintRule::Sink(std::move(S.SinkArgs)),
468*12c85518Srobert Rules);
469*12c85518Srobert }
470*12c85518Srobert
parseConfig(const std::string & Option,TaintConfiguration::Filter && S,RulesContTy & Rules) const471*12c85518Srobert void GenericTaintRuleParser::parseConfig(const std::string &Option,
472*12c85518Srobert TaintConfiguration::Filter &&S,
473*12c85518Srobert RulesContTy &Rules) const {
474*12c85518Srobert validateArgVector(Option, S.FilterArgs);
475*12c85518Srobert consumeRulesFromConfig(S, GenericTaintRule::Filter(std::move(S.FilterArgs)),
476*12c85518Srobert Rules);
477*12c85518Srobert }
478*12c85518Srobert
parseConfig(const std::string & Option,TaintConfiguration::Propagation && P,RulesContTy & Rules) const479*12c85518Srobert void GenericTaintRuleParser::parseConfig(const std::string &Option,
480*12c85518Srobert TaintConfiguration::Propagation &&P,
481*12c85518Srobert RulesContTy &Rules) const {
482*12c85518Srobert validateArgVector(Option, P.SrcArgs);
483*12c85518Srobert validateArgVector(Option, P.DstArgs);
484*12c85518Srobert bool IsSrcVariadic = P.VarType == TaintConfiguration::VariadicType::Src;
485*12c85518Srobert bool IsDstVariadic = P.VarType == TaintConfiguration::VariadicType::Dst;
486*12c85518Srobert std::optional<ArgIdxTy> JustVarIndex = P.VarIndex;
487*12c85518Srobert
488*12c85518Srobert ArgSet SrcDesc(std::move(P.SrcArgs),
489*12c85518Srobert IsSrcVariadic ? JustVarIndex : std::nullopt);
490*12c85518Srobert ArgSet DstDesc(std::move(P.DstArgs),
491*12c85518Srobert IsDstVariadic ? JustVarIndex : std::nullopt);
492*12c85518Srobert
493*12c85518Srobert consumeRulesFromConfig(
494*12c85518Srobert P, GenericTaintRule::Prop(std::move(SrcDesc), std::move(DstDesc)), Rules);
495*12c85518Srobert }
496*12c85518Srobert
497*12c85518Srobert GenericTaintRuleParser::RulesContTy
parseConfiguration(const std::string & Option,TaintConfiguration && Config) const498*12c85518Srobert GenericTaintRuleParser::parseConfiguration(const std::string &Option,
499*12c85518Srobert TaintConfiguration &&Config) const {
500*12c85518Srobert
501*12c85518Srobert RulesContTy Rules;
502*12c85518Srobert
503*12c85518Srobert for (auto &F : Config.Filters)
504*12c85518Srobert parseConfig(Option, std::move(F), Rules);
505*12c85518Srobert
506*12c85518Srobert for (auto &S : Config.Sinks)
507*12c85518Srobert parseConfig(Option, std::move(S), Rules);
508*12c85518Srobert
509*12c85518Srobert for (auto &P : Config.Propagations)
510*12c85518Srobert parseConfig(Option, std::move(P), Rules);
511*12c85518Srobert
512*12c85518Srobert return Rules;
513*12c85518Srobert }
514*12c85518Srobert
initTaintRules(CheckerContext & C) const515*12c85518Srobert void GenericTaintChecker::initTaintRules(CheckerContext &C) const {
516e5dd7070Spatrick // Check for exact name match for functions without builtin substitutes.
517e5dd7070Spatrick // Use qualified name, because these are C functions without namespace.
518e5dd7070Spatrick
519*12c85518Srobert if (StaticTaintRules || DynamicTaintRules)
520*12c85518Srobert return;
521e5dd7070Spatrick
522*12c85518Srobert using RulesConstructionTy =
523*12c85518Srobert std::vector<std::pair<CallDescription, GenericTaintRule>>;
524*12c85518Srobert using TR = GenericTaintRule;
525e5dd7070Spatrick
526*12c85518Srobert const Builtin::Context &BI = C.getASTContext().BuiltinInfo;
527*12c85518Srobert
528*12c85518Srobert RulesConstructionTy GlobalCRules{
529*12c85518Srobert // Sources
530*12c85518Srobert {{{"fdopen"}}, TR::Source({{ReturnValueIndex}})},
531*12c85518Srobert {{{"fopen"}}, TR::Source({{ReturnValueIndex}})},
532*12c85518Srobert {{{"freopen"}}, TR::Source({{ReturnValueIndex}})},
533*12c85518Srobert {{{"getch"}}, TR::Source({{ReturnValueIndex}})},
534*12c85518Srobert {{{"getchar"}}, TR::Source({{ReturnValueIndex}})},
535*12c85518Srobert {{{"getchar_unlocked"}}, TR::Source({{ReturnValueIndex}})},
536*12c85518Srobert {{{"gets"}}, TR::Source({{0}, ReturnValueIndex})},
537*12c85518Srobert {{{"gets_s"}}, TR::Source({{0}, ReturnValueIndex})},
538*12c85518Srobert {{{"scanf"}}, TR::Source({{}, 1})},
539*12c85518Srobert {{{"scanf_s"}}, TR::Source({{}, {1}})},
540*12c85518Srobert {{{"wgetch"}}, TR::Source({{}, ReturnValueIndex})},
541*12c85518Srobert // Sometimes the line between taint sources and propagators is blurry.
