[Static Analyzer] Checker for OS X / iOS localizability issues

[kulpreet]

Summary

This is the basis for a set of checks to detect code-level localizability issues for OS X / iOS including:

1. A checker that warns about uses of non-localized NSStrings passed to UI methods expecting localized strings
2. A syntax checker that warns against not including a comment in NSLocalizedString macros.

[zaks.anna]

Thanks for working on this!

Comments in line,
Anna.

lib/StaticAnalyzer/Checkers/Checkers.td

461

How about shortening the message to "Warn about.."

lib/StaticAnalyzer/Checkers/LocalizationChecker.cpp

14

Is the comment argument optional in some cases or is it always encouraged in some contexts?

40

Unknown is never used?

67

Please, use more descriptive names here (or add a comment on what these are).
Why StringSet does not work?

202

I believe this would just return a predecessor and not add a new transition.
If you want to create a new transition, you should tag the node with your checker info. For example, see CheckerProgramPointTag in the MallocChecker.

209

You can try reporting a more specific range here, for example the range of the argument expression if available. This is what gets highlighted in Xcode.

236

Are these temporaries needed?

290

Or the heuristic is triggered, right?
This applies to C++ as well.

323

Could you add a comment documenting what it is?
Is it that the literals other than the empty string are assumed to be non-localized?

334

Why are we not using the same heuristic as in the case with other calls?

366

Is it possible to see that we are dealing with an empty string from an SVal? That way you could keep the state lean.

427

Could you add a comment explaining what this does. For example, we try to match these macros and we assume they are defined in this way..

Also, the point here is that we cannot use the path sensitive check because the macro argument we are checking for is not used, so it only appears in the macro call, but not in the expansion.

#define NSLocalizedString(key, comment) \

[[NSBundle mainBundle] localizedStringForKey:(key) value:@"" table:nil]

#define NSLocalizedStringFromTable(key, tbl, comment) \

[[NSBundle mainBundle] localizedStringForKey:(key) value:@"" table:(tbl)]

#define NSLocalizedStringFromTableInBundle(key, tbl, bundle, comment) \

[bundle localizedStringForKey:(key) value:@"" table:(tbl)]

#define NSLocalizedStringWithDefaultValue(key, tbl, bundle, val, comment) \

[bundle localizedStringForKey:(key) value:(val) table:(tbl)]

451

Would this be susceptible to the macro definition changes?

What the while loop below is doing?

I don't think this will work if the expansion is inside of another macro expansion, so we should check for that case and not warn if that is the case.

506

"include comment" -> "include a non-empty comment"?

[kulpreet]

Thanks for the feedback! Uploading a new diff with the changes.

lib/StaticAnalyzer/Checkers/LocalizationChecker.cpp

14

Engineers sometimes assume that a particular string alone will have enough context for the translators to figure out the meaning, but this usually a bad assumption. Similar to the way that it is "bad practice" to not have descriptive variable and function names (i.e. foo()), it's "bad practice" to not include a comment in a localized string. I modified my comment to clarify.

40

Removing Unknown from the enum.

67

Adding in comments.

When I try to use StringSet I get:

error: no type named 'StringSet' in namespace 'llvm';

even when I explicitly #include "llvm/ADT/StringSet.h"

202

I'm not 100% clear on why I would want to create a new transition, but I adjusted to code so it does something similar to MallocChecker. The alternative is to just call getPredecessor() which seems to work the same?

209

Good idea. Adding this for arguments so it highlights the string.

236

No, these will be removed.

323

Adding a comment to the method signature, clarifying this.

334

I think we are? checkPostCall should also cover ObjC methods for the heuristic. This function is to specifically cover the case where we need to mark a value returned by a method in LocStringMethods (LSM) as localized.

366

Good idea. I was able to do this with the following:

if (const ObjCStringRegion *SR =
            dyn_cast_or_null<ObjCStringRegion>(svTitle.getAsRegion())) {
      StringRef stringValue =
          SR->getObjCStringLiteral()->getString()->getString();
      if (stringValue.empty())
        return;
    }

And then marking all string literals here as NonLocalized

451

This should work for any macro for [NSBundle localizedStringForKey:Value:Table:] where the last argument holds the comment.

I have a test in localization-aggressive.m that checks for the macro expansion within a macro expansion and it seems to be working as expected. (i.e. giving a warning where the user wrote the code).

Adding in some comments to clarify your other questions.

[kulpreet]

Including changes from Anna's comments.

[zaks.anna]

lib/StaticAnalyzer/Checkers/LocalizationChecker.cpp

15

My quick Google search did not show any mention of this :(

203

Adding a new transition is more debugging friendly.

335

Ah, I see!

367

I am not sure if we are on the same page.. I would not store/mark this information in the state, but just use the code as part of the check.

452

The point is that this macro can be used inside another, user defined macro where you'd no longer know which argument corresponds to "comment". The only way around that that I see is to only warn when these macros are called directly.

[kulpreet]

• Added in a test for the case for macro expansion scenario that Anna pointed out.
• Skipping warning on string literals that only contain whitespace in addition to empty string literals.
• Ran on a large projects to verify low false-positive rate (will send details in a separate email to reviewers)

[zaks.anna]

test/Analysis/localization-aggressive.m

203

How about something like this, where the last argument to the user defined macro is nil, but it has noting to do with the comment.

#define POSSIBLE_FALSE_POSITIVE(s, myarg) YOLOC(s)

..
POSSIBLE_FALSE_POSITIVE(@"Hello", nil)

[kulpreet]

test/Analysis/localization-aggressive.m

203

I added a regression test for this and it seems to not produce a false positive. This makes sense because the Lexer will only lex through NSLocalizedString macros.

