blob: cfc2f3734116922b0c9b335561629b72faef7a4a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
//===--- Env33CCheck.cpp - clang-tidy--------------------------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
#include "CommandProcessorCheck.h"
#include "clang/AST/ASTContext.h"
#include "clang/ASTMatchers/ASTMatchFinder.h"
using namespace clang::ast_matchers;
namespace clang {
namespace tidy {
namespace cert {
void CommandProcessorCheck::registerMatchers(MatchFinder *Finder) {
Finder->addMatcher(
callExpr(
callee(functionDecl(anyOf(hasName("::system"), hasName("::popen"),
hasName("::_popen")))
.bind("func")),
// Do not diagnose when the call expression passes a null pointer
// constant to system(); that only checks for the presence of a
// command processor, which is not a security risk by itself.
unless(callExpr(callee(functionDecl(hasName("::system"))),
argumentCountIs(1),
hasArgument(0, nullPointerConstant()))))
.bind("expr"),
this);
}
void CommandProcessorCheck::check(const MatchFinder::MatchResult &Result) {
const auto *Fn = Result.Nodes.getNodeAs<FunctionDecl>("func");
const auto *E = Result.Nodes.getNodeAs<CallExpr>("expr");
diag(E->getExprLoc(), "calling %0 uses a command processor") << Fn;
}
} // namespace cert
} // namespace tidy
} // namespace clang
|
