gcc/analyzer/sm-sensitive.cc

   1 /* An experimental state machine, for tracking exposure of sensitive
   2    data (e.g. through logging).
   3    Copyright (C) 2019-2023 Free Software Foundation, Inc.
   4    Contributed by David Malcolm <dmalcolm@redhat.com>.
   5
   6 This file is part of GCC.
   7
   8 GCC is free software; you can redistribute it and/or modify it
   9 under the terms of the GNU General Public License as published by
  10 the Free Software Foundation; either version 3, or (at your option)
  11 any later version.
  12
  13 GCC is distributed in the hope that it will be useful, but
  14 WITHOUT ANY WARRANTY; without even the implied warranty of
  15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16 General Public License for more details.
  17
  18 You should have received a copy of the GNU General Public License
  19 along with GCC; see the file COPYING3.  If not see
  20 <http://www.gnu.org/licenses/>.  */
  21
  22 #include "config.h"
  23 #define INCLUDE_MEMORY
  24 #include "system.h"
  25 #include "coretypes.h"
  26 #include "make-unique.h"
  27 #include "tree.h"
  28 #include "function.h"
  29 #include "basic-block.h"
  30 #include "gimple.h"
  31 #include "options.h"
  32 #include "diagnostic-path.h"
  33 #include "diagnostic-metadata.h"
  34 #include "analyzer/analyzer.h"
  35 #include "diagnostic-event-id.h"
  36 #include "analyzer/analyzer-logging.h"
  37 #include "analyzer/sm.h"
  38 #include "analyzer/pending-diagnostic.h"
  39
  40 #if ENABLE_ANALYZER
  41
  42 namespace ana {
  43
  44 namespace {
  45
  46 /* An experimental state machine, for tracking exposure of sensitive
  47    data (e.g. through logging).  */
  48
  49 class sensitive_state_machine : public state_machine
  50 {
  51 public:
  52   sensitive_state_machine (logger *logger);
  53
  54   bool inherited_state_p () const final override { return true; }
  55
  56   bool on_stmt (sm_context *sm_ctxt,
  57                 const supernode *node,
  58                 const gimple *stmt) const final override;
  59
  60   bool can_purge_p (state_t s) const final override;
  61
  62   /* State for "sensitive" data, such as a password.  */
  63   state_t m_sensitive;
  64
  65   /* Stop state, for a value we don't want to track any more.  */
  66   state_t m_stop;
  67
  68 private:
  69   void warn_for_any_exposure (sm_context *sm_ctxt,
  70                               const supernode *node,
  71                               const gimple *stmt,
  72                               tree arg) const;
  73 };
  74
  75 class exposure_through_output_file
  76   : public pending_diagnostic_subclass<exposure_through_output_file>
  77 {
  78 public:
  79   exposure_through_output_file (const sensitive_state_machine &sm, tree arg)
  80   : m_sm (sm), m_arg (arg)
  81   {}
  82
  83   const char *get_kind () const final override
  84   {
  85     return "exposure_through_output_file";
  86   }
  87
  88   bool operator== (const exposure_through_output_file &other) const
  89   {
  90     return same_tree_p (m_arg, other.m_arg);
  91   }
  92
  93   int get_controlling_option () const final override
  94   {
  95     return OPT_Wanalyzer_exposure_through_output_file;
  96   }
  97
  98   bool emit (rich_location *rich_loc,
  99              logger *) final override
 100   {
 101     diagnostic_metadata m;
 102     /* CWE-532: Information Exposure Through Log Files */
 103     m.add_cwe (532);
 104     return warning_meta (rich_loc, m, get_controlling_option (),
 105                          "sensitive value %qE written to output file",
 106                          m_arg);
 107   }
 108
 109   label_text describe_state_change (const evdesc::state_change &change)
 110     final override
 111   {
 112     if (change.m_new_state == m_sm.m_sensitive)
 113       {
 114         m_first_sensitive_event = change.m_event_id;
 115         return change.formatted_print ("sensitive value acquired here");
 116       }
 117     return label_text ();
 118   }
 119
 120   diagnostic_event::meaning
 121   get_meaning_for_state_change (const evdesc::state_change &change)
 122     const final override
 123   {
 124     if (change.m_new_state == m_sm.m_sensitive)
 125       return diagnostic_event::meaning (diagnostic_event::VERB_acquire,
 126                                         diagnostic_event::NOUN_sensitive);
 127     return diagnostic_event::meaning ();
 128   }
 129   label_text describe_call_with_state (const evdesc::call_with_state &info)
