Taint improvement

[dkrupp]

This patch improves the diagnostics of the alpha.security.taint.TaintPropagation and taint related checkers by showing the "Taint originated here" note at the correct place, where the attacker may inject it. This greatly improves the understandability of the taint reports.

Taint Analysis: The attacker injects the malicious data at the taint source (e.g. getenv() call) which is then propagated and used at taint sink (e.g. exec() call) causing a security vulnerability (e.g. shell injection vulnerability), without data sanitation.

The goal of the checker is to discover and show to the user these potential taint source, sink pairs and the propagation call chain.

In the baseline the taint source was pointing to an invalid location, typically somewhere between the real taint source and sink.

After the fix, the "Taint originated here" tag is correctly shown at the taint source. This is the function call where the attacker can inject a malicious data (e.g. reading from environment variable, reading from file, reding from standard input etc.).

Before the patch the clang static analyzer puts the taint origin note wrongly to the strtol(..) call.

int main(){
  char *pathbuf;
  char *user_data=getenv("USER_INPUT"); 
  char *end;  
  long size=strtol(user_data, &end, 10); // note: Taint originated here. 
  if (size > 0){
    pathbuf=(char*) malloc(size+1);//note: Untrusted data is used to specify the buffer size ...
    // ... 
    free(pathbuf);
  }
  return 0;
}

After the fix, the taint origin point is correctly annotated at getenv() where the attacker really injects the value.

int main(){
  char *pathbuf;
  char *user_data=getenv("USER_INPUT");  // note: Taint originated here. 
  char *end;
  long size=strtol(user_data, &end, 10); 
  if (size > 0){
    pathbuf=(char*) malloc(size+1);//note: Untrusted data is used to specify the buffer size ...
    // ... 
    free(pathbuf);
  }
  return 0;
}

The BugVisitor placing the note was wrongly going back only until introduction of the tainted SVal in the sink.

This patch creates a new uniquely identified taint flow for each taint source (e.g.getenv()) it traverses and places a NoteTag ("Taint originated here") with the new id. Then, when the bug report is generated, the taint flow id is propagated back (in the new TainBugReport) along the bug path and the correct "Taint originated here." annotation is generated (matching the flow id).

You can find the new improved reports

here

And the old reports (look out for "Taint originated here" notes. They are at the wrong place, close to the end of the reports)

here