1 //== TaintTesterChecker.cpp ----------------------------------- -*- C++ -*--=//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This checker can be used for testing how taint data is propagated.
12 //===----------------------------------------------------------------------===//
13 #include "ClangSACheckers.h"
14 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
15 #include "clang/StaticAnalyzer/Core/Checker.h"
16 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
17 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
19 using namespace clang;
23 class TaintTesterChecker : public Checker< check::PostStmt<Expr> > {
25 mutable std::unique_ptr<BugType> BT;
26 void initBugType() const;
28 /// Given a pointer argument, get the symbol of the value it contains
30 SymbolRef getPointedToSymbol(CheckerContext &C,
32 bool IssueWarning = true) const;
35 void checkPostStmt(const Expr *E, CheckerContext &C) const;
39 inline void TaintTesterChecker::initBugType() const {
41 BT.reset(new BugType(this, "Tainted data", "General"));
44 void TaintTesterChecker::checkPostStmt(const Expr *E,
45 CheckerContext &C) const {
46 ProgramStateRef State = C.getState();
50 if (State->isTainted(E, C.getLocationContext())) {
51 if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
53 auto report = llvm::make_unique<BugReport>(*BT, "tainted",N);
54 report->addRange(E->getSourceRange());
55 C.emitReport(std::move(report));
60 void ento::registerTaintTesterChecker(CheckerManager &mgr) {
61 mgr.registerChecker<TaintTesterChecker>();