542*12c85518Srobert // _IO_getc is choosen to be a source, but could also be a propagator.
543*12c85518Srobert // This way it is simpler, as modeling it as a propagator would require
544*12c85518Srobert // to model the possible sources of _IO_FILE * values, which the _IO_getc
545*12c85518Srobert // function takes as parameters.
546*12c85518Srobert {{{"_IO_getc"}}, TR::Source({{ReturnValueIndex}})},
547*12c85518Srobert {{{"getcwd"}}, TR::Source({{0, ReturnValueIndex}})},
548*12c85518Srobert {{{"getwd"}}, TR::Source({{0, ReturnValueIndex}})},
549*12c85518Srobert {{{"readlink"}}, TR::Source({{1, ReturnValueIndex}})},
550*12c85518Srobert {{{"readlinkat"}}, TR::Source({{2, ReturnValueIndex}})},
551*12c85518Srobert {{{"get_current_dir_name"}}, TR::Source({{ReturnValueIndex}})},
552*12c85518Srobert {{{"gethostname"}}, TR::Source({{0}})},
553*12c85518Srobert {{{"getnameinfo"}}, TR::Source({{2, 4}})},
554*12c85518Srobert {{{"getseuserbyname"}}, TR::Source({{1, 2}})},
555*12c85518Srobert {{{"getgroups"}}, TR::Source({{1, ReturnValueIndex}})},
556*12c85518Srobert {{{"getlogin"}}, TR::Source({{ReturnValueIndex}})},
557*12c85518Srobert {{{"getlogin_r"}}, TR::Source({{0}})},
558*12c85518Srobert
559*12c85518Srobert // Props
560*12c85518Srobert {{{"atoi"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
561*12c85518Srobert {{{"atol"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
562*12c85518Srobert {{{"atoll"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
563*12c85518Srobert {{{"fgetc"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
564*12c85518Srobert {{{"fgetln"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
565*12c85518Srobert {{{"fgets"}}, TR::Prop({{2}}, {{0, ReturnValueIndex}})},
566*12c85518Srobert {{{"fscanf"}}, TR::Prop({{0}}, {{}, 2})},
567*12c85518Srobert {{{"fscanf_s"}}, TR::Prop({{0}}, {{}, {2}})},
568*12c85518Srobert {{{"sscanf"}}, TR::Prop({{0}}, {{}, 2})},
569*12c85518Srobert
570*12c85518Srobert {{{"getc"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
571*12c85518Srobert {{{"getc_unlocked"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
572*12c85518Srobert {{{"getdelim"}}, TR::Prop({{3}}, {{0}})},
573*12c85518Srobert {{{"getline"}}, TR::Prop({{2}}, {{0}})},
574*12c85518Srobert {{{"getw"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
575*12c85518Srobert {{{"pread"}}, TR::Prop({{0, 1, 2, 3}}, {{1, ReturnValueIndex}})},
576*12c85518Srobert {{{"read"}}, TR::Prop({{0, 2}}, {{1, ReturnValueIndex}})},
577*12c85518Srobert {{{"strchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
578*12c85518Srobert {{{"strrchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
579*12c85518Srobert {{{"tolower"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
580*12c85518Srobert {{{"toupper"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
581*12c85518Srobert {{{"fread"}}, TR::Prop({{3}}, {{0, ReturnValueIndex}})},
582*12c85518Srobert {{{"recv"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
583*12c85518Srobert {{{"recvfrom"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
584*12c85518Srobert
585*12c85518Srobert {{{"ttyname"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
586*12c85518Srobert {{{"ttyname_r"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
587*12c85518Srobert
588*12c85518Srobert {{{"basename"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
589*12c85518Srobert {{{"dirname"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
590*12c85518Srobert {{{"fnmatch"}}, TR::Prop({{1}}, {{ReturnValueIndex}})},
591*12c85518Srobert {{{"memchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
592*12c85518Srobert {{{"memrchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
593*12c85518Srobert {{{"rawmemchr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
594*12c85518Srobert
595*12c85518Srobert {{{"mbtowc"}}, TR::Prop({{1}}, {{0, ReturnValueIndex}})},
596*12c85518Srobert {{{"wctomb"}}, TR::Prop({{1}}, {{0, ReturnValueIndex}})},
597*12c85518Srobert {{{"wcwidth"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
598*12c85518Srobert
599*12c85518Srobert {{{"memcmp"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
600*12c85518Srobert {{{"memcpy"}}, TR::Prop({{1}}, {{0, ReturnValueIndex}})},
601*12c85518Srobert {{{"memmove"}}, TR::Prop({{1}}, {{0, ReturnValueIndex}})},
602*12c85518Srobert // If memmem was called with a tainted needle and the search was
603*12c85518Srobert // successful, that would mean that the value pointed by the return value
604*12c85518Srobert // has the same content as the needle. If we choose to go by the policy of
605*12c85518Srobert // content equivalence implies taintedness equivalence, that would mean
606*12c85518Srobert // haystack should be considered a propagation source argument.
