Go,Java,Python: Fix some tests.

This commit is contained in:
Anders Schack-Mulligen
2023-02-28 09:58:33 +01:00
parent 64c60d59b1
commit 5469a82efb
4 changed files with 19 additions and 28 deletions

View File

@@ -41,8 +41,6 @@ class DataConfiguration extends DataFlow::Configuration {
override predicate isSink(DataFlow::Node sink) { override predicate isSink(DataFlow::Node sink) {
sink = any(DataFlow::CallNode c | c.getCalleeName() = "sink").getArgument(0) sink = any(DataFlow::CallNode c | c.getCalleeName() = "sink").getArgument(0)
} }
override int explorationLimit() { result = 10 } // this is different!
} }
class DataFlowTest extends InlineExpectationsTest { class DataFlowTest extends InlineExpectationsTest {
@@ -71,8 +69,6 @@ class TaintConfiguration extends TaintTracking::Configuration {
override predicate isSink(DataFlow::Node sink) { override predicate isSink(DataFlow::Node sink) {
sink = any(DataFlow::CallNode c | c.getCalleeName() = "sink").getArgument(0) sink = any(DataFlow::CallNode c | c.getCalleeName() = "sink").getArgument(0)
} }
override int explorationLimit() { result = 10 } // this is different!
} }
class TaintFlowTest extends InlineExpectationsTest { class TaintFlowTest extends InlineExpectationsTest {

View File

@@ -6,13 +6,7 @@ edges
| tst.go:10:13:10:35 | call to FormValue | tst.go:24:66:24:72 | tainted | | tst.go:10:13:10:35 | call to FormValue | tst.go:24:66:24:72 | tainted |
| tst.go:10:13:10:35 | call to FormValue | tst.go:27:11:27:29 | ...+... | | tst.go:10:13:10:35 | call to FormValue | tst.go:27:11:27:29 | ...+... |
| tst.go:10:13:10:35 | call to FormValue | tst.go:29:11:29:40 | ...+... | | tst.go:10:13:10:35 | call to FormValue | tst.go:29:11:29:40 | ...+... |
| tst.go:10:13:10:35 | call to FormValue | tst.go:36:2:36:2 | implicit dereference |
| tst.go:10:13:10:35 | call to FormValue | tst.go:37:11:37:20 | call to String | | tst.go:10:13:10:35 | call to FormValue | tst.go:37:11:37:20 | call to String |
| tst.go:35:2:35:2 | definition of u [pointer] | tst.go:36:2:36:2 | u [pointer] |
| tst.go:36:2:36:2 | implicit dereference | tst.go:35:2:35:2 | definition of u [pointer] |
| tst.go:36:2:36:2 | implicit dereference | tst.go:36:2:36:2 | implicit dereference |
| tst.go:36:2:36:2 | implicit dereference | tst.go:37:11:37:20 | call to String |
| tst.go:36:2:36:2 | u [pointer] | tst.go:36:2:36:2 | implicit dereference |
| websocket.go:60:21:60:31 | call to Referer | websocket.go:65:27:65:40 | untrustedInput | | websocket.go:60:21:60:31 | call to Referer | websocket.go:65:27:65:40 | untrustedInput |
| websocket.go:74:21:74:31 | call to Referer | websocket.go:78:36:78:49 | untrustedInput | | websocket.go:74:21:74:31 | call to Referer | websocket.go:78:36:78:49 | untrustedInput |
| websocket.go:88:21:88:31 | call to Referer | websocket.go:91:31:91:44 | untrustedInput | | websocket.go:88:21:88:31 | call to Referer | websocket.go:91:31:91:44 | untrustedInput |
@@ -32,9 +26,6 @@ nodes
| tst.go:24:66:24:72 | tainted | semmle.label | tainted | | tst.go:24:66:24:72 | tainted | semmle.label | tainted |
| tst.go:27:11:27:29 | ...+... | semmle.label | ...+... | | tst.go:27:11:27:29 | ...+... | semmle.label | ...+... |
| tst.go:29:11:29:40 | ...+... | semmle.label | ...+... | | tst.go:29:11:29:40 | ...+... | semmle.label | ...+... |
| tst.go:35:2:35:2 | definition of u [pointer] | semmle.label | definition of u [pointer] |
| tst.go:36:2:36:2 | implicit dereference | semmle.label | implicit dereference |
| tst.go:36:2:36:2 | u [pointer] | semmle.label | u [pointer] |
| tst.go:37:11:37:20 | call to String | semmle.label | call to String | | tst.go:37:11:37:20 | call to String | semmle.label | call to String |
| websocket.go:60:21:60:31 | call to Referer | semmle.label | call to Referer | | websocket.go:60:21:60:31 | call to Referer | semmle.label | call to Referer |
| websocket.go:65:27:65:40 | untrustedInput | semmle.label | untrustedInput | | websocket.go:65:27:65:40 | untrustedInput | semmle.label | untrustedInput |

