ast-grep-essentials/rules/cpp/security/std-return-data-cpp.yml at main · coderabbitai/ast-grep-essentials · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
id: std-return-data-cpp
language: cpp
severity: warning
message: >-
  $FUNC` returns a pointer to the memory owned by `$VAR`. This pointer
  is invalid after `$VAR` goes out of scope, which can trigger a use after
  free.
note: >-
  [CWE-416: Use After Free.
  [REFERENCES]
      - https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations

ast-grep-essentials: true

rule:
  kind: return_statement
  pattern: return $VAR.data();
  all:
    - inside:
        stopBy: end
        kind: function_definition
        all:
          - has:
              nthChild: 1
              pattern: $RETURN_TYPE
          - has:
              kind: pointer_declarator
    - any:
        - follows:
            stopBy: end
            all:
              - has:
                  nthChild: 1
                  regex: ^(array<.*>|std::array<.*>|deque<.*>|std::deque<.*>|forward_list<.*>|std::forward_list<.*>|list<.*>|std::list<.*>|map<.*, .*>|std::map<.*, .*>|multimap<.*, .*>|std::multimap<.*, .*>|multiset<.*>|std::multiset<.*>|set<.*>|std::set<.*>|unordered_map<.*>|std::unordered_map<.*>|unordered_multimap<.*, .*>|std::unordered_multimap<.*, .*>|unordered_multiset<.*>|std::unordered_multiset<.*>|unordered_set<.*>|std::unordered_set<.*>|vector<.*>|std::vector<.*>)$
              - has:
                  stopBy: end
                  #   nthChild: 2
                  pattern: $VAR
              - not:
                  inside:
                    stopBy: end
                    has:
                      kind: storage_class_specifier
              - inside:
                  stopBy: end
                  kind: compound_statement
        - inside:
            stopBy: end
            follows:
              stopBy: end
              all:
                - has:
                    nthChild: 1
                    regex: ^(array<.*>|std::array<.*>|deque<.*>|std::deque<.*>|forward_list<.*>|std::forward_list<.*>|list<.*>|std::list<.*>|map<.*, .*>|std::map<.*, .*>|multimap<.*, .*>|std::multimap<.*, .*>|multiset<.*>|std::multiset<.*>|set<.*>|std::set<.*>|unordered_map<.*>|std::unordered_map<.*>|unordered_multimap<.*, .*>|std::unordered_multimap<.*, .*>|unordered_multiset<.*>|std::unordered_multiset<.*>|unordered_set<.*>|std::unordered_set<.*>|vector<.*>|std::vector<.*>)$
                - has:
                    #   nthChild: 2
                    stopBy: end
                    pattern: $VAR
                - not:
                    inside:
                      stopBy: end
                      has:
                        kind: storage_class_specifier
                - inside:
                    stopBy: end
                    kind: compound_statement
        - inside:
            stopBy: end
            follows:
              stopBy: end
              kind: pointer_declarator
              all:
                - has:
                    stopBy: end
                    nthChild: 1
                    regex: ^(array<.*>|std::array<.*>|deque<.*>|std::deque<.*>|forward_list<.*>|std::forward_list<.*>|list<.*>|std::list<.*>|map<.*, .*>|std::map<.*, .*>|multimap<.*, .*>|std::multimap<.*, .*>|multiset<.*>|std::multiset<.*>|set<.*>|std::set<.*>|unordered_map<.*>|std::unordered_map<.*>|unordered_multimap<.*, .*>|std::unordered_multimap<.*, .*>|unordered_multiset<.*>|std::unordered_multiset<.*>|unordered_set<.*>|std::unordered_set<.*>|vector<.*>|std::vector<.*>)$
                - has:
                    #   nthChild: 2
                    stopBy: end
                    pattern: $VAR
                - not:
                    inside:
                      stopBy: end
                      has:
                        kind: storage_class_specifier