607*12c85518Srobert {{{"memmem"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
608*12c85518Srobert
609*12c85518Srobert // The comment for memmem above also applies to strstr.
610*12c85518Srobert {{{"strstr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
611*12c85518Srobert {{{"strcasestr"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
612*12c85518Srobert
613*12c85518Srobert {{{"strchrnul"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
614*12c85518Srobert
615*12c85518Srobert {{{"index"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
616*12c85518Srobert {{{"rindex"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
617*12c85518Srobert
618*12c85518Srobert // FIXME: In case of arrays, only the first element of the array gets
619*12c85518Srobert // tainted.
620*12c85518Srobert {{{"qsort"}}, TR::Prop({{0}}, {{0}})},
621*12c85518Srobert {{{"qsort_r"}}, TR::Prop({{0}}, {{0}})},
622*12c85518Srobert
623*12c85518Srobert {{{"strcmp"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
624*12c85518Srobert {{{"strcasecmp"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
625*12c85518Srobert {{{"strncmp"}}, TR::Prop({{0, 1, 2}}, {{ReturnValueIndex}})},
626*12c85518Srobert {{{"strncasecmp"}}, TR::Prop({{0, 1, 2}}, {{ReturnValueIndex}})},
627*12c85518Srobert {{{"strspn"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
628*12c85518Srobert {{{"strcspn"}}, TR::Prop({{0, 1}}, {{ReturnValueIndex}})},
629*12c85518Srobert {{{"strpbrk"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
630*12c85518Srobert {{{"strndup"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
631*12c85518Srobert {{{"strndupa"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
632*12c85518Srobert {{{"strlen"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
633*12c85518Srobert {{{"strnlen"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
634*12c85518Srobert {{{"strtol"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
635*12c85518Srobert {{{"strtoll"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
636*12c85518Srobert {{{"strtoul"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
637*12c85518Srobert {{{"strtoull"}}, TR::Prop({{0}}, {{1, ReturnValueIndex}})},
638*12c85518Srobert
639*12c85518Srobert {{{"isalnum"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
640*12c85518Srobert {{{"isalpha"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
641*12c85518Srobert {{{"isascii"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
642*12c85518Srobert {{{"isblank"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
643*12c85518Srobert {{{"iscntrl"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
644*12c85518Srobert {{{"isdigit"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
645*12c85518Srobert {{{"isgraph"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
646*12c85518Srobert {{{"islower"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
647*12c85518Srobert {{{"isprint"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
648*12c85518Srobert {{{"ispunct"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
649*12c85518Srobert {{{"isspace"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
650*12c85518Srobert {{{"isupper"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
651*12c85518Srobert {{{"isxdigit"}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
652*12c85518Srobert
653*12c85518Srobert {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrncat)}},
654*12c85518Srobert TR::Prop({{1, 2}}, {{0, ReturnValueIndex}})},
655*12c85518Srobert {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrlcpy)}},
656*12c85518Srobert TR::Prop({{1, 2}}, {{0}})},
657*12c85518Srobert {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrlcat)}},
658*12c85518Srobert TR::Prop({{1, 2}}, {{0}})},
659*12c85518Srobert {{CDF_MaybeBuiltin, {{"snprintf"}}},
660*12c85518Srobert TR::Prop({{1}, 3}, {{0, ReturnValueIndex}})},
661*12c85518Srobert {{CDF_MaybeBuiltin, {{"sprintf"}}},
