19 using namespace clang;
23 class TaintTesterChecker :
public Checker< check::PostStmt<Expr> > {
25 mutable std::unique_ptr<BugType> BT;
26 void initBugType()
const;
30 SymbolRef getPointedToSymbol(CheckerContext &C,
32 bool IssueWarning =
true)
const;
35 void checkPostStmt(
const Expr *E, CheckerContext &C)
const;
39 inline void TaintTesterChecker::initBugType()
const {
41 BT.reset(
new BugType(
this,
"Tainted data",
"General"));
44 void TaintTesterChecker::checkPostStmt(
const Expr *E,
45 CheckerContext &C)
const {
50 if (State->isTainted(E, C.getLocationContext())) {
51 if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
53 auto report = llvm::make_unique<BugReport>(*BT,
"tainted",N);
55 C.emitReport(std::move(report));
60 void ento::registerTaintTesterChecker(CheckerManager &mgr) {
61 mgr.registerChecker<TaintTesterChecker>();
const SymExpr * SymbolRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
This represents one expression.
Dataflow Directional Tag Classes.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...