[NFC][analyzer] Add missing documentation for decodeValueOfObjCType

[zeyi2]

This check is introduced in b284005, but the documentation seems missing from checkers.rst.

[llvmbot]

@llvm/pr-subscribers-clang

@llvm/pr-subscribers-clang-static-analyzer-1

Author: mitchell (zeyi2)

Changes

---

Full diff: https://github.com/llvm/llvm-project/pull/167822.diff

1 Files Affected:

• (modified) clang/docs/analyzer/checkers.rst (+20-1)

diff --git a/clang/docs/analyzer/checkers.rst b/clang/docs/analyzer/checkers.rst
index fd0b304cba0df..51ca5e112c6bd 100644
--- a/clang/docs/analyzer/checkers.rst
+++ b/clang/docs/analyzer/checkers.rst
@@ -198,7 +198,7 @@ as error. Specifically on x86/x86-64 target if the pointer address space is
 dereference is not defined as error. See `X86/X86-64 Language Extensions
 <https://clang.llvm.org/docs/LanguageExtensions.html#memory-references-to-specified-segments>`__
 for reference.
-	
+
 If the analyzer option ``suppress-dereferences-from-any-address-space`` is set
 to true (the default value), then this checker never reports dereference of
 pointers with a specified address space. If the option is set to false, then
@@ -1664,6 +1664,25 @@ Warn on uses of the 'bzero' function.
    bzero(ptr, n); // warn
  }
 
+.. _security-insecureAPI-decodeValueOfObjCType:
+
+security.insecureAPI.decodeValueOfObjCType (C)
+"""""""""""""""""""""""""""""""""""""""
+Warn on uses of the Objective-C method ``-decodeValueOfObjCType:at:``.
+
+.. code-block:: objc
+
+  void test(NSCoder *decoder) {
+    unsigned int x;
+    [decoder decodeValueOfObjCType:"I" at:&x]; // warn
+  }
+
+This diagnostic is emitted only on Apple platforms where the safer
+``-decodeValueOfObjCType:at:size:`` alternative is available
+(
+iOS 11+, macOS 10.13+, tvOS 11+, watchOS 4.0+
+).
+
 .. _security-insecureAPI-getpw:
 
 security.insecureAPI.getpw (C)

[NagyDonat]

Thanks for adding this missing documentation! The commit looks good to me if you handle one small formatting issue that I marked with an inline comment.

(By the way, note that these security.insecureAPI checkers are "out of place" in the analyzer. These were developed a long time ago and they are "grandfathered in" because they are used by the users, but freshly developed simple AST-based checks like this would belong to Clang-Tidy -- which is a more lightweight tool and is more accessible for the users. However, this doesn't detract from the value of this documentation patch -- documentation is equally valuable for all checkers that we provide.)

[zeyi2]

Thanks for reviewing! I've updated the formatting, everything should be good now :)

[zeyi2]

@NagyDonat Hi, could you help merge this PR? Thanks!

[NagyDonat]

Of course 😄