662*12c85518Srobert TR::Prop({{1}, 2}, {{0, ReturnValueIndex}})},
663*12c85518Srobert {{CDF_MaybeBuiltin, {{"strcpy"}}},
664*12c85518Srobert TR::Prop({{1}}, {{0, ReturnValueIndex}})},
665*12c85518Srobert {{CDF_MaybeBuiltin, {{"stpcpy"}}},
666*12c85518Srobert TR::Prop({{1}}, {{0, ReturnValueIndex}})},
667*12c85518Srobert {{CDF_MaybeBuiltin, {{"strcat"}}},
668*12c85518Srobert TR::Prop({{1}}, {{0, ReturnValueIndex}})},
669*12c85518Srobert {{CDF_MaybeBuiltin, {{"strdup"}}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
670*12c85518Srobert {{CDF_MaybeBuiltin, {{"strdupa"}}},
671*12c85518Srobert TR::Prop({{0}}, {{ReturnValueIndex}})},
672*12c85518Srobert {{CDF_MaybeBuiltin, {{"wcsdup"}}}, TR::Prop({{0}}, {{ReturnValueIndex}})},
673*12c85518Srobert
674*12c85518Srobert // Sinks
675*12c85518Srobert {{{"system"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
676*12c85518Srobert {{{"popen"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
677*12c85518Srobert {{{"execl"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
678*12c85518Srobert {{{"execle"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
679*12c85518Srobert {{{"execlp"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
680*12c85518Srobert {{{"execvp"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
681*12c85518Srobert {{{"execvP"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
682*12c85518Srobert {{{"execve"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
683*12c85518Srobert {{{"dlopen"}}, TR::Sink({{0}}, MsgSanitizeSystemArgs)},
684*12c85518Srobert {{CDF_MaybeBuiltin, {{"malloc"}}}, TR::Sink({{0}}, MsgTaintedBufferSize)},
685*12c85518Srobert {{CDF_MaybeBuiltin, {{"calloc"}}}, TR::Sink({{0}}, MsgTaintedBufferSize)},
686*12c85518Srobert {{CDF_MaybeBuiltin, {{"alloca"}}}, TR::Sink({{0}}, MsgTaintedBufferSize)},
687*12c85518Srobert {{CDF_MaybeBuiltin, {{"memccpy"}}},
688*12c85518Srobert TR::Sink({{3}}, MsgTaintedBufferSize)},
689*12c85518Srobert {{CDF_MaybeBuiltin, {{"realloc"}}},
690*12c85518Srobert TR::Sink({{1}}, MsgTaintedBufferSize)},
691*12c85518Srobert {{{{"setproctitle"}}}, TR::Sink({{0}, 1}, MsgUncontrolledFormatString)},
692*12c85518Srobert {{{{"setproctitle_fast"}}},
693*12c85518Srobert TR::Sink({{0}, 1}, MsgUncontrolledFormatString)},
694*12c85518Srobert
695*12c85518Srobert // SinkProps
696*12c85518Srobert {{CDF_MaybeBuiltin, BI.getName(Builtin::BImemcpy)},
697*12c85518Srobert TR::SinkProp({{2}}, {{1, 2}}, {{0, ReturnValueIndex}},
698*12c85518Srobert MsgTaintedBufferSize)},
699*12c85518Srobert {{CDF_MaybeBuiltin, {BI.getName(Builtin::BImemmove)}},
700*12c85518Srobert TR::SinkProp({{2}}, {{1, 2}}, {{0, ReturnValueIndex}},
701*12c85518Srobert MsgTaintedBufferSize)},
702*12c85518Srobert {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrncpy)}},
703*12c85518Srobert TR::SinkProp({{2}}, {{1, 2}}, {{0, ReturnValueIndex}},
704*12c85518Srobert MsgTaintedBufferSize)},
705*12c85518Srobert {{CDF_MaybeBuiltin, {BI.getName(Builtin::BIstrndup)}},
706*12c85518Srobert TR::SinkProp({{1}}, {{0, 1}}, {{ReturnValueIndex}},
707*12c85518Srobert MsgTaintedBufferSize)},
708*12c85518Srobert {{CDF_MaybeBuiltin, {{"bcopy"}}},
709*12c85518Srobert TR::SinkProp({{2}}, {{0, 2}}, {{1}}, MsgTaintedBufferSize)}};
710*12c85518Srobert
711*12c85518Srobert // `getenv` returns taint only in untrusted environments.
712*12c85518Srobert if (TR::UntrustedEnv(C)) {
713*12c85518Srobert // void setproctitle_init(int argc, char *argv[], char *envp[])
714*12c85518Srobert GlobalCRules.push_back(
715*12c85518Srobert {{{"setproctitle_init"}}, TR::Sink({{1, 2}}, MsgCustomSink)});
716*12c85518Srobert GlobalCRules.push_back({{{"getenv"}}, TR::Source({{ReturnValueIndex}})});
717ec727ea7Spatrick }
718e5dd7070Spatrick
719*12c85518Srobert StaticTaintRules.emplace(std::make_move_iterator(GlobalCRules.begin()),
720*12c85518Srobert std::make_move_iterator(GlobalCRules.end()));
721*12c85518Srobert
722*12c85518Srobert // User-provided taint configuration.
