1 //=== Taint.h - Taint tracking and basic propagation rules. --------*- C++ -*-//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // Defines basic, non-domain-specific mechanisms for tracking tainted values.
11 //===----------------------------------------------------------------------===//
13 #ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAINT_H
14 #define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAINT_H
16 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h"
17 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
23 /// The type of taint, which helps to differentiate between different types of
25 using TaintTagType = unsigned;
27 static constexpr TaintTagType TaintTagGeneric = 0;
29 /// Create a new state in which the value of the statement is marked as tainted.
30 LLVM_NODISCARD ProgramStateRef
31 addTaint(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx,
32 TaintTagType Kind = TaintTagGeneric);
34 /// Create a new state in which the value is marked as tainted.
35 LLVM_NODISCARD ProgramStateRef
36 addTaint(ProgramStateRef State, SVal V,
37 TaintTagType Kind = TaintTagGeneric);
39 /// Create a new state in which the symbol is marked as tainted.
40 LLVM_NODISCARD ProgramStateRef
41 addTaint(ProgramStateRef State, SymbolRef Sym,
42 TaintTagType Kind = TaintTagGeneric);
44 /// Create a new state in which the pointer represented by the region
45 /// is marked as tainted.
46 LLVM_NODISCARD ProgramStateRef
47 addTaint(ProgramStateRef State, const MemRegion *R,
48 TaintTagType Kind = TaintTagGeneric);
50 /// Create a new state in a which a sub-region of a given symbol is tainted.
51 /// This might be necessary when referring to regions that can not have an
52 /// individual symbol, e.g. if they are represented by the default binding of
53 /// a LazyCompoundVal.
54 LLVM_NODISCARD ProgramStateRef
55 addPartialTaint(ProgramStateRef State,
56 SymbolRef ParentSym, const SubRegion *SubRegion,
57 TaintTagType Kind = TaintTagGeneric);
59 /// Check if the statement has a tainted value in the given state.
60 bool isTainted(ProgramStateRef State, const Stmt *S,
61 const LocationContext *LCtx,
62 TaintTagType Kind = TaintTagGeneric);
64 /// Check if the value is tainted in the given state.
65 bool isTainted(ProgramStateRef State, SVal V,
66 TaintTagType Kind = TaintTagGeneric);
68 /// Check if the symbol is tainted in the given state.
69 bool isTainted(ProgramStateRef State, SymbolRef Sym,
70 TaintTagType Kind = TaintTagGeneric);
72 /// Check if the pointer represented by the region is tainted in the given
74 bool isTainted(ProgramStateRef State, const MemRegion *Reg,
75 TaintTagType Kind = TaintTagGeneric);
77 void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl = "\n",
78 const char *sep = "");
80 LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State);
82 /// The bug visitor prints a diagnostic message at the location where a given
83 /// variable was tainted.
84 class TaintBugVisitor final : public BugReporterVisitor {
89 TaintBugVisitor(const SVal V) : V(V) {}
90 void Profile(llvm::FoldingSetNodeID &ID) const override { ID.Add(V); }
92 std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
93 BugReporterContext &BRC,
94 BugReport &BR) override;