[kulpreet]

• By default (non-aggressive mode) the UnlocalizedStringChecker will ignore strings that are less than two characters long to avoid false positives such as @"-"
• Added UIAlertView APIs to add coverage to methods that require localized strings.
• Added in test case for EmptyLocalizationContext checker to show that it doesn't produce a false positive in the case that Anna pointed out.

[kulpreet]

Updated diff to include Anna's suggestions.

[zaks.anna]

Thank you! LGTM.

I'll commit this tomorrow.

[zaks.anna]

Committed in r244389.
Thank you!

[kulpreet]

Moved UIMethods over to StringMap so it should compile on Windows now.

[kulpreet]

Fixed memory corruption bug with temporary std::string - found with address sanitizer.

Now, all regression tests pass with MallocScribble on.

[dcoughlin]

lib/StaticAnalyzer/Checkers/LocalizationChecker.cpp

68

FWIW,

#include "llvm/ADT/StringSet.h"

and using

mutable llvm::StringMap<llvm::StringSet<>> UIMethods;

works for me.

72

Is there a reason you use StringMap<char> here and StringMap<uint8_t> for UIMethods?

279

You can just write

StringRef SelectorName = SelectorString;

here.

509

You can just write

ME->getSelector().getAsString() == "localizedStringForKey:value:table:"

for the string comparison.

[kulpreet]

• Incorporated feedback from Devin's review
• Moved LSM over to StringSet<>

[zaks.anna]

Committed earlier today in r245093.

Thank you for contributing the checker!

lib/StaticAnalyzer/Checkers/CMakeLists.txt

   IdenticalExprChecker.cpp
   IvarInvalidationChecker.cpp
   LLVMConventionsChecker.cpp
+  LocalizationChecker.cpp
   MacOSKeychainAPIChecker.cpp
   MacOSXAPIChecker.cpp
   MallocChecker.cpp

lib/StaticAnalyzer/Checkers/Checkers.td

 def ObjCGenericsChecker : Checker<"ObjCGenerics">,
   HelpText<"Checks for type errors.">,
   DescFile<"ObjCGenericsChecker.cpp">;
+  
+def NonLocalizedStringChecker : Checker<"NonLocalizedStringChecker">,
+  HelpText<"Warns about uses of non-localized NSStrings passed to UI methods expecting localized NSStrings">,
+  DescFile<"LocalizationChecker.cpp">;
+
+def EmptyLocalizationContextChecker : Checker<"EmptyLocalizationContextChecker">,
+  HelpText<"Check that NSLocalizedString macros include a comment for context">,
+  DescFile<"LocalizationChecker.cpp">;
 
 } // end "alpha.osx.cocoa"
 

