hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

python: more consistent tests

Browse Source 
- do not test taint flow whne dataflow is established
- test taint of both the collection and the expected element
This commit is contained in:
Rasmus Lerchedahl Petersen
2023-06-22 11:52:25 +02:00
parent 0f8ebd1519
commit 2264b119a6
1 changed files with 15 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
python/ql/test/experimental/dataflow/model-summaries/model_summaries.py
View File

@@ -36,18 +36,10 @@ from foo import MS_identity, MS_apply_lambda, MS_reversed, MS_list_map, MS_appen
via_identity = MS_identity(SOURCE)
SINK(via_identity) # $ flow="SOURCE, l:-1 -> via_identity"
tainted = MS_identity(TAINTED_STRING)
ensure_tainted(tainted) # $ tainted
# Lambda summary
via_lambda = MS_apply_lambda(lambda x: [x], SOURCE)
SINK(via_lambda[0]) # $ flow="SOURCE, l:-1 -> via_lambda[0]"
tainted_lambda = MS_apply_lambda(lambda x: [x], TAINTED_STRING)
ensure_tainted(tainted_lambda) # $ tainted
# A lambda that breaks the flow
not_via_lambda = MS_apply_lambda(lambda x: 1, SOURCE)
SINK_F(not_via_lambda)
@@ -59,8 +51,11 @@ ensure_not_tainted(untainted_lambda)
via_reversed = MS_reversed([SOURCE])
SINK(via_reversed[0]) # $ flow="SOURCE, l:-1 -> via_reversed[0]"
tainted_list = MS_reversed([TAINTED_STRING])
ensure_tainted(tainted_list[0]) # $ tainted
tainted_list = MS_reversed(TAINTED_LIST)
ensure_tainted(
tainted_list, # $ tainted
tainted_list[0] # $ tainted
)
# Complex summaries
def box(x):
@@ -69,8 +64,11 @@ def box(x):
via_map = MS_list_map(box, [SOURCE])
SINK(via_map[0][0]) # $ flow="SOURCE, l:-1 -> via_map[0][0]"
tainted_mapped = MS_list_map(box, [TAINTED_STRING])
ensure_tainted(tainted_mapped[0][0]) # $ tainted
tainted_mapped = MS_list_map(box, TAINTED_LIST)
ensure_tainted(
tainted_mapped, # $ tainted
tainted_mapped[0][0] # $ tainted
)
def explicit_identity(x):
return x
@@ -78,25 +76,19 @@ def explicit_identity(x):
via_map_explicit = MS_list_map(explicit_identity, [SOURCE])
SINK(via_map_explicit[0]) # $ flow="SOURCE, l:-1 -> via_map_explicit[0]"
tainted_mapped_explicit = MS_list_map(explicit_identity, [TAINTED_STRING])
tainted_mapped_explicit_implicit = MS_list_map(explicit_identity, TAINTED_LIST)
tainted_mapped_explicit = MS_list_map(explicit_identity, TAINTED_LIST)
ensure_tainted(
tainted_mapped_explicit, # $ tainted
tainted_mapped_explicit[0], # $ tainted
tainted_mapped_explicit_implicit, # $ tainted
tainted_mapped_explicit_implicit[0] # $ tainted
tainted_mapped_explicit[0] # $ tainted
)
via_map_summary = MS_list_map(MS_identity, [SOURCE])
SINK(via_map_summary[0]) # $ flow="SOURCE, l:-1 -> via_map_summary[0]"
tainted_mapped_summary = MS_list_map(MS_identity, [TAINTED_STRING])
tainted_mapped_summary_implicit = MS_list_map(MS_identity, TAINTED_LIST)
tainted_mapped_summary = MS_list_map(MS_identity, TAINTED_LIST)
ensure_tainted(
tainted_mapped_summary, # $ tainted
tainted_mapped_summary[0], # $ tainted
tainted_mapped_summary_implicit, # $ tainted
tainted_mapped_summary_implicit[0] # $ tainted
tainted_mapped_summary[0] # $ tainted
)
via_append_el = MS_append_to_list([], SOURCE)
@@ -111,13 +103,10 @@ ensure_tainted(
via_append = MS_append_to_list([SOURCE], NONSOURCE)
SINK(via_append[0]) # $ flow="SOURCE, l:-1 -> via_append[0]"
tainted_list = MS_append_to_list([TAINTED_STRING], NONSOURCE)
tainted_list_implicit = MS_append_to_list(TAINTED_LIST, NONSOURCE)
ensure_tainted(
tainted_list, # $ tainted
tainted_list[0], # $ tainted
tainted_list_implicit, # $ tainted
tainted_list_implicit[0] # $ tainted
tainted_list[0] # $ tainted
)
# Modeled flow-summary is not value preserving