723*12c85518Srobert CheckerManager *Mgr = C.getAnalysisManager().getCheckerManager();
724*12c85518Srobert assert(Mgr);
725*12c85518Srobert GenericTaintRuleParser ConfigParser{*Mgr};
726*12c85518Srobert std::string Option{"Config"};
727*12c85518Srobert StringRef ConfigFile =
728*12c85518Srobert Mgr->getAnalyzerOptions().getCheckerStringOption(this, Option);
729*12c85518Srobert std::optional<TaintConfiguration> Config =
730*12c85518Srobert getConfiguration<TaintConfiguration>(*Mgr, this, Option, ConfigFile);
731*12c85518Srobert if (!Config) {
732*12c85518Srobert // We don't have external taint config, no parsing required.
733*12c85518Srobert DynamicTaintRules = RuleLookupTy{};
734*12c85518Srobert return;
735e5dd7070Spatrick }
736e5dd7070Spatrick
737*12c85518Srobert GenericTaintRuleParser::RulesContTy Rules{
738*12c85518Srobert ConfigParser.parseConfiguration(Option, std::move(*Config))};
739e5dd7070Spatrick
740*12c85518Srobert DynamicTaintRules.emplace(std::make_move_iterator(Rules.begin()),
741*12c85518Srobert std::make_move_iterator(Rules.end()));
742e5dd7070Spatrick }
743e5dd7070Spatrick
checkPreCall(const CallEvent & Call,CheckerContext & C) const744ec727ea7Spatrick void GenericTaintChecker::checkPreCall(const CallEvent &Call,
745e5dd7070Spatrick CheckerContext &C) const {
746*12c85518Srobert initTaintRules(C);
747e5dd7070Spatrick
748*12c85518Srobert // FIXME: this should be much simpler.
749*12c85518Srobert if (const auto *Rule =
750*12c85518Srobert Call.isGlobalCFunction() ? StaticTaintRules->lookup(Call) : nullptr)
751*12c85518Srobert Rule->process(*this, Call, C);
752*12c85518Srobert else if (const auto *Rule = DynamicTaintRules->lookup(Call))
753*12c85518Srobert Rule->process(*this, Call, C);
754e5dd7070Spatrick
755*12c85518Srobert // FIXME: These edge cases are to be eliminated from here eventually.
756*12c85518Srobert //
757*12c85518Srobert // Additional check that is not supported by CallDescription.
758*12c85518Srobert // TODO: Make CallDescription be able to match attributes such as printf-like
759*12c85518Srobert // arguments.
760*12c85518Srobert checkUncontrolledFormatString(Call, C);
761e5dd7070Spatrick
762*12c85518Srobert // TODO: Modeling sockets should be done in a specific checker.
763*12c85518Srobert // Socket is a source, which taints the return value.
764*12c85518Srobert taintUnsafeSocketProtocol(Call, C);
765e5dd7070Spatrick }
766e5dd7070Spatrick
checkPostCall(const CallEvent & Call,CheckerContext & C) const767ec727ea7Spatrick void GenericTaintChecker::checkPostCall(const CallEvent &Call,
768e5dd7070Spatrick CheckerContext &C) const {
769e5dd7070Spatrick // Set the marked values as tainted. The return value only accessible from
770e5dd7070Spatrick // checkPostStmt.
771e5dd7070Spatrick ProgramStateRef State = C.getState();
772*12c85518Srobert const StackFrameContext *CurrentFrame = C.getStackFrame();
773e5dd7070Spatrick
774e5dd7070Spatrick // Depending on what was tainted at pre-visit, we determined a set of
775e5dd7070Spatrick // arguments which should be tainted after the function returns. These are
776e5dd7070Spatrick // stored in the state as TaintArgsOnPostVisit set.
777*12c85518Srobert TaintArgsOnPostVisitTy TaintArgsMap = State->get<TaintArgsOnPostVisit>();
778e5dd7070Spatrick
779*12c85518Srobert const ImmutableSet<ArgIdxTy> *TaintArgs = TaintArgsMap.lookup(CurrentFrame);
780*12c85518Srobert if (!TaintArgs)
781*12c85518Srobert return;
782*12c85518Srobert assert(!TaintArgs->isEmpty());
783*12c85518Srobert
784*12c85518Srobert LLVM_DEBUG(for (ArgIdxTy I
785*12c85518Srobert : *TaintArgs) {
786*12c85518Srobert llvm::dbgs() << "PostCall<";
787*12c85518Srobert Call.dump(llvm::dbgs());
788*12c85518Srobert llvm::dbgs() << "> actually wants to taint arg index: " << I << '\n';
789*12c85518Srobert });
790*12c85518Srobert
791*12c85518Srobert for (ArgIdxTy ArgNum : *TaintArgs) {
792e5dd7070Spatrick // Special handling for the tainted return value.
