Number tests and update test queries and expected values

2025-12-15 19:53:03 +01:00 · 2023-12-01 13:42:37 -08:00
parent d4c477a0ed
commit 9565629463
24 changed files with 22 additions and 111 deletions
--- a/js-sqli.code-workspace
+++ b/js-sqli.code-workspace
@@ -5,6 +5,7 @@
 		}
 	],
 	"settings": {
-		"git.ignoreLimitWarning": true
+		"git.ignoreLimitWarning": true,
+		"sarif-viewer.connectToGithubCodeScanning": "off"
 	}
 }
--- a/solutions/01-UltimateSource.ql
+++ b/solutions/01-UltimateSource.ql
--- a/solutions/02-UltimateSink.ql
+++ b/solutions/02-UltimateSink.ql
@@ -11,10 +11,10 @@ predicate uSource(MethodCallExpr sbts) {
 // Ultimate sink
 // ----------------
 //     db.exec(query);
-predicate uSink(MethodCallExpr dbe) {
-    //  sbts.getReceiver().(DotExpr).getPropertyNameExpr().(Identifier).getName() = "toString"
-    dbe.getMethodName().matches("%exec%") 
-}
+// predicate uSink(MethodCallExpr dbe) {
+//     //  sbts.getReceiver().(DotExpr).getPropertyNameExpr().(Identifier).getName() = "toString"
+//     dbe.getMethodName().matches("%exec%") 
+// }


 // Intermediate flow sink
--- a/solutions/03-IdentifyFlowSink.ql
+++ b/solutions/03-IdentifyFlowSink.ql
@@ -8,12 +8,12 @@ import DataFlow::PathGraph
 // Ultimate source
 // ----------------
 //     var line = stdinBuffer.toString();
-predicate uSource(MethodCallExpr sbts) { sbts.getMethodName().matches("%toString%") }
+// predicate uSource(MethodCallExpr sbts) { sbts.getMethodName().matches("%toString%") }

 // Ultimate sink
 // ----------------
 //     db.exec(query);
-predicate uSink(MethodCallExpr dbe) { dbe.getMethodName().matches("%exec%") }
+// predicate uSink(MethodCallExpr dbe) { dbe.getMethodName().matches("%exec%") }

 // Flow sink origin
 // ------------------------
@@ -29,7 +29,7 @@ class FlowSinkOrigin extends DataFlow::FlowLabel {
 class IdentifyFlowSink extends DataFlow::Configuration {
  IdentifyFlowSink() { this = "IdentifyFlowSink" }

-  override predicate isSource(DataFlow::Node nd, DataFlow::FlowLabel lbl) {
+  override predicate isSource(DataFlow::Node nd) {
    //     const db = new sqlite3.Database(
    exists(NewExpr newdb |
      newdb.getCalleeName() = "Database" and
@@ -37,7 +37,7 @@ class IdentifyFlowSink extends DataFlow::Configuration {
    )
  }

-  override predicate isSink(DataFlow::Node nd, DataFlow::FlowLabel lbl) {
+  override predicate isSink(DataFlow::Node nd) {
    //     db.exec(query);
    exists(Expr db, MethodCallExpr exec |
      exec.getMethodName() = "exec" and
--- a/solutions/04-AnySqlInjection.ql
+++ b/solutions/04-AnySqlInjection.ql
--- a/solutions/05-RestrictedSqlInjection.ql
+++ b/solutions/05-RestrictedSqlInjection.ql
--- a/solutions/06-RestrictedSqlInjectionViaTT.ql
+++ b/solutions/06-RestrictedSqlInjectionViaTT.ql
--- a/solutions/07-DefUseSample.ql
+++ b/solutions/07-DefUseSample.ql
@@ -50,9 +50,9 @@ DotExpr updateExpression() { result.getPropertyName() = "update" }
 VarRef recordUpdate() { result = updateExpression().getBase() }

 // var ua = new GR('status');     //: source 2
-class GR extends NewExpr {
-  GR() { this.getCalleeName() = "GR" }
-}
+// class GR extends NewExpr {
+//   GR() { this.getCalleeName() = "GR" }
+// }

 class FromRequestToGrUpdate extends TaintTracking::Configuration {
  FromRequestToGrUpdate() { this = "FromRequestToGrUpdate" }
--- a/solutions/08-PreGuardRecursivePredicate.ql
+++ b/solutions/08-PreGuardRecursivePredicate.ql
@@ -53,24 +53,6 @@ predicate setValueTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
  )
 }

