1 /* An experimental state machine, for tracking exposure of sensitive
2 data (e.g. through logging).
3 Copyright (C) 2019-2023 Free Software Foundation, Inc.
4 Contributed by David Malcolm <dmalcolm@redhat.com>.
6 This file is part of GCC.
8 GCC is free software; you can redistribute it and/or modify it
9 under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3, or (at your option)
13 GCC is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with GCC; see the file COPYING3. If not see
20 <http://www.gnu.org/licenses/>. */
23 #define INCLUDE_MEMORY
25 #include "coretypes.h"
26 #include "make-unique.h"
29 #include "basic-block.h"
32 #include "diagnostic-path.h"
33 #include "analyzer/analyzer.h"
34 #include "diagnostic-event-id.h"
35 #include "analyzer/analyzer-logging.h"
36 #include "analyzer/sm.h"
37 #include "analyzer/pending-diagnostic.h"
45 /* An experimental state machine, for tracking exposure of sensitive
46 data (e.g. through logging). */
48 class sensitive_state_machine
: public state_machine
51 sensitive_state_machine (logger
*logger
);
53 bool inherited_state_p () const final override
{ return true; }
55 bool on_stmt (sm_context
*sm_ctxt
,
56 const supernode
*node
,
57 const gimple
*stmt
) const final override
;
59 bool can_purge_p (state_t s
) const final override
;
61 /* State for "sensitive" data, such as a password. */
64 /* Stop state, for a value we don't want to track any more. */
68 void warn_for_any_exposure (sm_context
*sm_ctxt
,
69 const supernode
*node
,
74 class exposure_through_output_file
75 : public pending_diagnostic_subclass
<exposure_through_output_file
>
78 exposure_through_output_file (const sensitive_state_machine
&sm
, tree arg
)
79 : m_sm (sm
), m_arg (arg
)
82 const char *get_kind () const final override
84 return "exposure_through_output_file";
87 bool operator== (const exposure_through_output_file
&other
) const
89 return same_tree_p (m_arg
, other
.m_arg
);
92 int get_controlling_option () const final override
94 return OPT_Wanalyzer_exposure_through_output_file
;
97 bool emit (diagnostic_emission_context
&ctxt
) final override
99 /* CWE-532: Information Exposure Through Log Files */
101 return ctxt
.warn ("sensitive value %qE written to output file",
105 label_text
describe_state_change (const evdesc::state_change
&change
)
108 if (change
.m_new_state
== m_sm
.m_sensitive
)
110 m_first_sensitive_event
= change
.m_event_id
;
111 return change
.formatted_print ("sensitive value acquired here");
113 return label_text ();
116 diagnostic_event::meaning
117 get_meaning_for_state_change (const evdesc::state_change
&change
)
120 if (change
.m_new_state
== m_sm
.m_sensitive
)
121 return diagnostic_event::meaning (diagnostic_event::VERB_acquire
,
122 diagnostic_event::NOUN_sensitive
);
123 return diagnostic_event::meaning ();
125 label_text
describe_call_with_state (const evdesc::call_with_state
&info
)
128 if (info
.m_state
== m_sm
.m_sensitive
)
129 return info
.formatted_print
130 ("passing sensitive value %qE in call to %qE from %qE",
131 info
.m_expr
, info
.m_callee_fndecl
, info
.m_caller_fndecl
);
132 return label_text ();
135 label_text
describe_return_of_state (const evdesc::return_of_state
&info
)
138 if (info
.m_state
== m_sm
.m_sensitive
)
139 return info
.formatted_print ("returning sensitive value to %qE from %qE",
140 info
.m_caller_fndecl
, info
.m_callee_fndecl
);
141 return label_text ();
144 label_text
describe_final_event (const evdesc::final_event
&ev
) final override
146 if (m_first_sensitive_event
.known_p ())
147 return ev
.formatted_print ("sensitive value %qE written to output file"
149 m_arg
, &m_first_sensitive_event
);
151 return ev
.formatted_print ("sensitive value %qE written to output file",
156 const sensitive_state_machine
&m_sm
;
158 diagnostic_event_id_t m_first_sensitive_event
;
161 /* sensitive_state_machine's ctor. */
163 sensitive_state_machine::sensitive_state_machine (logger
*logger
)
164 : state_machine ("sensitive", logger
),
165 m_sensitive (add_state ("sensitive")),
166 m_stop (add_state ("stop"))
170 /* Warn about an exposure at NODE and STMT if ARG is in the "sensitive"
174 sensitive_state_machine::warn_for_any_exposure (sm_context
*sm_ctxt
,
175 const supernode
*node
,
179 if (sm_ctxt
->get_state (stmt
, arg
) == m_sensitive
)
181 tree diag_arg
= sm_ctxt
->get_diagnostic_tree (arg
);
182 sm_ctxt
->warn (node
, stmt
, arg
,
183 make_unique
<exposure_through_output_file
> (*this,
188 /* Implementation of state_machine::on_stmt vfunc for
189 sensitive_state_machine. */
192 sensitive_state_machine::on_stmt (sm_context
*sm_ctxt
,
193 const supernode
*node
,
194 const gimple
*stmt
) const
196 if (const gcall
*call
= dyn_cast
<const gcall
*> (stmt
))
197 if (tree callee_fndecl
= sm_ctxt
->get_fndecl_for_call (call
))
199 if (is_named_call_p (callee_fndecl
, "getpass", call
, 1))
201 tree lhs
= gimple_call_lhs (call
);
203 sm_ctxt
->on_transition (node
, stmt
, lhs
, m_start
, m_sensitive
);
206 else if (is_named_call_p (callee_fndecl
, "fprintf")
207 || is_named_call_p (callee_fndecl
, "printf"))
209 /* Handle a match at any position in varargs. */
210 for (unsigned idx
= 1; idx
< gimple_call_num_args (call
); idx
++)
212 tree arg
= gimple_call_arg (call
, idx
);
213 warn_for_any_exposure (sm_ctxt
, node
, stmt
, arg
);
217 else if (is_named_call_p (callee_fndecl
, "fwrite", call
, 4))
219 tree arg
= gimple_call_arg (call
, 0);
220 warn_for_any_exposure (sm_ctxt
, node
, stmt
, arg
);
223 // TODO: ...etc. This is just a proof-of-concept at this point.
229 sensitive_state_machine::can_purge_p (state_t s ATTRIBUTE_UNUSED
) const
234 } // anonymous namespace
236 /* Internal interface to this file. */
239 make_sensitive_state_machine (logger
*logger
)
241 return new sensitive_state_machine (logger
);
246 #endif /* #if ENABLE_ANALYZER */