1 /* An experimental state machine, for tracking exposure of sensitive
2 data (e.g. through logging).
3 Copyright (C) 2019-2021 Free Software Foundation, Inc.
4 Contributed by David Malcolm <dmalcolm@redhat.com>.
6 This file is part of GCC.
8 GCC is free software; you can redistribute it and/or modify it
9 under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3, or (at your option)
13 GCC is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with GCC; see the file COPYING3. If not see
20 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
28 #include "basic-block.h"
31 #include "diagnostic-path.h"
32 #include "diagnostic-metadata.h"
35 #include "analyzer/analyzer.h"
36 #include "diagnostic-event-id.h"
37 #include "analyzer/analyzer-logging.h"
38 #include "analyzer/sm.h"
39 #include "analyzer/pending-diagnostic.h"
47 /* An experimental state machine, for tracking exposure of sensitive
48 data (e.g. through logging). */
50 class sensitive_state_machine
: public state_machine
53 sensitive_state_machine (logger
*logger
);
55 bool inherited_state_p () const FINAL OVERRIDE
{ return true; }
57 bool on_stmt (sm_context
*sm_ctxt
,
58 const supernode
*node
,
59 const gimple
*stmt
) const FINAL OVERRIDE
;
61 bool can_purge_p (state_t s
) const FINAL OVERRIDE
;
63 /* State for "sensitive" data, such as a password. */
66 /* Stop state, for a value we don't want to track any more. */
70 void warn_for_any_exposure (sm_context
*sm_ctxt
,
71 const supernode
*node
,
76 class exposure_through_output_file
77 : public pending_diagnostic_subclass
<exposure_through_output_file
>
80 exposure_through_output_file (const sensitive_state_machine
&sm
, tree arg
)
81 : m_sm (sm
), m_arg (arg
)
84 const char *get_kind () const FINAL OVERRIDE
86 return "exposure_through_output_file";
89 bool operator== (const exposure_through_output_file
&other
) const
91 return same_tree_p (m_arg
, other
.m_arg
);
94 bool emit (rich_location
*rich_loc
) FINAL OVERRIDE
96 diagnostic_metadata m
;
97 /* CWE-532: Information Exposure Through Log Files */
99 return warning_meta (rich_loc
, m
,
100 OPT_Wanalyzer_exposure_through_output_file
,
101 "sensitive value %qE written to output file",
105 label_text
describe_state_change (const evdesc::state_change
&change
)
108 if (change
.m_new_state
== m_sm
.m_sensitive
)
110 m_first_sensitive_event
= change
.m_event_id
;
111 return change
.formatted_print ("sensitive value acquired here");
113 return label_text ();
116 label_text
describe_call_with_state (const evdesc::call_with_state
&info
)
119 if (info
.m_state
== m_sm
.m_sensitive
)
120 return info
.formatted_print
121 ("passing sensitive value %qE in call to %qE from %qE",
122 info
.m_expr
, info
.m_callee_fndecl
, info
.m_caller_fndecl
);
123 return label_text ();
126 label_text
describe_return_of_state (const evdesc::return_of_state
&info
)
129 if (info
.m_state
== m_sm
.m_sensitive
)
130 return info
.formatted_print ("returning sensitive value to %qE from %qE",
131 info
.m_caller_fndecl
, info
.m_callee_fndecl
);
132 return label_text ();
135 label_text
describe_final_event (const evdesc::final_event
&ev
) FINAL OVERRIDE
137 if (m_first_sensitive_event
.known_p ())
138 return ev
.formatted_print ("sensitive value %qE written to output file"
140 m_arg
, &m_first_sensitive_event
);
142 return ev
.formatted_print ("sensitive value %qE written to output file",
147 const sensitive_state_machine
&m_sm
;
149 diagnostic_event_id_t m_first_sensitive_event
;
152 /* sensitive_state_machine's ctor. */
154 sensitive_state_machine::sensitive_state_machine (logger
*logger
)
155 : state_machine ("sensitive", logger
)
157 m_sensitive
= add_state ("sensitive");
158 m_stop
= add_state ("stop");
161 /* Warn about an exposure at NODE and STMT if ARG is in the "sensitive"
165 sensitive_state_machine::warn_for_any_exposure (sm_context
*sm_ctxt
,
166 const supernode
*node
,
170 if (sm_ctxt
->get_state (stmt
, arg
) == m_sensitive
)
172 tree diag_arg
= sm_ctxt
->get_diagnostic_tree (arg
);
173 sm_ctxt
->warn (node
, stmt
, arg
,
174 new exposure_through_output_file (*this, diag_arg
));
178 /* Implementation of state_machine::on_stmt vfunc for
179 sensitive_state_machine. */
182 sensitive_state_machine::on_stmt (sm_context
*sm_ctxt
,
183 const supernode
*node
,
184 const gimple
*stmt
) const
186 if (const gcall
*call
= dyn_cast
<const gcall
*> (stmt
))
187 if (tree callee_fndecl
= sm_ctxt
->get_fndecl_for_call (call
))
189 if (is_named_call_p (callee_fndecl
, "getpass", call
, 1))
191 tree lhs
= gimple_call_lhs (call
);
193 sm_ctxt
->on_transition (node
, stmt
, lhs
, m_start
, m_sensitive
);
196 else if (is_named_call_p (callee_fndecl
, "fprintf")
197 || is_named_call_p (callee_fndecl
, "printf"))
199 /* Handle a match at any position in varargs. */
200 for (unsigned idx
= 1; idx
< gimple_call_num_args (call
); idx
++)
202 tree arg
= gimple_call_arg (call
, idx
);
203 warn_for_any_exposure (sm_ctxt
, node
, stmt
, arg
);
207 else if (is_named_call_p (callee_fndecl
, "fwrite", call
, 4))
209 tree arg
= gimple_call_arg (call
, 0);
210 warn_for_any_exposure (sm_ctxt
, node
, stmt
, arg
);
213 // TODO: ...etc. This is just a proof-of-concept at this point.
219 sensitive_state_machine::can_purge_p (state_t s ATTRIBUTE_UNUSED
) const
224 } // anonymous namespace
226 /* Internal interface to this file. */
229 make_sensitive_state_machine (logger
*logger
)
231 return new sensitive_state_machine (logger
);
236 #endif /* #if ENABLE_ANALYZER */