Revision control
Copy as Markdown
// Copyright (C) 2026 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only
//
// qt_tara — TARA (Threat And Risk Assessment) launcher for Qt source files.
//
// Walks .cpp / .mm / .h files in the given directory (default: the current
// working directory), selects every file that carries the marker
//
// Qt-Security score:critical
//
// extracts the unique set of Q-prefixed class names declared in those files,
// and for every class spawns
//
// qt_fuzz_gen <ClassName> --qt-prefix <prefix>
//
// as a parallel background process. All children are started before any is
// waited on, so the work runs concurrently. The tool exits with the count
// of non-zero child exit codes (0 means all succeeded).
//
// Usage:
// qt_tara --qt-prefix <path> [<directory>]
//
// Options:
// --qt-prefix <path> Qt install prefix passed through to qt_fuzz_gen (required)
// <directory> Directory to scan (default: current working directory)
// -h / --help Print this help and exit
#include <filesystem>
#include <fstream>
#include <iostream>
#include <regex>
#include <set>
#include <sstream>
#include <string>
#include <vector>
#ifdef _WIN32
# define WIN32_LEAN_AND_MEAN
# define NOMINMAX
# include <windows.h>
#else
# include <sys/wait.h>
# include <unistd.h>
#endif
namespace fs = std::filesystem;
// ---------------------------------------------------------------------------
// Cross-platform background-process helpers
// ---------------------------------------------------------------------------
#ifdef _WIN32
using ProcessHandle = HANDLE;
static const ProcessHandle kInvalidHandle = INVALID_HANDLE_VALUE;
static ProcessHandle spawnBackground(const std::string &exe, const std::vector<std::string> &args)
{
// Build a quoted command line: "exe" "arg1" "arg2" ...
std::string cmd = "\"" + exe + "\"";
for (const auto &a : args)
cmd += " \"" + a + "\"";
STARTUPINFOA si = { };
si.cb = sizeof(si);
PROCESS_INFORMATION pi = { };
if (!CreateProcessA(nullptr, const_cast<char *>(cmd.c_str()), nullptr, nullptr, FALSE, 0,
nullptr, nullptr, &si, &pi)) {
std::cerr << "[qt_tara] CreateProcess failed (error " << GetLastError() << "): " << cmd
<< "\n";
return kInvalidHandle;
}
CloseHandle(pi.hThread); // handle not needed
return pi.hProcess;
}
static int waitAll(std::vector<ProcessHandle> &handles)
{
int failed = 0;
for (auto h : handles) {
if (h == kInvalidHandle) {
++failed;
continue;
}
WaitForSingleObject(h, INFINITE);
DWORD code = 0;
if (GetExitCodeProcess(h, &code) && code != 0)
++failed;
CloseHandle(h);
}
return failed;
}
#else // POSIX
using ProcessHandle = pid_t;
static const ProcessHandle kInvalidHandle = -1;
static ProcessHandle spawnBackground(const std::string &exe, const std::vector<std::string> &args)
{
const pid_t pid = fork();
if (pid < 0) {
std::cerr << "[qt_tara] fork() failed: " << exe << "\n";
return kInvalidHandle;
}
if (pid == 0) {
std::vector<const char *> argv;
argv.push_back(exe.c_str());
for (const auto &a : args)
argv.push_back(a.c_str());
argv.push_back(nullptr);
execv(exe.c_str(), const_cast<char **>(argv.data()));
_exit(127);
}
return pid;
}
static int waitAll(std::vector<ProcessHandle> &handles)
{
int failed = 0;
for (auto pid : handles) {
if (pid == kInvalidHandle) {
++failed;
continue;
}
int wstatus = 0;
waitpid(pid, &wstatus, 0);
if (!WIFEXITED(wstatus) || WEXITSTATUS(wstatus) != 0)
++failed;
}
return failed;
}
#endif
// ---------------------------------------------------------------------------
// File / class-name helpers
// ---------------------------------------------------------------------------
static std::string readFile(const fs::path &p)
{
std::ifstream f(p);
if (!f)
return { };
std::ostringstream ss;
ss << f.rdbuf();
return ss.str();
}
static bool hasCriticalMarker(const std::string &src)
{
return src.find("Qt-Security score:critical") != std::string::npos;
}
// Collect Q-prefixed class names: matches
// class [Q_SOMETHING_EXPORT] QFoo
// Requires QFoo to start with Q followed by an upper-case letter so that
// template parameters and misc. identifiers are excluded.
static void collectClassNames(const std::string &src, std::set<std::string> &out)
{
// Group 1: export macro (e.g. Q_CORE_EXPORT) — only exported classes are in scope.