lib/StaticAnalyzer/Checkers/LocalizationChecker.cpp

+//=- LocalizationChecker.cpp -------------------------------------*- C++ -*-==//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines a set of checks for localizability including:
+//  1) A checker that warns about uses of non-localized NSStrings passed to
+//     UI methods expecting localized strings
+//  2) A syntactic checker that warns against the bad practice of
+//     not including a comment in NSLocalizedString macros.
+//
+//===----------------------------------------------------------------------===//
+
+#include "ClangSACheckers.h"
+#include "SelectorExtras.h"
+#include "clang/AST/Attr.h"
+#include "clang/AST/Decl.h"
+#include "clang/AST/DeclObjC.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
+#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
+#include "clang/StaticAnalyzer/Core/Checker.h"
+#include "clang/StaticAnalyzer/Core/CheckerManager.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
+#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
+#include "clang/Lex/Lexer.h"
+#include "clang/AST/RecursiveASTVisitor.h"
+#include "clang/AST/StmtVisitor.h"
+#include "llvm/Support/Unicode.h"
+
+using namespace clang;
+using namespace ento;
+
+namespace {
+struct LocalizedState {
+private:
+  enum Kind { NonLocalized, Localized } K;
+  LocalizedState(Kind InK) : K(InK) {}
+
+public:
+  bool isLocalized() const { return K == Localized; }
+  bool isNonLocalized() const { return K == NonLocalized; }
+
+  static LocalizedState getLocalized() { return LocalizedState(Localized); }
+  static LocalizedState getNonLocalized() {
+    return LocalizedState(NonLocalized);
+  }
+
+  // Overload the == operator
+  bool operator==(const LocalizedState &X) const { return K == X.K; }
+
+  // LLVMs equivalent of a hash function
+  void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddInteger(K); }
+};
+
+class NonLocalizedStringChecker
+    : public Checker<check::PostCall, check::PreObjCMessage,
+                     check::PostObjCMessage,
+                     check::PostStmt<ObjCStringLiteral>> {
+
+  mutable std::unique_ptr<BugType> BT;
+
+  // Methods that require a localized string
+  mutable llvm::StringMap<llvm::StringMap<uint8_t>> UIMethods;
+  // Methods that return a localized string
+  mutable llvm::SmallSet<std::pair<StringRef, StringRef>, 12> LSM;
+  // C Functions that return a localized string
+  mutable llvm::StringMap<char> LSF;
+
+  void initUIMethods(ASTContext &Ctx) const;
+  void initLocStringsMethods(ASTContext &Ctx) const;
+
+  bool hasNonLocalizedState(SVal S, CheckerContext &C) const;
+  bool hasLocalizedState(SVal S, CheckerContext &C) const;
+  void setNonLocalizedState(SVal S, CheckerContext &C) const;
+  void setLocalizedState(SVal S, CheckerContext &C) const;
+
+  bool isAnnotatedAsLocalized(const Decl *D) const;
+  void reportLocalizationError(SVal S, const ObjCMethodCall &M,
+                               CheckerContext &C, int argumentNumber = 0) const;
+
+public:
+  NonLocalizedStringChecker();
+
+  // When this parameter is set to true, the checker assumes all
+  // methods that return NSStrings are unlocalized. Thus, more false
+  // positives will be reported.
+  DefaultBool IsAggressive;
+
+  void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
+  void checkPostObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
+  void checkPostStmt(const ObjCStringLiteral *SL, CheckerContext &C) const;
+  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
+};
+
+} // end anonymous namespace
+
+REGISTER_MAP_WITH_PROGRAMSTATE(LocalizedMemMap, const MemRegion *,
+                               LocalizedState)
+
+NonLocalizedStringChecker::NonLocalizedStringChecker() {
+  BT.reset(new BugType(this, "Unlocalized string", "Localizability Error"));
+}
+
+/// Initializes a list of methods that require a localized string
+/// Format: {"ClassName", {{"selectorName:", LocStringArg#}, ...}, ...}
+void NonLocalizedStringChecker::initUIMethods(ASTContext &Ctx) const {
+  if (!UIMethods.empty())
+    return;
+
+  // TODO: This should eventually be a comprehensive list of UIKit methods
+
+  // UILabel Methods
+  llvm::StringMap<uint8_t> &UILabelM =
+      UIMethods.insert({"UILabel", llvm::StringMap<uint8_t>()}).first->second;
+  UILabelM.insert({"setText:", 0});
+
+  // UIButton Methods
+  llvm::StringMap<uint8_t> &UIButtonM =
+      UIMethods.insert({"UIButton", llvm::StringMap<uint8_t>()}).first->second;
+  UIButtonM.insert({"setText:", 0});
+
+  // UIAlertAction Methods
+  llvm::StringMap<uint8_t> &UIAlertActionM =
+      UIMethods.insert({"UIAlertAction", llvm::StringMap<uint8_t>()})
+          .first->second;
+  UIAlertActionM.insert({"actionWithTitle:style:handler:", 0});
+
+  // UIAlertController Methods
+  llvm::StringMap<uint8_t> &UIAlertControllerM =
+      UIMethods.insert({"UIAlertController", llvm::StringMap<uint8_t>()})
+          .first->second;
+  UIAlertControllerM.insert(
+      {"alertControllerWithTitle:message:preferredStyle:", 1});
+
+  // NSButton Methods
+  llvm::StringMap<uint8_t> &NSButtonM =
+      UIMethods.insert({"NSButton", llvm::StringMap<uint8_t>()}).first->second;
+  NSButtonM.insert({"setTitle:", 0});
+
+  // NSButtonCell Methods
+  llvm::StringMap<uint8_t> &NSButtonCellM =
