[clang] [clang][analyzer]Add TaintPropagation:EnableDefaultConfig config parameter (PR #176185)
Daniel Krupp via cfe-commits
cfe-commits at lists.llvm.org
Wed Jan 28 03:46:36 PST 2026
https://github.com/dkrupp updated https://github.com/llvm/llvm-project/pull/176185
>From 4dac726a3ba07b49be1accd3dc751f773fc33768 Mon Sep 17 00:00:00 2001
From: Daniel Krupp <daniel.krupp at ericsson.com>
Date: Wed, 14 Jan 2026 23:53:36 +0100
Subject: [PATCH 1/4] [clang][analyzer]Add
optin.taint.TaintPropagation:EnableDefaultConfig checker configuration
parameter
The new optin.taint.TaintPropagation:EnableDefaultConfig
checker configuration parameter makes it possible for the users
to disable the built-in taint configuration.
---
clang/docs/analyzer/checkers.rst | 6 +++++-
.../clang/StaticAnalyzer/Checkers/Checkers.td | 8 ++++++++
.../Checkers/GenericTaintChecker.cpp | 14 +++++++++-----
3 files changed, 22 insertions(+), 6 deletions(-)
diff --git a/clang/docs/analyzer/checkers.rst b/clang/docs/analyzer/checkers.rst
index 31edf9e99dc7d..71a4afcd9b306 100644
--- a/clang/docs/analyzer/checkers.rst
+++ b/clang/docs/analyzer/checkers.rst
@@ -1371,8 +1371,12 @@ For a more detailed description of configuration options, please see the
**Configuration**
-* `Config` Specifies the name of the YAML configuration file. The user can
+* `optin.taint.TaintPropagation:Config` Specifies the name of the YAML configuration file. The user can
define their own taint sources and sinks.
+* `optin.taint.TaintPropagation:EnableDefaultConfig` If set to true,
+ the default source, sink and propagation rules are loaded. Consider
+ setting it to false, if you want a fully custom taint configuration
+ without the defaults.
**Related Guidelines**
diff --git a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td
index e1662e0792e69..2a71f516afee3 100644
--- a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td
+++ b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td
@@ -1621,6 +1621,14 @@ def TaintPropagationChecker : Checker<"TaintPropagation">, // Modelling checker
"Config",
"Specifies the name of the configuration file.",
"",
+ Released>,
+ CmdLineOption<Boolean,
+ "EnableDefaultConfig",
+ "If set to true, the default source, sink and "
+ "propagation rules are added. Consider setting "
+ "it to false if you want to use a fully custom "
+ "taint configuration.",
+ "true",
Released>
]>,
Documentation<NotDocumented>,
diff --git a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
index bea8f3f13ba21..1c432219b307c 100644
--- a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
@@ -801,14 +801,18 @@ void GenericTaintChecker::initTaintRules(CheckerContext &C) const {
GlobalCRules.push_back(
{{CDM::CLibrary, {"getenv"}}, TR::Source({{ReturnValueIndex}})});
}
+ CheckerManager *Mgr = C.getAnalysisManager().getCheckerManager();
+ assert(Mgr);
+
- StaticTaintRules.emplace(std::make_move_iterator(GlobalCRules.begin()),
- std::make_move_iterator(GlobalCRules.end()));
+ if (Mgr->getAnalyzerOptions().getCheckerBooleanOption(this, "EnableDefaultConfig"))
+ StaticTaintRules.emplace(std::make_move_iterator(GlobalCRules.begin()),
+ std::make_move_iterator(GlobalCRules.end()));
+ else
+ StaticTaintRules = RuleLookupTy{};
// User-provided taint configuration.
- CheckerManager *Mgr = C.getAnalysisManager().getCheckerManager();
- assert(Mgr);
- GenericTaintRuleParser ConfigParser{*Mgr};
+ const GenericTaintRuleParser ConfigParser{*Mgr};
std::string Option{"Config"};
StringRef ConfigFile =
Mgr->getAnalyzerOptions().getCheckerStringOption(this, Option);
>From 14f6af15ce73192f24172eb490f50e8b481bbe5c Mon Sep 17 00:00:00 2001
From: Daniel Krupp <daniel.krupp at ericsson.com>
Date: Tue, 27 Jan 2026 15:03:25 +0100
Subject: [PATCH 2/4] Fixup!
---
clang/docs/analyzer/checkers.rst | 12 ++++++------
.../clang/StaticAnalyzer/Checkers/Checkers.td | 8 ++++----
.../StaticAnalyzer/Checkers/GenericTaintChecker.cpp | 5 +----
3 files changed, 11 insertions(+), 14 deletions(-)
diff --git a/clang/docs/analyzer/checkers.rst b/clang/docs/analyzer/checkers.rst
index 71a4afcd9b306..bef80f9c6ec8a 100644
--- a/clang/docs/analyzer/checkers.rst
+++ b/clang/docs/analyzer/checkers.rst
@@ -1371,12 +1371,12 @@ For a more detailed description of configuration options, please see the
**Configuration**
-* `optin.taint.TaintPropagation:Config` Specifies the name of the YAML configuration file. The user can
- define their own taint sources and sinks.
