# A list of source/propagation function
Propagations:
# int x = mySource1(); // x is tainted
- Name: mySource1
DstArgs: # Index for return value
# int x;
# mySource2(&x); // x is tainted
- Name: mySource2
DstArgs:
# int x = myNamespace::mySource3(); // x is tainted
- Name: mySource3
Scope: "myNamespace::"
DstArgs:
# int x = myAnotherNamespace::mySource3(); // x is tainted
- Name: mySource3
Scope: "myAnotherNamespace::"
DstArgs:
# int x, y;
# myScanf("%d %d", &x, &y); // x and y are tainted
- Name: myScanf
VariadicType: Dst
VariadicIndex: 1
# int x, y;
# Foo::myScanf("%d %d", &x, &y); // x and y are tainted
- Name: myMemberScanf
Scope: "Foo::"
VariadicType: Dst
VariadicIndex: 1
# int x; // x is tainted
# int y;
# myPropagator(x, &y); // y is tainted
- Name: myPropagator
SrcArgs:
DstArgs:
# constexpr unsigned size = 100;
# char buf[size];
# int x, y;
# int n = mySprintf(buf, size, "%d %d", x, y); // If size, x or y is tainted
# // the return value and the buf will be tainted
- Name: mySnprintf
SrcArgs:
DstArgs:
VariadicType: Src
VariadicIndex: 3
# A list of filter functions
Filters:
# int x; // x is tainted
# isOutOfRange(&x); // x is not tainted anymore
- Name: isOutOfRange
Args:
# int x; // x is tainted
# myNamespace::isOutOfRange(&x); // x is not tainted anymore
- Name: isOutOfRange2
Scope: "myNamespace::"
Args:
# int x; // x is tainted
# myAnotherNamespace::isOutOfRange(&x); // x is not tainted anymore
- Name: isOutOfRange2
Scope: "myAnotherNamespace::"
Args:
# A list of sink functions
Sinks:
# int x, y; // x and y are tainted
# mySink(x, 0, 1); // It will warn
# mySink(0, 1, y); // It will warn
# mySink(0, x, 1); // It won't warn
- Name: mySink
Args:
# int x; // x is tainted
# myNamespace::mySink(x); // It will warn
- Name: mySink2
Scope: "myNamespace::"
Args:
# int x; // x is tainted
# myAnotherNamespace::mySink(x); // It will warn
- Name: mySink2
Scope: "myAnotherNamespace::"
Args: