From 0ea06aca0622c988b8ec1bfcd3f17cba35bd2bc1 Mon Sep 17 00:00:00 2001 From: Simon Friis Vindum Date: Tue, 16 Dec 2025 12:32:40 +0100 Subject: [PATCH] Rust: Introduce more functions in Axum test --- .../web_frameworks/InlineFlow.expected | 156 +++++++++--------- .../web_frameworks/TaintSources.expected | 128 +++++++------- .../dataflow/sources/web_frameworks/test.rs | 80 ++++----- 3 files changed, 172 insertions(+), 192 deletions(-) diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected index 8777ff626eb..dce59fc29b7 100644 --- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected +++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/InlineFlow.expected @@ -20,36 +20,36 @@ edges | test.rs:58:14:58:15 | ms | test.rs:60:14:60:17 | ms.a | provenance | | | test.rs:58:14:58:15 | ms | test.rs:61:14:61:17 | ms.b | provenance | | | test.rs:68:15:68:15 | a | test.rs:70:14:70:14 | a | provenance | | -| test.rs:98:9:98:31 | ...: ...::Path::<...> | test.rs:100:17:100:20 | path | provenance | | -| test.rs:100:13:100:13 | a | test.rs:101:14:101:14 | a | provenance | | -| test.rs:100:13:100:13 | a | test.rs:102:14:102:14 | a | provenance | | -| test.rs:100:13:100:13 | a | test.rs:103:14:103:14 | a | provenance | | -| test.rs:100:17:100:20 | path | test.rs:100:17:100:33 | path.into_inner() | provenance | MaD:6 | -| test.rs:100:17:100:33 | path.into_inner() | test.rs:100:13:100:13 | a | provenance | | -| test.rs:101:14:101:14 | a | test.rs:101:14:101:23 | a.as_str() | provenance | MaD:8 | -| test.rs:102:14:102:14 | a | test.rs:102:14:102:25 | a.as_bytes() | provenance | MaD:7 | -| test.rs:109:9:109:41 | ...: ...::Path::<...> | test.rs:111:22:111:25 | path | provenance | | -| test.rs:111:13:111:18 | TuplePat | test.rs:113:14:113:14 | a | provenance | | -| test.rs:111:13:111:18 | TuplePat | test.rs:114:14:114:14 | b | provenance | | -| test.rs:111:22:111:25 | path | test.rs:111:22:111:38 | path.into_inner() | provenance | MaD:6 | -| test.rs:111:22:111:38 | path.into_inner() | test.rs:111:13:111:18 | TuplePat | provenance | | -| test.rs:120:9:120:41 | ...: ...::Query::<...> | test.rs:122:14:122:14 | a | provenance | | -| test.rs:127:5:127:20 | to | test.rs:129:9:129:31 | ...: ...::Path::<...> | provenance | Src:MaD:4 | -| test.rs:129:9:129:31 | ...: ...::Path::<...> | test.rs:131:17:131:20 | path | provenance | | -| test.rs:131:13:131:13 | a | test.rs:132:14:132:14 | a | provenance | | -| test.rs:131:17:131:20 | path | test.rs:131:17:131:33 | path.into_inner() | provenance | MaD:6 | -| test.rs:131:17:131:33 | path.into_inner() | test.rs:131:13:131:13 | a | provenance | | -| test.rs:139:41:139:42 | to | test.rs:98:9:98:31 | ...: ...::Path::<...> | provenance | Src:MaD:5 | -| test.rs:140:45:140:46 | to | test.rs:109:9:109:41 | ...: ...::Path::<...> | provenance | Src:MaD:5 | -| test.rs:141:41:141:42 | to | test.rs:120:9:120:41 | ...: ...::Query::<...> | provenance | Src:MaD:5 | -| test.rs:242:33:242:35 | map | test.rs:242:38:242:46 | ...: String | provenance | Src:MaD:2 | -| test.rs:242:38:242:46 | ...: String | test.rs:244:18:244:18 | a | provenance | | -| test.rs:250:46:250:49 | then | test.rs:251:25:251:33 | ...: String | provenance | Src:MaD:3 | -| test.rs:251:25:251:33 | ...: String | test.rs:252:22:252:22 | a | provenance | | -| test.rs:259:50:259:57 | and_then | test.rs:260:26:260:32 | ...: u64 | provenance | Src:MaD:1 | -| test.rs:260:26:260:32 | ...: u64 | test.rs:263:22:263:23 | id | provenance | | -| test.rs:272:75:272:77 | map | test.rs:273:15:273:23 | ...: String | provenance | Src:MaD:2 | -| test.rs:273:15:273:23 | ...: String | test.rs:275:22:275:22 | a | provenance | | +| test.rs:97:33:97:55 | ...: ...::Path::<...