hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Use of inline tests for dataflow queries

Browse Source
This commit is contained in:
Sim4n6
2023-01-25 19:28:05 +01:00
parent b5a6f6e165
commit 10d6ebf95b
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/test/experimental/query-tests/Security/CWE-022/DataflowQueryTest.expected Normal file
View File

@@ -0,0 +1,4 @@
missingAnnotationOnSink
failures
| UnsafeUnpack.py:12:46:12:58 | Comment # $result=BAD | Missing result:result=BAD |
| UnsafeUnpack.py:55:53:55:65 | Comment # $result=BAD | Missing result:result=BAD |

2
python/ql/test/experimental/query-tests/Security/CWE-022/DataflowQueryTest.ql Normal file
View File

@@ -0,0 +1,2 @@
import python
import experimental.dataflow.TestUtil.DataflowQueryTest

4
python/ql/test/experimental/query-tests/Security/CWE-022/UnsafeUnpack.py
View File

@@ -9,7 +9,7 @@ with open(tarpath, "wb") as f:
f.write(response.raw.read())
untarredpath = "/tmp/tmp123"
shutil.unpack_archive(tarpath, untarredpath)
shutil.unpack_archive(tarpath, untarredpath) # $result=BAD
import tempfile
@@ -52,5 +52,5 @@ with tempfile.TemporaryDirectory() as temp_dir:
)
fs.get(uri, to_path, recursive=True)
if unpack_path:
shutil.unpack_archive(to_path, unpack_path)
shutil.unpack_archive(to_path, unpack_path) # $result=BAD
to_path = unpack_path