+      UIMethods.insert({"NSButtonCell", llvm::StringMap<uint8_t>()})
+          .first->second;
+  NSButtonCellM.insert({"setTitle:", 0});
+
+  // NSMenuItem Methods
+  llvm::StringMap<uint8_t> &NSMenuItemM =
+      UIMethods.insert({"NSMenuItem", llvm::StringMap<uint8_t>()})
+          .first->second;
+  NSMenuItemM.insert({"setTitle:", 0});
+
+  // NSAttributedString Methods
+  llvm::StringMap<uint8_t> &NSAttributedStringM =
+      UIMethods.insert({"NSAttributedString", llvm::StringMap<uint8_t>()})
+          .first->second;
+  NSAttributedStringM.insert({"initWithString:", 0});
+  NSAttributedStringM.insert({"initWithString:attributes:", 0});
+}
+
+/// Initializes a list of methods and C functions that return a localized string
+void NonLocalizedStringChecker::initLocStringsMethods(ASTContext &Ctx) const {
+  if (!LSM.empty())
+    return;
+
+  LSM.insert({"NSBundle", "localizedStringForKey:value:table:"});
+  LSM.insert({"NSDateFormatter", "stringFromDate:"});
+  LSM.insert(
+      {"NSDateFormatter", "localizedStringFromDate:dateStyle:timeStyle:"});
+  LSM.insert({"NSNumberFormatter", "stringFromNumber:"});
+  LSM.insert({"UITextField", "text"});
+  LSM.insert({"UITextView", "text"});
+  LSM.insert({"UILabel", "text"});
+
+  LSF.insert({"CFDateFormatterCreateStringWithDate", '\0'});
+  LSF.insert({"CFDateFormatterCreateStringWithAbsoluteTime", '\0'});
+  LSF.insert({"CFNumberFormatterCreateStringWithNumber", '\0'});
+}
+
+/// Checks to see if the method / function declaration includes
+/// __attribute__((annotate("returns_localized_nsstring")))
+bool NonLocalizedStringChecker::isAnnotatedAsLocalized(const Decl *D) const {
+  return std::any_of(
+      D->specific_attr_begin<AnnotateAttr>(),
+      D->specific_attr_end<AnnotateAttr>(), [](const AnnotateAttr *Ann) {
+        return Ann->getAnnotation() == "returns_localized_nsstring";
+      });
+}
+
+/// Returns true if the given SVal is marked as Localized in the program state
+bool NonLocalizedStringChecker::hasLocalizedState(SVal S,
+                                                  CheckerContext &C) const {
+  const MemRegion *mt = S.getAsRegion();
+  if (mt) {
+    const LocalizedState *LS = C.getState()->get<LocalizedMemMap>(mt);
+    if (LS && LS->isLocalized())
+      return true;
+  }
+  return false;
+}
+
+/// Returns true if the given SVal is marked as NonLocalized in the program
+/// state
+bool NonLocalizedStringChecker::hasNonLocalizedState(SVal S,
+                                                     CheckerContext &C) const {
+  const MemRegion *mt = S.getAsRegion();
+  if (mt) {
+    const LocalizedState *LS = C.getState()->get<LocalizedMemMap>(mt);
+    if (LS && LS->isNonLocalized())
+      return true;
+  }
+  return false;
+}
+
+/// Marks the given SVal as Localized in the program state
+void NonLocalizedStringChecker::setLocalizedState(const SVal S,
+                                                  CheckerContext &C) const {
+  const MemRegion *mt = S.getAsRegion();
+  if (mt) {
+    ProgramStateRef State =
+        C.getState()->set<LocalizedMemMap>(mt, LocalizedState::getLocalized());
+    C.addTransition(State);
+  }
+}
+
+/// Marks the given SVal as NonLocalized in the program state
+void NonLocalizedStringChecker::setNonLocalizedState(const SVal S,
+                                                     CheckerContext &C) const {
+  const MemRegion *mt = S.getAsRegion();
+  if (mt) {
+    ProgramStateRef State = C.getState()->set<LocalizedMemMap>(
+        mt, LocalizedState::getNonLocalized());
+    C.addTransition(State);
+  }
+}
+
+/// Reports a localization error for the passed in method call and SVal
+void NonLocalizedStringChecker::reportLocalizationError(
+    SVal S, const ObjCMethodCall &M, CheckerContext &C,
+    int argumentNumber) const {
+
+  ExplodedNode *ErrNode = C.getPredecessor();
+  static CheckerProgramPointTag Tag("NonLocalizedStringChecker",
+                                    "UnlocalizedString");
+  ErrNode = C.addTransition(C.getState(), C.getPredecessor(), &Tag);
+
+  if (!ErrNode)
+    return;
+
+  // Generate the bug report.
+  std::unique_ptr<BugReport> R(
+      new BugReport(*BT, "String should be localized", ErrNode));
+  if (argumentNumber) {
+    R->addRange(M.getArgExpr(argumentNumber - 1)->getSourceRange());
+  } else {
+    R->addRange(M.getSourceRange());
+  }
+  R->markInteresting(S);
+  C.emitReport(std::move(R));
+}
+
+/// Check if the string being passed in has NonLocalized state
+void NonLocalizedStringChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
+                                                    CheckerContext &C) const {
+  initUIMethods(C.getASTContext());
+
+  const ObjCInterfaceDecl *OD = msg.getReceiverInterface();
+  if (!OD)
+    return;
+  const IdentifierInfo *odInfo = OD->getIdentifier();
+
+  Selector S = msg.getSelector();
+
+  std::string SelectorString = S.getAsString();
+  StringRef SelectorName = StringRef(SelectorString);
+  assert(!SelectorName.empty());
+
+  auto method = UIMethods.find(odInfo->getName());
+  if (odInfo->isStr("NSString")) {
+    // Handle the case where the receiver is an NSString
+    // These special NSString methods draw to the screen
+
+    if (!(SelectorName.startswith("drawAtPoint") ||
+          SelectorName.startswith("drawInRect") ||
