diff --git a/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test.expected b/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test.expected new file mode 100644 index 00000000000..db33d6d2504 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test.expected @@ -0,0 +1,3 @@ +testFailures +invalidModelRow +failures diff --git a/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test.ext.yml new file mode 100644 index 00000000000..c720e53fd7b --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test.ext.yml @@ -0,0 +1,6 @@ +extensions: + - addsTo: + pack: codeql/threat-models + extensible: threatModelConfiguration + data: + - ["commandargs", true, 0] \ No newline at end of file diff --git a/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test.ql b/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test.ql new file mode 100644 index 00000000000..eb7ba46508e --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test.ql @@ -0,0 +1,19 @@ +import go +import ModelValidation +import TestUtilities.InlineExpectationsTest + +module SourceTest implements TestSig { + string getARelevantTag() { result = "source" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + exists(ActiveThreatModelSource s | + s.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = s.toString() and + value = "" and + tag = "source" + ) + } +} + +import MakeTest diff --git a/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test_os.go b/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test_os.go new file mode 100644 index 00000000000..f84347749ab --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/flowsources/local/commandargs/test_os.go @@ -0,0 +1,9 @@ +package test + +import "os" + +func loopThroughCommandArgs() { + for _, arg := range os.Args { // $ source + _ = arg + } +}