luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

checksrc: ban use of sscanf()

Browse Source 
Using sscanf() is not a (security) problem in itself, but we strongly
discorage using it for parsing input since it is hard to use right, easy
to mess up and often makes for sloppy error checking.

Allow it in examples and tests

Closes #15687
This commit is contained in:
Daniel Stenberg 2024-12-12 16:02:01 +01:00
parent d5c738c608
commit c2ac9ea1ee
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
4 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/examples/.checksrc
View File

@ -1,3 +1,4 @@
disable TYPEDEFSTRUCT disable TYPEDEFSTRUCT
disable SNPRINTF disable SNPRINTF
disable BANNEDFUNC disable BANNEDFUNC
disable SSCANF

11
scripts/checksrc.pl
View File

@ -99,6 +99,7 @@ my %warnings = (
'SPACEBEFOREPAREN' => 'space before an open parenthesis', 'SPACEBEFOREPAREN' => 'space before an open parenthesis',
'SPACESEMICOLON' => 'space before semicolon', 'SPACESEMICOLON' => 'space before semicolon',
'SPACESWITCHCOLON' => 'space before colon of switch label', 'SPACESWITCHCOLON' => 'space before colon of switch label',
"SSCANF" => 'use of sscanf',
'TABS' => 'TAB characters not allowed', 'TABS' => 'TAB characters not allowed',
'TRAILINGSPACE' => 'Trailing whitespace on the line', 'TRAILINGSPACE' => 'Trailing whitespace on the line',
'TYPEDEFSTRUCT' => 'typedefed struct', 'TYPEDEFSTRUCT' => 'typedefed struct',
@ -814,6 +815,16 @@ sub scanfile {
$line, length($1), $file, $ol, $line, length($1), $file, $ol,
"use of $2 is banned"); "use of $2 is banned");
} }
# scan for use of sscanf. This is not a BANNEDFUNC to allow for
# individual enable/disable of this warning.
if($l =~ /^(.*\W)(sscanf)\s*\(/x) {
if($1 !~ /^ *\#/) {
# skip preprocessor lines
checkwarn("SSCANF",
$line, length($1), $file, $ol,
"use of $2 is banned");
}
}
if($warnings{"STRERROR"}) { if($warnings{"STRERROR"}) {
# scan for use of banned strerror. This is not a BANNEDFUNC to # scan for use of banned strerror. This is not a BANNEDFUNC to
# allow for individual enable/disable of this warning. # allow for individual enable/disable of this warning.

1
tests/libtest/.checksrc
View File

@ -1,2 +1,3 @@
disable TYPEDEFSTRUCT disable TYPEDEFSTRUCT
disable BANNEDFUNC disable BANNEDFUNC
disable SSCANF

1
tests/server/.checksrc
View File

@ -1 +1,2 @@
enable STRNCPY enable STRNCPY
disable SSCANF