clang-tools-extra/clang-tidy/bugprone/StringConstructorCheck.cpp

   1 //===--- StringConstructorCheck.cpp - clang-tidy---------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8
   9 #include "StringConstructorCheck.h"
  10 #include "../utils/OptionsUtils.h"
  11 #include "clang/AST/ASTContext.h"
  12 #include "clang/ASTMatchers/ASTMatchFinder.h"
  13 #include "clang/Tooling/FixIt.h"
  14
  15 using namespace clang::ast_matchers;
  16
  17 namespace clang::tidy::bugprone {
  18
  19 namespace {
  20 AST_MATCHER_P(IntegerLiteral, isBiggerThan, unsigned, N) {
  21   return Node.getValue().getZExtValue() > N;
  22 }
  23
  24 const char DefaultStringNames[] =
  25     "::std::basic_string;::std::basic_string_view";
  26
  27 static std::vector<StringRef>
  28 removeNamespaces(const std::vector<StringRef> &Names) {
  29   std::vector<StringRef> Result;
  30   Result.reserve(Names.size());
  31   for (StringRef Name : Names) {
  32     std::string::size_type ColonPos = Name.rfind(':');
  33     Result.push_back(
  34         Name.substr(ColonPos == std::string::npos ? 0 : ColonPos + 1));
  35   }
  36   return Result;
  37 }
  38
  39 } // namespace
  40
  41 StringConstructorCheck::StringConstructorCheck(StringRef Name,
  42                                                ClangTidyContext *Context)
  43     : ClangTidyCheck(Name, Context),
  44       IsStringviewNullptrCheckEnabled(
  45           Context->isCheckEnabled("bugprone-stringview-nullptr")),
  46       WarnOnLargeLength(Options.get("WarnOnLargeLength", true)),
  47       LargeLengthThreshold(Options.get("LargeLengthThreshold", 0x800000)),
  48       StringNames(utils::options::parseStringList(
  49           Options.get("StringNames", DefaultStringNames))) {}
  50
  51 void StringConstructorCheck::storeOptions(ClangTidyOptions::OptionMap &Opts) {
  52   Options.store(Opts, "WarnOnLargeLength", WarnOnLargeLength);
  53   Options.store(Opts, "LargeLengthThreshold", LargeLengthThreshold);
  54   Options.store(Opts, "StringNames", DefaultStringNames);
  55 }
  56
  57 void StringConstructorCheck::registerMatchers(MatchFinder *Finder) {
  58   const auto ZeroExpr = expr(ignoringParenImpCasts(integerLiteral(equals(0))));
  59   const auto CharExpr = expr(ignoringParenImpCasts(characterLiteral()));
  60   const auto NegativeExpr = expr(ignoringParenImpCasts(
  61       unaryOperator(hasOperatorName("-"),
  62                     hasUnaryOperand(integerLiteral(unless(equals(0)))))));
  63   const auto LargeLengthExpr = expr(ignoringParenImpCasts(
  64       integerLiteral(isBiggerThan(LargeLengthThreshold))));
  65   const auto CharPtrType = type(anyOf(pointerType(), arrayType()));
  66
  67   // Match a string-literal; even through a declaration with initializer.
  68   const auto BoundStringLiteral = stringLiteral().bind("str");
  69   const auto ConstStrLiteralDecl = varDecl(
  70       isDefinition(), hasType(constantArrayType()), hasType(isConstQualified()),
  71       hasInitializer(ignoringParenImpCasts(BoundStringLiteral)));
  72   const auto ConstPtrStrLiteralDecl = varDecl(
  73       isDefinition(),
  74       hasType(pointerType(pointee(isAnyCharacter(), isConstQualified()))),
  75       hasInitializer(ignoringParenImpCasts(BoundStringLiteral)));
  76   const auto ConstStrLiteral = expr(ignoringParenImpCasts(anyOf(
  77       BoundStringLiteral, declRefExpr(hasDeclaration(anyOf(
  78                               ConstPtrStrLiteralDecl, ConstStrLiteralDecl))))));
  79
  80   // Check the fill constructor. Fills the string with n consecutive copies of
  81   // character c. [i.e string(size_t n, char c);].