View File

@@ -39,22 +39,26 @@ predicate step(Node n1, Node n2, string s1, string s2) {
predicate checkNode(Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("check") } predicate checkNode(Node n) { n.asExpr().(Argument).getCall().getCallee().hasName("check") }
class Conf extends TaintTracking::Configuration { module Conf implements DataFlow::StateConfigSig {
Conf() { this = "qltest:state" } class FlowState = string;
override predicate isSource(Node n, FlowState s) { src(n, s) } predicate isSource(Node n, FlowState s) { src(n, s) }
override predicate isSink(Node n, FlowState s) { sink(n, s) } predicate isSink(Node n, FlowState s) { sink(n, s) }
override predicate isSanitizer(Node n, FlowState s) { bar(n, s) } predicate isBarrier(Node n, FlowState s) { bar(n, s) }
override predicate isAdditionalTaintStep(Node n1, FlowState s1, Node n2, FlowState s2) { predicate isAdditionalFlowStep(Node n1, FlowState s1, Node n2, FlowState s2) {
step(n1, n2, s1, s2) step(n1, n2, s1, s2)
} }
override int explorationLimit() { result = 0 }
} }
int explorationLimit() { result = 0 }
module Flow = TaintTracking::MakeWithState<Conf>;
module PartialFlow = Flow::FlowExploration<explorationLimit/0>;
class HasFlowTest extends InlineExpectationsTest { class HasFlowTest extends InlineExpectationsTest {
HasFlowTest() { this = "HasFlowTest" } HasFlowTest() { this = "HasFlowTest" }
@@ -62,16 +66,16 @@ class HasFlowTest extends InlineExpectationsTest {
override predicate hasActualResult(Location location, string element, string tag, string value) { override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "flow" and tag = "flow" and
exists(PathNode src, PathNode sink, Conf conf | exists(Flow::PathNode src, Flow::PathNode sink |
conf.hasFlowPath(src, sink) and Flow::hasFlowPath(src, sink) and
sink.getNode().getLocation() = location and sink.getNode().getLocation() = location and
element = sink.toString() and element = sink.toString() and
value = src.getState() value = src.getState()
) )
or or
tag = "pFwd" and tag = "pFwd" and
exists(PartialPathNode src, PartialPathNode node, Conf conf | exists(PartialFlow::PartialPathNode src, PartialFlow::PartialPathNode node |
conf.hasPartialFlow(src, node, _) and PartialFlow::hasPartialFlow(src, node, _) and
checkNode(node.getNode()) and checkNode(node.getNode()) and
node.getNode().getLocation() = location and node.getNode().getLocation() = location and
element = node.toString() and element = node.toString() and
@@ -79,8 +83,8 @@ class HasFlowTest extends InlineExpectationsTest {
) )
or or
tag = "pRev" and tag = "pRev" and
exists(PartialPathNode node, PartialPathNode sink, Conf conf | exists(PartialFlow::PartialPathNode node, PartialFlow::PartialPathNode sink |
conf.hasPartialFlowRev(node, sink, _) and PartialFlow::hasPartialFlowRev(node, sink, _) and
checkNode(node.getNode()) and checkNode(node.getNode()) and
node.getNode().getLocation() = location and node.getNode().getLocation() = location and
element = node.toString() and element = node.toString() and

View File

@@ -14,7 +14,7 @@ import experimental.meta.InlineTaintTest::Conf
import DataFlow::PathGraph import DataFlow::PathGraph
class Conf extends TestTaintTrackingConfiguration { class Conf extends TestTaintTrackingConfiguration {
override int explorationLimit() { result = 5 } // override int explorationLimit() { result = 5 }
} }
// from Conf config, DataFlow::PartialPathNode source, DataFlow::PartialPathNode sink // from Conf config, DataFlow::PartialPathNode source, DataFlow::PartialPathNode sink