-predicate foo(VarAccess gr, VarAccess postgr) {
-  exists(DotExpr temp, MethodCallExpr mce |
-    temp.getPropertyName() = "setValue" and
-    mce.getReceiver() = temp.getBase() and
-    gr = mce.getReceiver() and
-    gr.getASuccessor+() = postgr
-  )
-}
-
-predicate foo1(Expr gr, Expr postgr) {
-  exists(DotExpr temp, MethodCallExpr mce |
-    temp.getPropertyName() = "setValue" and
-    mce.getReceiver() = temp.getBase() and
-    gr = mce.getReceiver() and
-    recursiveSuccessor(gr, postgr)
-  )
-}
-
 // Def-Use special handling:
 // Include sanitizer check when flagging successive object member calls in taint step
 predicate recursiveSuccessor(ControlFlowNode gr, ControlFlowNode postgr) {
--- a/solutions/09-GuardedSafeToWrite.ql
+++ b/solutions/09-GuardedSafeToWrite.ql
@@ -72,33 +72,6 @@ predicate sanitizerCheckedSuccessor(ControlFlowNode gr, ControlFlowNode postgr)
  // recursion we need to be able to traverse expressions.
 }

-predicate foo(VarAccess gr, VarAccess postgr) {
-  exists(DotExpr temp, MethodCallExpr mce |
-    temp.getPropertyName() = "setValue" and
-    mce.getReceiver() = temp.getBase() and
-    gr = mce.getReceiver() and
-    gr.getASuccessor+() = postgr
-  )
-}
-
-predicate foo1(Expr gr, Expr postgr) {
-  exists(DotExpr temp, MethodCallExpr mce |
-    temp.getPropertyName() = "setValue" and
-    mce.getReceiver() = temp.getBase() and
-    gr = mce.getReceiver() and
-    recursiveSuccessor(gr, postgr)
-  )
-}
-
-predicate foo2(Expr gr, Expr postgr) {
-  exists(DotExpr temp, MethodCallExpr mce |
-    temp.getPropertyName() = "setValue" and
-    mce.getReceiver() = temp.getBase() and
-    gr = mce.getReceiver() and
-    sanitizerCheckedSuccessor(gr, postgr)
-  )
-}
-
 predicate inSafeToWrite(ControlFlowNode p) {
  exists(
    //  DotExpr temp, MethodCallExpr mce,
--- a/tests/AnySqlInjection/AnySqlInjection.qlref
+++ b/tests/AnySqlInjection/AnySqlInjection.qlref
@@ -1 +1 @@
-AnySqlInjection.ql
+04-AnySqlInjection.ql
--- a/tests/DefUseSample/DefUseSample.expected
+++ b/tests/DefUseSample/DefUseSample.expected
@@ -1,4 +1,3 @@
-WARNING: Unused class GR (/Users/hohn/local/codeql-javascript-multiflow/solutions/DefUseSample.ql:53,7-9)
 nodes
 | sample-utility-0.js:5:6:5:39 | value |
 | sample-utility-0.js:5:14:5:39 | this.ge ... value') |
--- a/tests/DefUseSample/DefUseSample.qlref
+++ b/tests/DefUseSample/DefUseSample.qlref
@@ -1 +1 @@
-DefUseSample.ql
+07-DefUseSample.ql
--- a/tests/GuardedSafeToWrite/GuardedSafeToWrite.expected
+++ b/tests/GuardedSafeToWrite/GuardedSafeToWrite.expected
@@ -1,6 +1,3 @@
-WARNING: Unused predicate foo (/Users/hohn/local/codeql-javascript-multiflow/solutions/GuardedSafeToWrite.ql:75,11-14)
-WARNING: Unused predicate foo1 (/Users/hohn/local/codeql-javascript-multiflow/solutions/GuardedSafeToWrite.ql:84,11-15)
-WARNING: Unused predicate foo2 (/Users/hohn/local/codeql-javascript-multiflow/solutions/GuardedSafeToWrite.ql:93,11-15)
