JS: Add InlineFlowTest

This commit is contained in:
Asger F
2024-08-07 14:03:25 +02:00
parent 4b8ae2a4f3
commit 4cdaccd22e
2 changed files with 46 additions and 0 deletions

View File

@@ -0,0 +1,25 @@
/**
* Inline flow tests for JavaScript.
* See `shared/util/codeql/dataflow/test/InlineFlowTest.qll`
*/
private import javascript
private import semmle.javascript.Locations
private import codeql.dataflow.test.InlineFlowTest
private import semmle.javascript.dataflow.internal.sharedlib.DataFlowArg
private import semmle.javascript.frameworks.data.internal.ApiGraphModelsExtensions as ApiGraphModelsExtensions
private import internal.InlineExpectationsTestImpl
private module FlowTestImpl implements InputSig<Location, JSDataFlow> {
import testUtilities.InlineFlowTestUtil
bindingset[src, sink]
string getArgString(DataFlow::Node src, DataFlow::Node sink) {
(if exists(getSourceArgString(src)) then result = getSourceArgString(src) else result = "") and
exists(sink)
}
predicate interpretModelForTest = ApiGraphModelsExtensions::interpretModelForTest/2;
}
import InlineFlowTestMake<Location, JSDataFlow, JSTaintFlow, Impl, FlowTestImpl>

View File

@@ -0,0 +1,21 @@
/**
* Defines the default source and sink recognition for `InlineFlowTest.qll`.
*
* We reuse these predicates in some type-tracking tests that don't wish to bring in the
* test configuration from `InlineFlowTest`.
*/
private import javascript
predicate defaultSource(DataFlow::Node src) { src.(DataFlow::CallNode).getCalleeName() = "source" }
predicate defaultSink(DataFlow::Node sink) {
exists(DataFlow::CallNode call | call.getCalleeName() = "sink" | sink = call.getAnArgument())
}
bindingset[src]
string getSourceArgString(DataFlow::Node src) {
src.(DataFlow::CallNode).getAnArgument().getStringValue() = result
or
src.(DataFlow::ParameterNode).getName() = result
}