-* `optin.taint.TaintPropagation:EnableDefaultConfig` If set to true,
- the default source, sink and propagation rules are loaded. Consider
- setting it to false, if you want a fully custom taint configuration
- without the defaults.
+* ``optin.taint.TaintPropagation:Config`` Specifies the name of the YAML
+ configuration file. The user can define their own taint sources and sinks.
+* ``optin.taint.TaintPropagation:EnableDefaultConfig`` If set to false,
+ the default source, sink and propagation rules are not loaded. This way,
+ advanced users can fully customize their taint configuration model.
+ Default: ``true``.
**Related Guidelines**
diff --git a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td
index 2a71f516afee3..e3aa9e1c6502e 100644
--- a/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td
+++ b/clang/include/clang/StaticAnalyzer/Checkers/Checkers.td
@@ -1624,10 +1624,10 @@ def TaintPropagationChecker : Checker<"TaintPropagation">, // Modelling checker
Released>,
CmdLineOption<Boolean,
"EnableDefaultConfig",
- "If set to true, the default source, sink and "
- "propagation rules are added. Consider setting "
- "it to false if you want to use a fully custom "
- "taint configuration.",
+ "If set to false, the default source, "
+ "sink and propagation rules are not loaded."
+ "This way, advanced users can fully customize "
+ "their taint configuration model.",
"true",
Released>
]>,
diff --git a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
index 1c432219b307c..3b87ced6c191b 100644
--- a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
@@ -802,14 +802,11 @@ void GenericTaintChecker::initTaintRules(CheckerContext &C) const {
{{CDM::CLibrary, {"getenv"}}, TR::Source({{ReturnValueIndex}})});
}
CheckerManager *Mgr = C.getAnalysisManager().getCheckerManager();
- assert(Mgr);
-
+ StaticTaintRules = RuleLookupTy{};
if (Mgr->getAnalyzerOptions().getCheckerBooleanOption(this, "EnableDefaultConfig"))
StaticTaintRules.emplace(std::make_move_iterator(GlobalCRules.begin()),
std::make_move_iterator(GlobalCRules.end()));
- else
- StaticTaintRules = RuleLookupTy{};
// User-provided taint configuration.
const GenericTaintRuleParser ConfigParser{*Mgr};
>From d68d92dcfe8105068f4f95172e8fe73726b3d261 Mon Sep 17 00:00:00 2001
From: Daniel Krupp <daniel.krupp at ericsson.com>
Date: Tue, 27 Jan 2026 15:04:14 +0100
Subject: [PATCH 3/4] Formatting fix
---
clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
index 3b87ced6c191b..6637d044a98af 100644
--- a/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
@@ -804,9 +804,10 @@ void GenericTaintChecker::initTaintRules(CheckerContext &C) const {
CheckerManager *Mgr = C.getAnalysisManager().getCheckerManager();
StaticTaintRules = RuleLookupTy{};
- if (Mgr->getAnalyzerOptions().getCheckerBooleanOption(this, "EnableDefaultConfig"))
+ if (Mgr->getAnalyzerOptions().getCheckerBooleanOption(this,
+ "EnableDefaultConfig"))
StaticTaintRules.emplace(std::make_move_iterator(GlobalCRules.begin()),
- std::make_move_iterator(GlobalCRules.end()));
+ std::make_move_iterator(GlobalCRules.end()));
// User-provided taint configuration.
const GenericTaintRuleParser ConfigParser{*Mgr};
>From 602be03e1d86db4e08d9bad3c2769fcb4f0e2320 Mon Sep 17 00:00:00 2001
From: Daniel Krupp <daniel.krupp at ericsson.com>
Date: Wed, 28 Jan 2026 12:46:21 +0100
Subject: [PATCH 4/4] Fixup: fix a failing test
---
clang/test/Analysis/analyzer-config.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/clang/test/Analysis/analyzer-config.c b/clang/test/Analysis/analyzer-config.c
index 4e1f5336a9040..19196f8a45a5a 100644
--- a/clang/test/Analysis/analyzer-config.c
+++ b/clang/test/Analysis/analyzer-config.c
@@ -114,6 +114,7 @@
// CHECK-NEXT: optin.osx.cocoa.localizability.NonLocalizedStringChecker:AggressiveReport = false
// CHECK-NEXT: optin.performance.Padding:AllowedPad = 24
// CHECK-NEXT: optin.taint.TaintPropagation:Config = ""
+// CHECK-NEXT: optin.taint.TaintPropagation:EnableDefaultConfig = true
// CHECK-NEXT: osx.NumberObjectConversion:Pedantic = false
// CHECK-NEXT: osx.cocoa.RetainCount:TrackNSCFStartParam = false
// CHECK-NEXT: prune-paths = true
More information about the cfe-commits
mailing list