 nodes
 | sample-utility-0.js:5:13:5:46 | value |
 | sample-utility-0.js:5:21:5:46 | this.ge ... value') |
--- a/tests/GuardedSafeToWrite/GuardedSafeToWrite.qlref
+++ b/tests/GuardedSafeToWrite/GuardedSafeToWrite.qlref
@@ -1 +1 @@
-GuardedSafeToWrite.ql
+09-GuardedSafeToWrite.ql
--- a/tests/IdentifyFlowSink/IdentifyFlowSink.expected
+++ b/tests/IdentifyFlowSink/IdentifyFlowSink.expected
@@ -1,61 +1,23 @@
-WARNING: Unused predicate uSink (/Users/hohn/local/codeql-javascript-multiflow/solutions/IdentifyFlowSink.ql:16,11-16)
-WARNING: Unused predicate uSource (/Users/hohn/local/codeql-javascript-multiflow/solutions/IdentifyFlowSink.ql:11,11-18)
-WARNING: Unused variable lbl (/Users/hohn/local/codeql-javascript-multiflow/solutions/IdentifyFlowSink.ql:32,70-73)
-WARNING: Unused variable lbl (/Users/hohn/local/codeql-javascript-multiflow/solutions/IdentifyFlowSink.ql:40,68-71)
 nodes
 | add-user.js:16:11:26:10 | db |
-| add-user.js:16:11:26:10 | db |
-| add-user.js:16:11:26:10 | db |
-| add-user.js:16:16:26:10 | new sql ...      }) |
-| add-user.js:16:16:26:10 | new sql ...      }) |
 | add-user.js:16:16:26:10 | new sql ...      }) |
 | add-user.js:16:16:26:10 | new sql ...      }) |
 | add-user.js:28:12:28:13 | db |
-| add-user.js:28:12:28:13 | db |
-| add-user.js:28:12:28:13 | db |
-| add-user.js:31:21:31:22 | db |
-| add-user.js:31:21:31:22 | db |
 | add-user.js:31:21:31:22 | db |
 | add-user.js:35:5:35:6 | db |
 | add-user.js:35:5:35:6 | db |
-| add-user.js:35:5:35:6 | db |
-| add-user.js:35:5:35:6 | db |
-| add-user.js:43:9:43:25 | db |
-| add-user.js:43:9:43:25 | db |
 | add-user.js:43:9:43:25 | db |
 | add-user.js:43:14:43:25 | connect_db() |
-| add-user.js:43:14:43:25 | connect_db() |
-| add-user.js:43:14:43:25 | connect_db() |
-| add-user.js:44:16:44:17 | db |
-| add-user.js:44:16:44:17 | db |
 | add-user.js:44:16:44:17 | db |
 edges
 | add-user.js:16:11:26:10 | db | add-user.js:28:12:28:13 | db |
-| add-user.js:16:11:26:10 | db | add-user.js:28:12:28:13 | db |
-| add-user.js:16:11:26:10 | db | add-user.js:28:12:28:13 | db |
-| add-user.js:16:16:26:10 | new sql ...      }) | add-user.js:16:11:26:10 | db |
-| add-user.js:16:16:26:10 | new sql ...      }) | add-user.js:16:11:26:10 | db |
-| add-user.js:16:16:26:10 | new sql ...      }) | add-user.js:16:11:26:10 | db |
-| add-user.js:16:16:26:10 | new sql ...      }) | add-user.js:16:11:26:10 | db |
 | add-user.js:16:16:26:10 | new sql ...      }) | add-user.js:16:11:26:10 | db |
 | add-user.js:16:16:26:10 | new sql ...      }) | add-user.js:16:11:26:10 | db |
 | add-user.js:28:12:28:13 | db | add-user.js:43:14:43:25 | connect_db() |
-| add-user.js:28:12:28:13 | db | add-user.js:43:14:43:25 | connect_db() |
-| add-user.js:28:12:28:13 | db | add-user.js:43:14:43:25 | connect_db() |
-| add-user.js:31:21:31:22 | db | add-user.js:35:5:35:6 | db |
-| add-user.js:31:21:31:22 | db | add-user.js:35:5:35:6 | db |
