Re: [cocci] Adjusting attributes for variables with SmPL?
Pierrick Philippe <[email protected]> Thu, 28 May 2026 09:29:26 +0200
| Newsgroups | fr.inria.cocci |
|---|---|
| Message-ID | <[email protected]> |
On 5/28/26 09:11, Markus Elfring wrote: >>>> I apologize to both of you for the confusion, I do want quote, but I do not want escaped quote (I haven't tried it with escaped quote, but I'm pretty sure it won't be a valid string for GCC). >>> I suggest to reconsider known use cases for corresponding quoting >>> (in discussed source code variants). >> Not sure what you meant here, I am sorry. > Are you used to escaping of selected data? > https://en.wikipedia.org/wiki/Escape_character Oh, yes, I am sorry. >>>> The attribute I'm working with is taking an optional parameter, which, if present, should be a string (const char *) containing the field name of interest. >>> Where would you like to benefit from the knowledge of such an identifier? >> My use case is a plugin to GCC where I use this attribute to identify variables of interest for a specific analysis. To be even more precise, its purpose is to identify variables (or types) that are known to hold secret data (cryptographically speaking) in order to run static analysis to detect misuses of such data (e.g., a call to memcmp). > Would further programming interfaces be helpful for source code introspection? Yeah, I came out with the idea of a configuration file where the variables/types/parameters of interest are listed per files (and maybe scope?) alongside a python script to generate the different semantic patch to be used with Coccinelle. At first, I was thinking about writing a custom clang-tool for doing it from the configuration file, but then I remembered that Coccinelle was completely doing the same job and is also a tool coming for public research. The idea of the configuration file is to be able to leave the code base untouched, while still being able to play along with our tool. >> The idea to use Coccinelle here is to be able to patch the source code of huge code base in order to run our analysis. > This approach triggers special development challenges. What do you mean? Regards, Pierrick > Regards, > Markus