From 95b7f2b99855373ac52987adca04f37e1ac9b9ed Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Sun, 10 May 2026 12:36:24 +0200
Subject: [PATCH] scan-build: support taint filtering

Support scan-build's taint filtering logic. Adds a yaml config to mark
a dedicated debug validation function as filtering a taint.

Use to suppress warnings in reference, threshold and classification file
handling.

Ticket: #3153.
---
 .github/workflows/scan-build.yml |  2 ++
 qa/sb-taint-config.yaml          | 12 ++++++++++++
 src/suricata-common.h            |  5 +++++
 src/util-classification-config.c |  1 +
 src/util-reference-config.c      |  1 +
 src/util-threshold-config.c      |  1 +
 src/util-validate.h              |  9 +++++++++
 7 files changed, 31 insertions(+)
 create mode 100644 qa/sb-taint-config.yaml

diff --git a/.github/workflows/scan-build.yml b/.github/workflows/scan-build.yml
index 497df3aeb8..6e3997796f 100644
--- a/.github/workflows/scan-build.yml
+++ b/.github/workflows/scan-build.yml
@@ -153,6 +153,8 @@ jobs:
                 -enable-checker unix.cstring.NotNullTerminated \
                 -enable-checker unix.cstring.NullArg \
                 \
+                -analyzer-config optin.taint.TaintPropagation:Config="$(pwd)/qa/sb-taint-config.yaml" \
+                \
                 make
         env:
           CC: clang-22
diff --git a/qa/sb-taint-config.yaml b/qa/sb-taint-config.yaml
new file mode 100644
index 0000000000..936201905c
--- /dev/null
+++ b/qa/sb-taint-config.yaml
@@ -0,0 +1,12 @@
+# taint yaml for scan-build, to be loaded as
+# `-analyzer-config optin.taint.TaintPropagation:Config=../qa/sb-taint-config.yaml`
+#
+# See further:
+# https://rocm.docs.amd.com/projects/llvm-project/en/latest/LLVM/clang/html/analyzer/user-docs/TaintAnalysisConfiguration.html
+# https://clang.llvm.org/docs/analyzer/checkers.html#optin-taint-generictaint
+#
+# Generic no-op to signal to scan-build a taint source as sanitized
+# (i.e. not to be propagated)
+Filters:
+  - Name: ScanBuildMarkSanitized
+    Args: [0]
diff --git a/src/suricata-common.h b/src/suricata-common.h
index 3bfe425593..941be0d2f0 100644
--- a/src/suricata-common.h
+++ b/src/suricata-common.h
@@ -45,6 +45,11 @@ extern "C"
 /* clang analyzer acts as DEBUG_VALIDATION in some places, so
  * force this so #ifdef DEBUG_VALIDATION code gets included */
 #define DEBUG_VALIDATION 1
+
+    /* function prototype to be used to filter taints. To be used
+     * through the DEBUG_VALIDATE_MARK_SANITIZED macro. The scan-build
+     * taint config will then consider this in the taint analysis. */
+    void ScanBuildMarkSanitized(const void *);
 #endif
 
 #if defined(__has_feature)
diff --git a/src/util-classification-config.c b/src/util-classification-config.c
index 66055f772e..b4cd39969c 100644
--- a/src/util-classification-config.c
+++ b/src/util-classification-config.c
@@ -136,6 +136,7 @@ static FILE *SCClassConfInitContextAndLocalResources(DetectEngineCtx *de_ctx, FI
         }
     }
 
+    DEBUG_VALIDATE_MARK_SANITIZED(fd);
     return fd;
 }
 
diff --git a/src/util-reference-config.c b/src/util-reference-config.c
index b25dbbaad4..92854e4d18 100644
--- a/src/util-reference-config.c
+++ b/src/util-reference-config.c
@@ -126,6 +126,7 @@ static FILE *SCRConfInitContextAndLocalResources(DetectEngineCtx *de_ctx, FILE *
         }
     }
 
+    DEBUG_VALIDATE_MARK_SANITIZED(fd);
     return fd;
 }
 
diff --git a/src/util-threshold-config.c b/src/util-threshold-config.c
index aaf67ec9c8..28a8163dce 100644
--- a/src/util-threshold-config.c
+++ b/src/util-threshold-config.c
@@ -187,6 +187,7 @@ int SCThresholdConfInitContext(DetectEngineCtx *de_ctx)
     }
 #endif
 
+    DEBUG_VALIDATE_MARK_SANITIZED(fd);
     if (SCThresholdConfParseFile(de_ctx, fd) < 0) {
         SCLogWarning("Error loading threshold configuration from %s", filename);
         SCThresholdConfDeInitContext(de_ctx, fd);
diff --git a/src/util-validate.h b/src/util-validate.h
index cc9eac1041..36f3c9036f 100644
--- a/src/util-validate.h
+++ b/src/util-validate.h
@@ -94,6 +94,13 @@
 
 #define DEBUG_VALIDATE_BUG_ON(exp) BUG_ON((exp))
 
+#if defined(__clang_analyzer__)
+/* provide guidance to scan-build about taints. */
+#define DEBUG_VALIDATE_MARK_SANITIZED(ptr) ScanBuildMarkSanitized((ptr))
+#else
+#define DEBUG_VALIDATE_MARK_SANITIZED(ptr)
+#endif
+
 #else /* DEBUG_VALIDATE */
 
 #define DEBUG_ASSERT_FLOW_LOCKED(f)
@@ -101,6 +108,8 @@
 #define DEBUG_VALIDATE_PACKET(p)
 #define DEBUG_VALIDATE_BUG_ON(exp)
 
+#define DEBUG_VALIDATE_MARK_SANITIZED(ptr)
+
 #endif /* DEBUG_VALIDATE */
 
 #endif /* SURICATA_UTIL_VALIDATE_H */