1//=- DirectIvarAssignment.cpp - Check rules on ObjC properties -*- C++ ----*-==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9//  Check that Objective C properties are set with the setter, not though a
10//      direct assignment.
11//
12//  Two versions of a checker exist: one that checks all methods and the other
13//      that only checks the methods annotated with
14//      __attribute__((annotate("objc_no_direct_instance_variable_assignment")))
15//
16//  The checker does not warn about assignments to Ivars, annotated with
17//       __attribute__((objc_allow_direct_instance_variable_assignment"))). This
18//      annotation serves as a false positive suppression mechanism for the
19//      checker. The annotation is allowed on properties and Ivars.
20//
21//===----------------------------------------------------------------------===//
22
23#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
24#include "clang/AST/Attr.h"
25#include "clang/AST/DeclObjC.h"
26#include "clang/AST/StmtVisitor.h"
27#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
28#include "clang/StaticAnalyzer/Core/Checker.h"
29#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
30#include "llvm/ADT/DenseMap.h"
31
32using namespace clang;
33using namespace ento;
34
35namespace {
36
37/// The default method filter, which is used to filter out the methods on which
38/// the check should not be performed.
39///
40/// Checks for the init, dealloc, and any other functions that might be allowed
41/// to perform direct instance variable assignment based on their name.
42static bool DefaultMethodFilter(const ObjCMethodDecl *M) {
43  return M->getMethodFamily() == OMF_init ||
44         M->getMethodFamily() == OMF_dealloc ||
45         M->getMethodFamily() == OMF_copy ||
46         M->getMethodFamily() == OMF_mutableCopy ||
47         M->getSelector().getNameForSlot(0).find("init") != StringRef::npos ||
48         M->getSelector().getNameForSlot(0).find("Init") != StringRef::npos;
49}
50
51class DirectIvarAssignment :
52  public Checker<check::ASTDecl<ObjCImplementationDecl> > {
53
54  typedef llvm::DenseMap<const ObjCIvarDecl*,
55                         const ObjCPropertyDecl*> IvarToPropertyMapTy;
56
57  /// A helper class, which walks the AST and locates all assignments to ivars
58  /// in the given function.
59  class MethodCrawler : public ConstStmtVisitor<MethodCrawler> {
60    const IvarToPropertyMapTy &IvarToPropMap;
61    const ObjCMethodDecl *MD;
62    const ObjCInterfaceDecl *InterfD;
63    BugReporter &BR;
64    const CheckerBase *Checker;
65    LocationOrAnalysisDeclContext DCtx;
66
67  public:
68    MethodCrawler(const IvarToPropertyMapTy &InMap, const ObjCMethodDecl *InMD,
69                  const ObjCInterfaceDecl *InID, BugReporter &InBR,
70                  const CheckerBase *Checker, AnalysisDeclContext *InDCtx)
71        : IvarToPropMap(InMap), MD(InMD), InterfD(InID), BR(InBR),
72          Checker(Checker), DCtx(InDCtx) {}
73
74    void VisitStmt(const Stmt *S) { VisitChildren(S); }
75
76    void VisitBinaryOperator(const BinaryOperator *BO);
77
78    void VisitChildren(const Stmt *S) {
79      for (const Stmt *Child : S->children())
80        if (Child)
81          this->Visit(Child);
82    }
83  };
84
85public:
86  bool (*ShouldSkipMethod)(const ObjCMethodDecl *);
87
88  DirectIvarAssignment() : ShouldSkipMethod(&DefaultMethodFilter) {}
89
90  void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& Mgr,
91                    BugReporter &BR) const;
92};
93
94static const ObjCIvarDecl *findPropertyBackingIvar(const ObjCPropertyDecl *PD,
95                                               const ObjCInterfaceDecl *InterD,
96                                               ASTContext &Ctx) {
97  // Check for synthesized ivars.
98  ObjCIvarDecl *ID = PD->getPropertyIvarDecl();
99  if (ID)
100    return ID;
101
102  ObjCInterfaceDecl *NonConstInterD = const_cast<ObjCInterfaceDecl*>(InterD);
103
104  // Check for existing "_PropName".
105  ID = NonConstInterD->lookupInstanceVariable(PD->getDefaultSynthIvarName(Ctx));
106  if (ID)
107    return ID;
108
109  // Check for existing "PropName".
110  IdentifierInfo *PropIdent = PD->getIdentifier();
111  ID = NonConstInterD->lookupInstanceVariable(PropIdent);
112
113  return ID;
114}
115
116void DirectIvarAssignment::checkASTDecl(const ObjCImplementationDecl *D,
117                                       AnalysisManager& Mgr,
118                                       BugReporter &BR) const {
119  const ObjCInterfaceDecl *InterD = D->getClassInterface();
120
121
122  IvarToPropertyMapTy IvarToPropMap;
123
124  // Find all properties for this class.