  82   Finder->addMatcher(
  83       cxxConstructExpr(
  84           hasDeclaration(cxxMethodDecl(hasName("basic_string"))),
  85           hasArgument(0, hasType(qualType(isInteger()))),
  86           hasArgument(1, hasType(qualType(isInteger()))),
  87           anyOf(
  88               // Detect the expression: string('x', 40);
  89               hasArgument(0, CharExpr.bind("swapped-parameter")),
  90               // Detect the expression: string(0, ...);
  91               hasArgument(0, ZeroExpr.bind("empty-string")),
  92               // Detect the expression: string(-4, ...);
  93               hasArgument(0, NegativeExpr.bind("negative-length")),
  94               // Detect the expression: string(0x1234567, ...);
  95               hasArgument(0, LargeLengthExpr.bind("large-length"))))
  96           .bind("constructor"),
  97       this);
  98
  99   // Check the literal string constructor with char pointer and length
 100   // parameters. [i.e. string (const char* s, size_t n);]
 101   Finder->addMatcher(
 102       cxxConstructExpr(
 103           hasDeclaration(cxxConstructorDecl(ofClass(
 104               cxxRecordDecl(hasAnyName(removeNamespaces(StringNames)))))),
 105           hasArgument(0, hasType(CharPtrType)),
 106           hasArgument(1, hasType(isInteger())),
 107           anyOf(
 108               // Detect the expression: string("...", 0);
 109               hasArgument(1, ZeroExpr.bind("empty-string")),
 110               // Detect the expression: string("...", -4);
 111               hasArgument(1, NegativeExpr.bind("negative-length")),
 112               // Detect the expression: string("lit", 0x1234567);
 113               hasArgument(1, LargeLengthExpr.bind("large-length")),
 114               // Detect the expression: string("lit", 5)
 115               allOf(hasArgument(0, ConstStrLiteral.bind("literal-with-length")),
 116                     hasArgument(1, ignoringParenImpCasts(
 117                                        integerLiteral().bind("int"))))))
 118           .bind("constructor"),
 119       this);
 120
 121   // Check the literal string constructor with char pointer.
 122   // [i.e. string (const char* s);]
 123   Finder->addMatcher(
 124       traverse(
 125           TK_AsIs,
 126           cxxConstructExpr(
 127               hasDeclaration(cxxConstructorDecl(ofClass(anyOf(
 128                   cxxRecordDecl(hasName("basic_string_view"))
 129                       .bind("basic_string_view_decl"),
 130                   cxxRecordDecl(hasAnyName(removeNamespaces(StringNames))))))),
 131               hasArgument(0, expr().bind("from-ptr")),
 132               // do not match std::string(ptr, int)
 133               // match std::string(ptr, alloc)
 134               // match std::string(ptr)
 135               anyOf(hasArgument(1, unless(hasType(isInteger()))),
 136                     argumentCountIs(1)))
 137               .bind("constructor")),
 138       this);
 139 }
 140
 141 void StringConstructorCheck::check(const MatchFinder::MatchResult &Result) {
 142   const ASTContext &Ctx = *Result.Context;
 143   const auto *E = Result.Nodes.getNodeAs<CXXConstructExpr>("constructor");
 144   assert(E && "missing constructor expression");
 145   SourceLocation Loc = E->getBeginLoc();
 146
 147   if (Result.Nodes.getNodeAs<Expr>("swapped-parameter")) {
 148     const Expr *P0 = E->getArg(0);
 149     const Expr *P1 = E->getArg(1);
 150     diag(Loc, "string constructor parameters are probably swapped;"
 151               " expecting string(count, character)")
 152         << tooling::fixit::createReplacement(*P0, *P1, Ctx)
 153         << tooling::fixit::createReplacement(*P1, *P0, Ctx);
 154   } else if (Result.Nodes.getNodeAs<Expr>("empty-string")) {
 155     diag(Loc, "constructor creating an empty string");
 156   } else if (Result.Nodes.getNodeAs<Expr>("negative-length")) {
 157     diag(Loc, "negative value used as length parameter");
 158   } else if (Result.Nodes.getNodeAs<Expr>("large-length")) {
 159     if (WarnOnLargeLength)
 160       diag(Loc, "suspicious large length parameter");
 161   } else if (Result.Nodes.getNodeAs<Expr>("literal-with-length")) {
 162     const auto *Str = Result.Nodes.getNodeAs<StringLiteral>("str");
 163     const auto *Lit = Result.Nodes.getNodeAs<IntegerLiteral>("int");
 164     if (Lit->getValue().ugt(Str->getLength())) {
 165       diag(Loc, "length is bigger than string literal size");
 166     }
 167   } else if (const auto *Ptr = Result.Nodes.getNodeAs<Expr>("from-ptr")) {
 168     Expr::EvalResult ConstPtr;
 169     if (!Ptr->isInstantiationDependent() &&
 170         Ptr->EvaluateAsRValue(ConstPtr, Ctx) &&
 171         ((ConstPtr.Val.isInt() && ConstPtr.Val.getInt().isZero()) ||
 172          (ConstPtr.Val.isLValue() && ConstPtr.Val.isNullPointer()))) {
 173       if (IsStringviewNullptrCheckEnabled &&
 174           Result.Nodes.getNodeAs<CXXRecordDecl>("basic_string_view_decl")) {
 175         // Filter out `basic_string_view` to avoid conflicts with
 176         // `bugprone-stringview-nullptr`
 177         return;
 178       }
 179       diag(Loc, "constructing string from nullptr is undefined behaviour");
 180     }
 181   }
 182 }
 183
 184 } // namespace clang::tidy::bugprone