793e5dd7070Spatrick if (ArgNum == ReturnValueIndex) {
794ec727ea7Spatrick State = addTaint(State, Call.getReturnValue());
795e5dd7070Spatrick continue;
796e5dd7070Spatrick }
797e5dd7070Spatrick
798e5dd7070Spatrick // The arguments are pointer arguments. The data they are pointing at is
799e5dd7070Spatrick // tainted after the call.
800*12c85518Srobert if (auto V = getPointeeOf(C, Call.getArgSVal(ArgNum)))
801e5dd7070Spatrick State = addTaint(State, *V);
802e5dd7070Spatrick }
803e5dd7070Spatrick
804e5dd7070Spatrick // Clear up the taint info from the state.
805*12c85518Srobert State = State->remove<TaintArgsOnPostVisit>(CurrentFrame);
806e5dd7070Spatrick C.addTransition(State);
807e5dd7070Spatrick }
808e5dd7070Spatrick
printState(raw_ostream & Out,ProgramStateRef State,const char * NL,const char * Sep) const809*12c85518Srobert void GenericTaintChecker::printState(raw_ostream &Out, ProgramStateRef State,
810*12c85518Srobert const char *NL, const char *Sep) const {
811*12c85518Srobert printTaint(State, Out, NL, Sep);
812e5dd7070Spatrick }
813e5dd7070Spatrick
process(const GenericTaintChecker & Checker,const CallEvent & Call,CheckerContext & C) const814*12c85518Srobert void GenericTaintRule::process(const GenericTaintChecker &Checker,
815*12c85518Srobert const CallEvent &Call, CheckerContext &C) const {
816e5dd7070Spatrick ProgramStateRef State = C.getState();
817*12c85518Srobert const ArgIdxTy CallNumArgs = fromArgumentCount(Call.getNumArgs());
818e5dd7070Spatrick
819*12c85518Srobert /// Iterate every call argument, and get their corresponding Expr and SVal.
820*12c85518Srobert const auto ForEachCallArg = [&C, &Call, CallNumArgs](auto &&Fun) {
821*12c85518Srobert for (ArgIdxTy I = ReturnValueIndex; I < CallNumArgs; ++I) {
822*12c85518Srobert const Expr *E = GetArgExpr(I, Call);
823*12c85518Srobert Fun(I, E, C.getSVal(E));
824e5dd7070Spatrick }
825*12c85518Srobert };
826e5dd7070Spatrick
827*12c85518Srobert /// Check for taint sinks.
828*12c85518Srobert ForEachCallArg([this, &Checker, &C, &State](ArgIdxTy I, const Expr *E, SVal) {
829*12c85518Srobert if (SinkArgs.contains(I) && isTaintedOrPointsToTainted(E, State, C))
830*12c85518Srobert Checker.generateReportIfTainted(E, SinkMsg.value_or(MsgCustomSink), C);
831*12c85518Srobert });
832e5dd7070Spatrick
833*12c85518Srobert /// Check for taint filters.
834*12c85518Srobert ForEachCallArg([this, &C, &State](ArgIdxTy I, const Expr *E, SVal S) {
835*12c85518Srobert if (FilterArgs.contains(I)) {
836*12c85518Srobert State = removeTaint(State, S);
837*12c85518Srobert if (auto P = getPointeeOf(C, S))
838*12c85518Srobert State = removeTaint(State, *P);
839e5dd7070Spatrick }
840*12c85518Srobert });
841e5dd7070Spatrick
842*12c85518Srobert /// Check for taint propagation sources.
843*12c85518Srobert /// A rule is relevant if PropSrcArgs is empty, or if any of its signified
844*12c85518Srobert /// args are tainted in context of the current CallEvent.
845*12c85518Srobert bool IsMatching = PropSrcArgs.isEmpty();
846*12c85518Srobert ForEachCallArg(
847*12c85518Srobert [this, &C, &IsMatching, &State](ArgIdxTy I, const Expr *E, SVal) {
848*12c85518Srobert IsMatching = IsMatching || (PropSrcArgs.contains(I) &&
849*12c85518Srobert isTaintedOrPointsToTainted(E, State, C));
850*12c85518Srobert });
851e5dd7070Spatrick
852*12c85518Srobert if (!IsMatching)
853*12c85518Srobert return;
854e5dd7070Spatrick
855*12c85518Srobert const auto WouldEscape = [](SVal V, QualType Ty) -> bool {
856*12c85518Srobert if (!isa<Loc>(V))
857e5dd7070Spatrick return false;
858e5dd7070Spatrick
859*12c85518Srobert const bool IsNonConstRef = Ty->isReferenceType() && !Ty.isConstQualified();
860*12c85518Srobert const bool IsNonConstPtr =
861*12c85518Srobert Ty->isPointerType() && !Ty->getPointeeType().isConstQualified();
862e5dd7070Spatrick
863*12c85518Srobert return IsNonConstRef || IsNonConstPtr;
864*12c85518Srobert };
865*12c85518Srobert
866*12c85518Srobert /// Propagate taint where it is necessary.
