1 //===- unittests/StaticAnalyzer/NoStateChangeFuncVisitorTest.cpp ----------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 
9 #include "CheckerRegistration.h"
10 #include "clang/Frontend/CompilerInstance.h"
11 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
12 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h"
13 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
14 #include "clang/StaticAnalyzer/Core/BugReporter/CommonBugCategories.h"
15 #include "clang/StaticAnalyzer/Core/Checker.h"
16 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
17 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
18 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
22 #include "clang/StaticAnalyzer/Frontend/AnalysisConsumer.h"
23 #include "clang/StaticAnalyzer/Frontend/CheckerRegistry.h"
24 #include "llvm/Support/ErrorHandling.h"
25 #include "llvm/Support/raw_ostream.h"
26 #include "gtest/gtest.h"
27 #include <memory>
28 
29 //===----------------------------------------------------------------------===//
30 // Base classes for testing NoStateChangeFuncVisitor.
31 //
32 // Testing is done by observing a very simple trait change from one node to
33 // another -- the checker sets the ErrorPrevented trait to true if
34 // 'preventError()' is called in the source code, and sets it to false if
35 // 'allowError()' is called. If this trait is false when 'error()' is called,
36 // a warning is emitted.
37 //
38 // The checker then registers a simple NoStateChangeFuncVisitor to add notes to
39 // inlined functions that could have, but neglected to prevent the error.
40 //===----------------------------------------------------------------------===//
41 
42 REGISTER_TRAIT_WITH_PROGRAMSTATE(ErrorPrevented, bool)
43 
44 namespace clang {
45 namespace ento {
46 namespace {
47 
48 class ErrorNotPreventedFuncVisitor : public NoStateChangeFuncVisitor {
49 public:
50   ErrorNotPreventedFuncVisitor()
51       : NoStateChangeFuncVisitor(bugreporter::TrackingKind::Thorough) {}
52 
53   virtual PathDiagnosticPieceRef
54   maybeEmitNoteForObjCSelf(PathSensitiveBugReport &R,
55                            const ObjCMethodCall &Call,
56                            const ExplodedNode *N) override {
57     return nullptr;
58   }
59 
60   virtual PathDiagnosticPieceRef
61   maybeEmitNoteForCXXThis(PathSensitiveBugReport &R,
62                           const CXXConstructorCall &Call,
63                           const ExplodedNode *N) override {
64     return nullptr;
65   }
66 
67   virtual PathDiagnosticPieceRef
68   maybeEmitNoteForParameters(PathSensitiveBugReport &R, const CallEvent &Call,
69                              const ExplodedNode *N) override {
70     PathDiagnosticLocation L = PathDiagnosticLocation::create(
71         N->getLocation(),
72         N->getState()->getStateManager().getContext().getSourceManager());
73     return std::make_shared<PathDiagnosticEventPiece>(
74         L, "Returning without prevening the error");
75   }
76 
77   void Profile(llvm::FoldingSetNodeID &ID) const override {
78     static int Tag = 0;
79     ID.AddPointer(&Tag);
80   }
81 };
82 
83 template <class Visitor>
84 class StatefulChecker : public Checker<check::PreCall> {
85   mutable std::unique_ptr<BugType> BT;
86 
87 public:
88   void checkPreCall(const CallEvent &Call, CheckerContext &C) const {
89     if (CallDescription{"preventError", 0}.matches(Call)) {
90       C.addTransition(C.getState()->set<ErrorPrevented>(true));
91       return;
92     }
93 
94     if (CallDescription{"allowError", 0}.matches(Call)) {
95       C.addTransition(C.getState()->set<ErrorPrevented>(false));
96       return;
97     }
98 
99     if (CallDescription{"error", 0}.matches(Call)) {
100       if (C.getState()->get<ErrorPrevented>())
101         return;
102       const ExplodedNode *N = C.generateErrorNode();
103       if (!N)
104         return;
105       if (!BT)
106         BT.reset(new BugType(this->getCheckerName(), "error()",
107                              categories::SecurityError));
108       auto R =
109           std::make_unique<PathSensitiveBugReport>(*BT, "error() called", N);
110       R->template addVisitor<Visitor>();
111       C.emitReport(std::move(R));
112     }
113   }
114 };
115 
116 } // namespace
117 } // namespace ento
118 } // namespace clang
119 
120 //===----------------------------------------------------------------------===//
121 // Non-thorough analysis: only the state right before and right after the
122 // function call is checked for the difference in trait value.
