Rule 21.2.2 - UnsafeStringHandlingFunctions.ql

Add a query to detect uses of a number of common unsafe string
handling functions. [a]

Author: lcartey

cpp/misra/src/rules/RULE-21-2-2/UnsafeStringHandlingFunctions.ql

@@ -0,0 +1,45 @@
+/**
+ * @id cpp/misra/unsafe-string-handling-functions
+ * @name RULE-21-2-2: The string handling functions from <cstring>, <cstdlib>, <cwchar> and <cinttypes> shall not be used
+ * @description Using string handling functions from <cstring>, <cstdlib>, <cwchar> and <cinttypes>
+ *              headers may result in buffer overflows or unreliable error detection through errno.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-21-2-2
+ *       scope/single-translation-unit
+ *       external/misra/enforcement/decidable
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.cpp.misra
+
+predicate isBannedStringFunction(Function f) {
+  f.hasGlobalName([
+    "strcat", "strchr", "strcmp", "strcoll", "strcpy", "strcspn",
+    "strerror", "strlen", "strncat", "strncmp", "strncpy", "strpbrk",
+    "strrchr", "strspn", "strstr", "strtok", "strxfrm",
+    "strtol", "strtoll", "strtoul", "strtoull", "strtod", "strtof", "strtold",
+    "fgetwc", "fputwc", "wcstol", "wcstoll", "wcstoul", "wcstoull",
+    "wcstod", "wcstof", "wcstold",
+    "strtoumax", "strtoimax", "wcstoumax", "wcstoimax"
+  ])
+}
+
+from Expr e, Function f, string msg
+where
+  not isExcluded(e, BannedAPIsPackage::unsafeStringHandlingFunctionsQuery()) and
+  (
+    (e.(FunctionCall).getTarget() = f and isBannedStringFunction(f) and
+     msg = "Call to banned string handling function '" + f.getName() + "'.")
+    or
+    (e.(AddressOfExpr).getOperand().(FunctionAccess).getTarget() = f and isBannedStringFunction(f) and
+     msg = "Address taken of banned string handling function '" + f.getName() + "'.")
+    or
+    (e.(FunctionAccess).getTarget() = f and isBannedStringFunction(f) and
+     not e.getParent() instanceof FunctionCall and
+     not e.getParent() instanceof AddressOfExpr and
+     msg = "Reference to banned string handling function '" + f.getName() + "'.")
+  )
+select e, msg