+          SelectorName.startswith("drawWithRect")))
+      return;
+
+    SVal svTitle = msg.getReceiverSVal();
+
+    bool isNonLocalized = hasNonLocalizedState(svTitle, C);
+
+    if (isNonLocalized) {
+      reportLocalizationError(svTitle, msg, C);
+    }
+  } else if (method != UIMethods.end()) {
+
+    auto argumentIterator = method->getValue().find(SelectorName);
+
+    if (argumentIterator == method->getValue().end())
+      return;
+
+    int argumentNumber = argumentIterator->getValue();
+
+    SVal svTitle = msg.getArgSVal(argumentNumber);
+
+    if (const ObjCStringRegion *SR =
+            dyn_cast_or_null<ObjCStringRegion>(svTitle.getAsRegion())) {
+      StringRef stringValue =
+          SR->getObjCStringLiteral()->getString()->getString();
+      if ((stringValue.trim().size() == 0 && stringValue.size() > 0) ||
+          stringValue.empty())
+        return;
+      if (!IsAggressive && llvm::sys::unicode::columnWidthUTF8(stringValue) < 2)
+        return;
+    }
+
+    bool isNonLocalized = hasNonLocalizedState(svTitle, C);
+
+    if (isNonLocalized) {
+      reportLocalizationError(svTitle, msg, C, argumentNumber + 1);
+    }
+  }
+}
+
+static inline bool isNSStringType(QualType T, ASTContext &Ctx) {
+
+  const ObjCObjectPointerType *PT = T->getAs<ObjCObjectPointerType>();
+  if (!PT)
+    return false;
+
+  ObjCInterfaceDecl *Cls = PT->getObjectType()->getInterface();
+  if (!Cls)
+    return false;
+
+  IdentifierInfo *ClsName = Cls->getIdentifier();
+
+  // FIXME: Should we walk the chain of classes?
+  return ClsName == &Ctx.Idents.get("NSString") ||
+         ClsName == &Ctx.Idents.get("NSMutableString");
+}
+
+/// Marks a string being returned by any call as localized
+/// if it is in LocStringFunctions (LSF) or the function is annotated.
+/// Otherwise, we mark it as NonLocalized (Aggressive) or
+/// NonLocalized only if it is not backed by a SymRegion (Non-Aggressive),
+/// basically leaving only string literals as NonLocalized.
+void NonLocalizedStringChecker::checkPostCall(const CallEvent &Call,
+                                              CheckerContext &C) const {
+  initLocStringsMethods(C.getASTContext());
+
+  if (!Call.getOriginExpr())
+    return;
+
+  // Anything that takes in a localized NSString as an argument
+  // and returns an NSString will be assumed to be returning a
+  // localized NSString. (Counter: Incorrectly combining two LocalizedStrings)
+  const QualType RT = Call.getResultType();
+  if (isNSStringType(RT, C.getASTContext())) {
+    for (unsigned i = 0; i < Call.getNumArgs(); ++i) {
+      SVal argValue = Call.getArgSVal(i);
+      if (hasLocalizedState(argValue, C)) {
+        SVal sv = Call.getReturnValue();
+        setLocalizedState(sv, C);
+        return;
+      }
+    }
+  }
+
+  const Decl *D = Call.getDecl();
+  if (!D)
+    return;
+
+  StringRef IdentifierName = C.getCalleeName(D->getAsFunction());
+
+  SVal sv = Call.getReturnValue();
+  if (isAnnotatedAsLocalized(D) || LSF.find(IdentifierName) != LSF.end()) {
+    setLocalizedState(sv, C);
+  } else if (isNSStringType(RT, C.getASTContext()) &&
+             !hasLocalizedState(sv, C)) {
+    if (IsAggressive) {
+      setNonLocalizedState(sv, C);
+    } else {
+      const SymbolicRegion *SymReg =
+          dyn_cast_or_null<SymbolicRegion>(sv.getAsRegion());
+      if (!SymReg)
+        setNonLocalizedState(sv, C);
+    }
+  }
+}
+
+/// Marks a string being returned by an ObjC method as localized
+/// if it is in LocStringMethods or the method is annotated
+void NonLocalizedStringChecker::checkPostObjCMessage(const ObjCMethodCall &msg,
+                                                     CheckerContext &C) const {
+  initLocStringsMethods(C.getASTContext());
+
+  if (!msg.isInstanceMessage())
+    return;
+
+  const ObjCInterfaceDecl *OD = msg.getReceiverInterface();
+  if (!OD)
+    return;
+  const IdentifierInfo *odInfo = OD->getIdentifier();
+
+  StringRef IdentifierName = odInfo->getName();
+
+  Selector S = msg.getSelector();
+  std::string SelectorName = S.getAsString();
+
+  std::pair<StringRef, StringRef> MethodDescription = {IdentifierName,
+                                                       SelectorName};
+
+  if (LSM.count(MethodDescription) || isAnnotatedAsLocalized(msg.getDecl())) {
+    SVal sv = msg.getReturnValue();
+    setLocalizedState(sv, C);
+  }
+}
+
+/// Marks all empty string literals as localized
+void NonLocalizedStringChecker::checkPostStmt(const ObjCStringLiteral *SL,
+                                              CheckerContext &C) const {
+  SVal sv = C.getSVal(SL);
+  setNonLocalizedState(sv, C);
+}
+
+namespace {
+class EmptyLocalizationContextChecker
+    : public Checker<check::ASTDecl<ObjCImplementationDecl>> {
+
+  // A helper class, which walks the AST
+  class MethodCrawler : public ConstStmtVisitor<MethodCrawler> {
+    const ObjCMethodDecl *MD;
+    BugReporter &BR;
+    AnalysisManager &Mgr;
+    const CheckerBase *Checker;
+    LocationOrAnalysisDeclContext DCtx;
+
+  public:
+    MethodCrawler(const ObjCMethodDecl *InMD, BugReporter &InBR,
+                  const CheckerBase *Checker, AnalysisManager &InMgr,
+                  AnalysisDeclContext *InDCtx)
+        : MD(InMD), BR(InBR), Mgr(InMgr), Checker(Checker), DCtx(InDCtx) {}