// Group 2: class name
static const std::regex kRe(R"(\bclass\s+(Q_\w+_EXPORT)\s+(Q[A-Z]\w+)\b)",
std::regex::optimize);
for (auto it = std::sregex_iterator(src.cbegin(), src.cend(), kRe);
it != std::sregex_iterator(); ++it) {
const std::string name = (*it)[2].str();
// Skip macro-like tokens (e.g. QT_DEPRECATED_VERSION_X_6_15 appearing
// as a deprecation annotation between the export macro and the real name).
if (name.find('_') != std::string::npos)
continue;
out.insert(name);
}
}
// A private header is in scope for --qml when it registers a QML type
// (QML_ELEMENT / QML_NAMED_ELEMENT) that exposes properties.
static bool hasQmlType(const std::string &src)
{
const bool hasRegistration = src.find("QML_ELEMENT") != std::string::npos
|| src.find("QML_NAMED_ELEMENT") != std::string::npos;
return hasRegistration && src.find("Q_PROPERTY") != std::string::npos;
}
// For _p.h files with QML_ELEMENT / QML_NAMED_ELEMENT: class names need not be
// Q-prefixed or exported (e.g. SphereGeometry, StateMachine, ColorGradient).
static void collectQmlClassNames(const std::string &src, std::set<std::string> &out)
{
static const std::regex kRe(R"(\bclass\s+(?:Q_\w+_EXPORT\s+)?([A-Z][A-Za-z0-9]+)\b)",
std::regex::optimize);
for (auto it = std::sregex_iterator(src.cbegin(), src.cend(), kRe);
it != std::sregex_iterator(); ++it) {
const std::string name = (*it)[1].str();
if (name.find('_') != std::string::npos)
continue;
out.insert(name);
}
}
// ---------------------------------------------------------------------------
// Locate qt_fuzz_gen next to our own binary, fall back to PATH
// ---------------------------------------------------------------------------
static std::string findFuzzGen(const char *argv0)
{
#ifdef _WIN32
static const char kName[] = "qt_fuzz_gen.exe";
#else
static const char kName[] = "qt_fuzz_gen";
#endif
std::error_code ec;
fs::path sibling = fs::absolute(fs::path(argv0), ec).parent_path() / kName;
if (!ec && fs::exists(sibling))
return sibling.string();
return kName; // rely on PATH
}
// ---------------------------------------------------------------------------
// main
// ---------------------------------------------------------------------------
int main(int argc, char *argv[])
{
std::string qtPrefix;
std::string scanDirArg;
bool listOnly = false;
bool includeQml = false;
for (int i = 1; i < argc; ++i) {
const std::string a = argv[i];
if (a == "--qt-prefix" && i + 1 < argc) {
qtPrefix = argv[++i];
} else if (a.rfind("--qt-prefix=", 0) == 0) {
qtPrefix = a.substr(12);
} else if (a == "--list-classes") {
listOnly = true;
} else if (a == "--qml") {
includeQml = true;
} else if (a == "-h" || a == "--help") {
std::cout
<< "Usage: qt_tara --qt-prefix <path> [<directory>]\n\n"
<< " Scans <directory> (default: current directory) for .cpp / .mm / .h\n"
<< " files that carry the 'Qt-Security score:critical' marker, extracts\n"
<< " all Q-prefixed class names, and spawns\n\n"
<< " qt_fuzz_gen <ClassName> --qt-prefix <path>\n\n"
<< " in parallel for every unique class found.\n\n"
<< "Options:\n"
<< " --qt-prefix <path> Qt install prefix (required unless --list-classes)\n"
<< " --list-classes Print in-scope class names and exit without "
"running qt_fuzz_gen\n"
<< " --qml Pass --qml to qt_fuzz_gen (include QML-exposed "
"private classes)\n"