> | test.rs:98:17:98:20 | path | provenance | | +| test.rs:98:13:98:13 | a | test.rs:99:14:99:14 | a | provenance | | +| test.rs:98:13:98:13 | a | test.rs:100:14:100:14 | a | provenance | | +| test.rs:98:13:98:13 | a | test.rs:101:14:101:14 | a | provenance | | +| test.rs:98:17:98:20 | path | test.rs:98:17:98:33 | path.into_inner() | provenance | MaD:6 | +| test.rs:98:17:98:33 | path.into_inner() | test.rs:98:13:98:13 | a | provenance | | +| test.rs:99:14:99:14 | a | test.rs:99:14:99:23 | a.as_str() | provenance | MaD:8 | +| test.rs:100:14:100:14 | a | test.rs:100:14:100:25 | a.as_bytes() | provenance | MaD:7 | +| test.rs:106:33:106:65 | ...: ...::Path::<...> | test.rs:107:22:107:25 | path | provenance | | +| test.rs:107:13:107:18 | TuplePat | test.rs:109:14:109:14 | a | provenance | | +| test.rs:107:13:107:18 | TuplePat | test.rs:110:14:110:14 | b | provenance | | +| test.rs:107:22:107:25 | path | test.rs:107:22:107:38 | path.into_inner() | provenance | MaD:6 | +| test.rs:107:22:107:38 | path.into_inner() | test.rs:107:13:107:18 | TuplePat | provenance | | +| test.rs:115:33:115:65 | ...: ...::Query::<...> | test.rs:116:14:116:14 | a | provenance | | +| test.rs:121:5:121:20 | to | test.rs:122:33:122:55 | ...: ...::Path::<...> | provenance | Src:MaD:4 | +| test.rs:122:33:122:55 | ...: ...::Path::<...> | test.rs:123:17:123:20 | path | provenance | | +| test.rs:123:13:123:13 | a | test.rs:124:14:124:14 | a | provenance | | +| test.rs:123:17:123:20 | path | test.rs:123:17:123:33 | path.into_inner() | provenance | MaD:6 | +| test.rs:123:17:123:33 | path.into_inner() | test.rs:123:13:123:13 | a | provenance | | +| test.rs:131:41:131:42 | to | test.rs:97:33:97:55 | ...: ...::Path::<...> | provenance | Src:MaD:5 | +| test.rs:132:45:132:46 | to | test.rs:106:33:106:65 | ...: ...::Path::<...> | provenance | Src:MaD:5 | +| test.rs:133:41:133:42 | to | test.rs:115:33:115:65 | ...: ...::Query::<...> | provenance | Src:MaD:5 | +| test.rs:222:33:222:35 | map | test.rs:222:38:222:46 | ...: String | provenance | Src:MaD:2 | +| test.rs:222:38:222:46 | ...: String | test.rs:224:18:224:18 | a | provenance | | +| test.rs:230:46:230:49 | then | test.rs:231:25:231:33 | ...: String | provenance | Src:MaD:3 | +| test.rs:231:25:231:33 | ...: String | test.rs:232:22:232:22 | a | provenance | | +| test.rs:239:50:239:57 | and_then | test.rs:240:26:240:32 | ...: u64 | provenance | Src:MaD:1 | +| test.rs:240:26:240:32 | ...: u64 | test.rs:243:22:243:23 | id | provenance | | +| test.rs:252:75:252:77 | map | test.rs:253:15:253:23 | ...: String | provenance | Src:MaD:2 | +| test.rs:253:15:253:23 | ...: String | test.rs:255:22:255:22 | a | provenance | | nodes | test.rs:11:31:11:31 | a | semmle.label | a | | test.rs:13:14:13:14 | a | semmle.label | a | @@ -68,44 +68,44 @@ nodes | test.rs:61:14:61:17 | ms.b | semmle.label | ms.b | | test.rs:68:15:68:15 | a | semmle.label | a | | test.rs:70:14:70:14 | a | semmle.label | a | -| test.rs:98:9:98:31 | ...: ...::Path::<...> | semmle.label | ...: ...::Path::<...> | -| test.rs:100:13:100:13 | a | semmle.label | a | -| test.rs:100:17:100:20 | path | semmle.label | path | -| test.rs:100:17:100:33 | path.into_inner() | semmle.label | path.into_inner() | +| test.rs:97:33:97:55 | ...: ...::Path::<...> | semmle.label | ...: ...::Path::<...> | +| test.rs:98:13:98:13 | a | semmle.label | a | +| test.rs:98:17:98:20 | path | semmle.label | path | +| test.rs:98:17:98:33 | path.into_inner() | semmle.label | path.into_inner() | +| test.rs:99:14:99:14 | a | semmle.label | a | +| test.rs:99:14:99:23 | a.as_str() | semmle.label | a.as_str() | +| test.rs:100:14:100:14 | a | semmle.label | a | +| test.rs:100:14:100:25 | a.as_bytes() | semmle.label | a.as_bytes() | | test.rs:101:14:101:14 | a | semmle.label | a | -| test.rs:101:14:101:23 | a.as_str() | semmle.label | a.as_str() | -| test.rs:102:14:102:14 | a | semmle.label | a | -| test.rs:102:14:102:25 | a.as_bytes() | semmle.label | a.as_bytes() | -| test.rs:103:14:103:14 | a | semmle.label | a | -| test.rs:109:9:109:41 | ...: ...::Path::<...> | semmle.label | ...: ...::Path::<...> | -| test.rs:111:13:111:18 | TuplePat | semmle.label | TuplePat | -| test.rs:111:22:111:25 | path | semmle.label | path | -| test.rs:111:22:111:38 | path.into_inner() | semmle.label | path.into_inner() | -| test.rs:113:14:113:14 | a | semmle.label | a | -| test.rs:114:14:114:14 | b | semmle.label | b | -| test.rs:120:9:120:41 | ...: ...::Query::<...> | semmle.label | ...: ...::Query::<...> | -| test.rs:122:14:122:14 | a | semmle.label | a | -| test.rs:127:5:127:20 | to | semmle.label | to | -| test.rs:129:9:129:31 | ...: ...::Path::<...> | semmle.label | ...: ...::Path::<...> | -| test.rs:131:13:131:13 | a | semmle.label | a | -| test.rs:131:17:131:20 | path | semmle.label | path | -| test.rs:131:17:131:33 | path.into_inner() | semmle.label | path.into_inner() | -| test.rs:132:14:132:14 | a | semmle.label | a | -| test.rs:139:41:139:42 | to | semmle.label | to | -| test.rs:140:45:140:46 | to | semmle.label | to | -| test.rs:141:41:141:42 | to | semmle.label | to | -| test.rs:242:33:242:35 | map | semmle.label | map | -| test.rs:242:38:242:46 | ...: String | semmle.label | ...: String | -| test.rs:244:18:244:18 | a | semmle.label | a | -| test.rs:250:46:250:49 | then | semmle.label | then | -| test.rs:251:25:251:33 | ...: String | semmle.label | ...: String | -| test.rs:252:22:252:22 | a | semmle.label | a | -| test.rs:259:50:259:57 | and_then | semmle.label | and_then | -| test.rs:260:26:260:32 | ...: u64 | semmle.label | ...: u64 | -| test.rs:263:22:263:23 | id | semmle.label | id | -| test.rs:272:75:272:77 | map | semmle.label | map | -| test.rs:273:15:273:23 | ...: String | semmle.label | ...: String | -| test.rs:275:22:275:22 | a | semmle.label | a | +| test.rs:106:33:106:65 | ...: ...::Path::<...> | semmle.label | ...: ...::Path::<...> | +| test.rs:107:13:107:18 | TuplePat | semmle.label | TuplePat | +| test.rs:107:22:107:25 | path | semmle.label | path | +| test.rs:107:22:107:38 | path.into_inner() | semmle.label | path.into_inner() | +| test.rs:109:14:109:14 | a | semmle.label | a | +| test.rs:110:14:110:14 | b | semmle.label | b | +| test.rs:115:33:115:65 | ...: ...::Query::<...> | semmle.label | ...: ...::Query::<...> | +| test.rs:116:14:116:14 | a | semmle.label | a | +| test.rs:121:5:121:20 | to | semmle.label | to | +| test.rs:122:33:122:55 | ...: ...::Path::<...> | semmle.label | ...: ...::Path::<...> | +| test.rs:123:13:123:13 | a | semmle.label | a | +| test.rs:123:17:123:20 | path | semmle.label | path | +| test.rs:123:17:123:33 | path.into_inner() | semmle.label | path.into_inner() | +| test.rs:124:14:124:14 | a | semmle.label | a | +| test.rs:131:41:131:42 | to | semmle.label | to | +| test.rs:132:45:132:46 | to | semmle.label | to | +| test.rs:133:41:133:42 | to | semmle.label | to | +| test.rs:222:33:222:35 | map | semmle.label | map | +| test.rs:222:38:222:46 | ...: String | semmle.label | ...: String | +| test.rs:224:18:224:18 | a | semmle.label | a | +| test.rs:230:46:230:49 | then | semmle.label | then | +| test.rs:231:25:231:33 | ...: String | semmle.label | ...: String | +| test.rs:232:22:232:22 | a | semmle.label | a | +| test.rs:239:50:239:57 | and_then | semmle.label | and_then | +| test.rs:240:26:240:32 | ...: u64 | semmle.label | ...: u64 | +| test.rs:243:22:243:23 | id | semmle.label | id | +| test.rs:252:75:252:77 | map | semmle.label | map | +| test.rs:253:15:253:23 | ...: String | semmle.label | ...: String | +| test.rs:255:22:255:22 | a | semmle.label | a | subpaths testFailures #select @@ -119,14 +119,14 @@ testFailures | test.rs:60:14:60:17 | ms.a | test.rs:58:14:58:15 | ms | test.rs:60:14:60:17 | ms.a | $@ | test.rs:58:14:58:15 | ms | ms | | test.rs:61:14:61:17 | ms.b | test.rs:58:14:58:15 | ms | test.rs:61:14:61:17 | ms.b | $@ | test.rs:58:14:58:15 | ms | ms | | test.rs:70:14:70:14 | a | test.rs:68:15:68:15 | a | test.rs:70:14:70:14 | a | $@ | test.rs:68:15:68:15 | a | a | -| test.rs:101:14:101:23 | a.as_str() | test.rs:139:41:139:42 | to | test.rs:101:14:101:23 | a.as_str() | $@ | test.rs:139:41:139:42 | to | to | -| test.rs:102:14:102:25 | a.as_bytes() | test.rs:139:41:139:42 | to | test.rs:102:14:102:25 | a.as_bytes() | $@ | test.rs:139:41:139:42 | to | to | -| test.rs:103:14:103:14 | a | test.rs:139:41:139:42 | to | test.rs:103:14:103:14 | a | $@ | test.rs:139:41:139:42 | to | to | -| test.rs:113:14:113:14 | a | test.rs:140:45:140:46 | to | test.rs:113:14:113:14 | a | $@ | test.rs:140:45:140:46 | to | to | -| test.rs:114:14:114:14 | b | test.rs:140:45:140:46 | to | test.rs:114:14:114:14 | b | $@ | test.rs:140:45:140:46 | to | to | -| test.rs:122:14:122:14 | a | test.rs:141:41:141:42 | to | test.rs:122:14:122:14 | a | $@ | test.rs:141:41:141:42 | to | to | -| test.rs:132:14:132:14 | a | test.rs:127:5:127:20 | to | test.rs:132:14:132:14 | a | $@ | test.rs:127:5:127:20 | to | to | -| test.rs:244:18:244:18 | a | test.rs:242:33:242:35 | map | test.rs:244:18:244:18 | a | $@ | test.rs:242:33:242:35 | map | map | -| test.rs:252:22:252:22 | a | test.rs:250:46:250:49 | then | test.rs:252:22:252:22 | a | $@ | test.rs:250:46:250:49 | then | then | -| test.rs:263:22:263:23 | id | test.rs:259:50:259:57 | and_then | test.rs:263:22:263:23 | id | $@ | test.rs:259:50:259:57 | and_then | and_then | -| test.rs:275:22:275:22 | a | test.rs:272:75:272:77 | map | test.rs:275:22:275:22 | a | $@ | test.rs:272:75:272:77 | map | map | +| test.rs:99:14:99:23 | a.as_str() | test.rs:131:41:131:42 | to | test.rs:99:14:99:23 | a.as_str() | $@ | test.rs:131:41:131:42 | to | to | +| test.rs:100:14:100:25 | a.as_bytes() | test.rs:131:41:131:42 | to | test.rs:100:14:100:25 | a.as_bytes() | $@ | test.rs:131:41:131:42 | to | to | +| test.rs:101:14:101:14 | a | test.rs:131:41:131:42 | to | test.rs:101:14:101:14 | a | $@ | test.rs:131:41:131:42 | to | to | +| test.rs:109:14:109:14 | a | test.rs:132:45:132:46 | to | test.rs:109:14:109:14 | a | $@ | test.rs:132:45:132:46 | to | to | +| test.rs:110:14:110:14 | b | test.rs:132:45:132:46 | to | test.rs:110:14:110:14 | b | $@ | test.rs:132:45:132:46 | to | to | +| test.rs:116:14:116:14 | a | test.rs:133:41:133:42 | to | test.rs:116:14:116:14 | a | $@ | test.rs:133:41:133:42 | to | to | +| test.rs:124:14:124:14 | a | test.rs:121:5:121:20 | to | test.rs:124:14:124:14 | a | $@ | test.rs:121:5:121:20 | to | to | +| test.rs:224:18:224:18 | a | test.rs:222:33:222:35 | map | test.rs:224:18:224:18 | a | $@ | test.rs:222:33:222:35 | map | map | +| test.rs:232:22:232:22 | a | test.rs:230:46:230:49 | then | test.rs:232:22:232:22 | a | $@ | test.rs:230:46:230:49 | then | then | +| test.rs:243:22:243:23 | id | test.rs:239:50:239:57 | and_then | test.rs:243:22:243:23 | id | $@ | test.rs:239:50:239:57 | and_then | and_then | +| test.rs:255:22:255:22 | a | test.rs:252:75:252:77 | map | test.rs:255:22:255:22 | a | $@ | test.rs:252:75:252:77 | map | map | diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/TaintSources.expected b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/TaintSources.expected index 20a20ce3f9b..660eb7d12fa 100644 --- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/TaintSources.expected +++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/TaintSources.expected @@ -3,67 +3,67 @@ | test.rs:48:14:48:30 | MyStruct {...