+
+    void VisitStmt(const Stmt *S) { VisitChildren(S); }
+
+    void VisitObjCMessageExpr(const ObjCMessageExpr *ME);
+
+    void reportEmptyContextError(const ObjCMessageExpr *M) const;
+
+    void VisitChildren(const Stmt *S) {
+      for (const Stmt *Child : S->children()) {
+        if (Child)
+          this->Visit(Child);
+      }
+    }
+  };
+
+public:
+  void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager &Mgr,
+                    BugReporter &BR) const;
+};
+} // end anonymous namespace
+
+void EmptyLocalizationContextChecker::checkASTDecl(
+    const ObjCImplementationDecl *D, AnalysisManager &Mgr,
+    BugReporter &BR) const {
+
+  for (const ObjCMethodDecl *M : D->methods()) {
+    AnalysisDeclContext *DCtx = Mgr.getAnalysisDeclContext(M);
+
+    const Stmt *Body = M->getBody();
+    assert(Body);
+
+    MethodCrawler MC(M->getCanonicalDecl(), BR, this, Mgr, DCtx);
+    MC.VisitStmt(Body);
+  }
+}
+
+/// This check attempts to match these macros, assuming they are defined as
+/// follows:
+///
+/// #define NSLocalizedString(key, comment) \
+/// [[NSBundle mainBundle] localizedStringForKey:(key) value:@"" table:nil]
+/// #define NSLocalizedStringFromTable(key, tbl, comment) \
+/// [[NSBundle mainBundle] localizedStringForKey:(key) value:@"" table:(tbl)]
+/// #define NSLocalizedStringFromTableInBundle(key, tbl, bundle, comment) \
+/// [bundle localizedStringForKey:(key) value:@"" table:(tbl)]
+/// #define NSLocalizedStringWithDefaultValue(key, tbl, bundle, val, comment)
+///
+/// We cannot use the path sensitive check because the macro argument we are
+/// checking for (comment) is not used and thus not present in the AST,
+/// so we use Lexer on the original macro call and retrieve the value of
+/// the comment. If it's empty or nil, we raise a warning.
+void EmptyLocalizationContextChecker::MethodCrawler::VisitObjCMessageExpr(
+    const ObjCMessageExpr *ME) {
+
+  const ObjCInterfaceDecl *OD = ME->getReceiverInterface();
+  if (!OD)
+    return;
+
+  const IdentifierInfo *odInfo = OD->getIdentifier();
+
+  if (!(odInfo->isStr("NSBundle") ||
+        StringRef(ME->getSelector().getAsString())
+            .equals("localizedStringForKey:value:table:"))) {
+    return;
+  }
+
+  SourceRange R = ME->getSourceRange();
+  if (!R.getBegin().isMacroID())
+    return;
+
+  // getImmediateMacroCallerLoc gets the location of the immediate macro
+  // caller, one level up the stack toward the initial macro typed into the
+  // source, so SL should point to the NSLocalizedString macro.
+  SourceLocation SL =
+      Mgr.getSourceManager().getImmediateMacroCallerLoc(R.getBegin());
+  std::pair<FileID, unsigned> SLInfo =
+      Mgr.getSourceManager().getDecomposedLoc(SL);
+
+  SrcMgr::SLocEntry SE = Mgr.getSourceManager().getSLocEntry(SLInfo.first);
+
+  // If NSLocalizedString macro is wrapped in another macro, we need to
+  // unwrap the expansion until we get to the NSLocalizedStringMacro.
+  while (SE.isExpansion()) {
+    SL = SE.getExpansion().getSpellingLoc();
+    SLInfo = Mgr.getSourceManager().getDecomposedLoc(SL);
+    SE = Mgr.getSourceManager().getSLocEntry(SLInfo.first);
+  }
+
+  llvm::MemoryBuffer *BF = SE.getFile().getContentCache()->getRawBuffer();
+  Lexer TheLexer(SL, LangOptions(), BF->getBufferStart(),
+                 BF->getBufferStart() + SLInfo.second, BF->getBufferEnd());
+
+  Token I;
+  Token Result;    // This will hold the token just before the last ')'
+  int p_count = 0; // This is for parenthesis matching
+  while (!TheLexer.LexFromRawLexer(I)) {
+    if (I.getKind() == tok::l_paren)
+      ++p_count;
+    if (I.getKind() == tok::r_paren) {
+      if (p_count == 1)
+        break;
+      --p_count;
+    }
+    Result = I;
+  }
+
+  if (isAnyIdentifier(Result.getKind())) {
+    if (Result.getRawIdentifier().equals("nil")) {
+      reportEmptyContextError(ME);
+      return;
+    }
+  }
+
+  if (!isStringLiteral(Result.getKind()))
+    return;
+
+  StringRef Comment =
+      StringRef(Result.getLiteralData(), Result.getLength()).trim("\"");
+
+  if ((Comment.trim().size() == 0 && Comment.size() > 0) || // Is Whitespace
+      Comment.empty()) {
+    reportEmptyContextError(ME);
+  }
+}
+
+void EmptyLocalizationContextChecker::MethodCrawler::reportEmptyContextError(
+    const ObjCMessageExpr *ME) const {
+  // Generate the bug report.
+  BR.EmitBasicReport(MD, Checker, "Context Missing", "Localizability Error",
+                     "Localized string macro should include a non-empty "
+                     "comment for translators",
+                     PathDiagnosticLocation(ME, BR.getSourceManager(), DCtx));
+}
+
+//===----------------------------------------------------------------------===//
+// Checker registration.
+//===----------------------------------------------------------------------===//
+
+void ento::registerNonLocalizedStringChecker(CheckerManager &mgr) {
+  NonLocalizedStringChecker *checker =
+      mgr.registerChecker<NonLocalizedStringChecker>();
+  checker->IsAggressive =
+      mgr.getAnalyzerOptions().getBooleanOption("AggressiveReport", false);
+}
+
+void ento::registerEmptyLocalizationContextChecker(CheckerManager &mgr) {
+  mgr.registerChecker<EmptyLocalizationContextChecker>();
+}
 No newline at end of file

