sqc 0.4.13

Software Code Quality - CERT C compliance checker
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

//! ERR06-C: Understand the termination behavior of assert() and abort()
//!
//! The assert() macro calls abort(), which means cleanup functions registered
//! with atexit() are not called. When cleanup handlers are registered, use
//! explicit error checking instead of assert().
//!
//! ## Examples:
//!
//! **Non-compliant:**
//! ```c
//! if (atexit(cleanup) != 0) { /* Handle error */ }
//! // ...
//! assert(condition);  // Bypasses atexit cleanup if assertion fails
//! ```
//!
//! **Compliant:**
//! ```c
//! if (atexit(cleanup) != 0) { /* Handle error */ }
//! // ...
//! if (!condition) {
//!     exit(EXIT_FAILURE);  // Calls atexit cleanup handlers
//! }
//! ```

use super::super::{CertRule, RuleViolation};
use crate::manifest::{RuleCategory, Severity};
use crate::utility::cert_c::ast_utils::get_node_text;
use tree_sitter::Node;

pub struct Err06C;

impl CertRule for Err06C {
    fn rule_id(&self) -> &'static str {
        "ERR06-C"
    }

    fn description(&self) -> &'static str {
        "Understand the termination behavior of assert() and abort()"
    }

    fn severity(&self) -> Severity {
        Severity::Medium
    }

    fn category(&self) -> RuleCategory {
        RuleCategory::Recommendation
    }

    fn cert_id(&self) -> &'static str {
        "ERR06-C"
    }

    fn check(&self, node: &Node, source: &str) -> Vec<RuleViolation> {
        let mut violations = Vec::new();

        // Check if atexit is used anywhere in the file
        let has_atexit = self.find_atexit_calls(node, source);

        if has_atexit {
            // Find all assert() calls and flag them
            self.find_assert_calls(node, source, &mut violations);
        }

        violations
    }
}

impl Err06C {
    /// Check if atexit() or at_quick_exit() is called anywhere in the tree
    fn find_atexit_calls(&self, node: &Node, source: &str) -> bool {
        if node.kind() == "call_expression" {
            if let Some(function) = node.child_by_field_name("function") {
                let func_name = get_node_text(&function, source);
                if func_name == "atexit" || func_name == "at_quick_exit" {
                    return true;
                }
            }
        }

        // Recurse through children
        for i in 0..node.child_count() {
            if let Some(child) = node.child(i) {
                if self.find_atexit_calls(&child, source) {
                    return true;
                }
            }
        }

        false
    }

    /// Find all assert() calls and create violations
    fn find_assert_calls(&self, node: &Node, source: &str, violations: &mut Vec<RuleViolation>) {
        if node.kind() == "call_expression" {
            if let Some(function) = node.child_by_field_name("function") {
                let func_name = get_node_text(&function, source);
                if func_name == "assert" {
                    violations.push(RuleViolation {
                        rule_id: self.rule_id().to_string(),
                        message: "assert() used when atexit() cleanup handlers are registered. \
                                 assert() calls abort() which bypasses atexit cleanup."
                            .to_string(),
                        severity: self.severity(),
                        line: node.start_position().row + 1,
                        column: node.start_position().column + 1,
                        file_path: String::new(),
                        suggestion: Some(
                            "Replace assert() with explicit error checking: \
                             if (!condition) { exit(EXIT_FAILURE); }"
                                .to_string(),
                        ),
                        requires_manual_review: None,
                    });
                }
            }
        }

        // Recurse through children
        for i in 0..node.child_count() {
            if let Some(child) = node.child(i) {
                self.find_assert_calls(&child, source, violations);
            }
        }
    }
}