-| add-user.js:31:21:31:22 | db | add-user.js:35:5:35:6 | db |
-| add-user.js:31:21:31:22 | db | add-user.js:35:5:35:6 | db |
 | add-user.js:31:21:31:22 | db | add-user.js:35:5:35:6 | db |
 | add-user.js:31:21:31:22 | db | add-user.js:35:5:35:6 | db |
 | add-user.js:43:9:43:25 | db | add-user.js:44:16:44:17 | db |
-| add-user.js:43:9:43:25 | db | add-user.js:44:16:44:17 | db |
-| add-user.js:43:9:43:25 | db | add-user.js:44:16:44:17 | db |
 | add-user.js:43:14:43:25 | connect_db() | add-user.js:43:9:43:25 | db |
-| add-user.js:43:14:43:25 | connect_db() | add-user.js:43:9:43:25 | db |
-| add-user.js:43:14:43:25 | connect_db() | add-user.js:43:9:43:25 | db |
-| add-user.js:44:16:44:17 | db | add-user.js:31:21:31:22 | db |
-| add-user.js:44:16:44:17 | db | add-user.js:31:21:31:22 | db |
 | add-user.js:44:16:44:17 | db | add-user.js:31:21:31:22 | db |
 #select
 | add-user.js:35:5:35:6 | db | add-user.js:16:16:26:10 | new sql ...      }) | add-user.js:35:5:35:6 | db | Database originating $@ | add-user.js:16:16:26:10 | new sql ...      }) | here |
--- a/tests/IdentifyFlowSink/IdentifyFlowSink.qlref
+++ b/tests/IdentifyFlowSink/IdentifyFlowSink.qlref
@@ -1 +1 @@
-IdentifyFlowSink.ql
+03-IdentifyFlowSink.ql
--- a/tests/PreGuardRecursivePredicate/PreGuardRecursivePredicate.expected
+++ b/tests/PreGuardRecursivePredicate/PreGuardRecursivePredicate.expected
@@ -1,5 +1,3 @@
-WARNING: Unused predicate foo (/Users/hohn/local/codeql-javascript-multiflow/solutions/PreGuardRecursivePredicate.ql:56,11-14)
-WARNING: Unused predicate foo1 (/Users/hohn/local/codeql-javascript-multiflow/solutions/PreGuardRecursivePredicate.ql:65,11-15)
 nodes
 | sample-utility-0.js:5:13:5:46 | value |
 | sample-utility-0.js:5:21:5:46 | this.ge ... value') |
--- a/tests/PreGuardRecursivePredicate/PreGuardRecursivePredicate.qlref
+++ b/tests/PreGuardRecursivePredicate/PreGuardRecursivePredicate.qlref
@@ -1 +1 @@
-PreGuardRecursivePredicate.ql
+08-PreGuardRecursivePredicate.ql
--- a/tests/RestrictedSqlInjection/RestrictedSqlInjection.qlref
+++ b/tests/RestrictedSqlInjection/RestrictedSqlInjection.qlref
@@ -1 +1 @@
-RestrictedSqlInjection.ql
+05-RestrictedSqlInjection.ql
--- a/tests/RestrictedSqlInjectionViaTT/RestrictedSqlInjectionViaTT.qlref
+++ b/tests/RestrictedSqlInjectionViaTT/RestrictedSqlInjectionViaTT.qlref
@@ -1 +1 @@
-RestrictedSqlInjectionViaTT.ql
+06-RestrictedSqlInjectionViaTT.ql
--- a/tests/UltimateSink/UltimateSink.expected
+++ b/tests/UltimateSink/UltimateSink.expected
@@ -1,2 +1 @@
-WARNING: Unused predicate uSink (/Users/hohn/local/codeql-javascript-multiflow/solutions/UltimateSink.ql:14,11-16)
 | add-user.js:4:16:4:37 | stdinBu ... tring() |
--- a/tests/UltimateSink/UltimateSink.qlref
+++ b/tests/UltimateSink/UltimateSink.qlref
@@ -1 +1 @@
-UltimateSink.ql
+02-UltimateSink.ql
--- a/tests/UltimateSource/UltimateSource.qlref
+++ b/tests/UltimateSource/UltimateSource.qlref
@@ -1 +1 @@
-UltimateSource.ql
+01-UltimateSource.ql