test/Analysis/localization-aggressive.m

+// RUN: %clang_cc1 -analyze -fblocks -analyzer-store=region  -analyzer-checker=alpha.osx.cocoa.NonLocalizedStringChecker -analyzer-checker=alpha.osx.cocoa.EmptyLocalizationContextChecker -verify  -analyzer-config AggressiveReport=true %s
+
+// These declarations were reduced using Delta-Debugging from Foundation.h
+// on Mac OS X.
+
+#define nil ((id)0)
+#define NSLocalizedString(key, comment)                                        \
+  [[NSBundle mainBundle] localizedStringForKey:(key) value:@"" table:nil]
+#define NSLocalizedStringFromTable(key, tbl, comment)                          \
+  [[NSBundle mainBundle] localizedStringForKey:(key) value:@"" table:(tbl)]
+#define NSLocalizedStringFromTableInBundle(key, tbl, bundle, comment)          \
+  [bundle localizedStringForKey:(key) value:@"" table:(tbl)]
+#define NSLocalizedStringWithDefaultValue(key, tbl, bundle, val, comment)      \
+  [bundle localizedStringForKey:(key) value:(val) table:(tbl)]
+#define CGFLOAT_TYPE double
+typedef CGFLOAT_TYPE CGFloat;
+struct CGPoint {
+  CGFloat x;
+  CGFloat y;
+};
+typedef struct CGPoint CGPoint;
+@interface NSObject
++ (id)alloc;
+- (id)init;
+@end
+@class NSDictionary;
+@interface NSString : NSObject
+- (void)drawAtPoint:(CGPoint)point withAttributes:(NSDictionary *)attrs;
++ (instancetype)localizedStringWithFormat:(NSString *)format, ...;
+@end
+@interface NSBundle : NSObject
++ (NSBundle *)mainBundle;
+- (NSString *)localizedStringForKey:(NSString *)key
+                              value:(NSString *)value
+                              table:(NSString *)tableName;
+@end
+@interface UILabel : NSObject
+@property(nullable, nonatomic, copy) NSString *text;
+- (void)accessibilitySetIdentification:(NSString *)ident;
+@end
+@interface TestObject : NSObject
+@property(strong) NSString *text;
+@end
+
+@interface LocalizationTestSuite : NSObject
+NSString *ForceLocalized(NSString *str)
+    __attribute__((annotate("returns_localized_nsstring")));
+CGPoint CGPointMake(CGFloat x, CGFloat y);
+int random();
+// This next one is a made up API
+NSString *CFNumberFormatterCreateStringWithNumber(float x);
++ (NSString *)forceLocalized:(NSString *)str
+    __attribute__((annotate("returns_localized_nsstring")));
+@end
+
+// Test cases begin here
+@implementation LocalizationTestSuite
+
+// A C-Funtion that returns a localized string because it has the
+// "returns_localized_nsstring" annotation
+NSString *ForceLocalized(NSString *str) { return str; }
+// An ObjC method that returns a localized string because it has the
+// "returns_localized_nsstring" annotation
++ (NSString *)forceLocalized:(NSString *)str {
+  return str;
+}
+
+// An ObjC method that returns a localized string
++ (NSString *)unLocalizedStringMethod {
+  return @"UnlocalizedString";
+}
+
+- (void)testLocalizationErrorDetectedOnPathway {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *bar = NSLocalizedString(@"Hello", @"Comment");
+
+  if (random()) {
+    bar = @"Unlocalized string";
+  }
+
+  [testLabel setText:bar]; // expected-warning {{String should be localized}}
+}
+
+- (void)testLocalizationErrorDetectedOnNSString {
+  NSString *bar = NSLocalizedString(@"Hello", @"Comment");
+
+  if (random()) {
+    bar = @"Unlocalized string";
+  }
+
+  [bar drawAtPoint:CGPointMake(0, 0) withAttributes:nil]; // expected-warning {{String should be localized}}
+}
+
+- (void)testNoLocalizationErrorDetectedFromCFunction {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *bar = CFNumberFormatterCreateStringWithNumber(1);
+
+  [testLabel setText:bar]; // no-warning
+}
+
+- (void)testAnnotationAddsLocalizedStateForCFunction {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *bar = NSLocalizedString(@"Hello", @"Comment");
+
+  if (random()) {
+    bar = @"Unlocalized string";
+  }
+
+  [testLabel setText:ForceLocalized(bar)]; // no-warning
+}
+
+- (void)testAnnotationAddsLocalizedStateForObjCMethod {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *bar = NSLocalizedString(@"Hello", @"Comment");
+
+  if (random()) {
+    bar = @"Unlocalized string";
+  }
+
+  [testLabel setText:[LocalizationTestSuite forceLocalized:bar]]; // no-warning
+}
+
+// An empty string literal @"" should not raise an error
+- (void)testEmptyStringLiteralHasLocalizedState {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *bar = @"";
+
+  [testLabel setText:bar]; // no-warning
+}
+
+// An empty string literal @"" inline should not raise an error
+- (void)testInlineEmptyStringLiteralHasLocalizedState {
+  UILabel *testLabel = [[UILabel alloc] init];
+  [testLabel setText:@""]; // no-warning
+}
+
+// An string literal @"Hello" inline should raise an error
+- (void)testInlineStringLiteralHasLocalizedState {
+  UILabel *testLabel = [[UILabel alloc] init];
+  [testLabel setText:@"Hello"]; // expected-warning {{String should be localized}}
+}
+
+// A nil string should not raise an error
+- (void)testNilStringIsNotMarkedAsUnlocalized {
+  UILabel *testLabel = [[UILabel alloc] init];
+  [testLabel setText:nil]; // no-warning
+}
+
+// A method that takes in a localized string and returns a string
+// most likely that string is localized.
+- (void)testLocalizedStringArgument {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *localizedString = NSLocalizedString(@"Hello", @"Comment");
+
+  NSString *combinedString =
+      [NSString localizedStringWithFormat:@"%@", localizedString];
+
+  [testLabel setText:combinedString]; // no-warning
+}
+
+// A String passed in as a an parameter should not be considered
+// unlocalized
+- (void)testLocalizedStringAsArgument:(NSString *)argumentString {
+  UILabel *testLabel = [[UILabel alloc] init];
+
+  [testLabel setText:argumentString]; // no-warning
+}
+
+// The warning is expected to be seen in localizedStringAsArgument: body
+- (void)testLocalizedStringAsArgumentOtherMethod:(NSString *)argumentString {
+  [self localizedStringAsArgument:@"UnlocalizedString"];
+}
+
+// A String passed into another method that calls a method that
+// requires a localized string should give an error
+- (void)localizedStringAsArgument:(NSString *)argumentString {
+  UILabel *testLabel = [[UILabel alloc] init];
+
+  [testLabel setText:argumentString]; // expected-warning {{String should be localized}}
+}
+
+// [LocalizationTestSuite unLocalizedStringMethod] returns an unlocalized string
+// so we expect an error. Unfrtunately, it probably doesn't make a difference
+// what [LocalizationTestSuite unLocalizedStringMethod] returns since all
+// string values returned are marked as Unlocalized in aggressive reporting.
+- (void)testUnLocalizedStringMethod {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *bar = NSLocalizedString(@"Hello", @"Comment");
+
+  [testLabel setText:[LocalizationTestSuite unLocalizedStringMethod]]; // expected-warning {{String should be localized}}
+}
+
+// This is the reverse situation: accessibilitySetIdentification: doesn't care
+// about localization so we don't expect a warning
+- (void)testMethodNotInRequiresLocalizedStringMethods {
+  UILabel *testLabel = [[UILabel alloc] init];
+
+  [testLabel accessibilitySetIdentification:@"UnlocalizedString"]; // no-warning
+}
+
+// EmptyLocalizationContextChecker tests
+#define HOM(s) YOLOC(s)
+#define YOLOC(x) NSLocalizedString(x, nil)
+
+- (void)testNilLocalizationContext {
+  NSString *string = NSLocalizedString(@"LocalizedString", nil); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+  NSString *string2 = NSLocalizedString(@"LocalizedString", nil); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+  NSString *string3 = NSLocalizedString(@"LocalizedString", nil); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+}
+
+- (void)testEmptyLocalizationContext {
+  NSString *string = NSLocalizedString(@"LocalizedString", @""); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+  NSString *string2 = NSLocalizedString(@"LocalizedString", @" "); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+  NSString *string3 = NSLocalizedString(@"LocalizedString", @"   "); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+}
+
+- (void)testNSLocalizedStringVariants {
+  NSString *string = NSLocalizedStringFromTable(@"LocalizedString", nil, @""); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+  NSString *string2 = NSLocalizedStringFromTableInBundle(@"LocalizedString", nil, [[NSBundle alloc] init],@""); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+  NSString *string3 = NSLocalizedStringWithDefaultValue(@"LocalizedString", nil, [[NSBundle alloc] init], nil,@""); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+}
+
+- (void)testMacroExpansionNilString {
+  NSString *string = YOLOC(@"Hello"); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+  NSString *string2 = HOM(@"Hello");  // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+  NSString *string3 = NSLocalizedString((0 ? @"Critical" : @"Current"),nil); // expected-warning {{Localized string macro should include a non-empty comment for translators}}
+}
+
+#define KCLocalizedString(x,comment) NSLocalizedString(x, comment)
+#define POSSIBLE_FALSE_POSITIVE(s,other) KCLocalizedString(s,@"Comment")
+
+- (void)testNoWarningForNilCommentPassedIntoOtherMacro {
+  NSString *string = KCLocalizedString(@"Hello",@""); // no-warning
+  NSString *string2 = KCLocalizedString(@"Hello",nil); // no-warning
+  NSString *string3 = KCLocalizedString(@"Hello",@"Comment"); // no-warning
+}
+
+- (void)testPossibleFalsePositiveSituationAbove {
+  NSString *string = POSSIBLE_FALSE_POSITIVE(@"Hello", nil); // no-warning
+  NSString *string2 = POSSIBLE_FALSE_POSITIVE(@"Hello", @"Hello"); // no-warning
+}
+
+@end

