1 use clippy_utils::diagnostics::{span_lint_and_help, span_lint_and_sugg};
2 use clippy_utils::is_lint_allowed;
3 use clippy_utils::source::{indent_of, reindent_multiline, snippet};
4 use rustc_errors::Applicability;
5 use rustc_hir::intravisit::{walk_expr, Visitor};
6 use rustc_hir::{Block, BlockCheckMode, Expr, ExprKind, HirId, Local, UnsafeSource};
7 use rustc_lexer::TokenKind;
8 use rustc_lint::{LateContext, LateLintPass};
9 use rustc_middle::lint::in_external_macro;
10 use rustc_middle::ty::TyCtxt;
11 use rustc_session::{declare_tool_lint, impl_lint_pass};
12 use rustc_span::{BytePos, Span};
15 declare_clippy_lint! {
17 /// Checks for `unsafe` blocks without a `// SAFETY: ` comment
18 /// explaining why the unsafe operations performed inside
19 /// the block are safe.
21 /// ### Why is this bad?
22 /// Undocumented unsafe blocks can make it difficult to
23 /// read and maintain code, as well as uncover unsoundness
28 /// use std::ptr::NonNull;
31 /// let ptr = unsafe { NonNull::new_unchecked(a) };
35 /// use std::ptr::NonNull;
38 /// // SAFETY: references are guaranteed to be non-null.
39 /// let ptr = unsafe { NonNull::new_unchecked(a) };
41 #[clippy::version = "1.58.0"]
42 pub UNDOCUMENTED_UNSAFE_BLOCKS,
44 "creating an unsafe block without explaining why it is safe"
47 impl_lint_pass!(UndocumentedUnsafeBlocks => [UNDOCUMENTED_UNSAFE_BLOCKS]);
50 pub struct UndocumentedUnsafeBlocks {
52 pub local_span: Option<Span>,
53 // The local was already checked for an overall safety comment
54 // There is no need to continue checking the blocks in the local
55 pub local_checked: bool,
56 // Since we can only check the blocks from expanded macros
57 // We have to omit the suggestion due to the actual definition
58 // Not being available to us
59 pub macro_expansion: bool,
62 impl LateLintPass<'_> for UndocumentedUnsafeBlocks {
63 fn check_block(&mut self, cx: &LateContext<'_>, block: &'_ Block<'_>) {
65 if !self.local_checked;
66 if !is_lint_allowed(cx, UNDOCUMENTED_UNSAFE_BLOCKS, block.hir_id);
67 if !in_external_macro(cx.tcx.sess, block.span);
68 if let BlockCheckMode::UnsafeBlock(UnsafeSource::UserProvided) = block.rules;
69 if let Some(enclosing_scope_hir_id) = cx.tcx.hir().get_enclosing_scope(block.hir_id);
70 if self.block_has_safety_comment(cx.tcx, enclosing_scope_hir_id, block.span) == Some(false);
72 let mut span = block.span;
74 if let Some(local_span) = self.local_span {
77 let result = self.block_has_safety_comment(cx.tcx, enclosing_scope_hir_id, span);
79 if result.unwrap_or(true) {
80 self.local_checked = true;
90 fn check_local(&mut self, cx: &LateContext<'_>, local: &'_ Local<'_>) {
92 if !is_lint_allowed(cx, UNDOCUMENTED_UNSAFE_BLOCKS, local.hir_id);
93 if !in_external_macro(cx.tcx.sess, local.span);
94 if let Some(init) = local.init;
96 self.visit_expr(init);
98 if self.local_level > 0 {
99 self.local_span = Some(local.span);
105 fn check_block_post(&mut self, _: &LateContext<'_>, _: &'_ Block<'_>) {
106 self.local_level = self.local_level.saturating_sub(1);
108 if self.local_level == 0 {
109 self.local_checked = false;
110 self.local_span = None;
115 impl<'v> Visitor<'v> for UndocumentedUnsafeBlocks {
116 fn visit_expr(&mut self, ex: &'v Expr<'v>) {
118 ExprKind::Block(_, _) => self.local_level = self.local_level.saturating_add(1),
119 _ => walk_expr(self, ex),
124 impl UndocumentedUnsafeBlocks {
125 fn block_has_safety_comment(&mut self, tcx: TyCtxt<'_>, enclosing_hir_id: HirId, block_span: Span) -> Option<bool> {
127 let source_map = tcx.sess.source_map();
129 let enclosing_scope_span = map.opt_span(enclosing_hir_id)?;
131 let between_span = if block_span.from_expansion() {
132 self.macro_expansion = true;
133 enclosing_scope_span.with_hi(block_span.hi()).source_callsite()
135 self.macro_expansion = false;
136 enclosing_scope_span.to(block_span).source_callsite()
139 let file_name = source_map.span_to_filename(between_span);
140 let source_file = source_map.get_source_file(&file_name)?;
142 let lex_start = (between_span.lo().0 - source_file.start_pos.0 + 1) as usize;
143 let lex_end = (between_span.hi().0 - source_file.start_pos.0) as usize;
144 let src_str = source_file.src.as_ref()?[lex_start..lex_end].to_string();
146 let source_start_pos = source_file.start_pos.0 as usize + lex_start;
149 let mut comment = false;
151 for token in rustc_lexer::tokenize(&src_str) {
153 TokenKind::LineComment { doc_style: None }
154 | TokenKind::BlockComment {
158 let comment_str = src_str[pos + 2..pos + token.len].to_ascii_uppercase();
160 if comment_str.contains("SAFETY:") {
164 // We need to add all whitespace to `pos` before checking the comment's line number
165 TokenKind::Whitespace => {},
168 // Get the line number of the "comment" (really wherever the trailing whitespace ended)
169 let comment_line_num = source_file
170 .lookup_file_pos(BytePos((source_start_pos + pos).try_into().unwrap()))
172 // Find the block/local's line number
173 let block_line_num = tcx.sess.source_map().lookup_char_pos(block_span.lo()).line;
175 // Check the comment is immediately followed by the block/local
176 if block_line_num == comment_line_num + 1 || block_line_num == comment_line_num {
191 fn lint(&self, cx: &LateContext<'_>, mut span: Span) {
192 let source_map = cx.tcx.sess.source_map();
194 if source_map.is_multiline(span) {
195 span = source_map.span_until_char(span, '\n');
198 if self.macro_expansion {
201 UNDOCUMENTED_UNSAFE_BLOCKS,
203 "unsafe block in macro expansion missing a safety comment",
205 "consider adding a safety comment in the macro definition",
208 let block_indent = indent_of(cx, span);
209 let suggestion = format!("// SAFETY: ...\n{}", snippet(cx, span, ".."));
213 UNDOCUMENTED_UNSAFE_BLOCKS,
215 "unsafe block missing a safety comment",
216 "consider adding a safety comment",
217 reindent_multiline(Cow::Borrowed(&suggestion), true, block_indent).to_string(),
218 Applicability::HasPlaceholders,