taint-generic-config.yaml
2.23 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
# A list of source/propagation function
Propagations:
# int x = mySource1(); // x is tainted
- Name: mySource1
DstArgs: [-1] # Index for return value
# int x;
# mySource2(&x); // x is tainted
- Name: mySource2
DstArgs: [0]
# int x = myNamespace::mySource3(); // x is tainted
- Name: mySource3
Scope: "myNamespace::"
DstArgs: [-1]
# int x = myAnotherNamespace::mySource3(); // x is tainted
- Name: mySource3
Scope: "myAnotherNamespace::"
DstArgs: [-1]
# int x, y;
# myScanf("%d %d", &x, &y); // x and y are tainted
- Name: myScanf
VariadicType: Dst
VariadicIndex: 1
# int x, y;
# Foo::myScanf("%d %d", &x, &y); // x and y are tainted
- Name: myMemberScanf
Scope: "Foo::"
VariadicType: Dst
VariadicIndex: 1
# int x; // x is tainted
# int y;
# myPropagator(x, &y); // y is tainted
- Name: myPropagator
SrcArgs: [0]
DstArgs: [1]
# constexpr unsigned size = 100;
# char buf[size];
# int x, y;
# int n = mySprintf(buf, size, "%d %d", x, y); // If size, x or y is tainted
# // the return value and the buf will be tainted
- Name: mySnprintf
SrcArgs: [1]
DstArgs: [0, -1]
VariadicType: Src
VariadicIndex: 3
# A list of filter functions
Filters:
# int x; // x is tainted
# isOutOfRange(&x); // x is not tainted anymore
- Name: isOutOfRange
Args: [0]
# int x; // x is tainted
# myNamespace::isOutOfRange(&x); // x is not tainted anymore
- Name: isOutOfRange2
Scope: "myNamespace::"
Args: [0]
# int x; // x is tainted
# myAnotherNamespace::isOutOfRange(&x); // x is not tainted anymore
- Name: isOutOfRange2
Scope: "myAnotherNamespace::"
Args: [0]
# A list of sink functions
Sinks:
# int x, y; // x and y are tainted
# mySink(x, 0, 1); // It will warn
# mySink(0, 1, y); // It will warn
# mySink(0, x, 1); // It won't warn
- Name: mySink
Args: [0, 2]
# int x; // x is tainted
# myNamespace::mySink(x); // It will warn
- Name: mySink2
Scope: "myNamespace::"
Args: [0]
# int x; // x is tainted
# myAnotherNamespace::mySink(x); // It will warn
- Name: mySink2
Scope: "myAnotherNamespace::"
Args: [0]