123 //===----------------------------------------------------------------------===//
124 
125 namespace clang {
126 namespace ento {
127 namespace {
128 
129 class NonThoroughErrorNotPreventedFuncVisitor
130     : public ErrorNotPreventedFuncVisitor {
131 public:
132   virtual bool
133   wasModifiedInFunction(const ExplodedNode *CallEnterN,
134                         const ExplodedNode *CallExitEndN) override {
135     return CallEnterN->getState()->get<ErrorPrevented>() !=
136            CallExitEndN->getState()->get<ErrorPrevented>();
137   }
138 };
139 
140 void addNonThoroughStatefulChecker(AnalysisASTConsumer &AnalysisConsumer,
141                                    AnalyzerOptions &AnOpts) {
142   AnOpts.CheckersAndPackages = {{"test.StatefulChecker", true}};
143   AnalysisConsumer.AddCheckerRegistrationFn([](CheckerRegistry &Registry) {
144     Registry
145         .addChecker<StatefulChecker<NonThoroughErrorNotPreventedFuncVisitor>>(
146             "test.StatefulChecker", "Description", "");
147   });
148 }
149 
150 TEST(NoStateChangeFuncVisitor, NonThoroughFunctionAnalysis) {
151   std::string Diags;
152   EXPECT_TRUE(runCheckerOnCode<addNonThoroughStatefulChecker>(R"(
153     void error();
154     void preventError();
155     void allowError();
156 
157     void g() {
158       //preventError();
159     }
160 
161     void f() {
162       g();
163       error();
164     }
165   )", Diags));
166   EXPECT_EQ(Diags,
167             "test.StatefulChecker: Calling 'g' | Returning without prevening "
168             "the error | Returning from 'g' | error() called\n");
169 
170   Diags.clear();
171 
172   EXPECT_TRUE(runCheckerOnCode<addNonThoroughStatefulChecker>(R"(
173     void error();
174     void preventError();
175     void allowError();
176 
177     void g() {
178       preventError();
179       allowError();
180     }
181 
182     void f() {
183       g();
184       error();
185     }
186   )", Diags));
187   EXPECT_EQ(Diags,
188             "test.StatefulChecker: Calling 'g' | Returning without prevening "
189             "the error | Returning from 'g' | error() called\n");
190 
191   Diags.clear();
192 
193   EXPECT_TRUE(runCheckerOnCode<addNonThoroughStatefulChecker>(R"(
194     void error();
195     void preventError();
196     void allowError();
197 
198     void g() {
199       preventError();
200     }
201 
202     void f() {
203       g();
204       error();
205     }
206   )", Diags));
207   EXPECT_EQ(Diags, "");
208 }
209 
210 } // namespace
211 } // namespace ento
212 } // namespace clang
213 
214 //===----------------------------------------------------------------------===//
215 // Thorough analysis: only the state right before and right after the
216 // function call is checked for the difference in trait value.
217 //===----------------------------------------------------------------------===//
218 
219 namespace clang {
220 namespace ento {
221 namespace {
222 
223 class ThoroughErrorNotPreventedFuncVisitor
224     : public ErrorNotPreventedFuncVisitor {
225 public:
226   virtual bool
227   wasModifiedBeforeCallExit(const ExplodedNode *CurrN,
228                             const ExplodedNode *CallExitBeginN) override {
229     return CurrN->getState()->get<ErrorPrevented>() !=
230            CallExitBeginN->getState()->get<ErrorPrevented>();
231   }
232 };
233 
234 void addThoroughStatefulChecker(AnalysisASTConsumer &AnalysisConsumer,
235                                 AnalyzerOptions &AnOpts) {
236   AnOpts.CheckersAndPackages = {{"test.StatefulChecker", true}};
237   AnalysisConsumer.AddCheckerRegistrationFn([](CheckerRegistry &Registry) {
238     Registry.addChecker<StatefulChecker<ThoroughErrorNotPreventedFuncVisitor>>(
239         "test.StatefulChecker", "Description", "");
240   });
241 }
242 
243 TEST(NoStateChangeFuncVisitor, ThoroughFunctionAnalysis) {
244   std::string Diags;
245   EXPECT_TRUE(runCheckerOnCode<addThoroughStatefulChecker>(R"(
246     void error();
247     void preventError();
248     void allowError();
249 
250     void g() {
251       //preventError();
252     }
253 
254     void f() {
255       g();
256       error();
257     }
258   )", Diags));
259   EXPECT_EQ(Diags,
260             "test.StatefulChecker: Calling 'g' | Returning without prevening "
261             "the error | Returning from 'g' | error() called\n");
262 
263   Diags.clear();
264 
265   EXPECT_TRUE(runCheckerOnCode<addThoroughStatefulChecker>(R"(
266     void error();
267     void preventError();
268     void allowError();
269 
270     void g() {
271       preventError();
272       allowError();
273     }
274 
275     void f() {
276       g();
277       error();
278     }
279   )", Diags));
280   EXPECT_EQ(Diags, "test.StatefulChecker: error() called\n");
281 
282   Diags.clear();
283 
284   EXPECT_TRUE(runCheckerOnCode<addThoroughStatefulChecker>(R"(
285     void error();
286     void preventError();
287     void allowError();
288 
289     void g() {
290       preventError();
291     }
292 
293     void f() {
294       g();
295       error();
296     }
297   )", Diags));
298   EXPECT_EQ(Diags, "");
299 }
300 
301 } // namespace
302 } // namespace ento
303 } // namespace clang
304