return-c-str-cpp

Author: ESS-ENN

rules/cpp/return-c-str-c.yml

@@ -0,0 +1,27 @@
+id: return-c-str-cpp
+language: cpp
+severity: warning
+message: >-
+  "`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer
+      is invalid after `$STR` goes out of scope, which can trigger a use after
+      free."
+note: >-
+  [CWE-416] Use After Free
+  [REFERENCES]
+      - https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations
+      - https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime
+
+rule:
+  kind: return_statement
+  any:
+    - pattern: return basic_string<$TYPE>($$$).$METHOD();
+    - pattern: return std::basic_string<$TYPE>($$$).$METHOD();
+    - pattern: return string($$$).$METHOD();
+    - pattern: return std::string($$$).$METHOD();
+    - pattern: return wstring($$$).$METHOD();
+    - pattern: return std::wstring($$$).$METHOD();
+
+constraints:
+  METHOD:
+    regex: ^(c_str|data)$
+

tests/__snapshots__/return-c-str-cpp-snapshot.yml

@@ -0,0 +1,29 @@
+id: return-c-str-cpp
+snapshots:
+  ? |
+    char *return_basic_string_directly() {
+      return std::basic_string<char>("foo").c_str();
+    }
+  : labels:
+    - source: return std::basic_string<char>("foo").c_str();
+      style: primary
+      start: 41
+      end: 87
+  ? |
+    char *return_data_directly() {
+      return std::string("foo").data();
+    }
+  : labels:
+    - source: return std::string("foo").data();
+      style: primary
+      start: 33
+      end: 66
+  ? |
+    char *return_directly() {
+      return string("foo").c_str();
+    }
+  : labels:
+    - source: return string("foo").c_str();
+      style: primary
+      start: 28
+      end: 57

tests/__snapshots__/sizeof-this-cpp-snapshot.yml

@@ -1,2 +1,13 @@
 id: sizeof-this-cpp
-snapshots: {}
+snapshots:
+  ? |
+    return sizeof(this);
+  : labels:
+    - source: sizeof(this)
+      style: primary
+      start: 7
+      end: 19
+    - source: this
+      style: secondary
+      start: 14
+      end: 18

tests/cpp/return-c-str-cpp-test.yml

@@ -0,0 +1,24 @@
+id: return-c-str-cpp
+valid:
+  - |
+    std::string return_directly() {
+      // ok: return-c-str
+      return std::string("foo");
+    }
+invalid:
+  - |
+    char *return_namespace_directly() {
+      return std::string("foo").c_str();
+    }
+  - |
+    char *return_directly() {
+      return string("foo").c_str();
+    }
+  - |
+    char *return_basic_string_directly() {
+      return std::basic_string<char>("foo").c_str();
+    }
+  - |
+    char *return_data_directly() {
+      return std::string("foo").data();
+    }