test/Analysis/localization.m

+// RUN: %clang_cc1 -analyze -fblocks -analyzer-store=region -analyzer-checker=alpha.osx.cocoa.NonLocalizedStringChecker -analyzer-checker=alpha.osx.cocoa.EmptyLocalizationContextChecker -verify  %s
+
+// The larger set of tests in located in localization.m. These are tests
+// specific for non-aggressive reporting.
+
+// These declarations were reduced using Delta-Debugging from Foundation.h
+// on Mac OS X.
+
+#define nil ((id)0)
+#define NSLocalizedString(key, comment)                                        \
+  [[NSBundle mainBundle] localizedStringForKey:(key) value:@"" table:nil]
+#define NSLocalizedStringFromTable(key, tbl, comment)                          \
+  [[NSBundle mainBundle] localizedStringForKey:(key) value:@"" table:(tbl)]
+#define NSLocalizedStringFromTableInBundle(key, tbl, bundle, comment)          \
+  [bundle localizedStringForKey:(key) value:@"" table:(tbl)]
+#define NSLocalizedStringWithDefaultValue(key, tbl, bundle, val, comment)      \
+  [bundle localizedStringForKey:(key) value:(val) table:(tbl)]
+@interface NSObject
++ (id)alloc;
+- (id)init;
+@end
+@interface NSString : NSObject
+@end
+@interface NSBundle : NSObject
++ (NSBundle *)mainBundle;
+- (NSString *)localizedStringForKey:(NSString *)key
+                              value:(NSString *)value
+                              table:(NSString *)tableName;
+@end
+@interface UILabel : NSObject
+@property(nullable, nonatomic, copy) NSString *text;
+@end
+@interface TestObject : NSObject
+@property(strong) NSString *text;
+@end
+
+@interface LocalizationTestSuite : NSObject
+int random();
+@end
+
+// Test cases begin here
+@implementation LocalizationTestSuite
+
+// An object passed in as an parameter's string member
+// should not be considered unlocalized
+- (void)testObjectAsArgument:(TestObject *)argumentObject {
+  UILabel *testLabel = [[UILabel alloc] init];
+
+  [testLabel setText:[argumentObject text]]; // no-warning
+  [testLabel setText:argumentObject.text];   // no-warning
+}
+
+- (void)testLocalizationErrorDetectedOnPathway {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *bar = NSLocalizedString(@"Hello", @"Comment");
+
+  if (random()) {
+    bar = @"Unlocalized string";
+  }
+
+  [testLabel setText:bar]; // expected-warning {{String should be localized}}
+}
+
+- (void)testOneCharacterStringsDoNotGiveAWarning {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *bar = NSLocalizedString(@"Hello", @"Comment");
+
+  if (random()) {
+    bar = @"-";
+  }
+
+  [testLabel setText:bar]; // no-warning
+}
+
+- (void)testOneCharacterUTFStringsDoNotGiveAWarning {
+  UILabel *testLabel = [[UILabel alloc] init];
+  NSString *bar = NSLocalizedString(@"Hello", @"Comment");
+
+  if (random()) {
+    bar = @"\u2014";
+  }
+
+  [testLabel setText:bar]; // no-warning
+}
+
+@end