hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 20:26:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Adjust test to moved and expanded stubs

Browse Source
This commit is contained in:
Chris Smowton
2022-08-15 11:06:06 +01:00
parent ca4ef6578d
commit 38c0557d90
3 changed files with 31 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
java/ql/test/experimental/query-tests/security/CWE-078/ExecTainted.expected
View File

@@ -1,12 +1,12 @@
edges
| JSchOSInjectionTest.java:14:30:14:60 | getParameter(...) : String | JSchOSInjectionTest.java:26:48:26:64 | ... + ... |
| JSchOSInjectionTest.java:38:30:38:60 | getParameter(...) : String | JSchOSInjectionTest.java:50:32:50:48 | ... + ... |
| JSchOSInjectionTest.java:14:30:14:60 | getParameter(...) : String | JSchOSInjectionTest.java:27:52:27:68 | ... + ... |
| JSchOSInjectionTest.java:40:30:40:60 | getParameter(...) : String | JSchOSInjectionTest.java:53:36:53:52 | ... + ... |
nodes
| JSchOSInjectionTest.java:14:30:14:60 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JSchOSInjectionTest.java:26:48:26:64 | ... + ... | semmle.label | ... + ... |
| JSchOSInjectionTest.java:38:30:38:60 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JSchOSInjectionTest.java:50:32:50:48 | ... + ... | semmle.label | ... + ... |
| JSchOSInjectionTest.java:27:52:27:68 | ... + ... | semmle.label | ... + ... |
| JSchOSInjectionTest.java:40:30:40:60 | getParameter(...) : String | semmle.label | getParameter(...) : String |
| JSchOSInjectionTest.java:53:36:53:52 | ... + ... | semmle.label | ... + ... |
subpaths
#select
| JSchOSInjectionTest.java:26:48:26:64 | ... + ... | JSchOSInjectionTest.java:14:30:14:60 | getParameter(...) : String | JSchOSInjectionTest.java:26:48:26:64 | ... + ... | $@ flows to here and is used in a command. | JSchOSInjectionTest.java:14:30:14:60 | getParameter(...) | User-provided value |
| JSchOSInjectionTest.java:50:32:50:48 | ... + ... | JSchOSInjectionTest.java:38:30:38:60 | getParameter(...) : String | JSchOSInjectionTest.java:50:32:50:48 | ... + ... | $@ flows to here and is used in a command. | JSchOSInjectionTest.java:38:30:38:60 | getParameter(...) | User-provided value |
| JSchOSInjectionTest.java:27:52:27:68 | ... + ... | JSchOSInjectionTest.java:14:30:14:60 | getParameter(...) : String | JSchOSInjectionTest.java:27:52:27:68 | ... + ... | $@ flows to here and is used in a command. | JSchOSInjectionTest.java:14:30:14:60 | getParameter(...) | User-provided value |
| JSchOSInjectionTest.java:53:36:53:52 | ... + ... | JSchOSInjectionTest.java:40:30:40:60 | getParameter(...) : String | JSchOSInjectionTest.java:53:36:53:52 | ... + ... | $@ flows to here and is used in a command. | JSchOSInjectionTest.java:40:30:40:60 | getParameter(...) | User-provided value |

42
java/ql/test/experimental/query-tests/security/CWE-078/JSchOSInjectionTest.java
View File

@@ -17,17 +17,19 @@ public class JSchOSInjectionTest extends HttpServlet {
config.put("StrictHostKeyChecking", "no");
JSch jsch = new JSch();
Session session = jsch.getSession(user, host, 22);
session.setPassword(password);
session.setConfig(config);
session.connect();
try {
Session session = jsch.getSession(user, host, 22);
session.setPassword(password);
session.setConfig(config);
session.connect();
Channel channel = session.openChannel("exec");
((ChannelExec) channel).setCommand("ping " + command);
channel.setInputStream(null);
((ChannelExec) channel).setErrStream(System.err);
Channel channel = session.openChannel("exec");
((ChannelExec) channel).setCommand("ping " + command);
channel.setInputStream(null);
((ChannelExec) channel).setErrStream(System.err);
channel.connect();
channel.connect();
} catch (JSchException e) { }
}
protected void doPost(HttpServletRequest request, HttpServletResponse response)
@@ -41,16 +43,18 @@ public class JSchOSInjectionTest extends HttpServlet {
config.put("StrictHostKeyChecking", "no");
JSch jsch = new JSch();
Session session = jsch.getSession(user, host, 22);
session.setPassword(password);
session.setConfig(config);
session.connect();
try {
Session session = jsch.getSession(user, host, 22);
session.setPassword(password);
session.setConfig(config);
session.connect();
ChannelExec channel = (ChannelExec)session.openChannel("exec");
channel.setCommand("ping " + command);
channel.setInputStream(null);
channel.setErrStream(System.err);
ChannelExec channel = (ChannelExec)session.openChannel("exec");
channel.setCommand("ping " + command);
channel.setInputStream(null);
channel.setErrStream(System.err);
channel.connect();
channel.connect();
} catch (JSchException e) { }
}
}
}

2
java/ql/test/experimental/query-tests/security/CWE-078/options
View File

@@ -1,2 +1,2 @@
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/jsch-0.1.55
//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/jsch-0.1.55