125  for (const auto *PD : InterD->instance_properties()) {
126    // Find the corresponding IVar.
127    const ObjCIvarDecl *ID = findPropertyBackingIvar(PD, InterD,
128                                                     Mgr.getASTContext());
129
130    if (!ID)
131      continue;
132
133    // Store the IVar to property mapping.
134    IvarToPropMap[ID] = PD;
135  }
136
137  if (IvarToPropMap.empty())
138    return;
139
140  for (const auto *M : D->instance_methods()) {
141    AnalysisDeclContext *DCtx = Mgr.getAnalysisDeclContext(M);
142
143    if ((*ShouldSkipMethod)(M))
144      continue;
145
146    const Stmt *Body = M->getBody();
147    if (M->isSynthesizedAccessorStub())
148      continue;
149    assert(Body);
150
151    MethodCrawler MC(IvarToPropMap, M->getCanonicalDecl(), InterD, BR, this,
152                     DCtx);
153    MC.VisitStmt(Body);
154  }
155}
156
157static bool isAnnotatedToAllowDirectAssignment(const Decl *D) {
158  for (const auto *Ann : D->specific_attrs<AnnotateAttr>())
159    if (Ann->getAnnotation() ==
160        "objc_allow_direct_instance_variable_assignment")
161      return true;
162  return false;
163}
164
165void DirectIvarAssignment::MethodCrawler::VisitBinaryOperator(
166                                                    const BinaryOperator *BO) {
167  if (!BO->isAssignmentOp())
168    return;
169
170  const ObjCIvarRefExpr *IvarRef =
171          dyn_cast<ObjCIvarRefExpr>(BO->getLHS()->IgnoreParenCasts());
172
173  if (!IvarRef)
174    return;
175
176  if (const ObjCIvarDecl *D = IvarRef->getDecl()) {
177    IvarToPropertyMapTy::const_iterator I = IvarToPropMap.find(D);
178
179    if (I != IvarToPropMap.end()) {
180      const ObjCPropertyDecl *PD = I->second;
181      // Skip warnings on Ivars, annotated with
182      // objc_allow_direct_instance_variable_assignment. This annotation serves
183      // as a false positive suppression mechanism for the checker. The
184      // annotation is allowed on properties and ivars.
185      if (isAnnotatedToAllowDirectAssignment(PD) ||
186          isAnnotatedToAllowDirectAssignment(D))
187        return;
188
189      ObjCMethodDecl *GetterMethod =
190          InterfD->getInstanceMethod(PD->getGetterName());
191      ObjCMethodDecl *SetterMethod =
192          InterfD->getInstanceMethod(PD->getSetterName());
193
194      if (SetterMethod && SetterMethod->getCanonicalDecl() == MD)
195        return;
196
197      if (GetterMethod && GetterMethod->getCanonicalDecl() == MD)
198        return;
199
200      BR.EmitBasicReport(
201          MD, Checker, "Property access", categories::CoreFoundationObjectiveC,
202          "Direct assignment to an instance variable backing a property; "
203          "use the setter instead",
204          PathDiagnosticLocation(IvarRef, BR.getSourceManager(), DCtx));
205    }
206  }
207}
208}
209
210// Register the checker that checks for direct accesses in functions annotated
211// with __attribute__((annotate("objc_no_direct_instance_variable_assignment"))).
212static bool AttrFilter(const ObjCMethodDecl *M) {
213  for (const auto *Ann : M->specific_attrs<AnnotateAttr>())
214    if (Ann->getAnnotation() == "objc_no_direct_instance_variable_assignment")
215      return false;
216  return true;
217}
218
219// Register the checker that checks for direct accesses in all functions,
220// except for the initialization and copy routines.
221void ento::registerDirectIvarAssignment(CheckerManager &mgr) {
222  mgr.registerChecker<DirectIvarAssignment>();
223}
224
225bool ento::shouldRegisterDirectIvarAssignment(const LangOptions &LO) {
226  return true;
227}
228
229void ento::registerDirectIvarAssignmentForAnnotatedFunctions(
230    CheckerManager &mgr) {
231  mgr.getChecker<DirectIvarAssignment>()->ShouldSkipMethod = &AttrFilter;
232}
233
234bool ento::shouldRegisterDirectIvarAssignmentForAnnotatedFunctions(
235                                                        const LangOptions &LO) {
236  return true;
237}
238