 130     final override
 131   {
 132     if (info.m_state == m_sm.m_sensitive)
 133       return info.formatted_print
 134         ("passing sensitive value %qE in call to %qE from %qE",
 135          info.m_expr, info.m_callee_fndecl, info.m_caller_fndecl);
 136     return label_text ();
 137   }
 138
 139   label_text describe_return_of_state (const evdesc::return_of_state &info)
 140     final override
 141   {
 142     if (info.m_state == m_sm.m_sensitive)
 143       return info.formatted_print ("returning sensitive value to %qE from %qE",
 144                                    info.m_caller_fndecl, info.m_callee_fndecl);
 145     return label_text ();
 146   }
 147
 148   label_text describe_final_event (const evdesc::final_event &ev) final override
 149   {
 150     if (m_first_sensitive_event.known_p ())
 151       return ev.formatted_print ("sensitive value %qE written to output file"
 152                                  "; acquired at %@",
 153                                  m_arg, &m_first_sensitive_event);
 154     else
 155       return ev.formatted_print ("sensitive value %qE written to output file",
 156                                  m_arg);
 157   }
 158
 159 private:
 160   const sensitive_state_machine &m_sm;
 161   tree m_arg;
 162   diagnostic_event_id_t m_first_sensitive_event;
 163 };
 164
 165 /* sensitive_state_machine's ctor.  */
 166
 167 sensitive_state_machine::sensitive_state_machine (logger *logger)
 168 : state_machine ("sensitive", logger)
 169 {
 170   m_sensitive = add_state ("sensitive");
 171   m_stop = add_state ("stop");
 172 }
 173
 174 /* Warn about an exposure at NODE and STMT if ARG is in the "sensitive"
 175    state.  */
 176
 177 void
 178 sensitive_state_machine::warn_for_any_exposure (sm_context *sm_ctxt,
 179                                                 const supernode *node,
 180                                                 const gimple *stmt,
 181                                                 tree arg) const
 182 {
 183   if (sm_ctxt->get_state (stmt, arg) == m_sensitive)
 184     {
 185       tree diag_arg = sm_ctxt->get_diagnostic_tree (arg);
 186       sm_ctxt->warn (node, stmt, arg,
 187                      make_unique<exposure_through_output_file> (*this,
 188                                                                 diag_arg));
 189     }
 190 }
 191
 192 /* Implementation of state_machine::on_stmt vfunc for
 193    sensitive_state_machine.  */
 194
 195 bool
 196 sensitive_state_machine::on_stmt (sm_context *sm_ctxt,
 197                                   const supernode *node,
 198                                   const gimple *stmt) const
 199 {
 200   if (const gcall *call = dyn_cast <const gcall *> (stmt))
 201     if (tree callee_fndecl = sm_ctxt->get_fndecl_for_call (call))
 202       {
 203         if (is_named_call_p (callee_fndecl, "getpass", call, 1))
 204           {
 205             tree lhs = gimple_call_lhs (call);
 206             if (lhs)
 207               sm_ctxt->on_transition (node, stmt, lhs, m_start, m_sensitive);
 208             return true;
 209           }
 210         else if (is_named_call_p (callee_fndecl, "fprintf")
 211                  || is_named_call_p (callee_fndecl, "printf"))
 212           {
 213             /* Handle a match at any position in varargs.  */
 214             for (unsigned idx = 1; idx < gimple_call_num_args (call); idx++)
 215               {
 216                 tree arg = gimple_call_arg (call, idx);
 217                 warn_for_any_exposure (sm_ctxt, node, stmt, arg);
 218               }
 219             return true;
 220           }
 221         else if (is_named_call_p (callee_fndecl, "fwrite", call, 4))
 222           {
 223             tree arg = gimple_call_arg (call, 0);
 224             warn_for_any_exposure (sm_ctxt, node, stmt, arg);
 225             return true;
 226           }
 227         // TODO: ...etc.  This is just a proof-of-concept at this point.
 228       }
 229   return false;
 230 }
 231
 232 bool
 233 sensitive_state_machine::can_purge_p (state_t s ATTRIBUTE_UNUSED) const
 234 {
 235   return true;
 236 }
 237
 238 } // anonymous namespace
 239
 240 /* Internal interface to this file. */
 241
 242 state_machine *
 243 make_sensitive_state_machine (logger *logger)
 244 {
 245   return new sensitive_state_machine (logger);
 246 }
 247
 248 } // namespace ana
 249
 250 #endif /* #if ENABLE_ANALYZER */