867*12c85518Srobert auto &F = State->getStateManager().get_context<ArgIdxFactory>();
868*12c85518Srobert ImmutableSet<ArgIdxTy> Result = F.getEmptySet();
869*12c85518Srobert ForEachCallArg(
870*12c85518Srobert [&](ArgIdxTy I, const Expr *E, SVal V) {
871*12c85518Srobert if (PropDstArgs.contains(I)) {
872*12c85518Srobert LLVM_DEBUG(llvm::dbgs() << "PreCall<"; Call.dump(llvm::dbgs());
873*12c85518Srobert llvm::dbgs()
874*12c85518Srobert << "> prepares tainting arg index: " << I << '\n';);
875*12c85518Srobert Result = F.add(Result, I);
876e5dd7070Spatrick }
877e5dd7070Spatrick
878*12c85518Srobert // TODO: We should traverse all reachable memory regions via the
879*12c85518Srobert // escaping parameter. Instead of doing that we simply mark only the
880*12c85518Srobert // referred memory region as tainted.
881*12c85518Srobert if (WouldEscape(V, E->getType())) {
882*12c85518Srobert LLVM_DEBUG(if (!Result.contains(I)) {
883*12c85518Srobert llvm::dbgs() << "PreCall<";
884*12c85518Srobert Call.dump(llvm::dbgs());
885*12c85518Srobert llvm::dbgs() << "> prepares tainting arg index: " << I << '\n';
886*12c85518Srobert });
887*12c85518Srobert Result = F.add(Result, I);
888*12c85518Srobert }
889*12c85518Srobert });
890*12c85518Srobert
891*12c85518Srobert if (!Result.isEmpty())
892*12c85518Srobert State = State->set<TaintArgsOnPostVisit>(C.getStackFrame(), Result);
893*12c85518Srobert C.addTransition(State);
894e5dd7070Spatrick }
895e5dd7070Spatrick
UntrustedEnv(CheckerContext & C)896*12c85518Srobert bool GenericTaintRule::UntrustedEnv(CheckerContext &C) {
897*12c85518Srobert return !C.getAnalysisManager()
898*12c85518Srobert .getAnalyzerOptions()
899*12c85518Srobert .ShouldAssumeControlledEnvironment;
900e5dd7070Spatrick }
901e5dd7070Spatrick
generateReportIfTainted(const Expr * E,StringRef Msg,CheckerContext & C) const902e5dd7070Spatrick bool GenericTaintChecker::generateReportIfTainted(const Expr *E, StringRef Msg,
903e5dd7070Spatrick CheckerContext &C) const {
904e5dd7070Spatrick assert(E);
905*12c85518Srobert std::optional<SVal> TaintedSVal{getTaintedPointeeOrPointer(C, C.getSVal(E))};
906e5dd7070Spatrick
907*12c85518Srobert if (!TaintedSVal)
908e5dd7070Spatrick return false;
909e5dd7070Spatrick
910e5dd7070Spatrick // Generate diagnostic.
911e5dd7070Spatrick if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
912*12c85518Srobert auto report = std::make_unique<PathSensitiveBugReport>(BT, Msg, N);
913e5dd7070Spatrick report->addRange(E->getSourceRange());
914*12c85518Srobert report->addVisitor(std::make_unique<TaintBugVisitor>(*TaintedSVal));
915e5dd7070Spatrick C.emitReport(std::move(report));
916e5dd7070Spatrick return true;
917e5dd7070Spatrick }
918e5dd7070Spatrick return false;
919e5dd7070Spatrick }
920e5dd7070Spatrick
921*12c85518Srobert /// TODO: remove checking for printf format attributes and socket whitelisting
922*12c85518Srobert /// from GenericTaintChecker, and that means the following functions:
923*12c85518Srobert /// getPrintfFormatArgumentNum,
924*12c85518Srobert /// GenericTaintChecker::checkUncontrolledFormatString,
925*12c85518Srobert /// GenericTaintChecker::taintUnsafeSocketProtocol
926*12c85518Srobert
getPrintfFormatArgumentNum(const CallEvent & Call,const CheckerContext & C,ArgIdxTy & ArgNum)927*12c85518Srobert static bool getPrintfFormatArgumentNum(const CallEvent &Call,
928*12c85518Srobert const CheckerContext &C,
929*12c85518Srobert ArgIdxTy &ArgNum) {
930*12c85518Srobert // Find if the function contains a format string argument.