} | Flow source 'RemoteSource' of type remote (DEFAULT). | | test.rs:58:14:58:15 | ms | Flow source 'RemoteSource' of type remote (DEFAULT). | | test.rs:68:15:68:15 | a | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:127:5:127:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:127:5:127:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:127:5:127:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:127:5:127:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:127:5:127:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:127:5:127:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:127:5:127:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:127:5:127:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:139:41:139:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:139:41:139:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:139:41:139:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:139:41:139:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:139:41:139:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:139:41:139:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:139:41:139:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:139:41:139:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:140:45:140:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:140:45:140:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:140:45:140:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:140:45:140:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:140:45:140:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:140:45:140:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:140:45:140:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:140:45:140:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:141:41:141:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:141:41:141:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:141:41:141:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:141:41:141:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:141:41:141:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:141:41:141:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:141:41:141:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:141:41:141:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | -| test.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:121:5:121:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:121:5:121:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:121:5:121:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:121:5:121:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:121:5:121:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:121:5:121:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:121:5:121:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:121:5:121:20 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:131:41:131:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:131:41:131:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:131:41:131:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:131:41:131:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:131:41:131:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:131:41:131:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:131:41:131:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:131:41:131:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:132:45:132:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:132:45:132:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:132:45:132:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:132:45:132:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:132:45:132:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:132:45:132:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:132:45:132:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:132:45:132:46 