[all-commits] [llvm/llvm-project] a4ba78: [libc++] Enable -Wformat-nonliteral when building ...

[Louis Dionne via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: a4ba780510518150cc11b330bbd2beb447e1f50e
      https://github.com/llvm/llvm-project/commit/a4ba780510518150cc11b330bbd2beb447e1f50e
  Author: Louis Dionne <ldionne.2 at gmail.com>
  Date:   2021-11-09 (Tue, 09 Nov 2021)

  Changed paths:
    M libcxx/CMakeLists.txt
    M libcxx/include/locale

  Log Message:
  -----------
  [libc++] Enable -Wformat-nonliteral when building libc++

Using user-provided data as a format string is a well known source of
security vulnerabilities. For this reason, it is a good idea to compile
our code with -Wformat-nonliteral, which basically warns if a non-constant
string is used as a format specifier. This is the compiler’s best signal
that a format string call may be insecure.

I audited the code after adding the warning and made sure that the few
places where we used a non-literal string as a format string were not
potential security issues. I either disabled the warning locally for
those instances or fixed the warning by using a literal. The idea is
that after we add the warning to the build, any new use of a non-literal
string in a format string will trigger a diagnostic, and we can either
get rid of it or disable the warning locally, which is a way of
acknowledging that it has been audited.

I also looked into enabling it in the test suite, which would perhaps
allow finding additional instances of it in our headers, however that
is not possible at the moment because Clang doesn't support putting
__attribute__((__format__(...))) on variadic templates, which would
be needed.

rdar://84571685

Differential Revision: https://reviews.llvm.org/D112927