1 /* An experimental state machine, for tracking exposure of sensitive
2 data (e.g. through logging).
3 Copyright (C) 2019-2022 Free Software Foundation, Inc.
4 Contributed by David Malcolm <dmalcolm@redhat.com>.
6 This file is part of GCC.
8 GCC is free software; you can redistribute it and/or modify it
9 under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3, or (at your option)
13 GCC is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with GCC; see the file COPYING3. If not see
20 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
28 #include "basic-block.h"
31 #include "diagnostic-path.h"
32 #include "diagnostic-metadata.h"
35 #include "analyzer/analyzer.h"
36 #include "diagnostic-event-id.h"
37 #include "analyzer/analyzer-logging.h"
38 #include "analyzer/sm.h"
39 #include "analyzer/pending-diagnostic.h"
47 /* An experimental state machine, for tracking exposure of sensitive
48 data (e.g. through logging). */
50 class sensitive_state_machine
: public state_machine
53 sensitive_state_machine (logger
*logger
);
55 bool inherited_state_p () const FINAL OVERRIDE
{ return true; }
57 bool on_stmt (sm_context
*sm_ctxt
,
58 const supernode
*node
,
59 const gimple
*stmt
) const FINAL OVERRIDE
;
61 bool can_purge_p (state_t s
) const FINAL OVERRIDE
;
63 /* State for "sensitive" data, such as a password. */
66 /* Stop state, for a value we don't want to track any more. */
70 void warn_for_any_exposure (sm_context
*sm_ctxt
,
71 const supernode
*node
,
76 class exposure_through_output_file
77 : public pending_diagnostic_subclass
<exposure_through_output_file
>
80 exposure_through_output_file (const sensitive_state_machine
&sm
, tree arg
)
81 : m_sm (sm
), m_arg (arg
)
84 const char *get_kind () const FINAL OVERRIDE
86 return "exposure_through_output_file";
89 bool operator== (const exposure_through_output_file
&other
) const
91 return same_tree_p (m_arg
, other
.m_arg
);
94 int get_controlling_option () const FINAL OVERRIDE
96 return OPT_Wanalyzer_exposure_through_output_file
;
99 bool emit (rich_location
*rich_loc
) FINAL OVERRIDE
101 diagnostic_metadata m
;
102 /* CWE-532: Information Exposure Through Log Files */
104 return warning_meta (rich_loc
, m
, get_controlling_option (),
105 "sensitive value %qE written to output file",
109 label_text
describe_state_change (const evdesc::state_change
&change
)
112 if (change
.m_new_state
== m_sm
.m_sensitive
)
114 m_first_sensitive_event
= change
.m_event_id
;
115 return change
.formatted_print ("sensitive value acquired here");
117 return label_text ();
120 label_text
describe_call_with_state (const evdesc::call_with_state
&info
)
123 if (info
.m_state
== m_sm
.m_sensitive
)
124 return info
.formatted_print
125 ("passing sensitive value %qE in call to %qE from %qE",
126 info
.m_expr
, info
.m_callee_fndecl
, info
.m_caller_fndecl
);
127 return label_text ();
130 label_text
describe_return_of_state (const evdesc::return_of_state
&info
)
133 if (info
.m_state
== m_sm
.m_sensitive
)
134 return info
.formatted_print ("returning sensitive value to %qE from %qE",
135 info
.m_caller_fndecl
, info
.m_callee_fndecl
);
136 return label_text ();
139 label_text
describe_final_event (const evdesc::final_event
&ev
) FINAL OVERRIDE
141 if (m_first_sensitive_event
.known_p ())
142 return ev
.formatted_print ("sensitive value %qE written to output file"
144 m_arg
, &m_first_sensitive_event
);
146 return ev
.formatted_print ("sensitive value %qE written to output file",
151 const sensitive_state_machine
&m_sm
;
153 diagnostic_event_id_t m_first_sensitive_event
;
156 /* sensitive_state_machine's ctor. */
158 sensitive_state_machine::sensitive_state_machine (logger
*logger
)
159 : state_machine ("sensitive", logger
)
161 m_sensitive
= add_state ("sensitive");
162 m_stop
= add_state ("stop");
165 /* Warn about an exposure at NODE and STMT if ARG is in the "sensitive"
169 sensitive_state_machine::warn_for_any_exposure (sm_context
*sm_ctxt
,
170 const supernode
*node
,
174 if (sm_ctxt
->get_state (stmt
, arg
) == m_sensitive
)
176 tree diag_arg
= sm_ctxt
->get_diagnostic_tree (arg
);
177 sm_ctxt
->warn (node
, stmt
, arg
,
178 new exposure_through_output_file (*this, diag_arg
));
182 /* Implementation of state_machine::on_stmt vfunc for
183 sensitive_state_machine. */
186 sensitive_state_machine::on_stmt (sm_context
*sm_ctxt
,
187 const supernode
*node
,
188 const gimple
*stmt
) const
190 if (const gcall
*call
= dyn_cast
<const gcall
*> (stmt
))
191 if (tree callee_fndecl
= sm_ctxt
->get_fndecl_for_call (call
))
193 if (is_named_call_p (callee_fndecl
, "getpass", call
, 1))
195 tree lhs
= gimple_call_lhs (call
);
197 sm_ctxt
->on_transition (node
, stmt
, lhs
, m_start
, m_sensitive
);
200 else if (is_named_call_p (callee_fndecl
, "fprintf")
201 || is_named_call_p (callee_fndecl
, "printf"))
203 /* Handle a match at any position in varargs. */
204 for (unsigned idx
= 1; idx
< gimple_call_num_args (call
); idx
++)
206 tree arg
= gimple_call_arg (call
, idx
);
207 warn_for_any_exposure (sm_ctxt
, node
, stmt
, arg
);
211 else if (is_named_call_p (callee_fndecl
, "fwrite", call
, 4))
213 tree arg
= gimple_call_arg (call
, 0);
214 warn_for_any_exposure (sm_ctxt
, node
, stmt
, arg
);
217 // TODO: ...etc. This is just a proof-of-concept at this point.
223 sensitive_state_machine::can_purge_p (state_t s ATTRIBUTE_UNUSED
) const
228 } // anonymous namespace
230 /* Internal interface to this file. */
233 make_sensitive_state_machine (logger
*logger
)
235 return new sensitive_state_machine (logger
);
240 #endif /* #if ENABLE_ANALYZER */