931*12c85518Srobert // Handles: fprintf, printf, sprintf, snprintf, vfprintf, vprintf, vsprintf,
932*12c85518Srobert // vsnprintf, syslog, custom annotated functions.
933*12c85518Srobert const Decl *CallDecl = Call.getDecl();
934*12c85518Srobert if (!CallDecl)
935*12c85518Srobert return false;
936*12c85518Srobert const FunctionDecl *FDecl = CallDecl->getAsFunction();
937*12c85518Srobert if (!FDecl)
938*12c85518Srobert return false;
939*12c85518Srobert
940*12c85518Srobert const ArgIdxTy CallNumArgs = fromArgumentCount(Call.getNumArgs());
941*12c85518Srobert
942*12c85518Srobert for (const auto *Format : FDecl->specific_attrs<FormatAttr>()) {
943*12c85518Srobert ArgNum = Format->getFormatIdx() - 1;
944*12c85518Srobert if ((Format->getType()->getName() == "printf") && CallNumArgs > ArgNum)
945*12c85518Srobert return true;
946*12c85518Srobert }
947*12c85518Srobert
948*12c85518Srobert return false;
949*12c85518Srobert }
950*12c85518Srobert
checkUncontrolledFormatString(const CallEvent & Call,CheckerContext & C) const951e5dd7070Spatrick bool GenericTaintChecker::checkUncontrolledFormatString(
952ec727ea7Spatrick const CallEvent &Call, CheckerContext &C) const {
953e5dd7070Spatrick // Check if the function contains a format string argument.
954*12c85518Srobert ArgIdxTy ArgNum = 0;
955ec727ea7Spatrick if (!getPrintfFormatArgumentNum(Call, C, ArgNum))
956e5dd7070Spatrick return false;
957e5dd7070Spatrick
958e5dd7070Spatrick // If either the format string content or the pointer itself are tainted,
959e5dd7070Spatrick // warn.
960ec727ea7Spatrick return generateReportIfTainted(Call.getArgExpr(ArgNum),
961e5dd7070Spatrick MsgUncontrolledFormatString, C);
962e5dd7070Spatrick }
963e5dd7070Spatrick
taintUnsafeSocketProtocol(const CallEvent & Call,CheckerContext & C) const964*12c85518Srobert void GenericTaintChecker::taintUnsafeSocketProtocol(const CallEvent &Call,
965e5dd7070Spatrick CheckerContext &C) const {
966*12c85518Srobert if (Call.getNumArgs() < 1)
967*12c85518Srobert return;
968*12c85518Srobert const IdentifierInfo *ID = Call.getCalleeIdentifier();
969*12c85518Srobert if (!ID)
970*12c85518Srobert return;
971*12c85518Srobert if (!ID->getName().equals("socket"))
972*12c85518Srobert return;
973e5dd7070Spatrick
974*12c85518Srobert SourceLocation DomLoc = Call.getArgExpr(0)->getExprLoc();
975*12c85518Srobert StringRef DomName = C.getMacroNameOrSpelling(DomLoc);
976*12c85518Srobert // Allow internal communication protocols.
977*12c85518Srobert bool SafeProtocol = DomName.equals("AF_SYSTEM") ||
978*12c85518Srobert DomName.equals("AF_LOCAL") || DomName.equals("AF_UNIX") ||
979*12c85518Srobert DomName.equals("AF_RESERVED_36");
980*12c85518Srobert if (SafeProtocol)
981*12c85518Srobert return;
982e5dd7070Spatrick
983*12c85518Srobert ProgramStateRef State = C.getState();
984*12c85518Srobert auto &F = State->getStateManager().get_context<ArgIdxFactory>();
985*12c85518Srobert ImmutableSet<ArgIdxTy> Result = F.add(F.getEmptySet(), ReturnValueIndex);
986*12c85518Srobert State = State->set<TaintArgsOnPostVisit>(C.getStackFrame(), Result);
987*12c85518Srobert C.addTransition(State);
988e5dd7070Spatrick }
989e5dd7070Spatrick
990*12c85518Srobert /// Checker registration
registerGenericTaintChecker(CheckerManager & Mgr)991e5dd7070Spatrick void ento::registerGenericTaintChecker(CheckerManager &Mgr) {
992*12c85518Srobert Mgr.registerChecker<GenericTaintChecker>();
993e5dd7070Spatrick }
994e5dd7070Spatrick
shouldRegisterGenericTaintChecker(const CheckerManager & mgr)995ec727ea7Spatrick bool ento::shouldRegisterGenericTaintChecker(const CheckerManager &mgr) {
996e5dd7070Spatrick return true;
997e5dd7070Spatrick }
998