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:133:41:133:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:133:41:133:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:133:41:133:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:133:41:133:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:133:41:133:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:133:41:133:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:133:41:133:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:133:41:133:42 | to | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:222:33:222:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:222:33:222:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:222:33:222:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:222:33:222:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:222:33:222:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:222:33:222:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:222:33:222:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:222:33:222:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:230:46:230:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:230:46:230:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:230:46:230:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:230:46:230:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:230:46:230:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:230:46:230:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:230:46:230:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:230:46:230:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:239:50:239:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:239:50:239:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:239:50:239:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:239:50:239:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:239:50:239:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:239:50:239:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:239:50:239:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:239:50:239:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:252:75:252:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:252:75:252:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:252:75:252:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:252:75:252:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:252:75:252:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:252:75:252:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:252:75:252:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | +| test.rs:252:75:252:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). | diff --git a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs index 124f7615ef1..8033560bef5 100644 --- a/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs +++ b/rust/ql/test/library-tests/dataflow/sources/web_frameworks/test.rs @@ -94,9 +94,7 @@ mod actix_test { use super::sink; use actix_web::{get, web, App}; - async fn my_actix_handler_1( - path: web::Path, - ) -> String { + async fn my_actix_handler_1(path: web::Path) -> String { let a = path.into_inner(); sink(a.as_str()); // $ hasTaintFlow=my_actix_handler_1 sink(a.as_bytes()); // $ hasTaintFlow=my_actix_handler_1 @@ -105,9 +103,7 @@ mod actix_test { "".to_string() } - async fn my_actix_handler_2( - path: web::Path<(String, String)>, - ) -> String { + async fn my_actix_handler_2(path: web::Path<(String, String)>) -> String { let (a, b) = path.into_inner(); sink(a); // $ hasTaintFlow=my_actix_handler_2 @@ -116,18 +112,14 @@ mod actix_test { "".to_string() } - async fn my_actix_handler_3( - web::Query(a): web::Query, - ) -> String { + async fn my_actix_handler_3(web::Query(a): web::Query) -> String { sink(a); // $ hasTaintFlow=my_actix_handler_3 "".to_string() } #[get("/4/{a}")] // $ Alert[rust/summary/taint-sources] - async fn my_actix_handler_4( - path: web::Path, - ) -> String { + async fn my_actix_handler_4(path: web::Path) -> String { let a = path.into_inner(); sink(a); // $ hasTaintFlow=my_actix_handler_4 @@ -148,43 +140,35 @@ mod actix_test { mod axum_test { use super::sink; use axum::extract::{Json, Path, Query, Request}; - use axum::routing::get; + use axum::routing::{get, post, put, MethodFilter}; use axum::Router; use std::collections::HashMap; - async fn my_axum_handler_1( - Path(a): Path, // $ MISSING: Alert[rust/summary/taint-sources] - ) -> &'static str { - sink(a.as_str()); // $ MISSING: hasTaintFlow - sink(a.as_bytes()); // $ MISSING: hasTaintFlow - sink(a); // $ MISSING: hasTaintFlow + async fn my_axum_handler_1(Path(a): Path) -> &'static str { + sink(a.as_str()); // $ MISSING: hasTaintFlow=my_axum_handler_1 + sink(a.as_bytes()); // $ MISSING: hasTaintFlow=my_axum_handler_1 + sink(a); // $ MISSING: hasTaintFlow=my_axum_handler_1 "" } - async fn my_axum_handler_2( - Path((a, b)): Path<(String, String)>, // $ MISSING: Alert[rust/summary/taint-sources] - ) -> &'static str { - sink(a); // $ MISSING: hasTaintFlow - sink(b); // $ MISSING: hasTaintFlow + async fn my_axum_handler_2(Path((a, b)): Path<(String, String)>) -> &'static str { + sink(a); // $ MISSING: hasTaintFlow=my_axum_handler_2 + sink(b); // $ MISSING: hasTaintFlow=my_axum_handler_2 "" } - async fn my_axum_handler_3( - Query(params): Query>, // $ MISSING: Alert[rust/summary/taint-sources] - ) -> &'static str { + async fn my_axum_handler_3(Query(params): Query>) -> &'static str { for (key, value) in params { - sink(key); // $ MISSING: hasTaintFlow - sink(value); // $ MISSING: hasTaintFlow + sink(key); // $ MISSING: hasTaintFlow=my_axum_handler_3 + sink(value); // $ MISSING: hasTaintFlow=my_axum_handler_3 } "" } - async fn my_axum_handler_4( - request: Request, // $ MISSING: Alert[rust/summary/taint-sources] - ) -> &'static str { + async fn my_axum_handler_4(request: Request) -> &'static str { sink(request.body()); // $ MISSING: hasTaintFlow request.headers().get("header").unwrap(); // $ MISSING: hasTaintFlow sink(request.into_body()); // $ MISSING: hasTaintFlow @@ -192,39 +176,35 @@ mod axum_test { "" } - async fn my_axum_handler_5( - Json(payload): Json, // $ MISSING: Alert[rust/summary/taint-sources] - ) -> &'static str { + async fn my_axum_handler_5(Json(payload): Json) -> &'static str { sink(payload.as_str()); // $ MISSING: hasTaintFlow - sink(payload); // $ MISSING: hasTaintFlow + sink(payload); // $ MISSING: hasTaintFlow=...::DELETE "" } - async fn my_axum_handler_6( - body: String, // $ MISSING: Alert[rust/summary/taint-sources] - ) -> &'static str { - sink(body); // $ MISSING: hasTaintFlow + async fn my_axum_handler_6(body: String) -> &'static str { + sink(body); // $ MISSING: hasTaintFlow=my_axum_handler_6 "" } - async fn my_axum_handler_7( - body: String, // $ MISSING: Alert[rust/summary/taint-sources] - ) -> &'static str { - sink(body); // $ MISSING: hasTaintFlow + async fn my_axum_handler_7(body: String) -> &'static str { + sink(body); // $ MISSING: hasTaintFlow=my_axum_handler_7 "" } async fn test_axum() { let app = Router::<()>::new() - .route("/1/{a}", get(my_axum_handler_1)) - .route("/2/{a}/{b}", get(my_axum_handler_2)) - .route("/3/:a", get(my_axum_handler_3)) - .route("/4/:a", get(my_axum_handler_4)) - .route("/5/:a", get(my_axum_handler_5)) - .route("/67/:a", get(my_axum_handler_6).get(my_axum_handler_7)); + .route("/1/{a}", get(my_axum_handler_1)) // $ MISSING: Alert[rust/summary/taint-sources]) + .route("/2/{a}/{b}", post(my_axum_handler_2)) // $ MISSING: Alert[rust/summary/taint-sources]) + .route("/3/:a", put(my_axum_handler_3)) // $ MISSING: Alert[rust/summary/taint-sources]) + .route( + "/4/:a", + get(my_axum_handler_4).on(MethodFilter::DELETE, my_axum_handler_5), // $ MISSING: Alert[rust/summary/taint-sources]) + ) + .route("/5/:a", get(my_axum_handler_6).get(my_axum_handler_7)); // $ MISSING: Alert[rust/summary/taint-sources]) // ... }