<< " <directory> Directory to scan (default: .)\n";
return 0;
} else if (a.rfind("--", 0) != 0) {
scanDirArg = a;
} else {
std::cerr << "[qt_tara] Unknown option: " << a << " (try --help)\n";
return 1;
}
}
if (qtPrefix.empty() && !listOnly) {
std::cerr << "[qt_tara] Error: --qt-prefix <path> is required.\n";
return 1;
}
const fs::path root = scanDirArg.empty() ? fs::current_path() : fs::path(scanDirArg);
if (!fs::is_directory(root)) {
std::cerr << "[qt_tara] Not a directory: " << root.string() << "\n";
return 1;
}
// ── 1. Read all source files, collect security-critical class names ──────────
std::set<std::string> classes;
std::error_code ec;
for (const auto &entry : fs::recursive_directory_iterator(root, ec)) {
if (ec) {
ec.clear();
continue;
}
if (!entry.is_regular_file())
continue;
const auto &ext = entry.path().extension();
if (ext != ".cpp" && ext != ".mm" && ext != ".h")
continue;
const std::string src = readFile(entry.path());
if (!hasCriticalMarker(src))
continue;
const std::string stem = entry.path().stem().string();
std::cout << "[qt_tara] critical: " << entry.path().filename().string() << "\n";
// Private headers (*_p.h) contain implementation classes, not public API —
// unless --qml is active and the file exposes a QML type + Q_PROPERTY.
if (stem.size() >= 2 && stem[stem.size() - 2] == '_' && stem[stem.size() - 1] == 'p') {
if (!includeQml || !hasQmlType(src))
continue;
collectQmlClassNames(src, classes);
continue;
}
collectClassNames(src, classes);
// A critical .cpp / .mm usually only contains definitions; the class
// declaration (with the export macro) lives in the same-stem .h.
// Scan that header too so classes like QImage are not missed.
if (ext == ".cpp" || ext == ".mm") {
const fs::path hFile = entry.path().parent_path() / (stem + ".h");
if (fs::exists(hFile))
collectClassNames(readFile(hFile), classes);
// With --qml, QML types may be declared in the same-stem private
// header instead, without the header carrying the marker itself.
if (includeQml) {
const fs::path pFile = entry.path().parent_path() / (stem + "_p.h");
if (fs::exists(pFile)) {
const std::string pSrc = readFile(pFile);
if (hasQmlType(pSrc))
collectQmlClassNames(pSrc, classes);
}
}
}
}
if (classes.empty()) {
std::cout << "[qt_tara] No classes found in Qt-Security score:critical files.\n";
return 0;
}
if (listOnly) {
std::cout << "[qt_tara] " << classes.size() << " class(es) in scope:\n";
for (const auto &cls : classes)
std::cout << " " << cls << "\n";
return 0;
}
std::cout << "[qt_tara] Spawning qt_fuzz_gen for " << classes.size()
<< " class(es) in parallel:\n";
// ── 2. Spawn one qt_fuzz_gen process per class ───────────────────────────
const std::string fuzzGen = findFuzzGen(argv[0]);
std::vector<ProcessHandle> handles;
handles.reserve(classes.size());
for (const auto &cls : classes) {
std::cout << "[qt_tara] → " << cls << "\n";
std::vector<std::string> fgArgs = { cls, "--qt-prefix", qtPrefix };
if (includeQml)
fgArgs.push_back("--qml");
handles.push_back(spawnBackground(fuzzGen, fgArgs));
}
// ── 3. Wait for all children ─────────────────────────────────────────────
const int failed = waitAll(handles);
if (failed > 0)
std::cerr << "[qt_tara] " << failed << " process(es) exited with errors.\n";
else
std::cout << "[qt_tara] All done.\n";
return failed > 0 ? 1 : 0;
}