diff --git a/javascript/ql/test/library-tests/TripleDot/test.expected b/javascript/ql/test/library-tests/TripleDot/test.expected new file mode 100644 index 00000000000..046eb06471d --- /dev/null +++ b/javascript/ql/test/library-tests/TripleDot/test.expected @@ -0,0 +1,61 @@ +| tst.js:5:14:5:20 | rest[0] | Unexpected result: hasTaintFlow=t1.1 | +| tst.js:5:24:5:45 | // $ ha ... ow=t1.1 | Missing result:hasValueFlow=t1.1 | +| tst.js:6:14:6:20 | rest[1] | Unexpected result: hasTaintFlow=t1.1 | +| tst.js:6:24:6:45 | // $ ha ... ow=t1.2 | Missing result:hasValueFlow=t1.2 | +| tst.js:7:31:7:70 | // $ ha ... ow=t1.2 | Missing result:hasTaintFlow=t1.2 | +| tst.js:15:31:15:70 | // $ ha ... ow=t2.3 | Missing result:hasTaintFlow=t2.3 | +| tst.js:22:14:22:14 | x | Unexpected result: hasTaintFlow=t3.1 | +| tst.js:22:18:22:39 | // $ ha ... ow=t3.1 | Missing result:hasValueFlow=t3.1 | +| tst.js:23:14:23:14 | y | Unexpected result: hasTaintFlow=t3.1 | +| tst.js:23:18:23:39 | // $ ha ... ow=t3.2 | Missing result:hasValueFlow=t3.2 | +| tst.js:24:14:24:14 | z | Unexpected result: hasTaintFlow=t3.1 | +| tst.js:24:18:24:39 | // $ ha ... ow=t3.3 | Missing result:hasValueFlow=t3.3 | +| tst.js:34:14:34:14 | w | Unexpected result: hasTaintFlow=t4.1 | +| tst.js:35:14:35:14 | x | Unexpected result: hasTaintFlow=t4.1 | +| tst.js:35:18:35:39 | // $ ha ... ow=t4.1 | Missing result:hasValueFlow=t4.1 | +| tst.js:36:14:36:14 | y | Unexpected result: hasTaintFlow=t4.1 | +| tst.js:36:18:36:39 | // $ ha ... ow=t4.2 | Missing result:hasValueFlow=t4.2 | +| tst.js:37:14:37:14 | z | Unexpected result: hasTaintFlow=t4.1 | +| tst.js:37:18:37:39 | // $ ha ... ow=t4.3 | Missing result:hasValueFlow=t4.3 | +| tst.js:47:14:47:14 | w | Unexpected result: hasTaintFlow=t5.2 | +| tst.js:47:14:47:14 | w | Unexpected result: hasTaintFlow=t5.3 | +| tst.js:47:14:47:14 | w | Unexpected result: hasValueFlow=t5.1 | +| tst.js:48:14:48:14 | x | Unexpected result: hasTaintFlow=t5.1 | +| tst.js:48:14:48:14 | x | Unexpected result: hasTaintFlow=t5.3 | +| tst.js:48:14:48:14 | x | Unexpected result: hasValueFlow=t5.2 | +| tst.js:48:18:48:39 | // $ ha ... ow=t5.1 | Missing result:hasValueFlow=t5.1 | +| tst.js:49:14:49:14 | y | Unexpected result: hasTaintFlow=t5.1 | +| tst.js:49:14:49:14 | y | Unexpected result: hasTaintFlow=t5.2 | +| tst.js:49:14:49:14 | y | Unexpected result: hasValueFlow=t5.3 | +| tst.js:49:18:49:39 | // $ ha ... ow=t5.2 | Missing result:hasValueFlow=t5.2 | +| tst.js:50:14:50:14 | z | Unexpected result: hasTaintFlow=t5.1 | +| tst.js:50:14:50:14 | z | Unexpected result: hasTaintFlow=t5.2 | +| tst.js:50:14:50:14 | z | Unexpected result: hasTaintFlow=t5.3 | +| tst.js:50:18:50:39 | // $ ha ... ow=t5.3 | Missing result:hasValueFlow=t5.3 | +| tst.js:61:28:61:49 | // $ ha ... ow=t6.1 | Missing result:hasValueFlow=t6.1 | +| tst.js:62:28:62:49 | // $ ha ... ow=t6.2 | Missing result:hasValueFlow=t6.2 | +| tst.js:63:28:63:49 | // $ ha ... ow=t6.3 | Missing result:hasValueFlow=t6.3 | +| tst.js:70:18:70:39 | // $ ha ... ow=t7.1 | Missing result:hasValueFlow=t7.1 | +| tst.js:71:18:71:39 | // $ ha ... ow=t7.2 | Missing result:hasValueFlow=t7.2 | +| tst.js:72:18:72:39 | // $ ha ... ow=t7.3 | Missing result:hasValueFlow=t7.3 | +| tst.js:82:14:82:14 | x | Unexpected result: hasTaintFlow=t8.2 | +| tst.js:82:14:82:14 | x | Unexpected result: hasTaintFlow=t8.4 | +| tst.js:83:14:83:14 | y | Unexpected result: hasTaintFlow=t8.1 | +| tst.js:83:14:83:14 | y | Unexpected result: hasTaintFlow=t8.3 | +| tst.js:83:18:83:85 | // $ ha ... ow=t8.4 | Fixed spurious result:hasValueFlow=t8.3 | +| tst.js:84:14:84:14 | z | Unexpected result: hasTaintFlow=t8.1 | +| tst.js:84:14:84:14 | z | Unexpected result: hasTaintFlow=t8.2 | +| tst.js:84:14:84:14 | z | Unexpected result: hasTaintFlow=t8.3 | +| tst.js:84:14:84:14 | z | Unexpected result: hasTaintFlow=t8.4 | +| tst.js:84:18:84:85 | // $ ha ... ow=t8.4 | Fixed spurious result:hasValueFlow=t8.3 | +| tst.js:84:18:84:85 | // $ ha ... ow=t8.4 | Fixed spurious result:hasValueFlow=t8.4 | +| tst.js:84:18:84:85 | // $ ha ... ow=t8.4 | Missing result:hasValueFlow=t8.3 | +| tst.js:94:18:94:39 | // $ ha ... ow=t9.1 | Missing result:hasValueFlow=t9.1 | +| tst.js:95:18:95:39 | // $ ha ... ow=t9.2 | Missing result:hasValueFlow=t9.2 | +| tst.js:96:18:96:39 | // $ ha ... ow=t9.3 | Missing result:hasValueFlow=t9.3 | +| tst.js:106:14:106:14 | x | Unexpected result: hasTaintFlow=t10.1 | +| tst.js:106:18:106:40 | // $ ha ... w=t10.1 | Missing result:hasValueFlow=t10.1 | +| tst.js:107:14:107:14 | y | Unexpected result: hasTaintFlow=t10.1 | +| tst.js:107:18:107:40 | // $ ha ... w=t10.2 | Missing result:hasValueFlow=t10.2 | +| tst.js:108:14:108:14 | z | Unexpected result: hasTaintFlow=t10.1 | +| tst.js:108:18:108:40 | // $ ha ... w=t10.3 | Missing result:hasValueFlow=t10.3 | diff --git a/javascript/ql/test/library-tests/TripleDot/test.ql b/javascript/ql/test/library-tests/TripleDot/test.ql new file mode 100644 index 00000000000..222c24dbbea --- /dev/null +++ b/javascript/ql/test/library-tests/TripleDot/test.ql @@ -0,0 +1,3 @@ +import javascript +import testUtilities.InlineFlowTest +import DefaultFlowTest diff --git a/javascript/ql/test/library-tests/TripleDot/tst.js b/javascript/ql/test/library-tests/TripleDot/tst.js new file mode 100644 index 00000000000..3613857d455 --- /dev/null +++ b/javascript/ql/test/library-tests/TripleDot/tst.js @@ -0,0 +1,114 @@ +import 'dummy'; + +function t1() { + function target(...rest) { + sink(rest[0]); // $ hasValueFlow=t1.1 + sink(rest[1]); // $ hasValueFlow=t1.2 + sink(rest.join(',')); // $ hasTaintFlow=t1.1 hasTaintFlow=t1.2 + } + target(source('t1.1'), source('t1.2')); +} + +function t2() { + function target(x, ...rest) { + sink(x); // $ hasValueFlow=t2.1 + sink(rest.join(',')); // $ hasTaintFlow=t2.2 hasTaintFlow=t2.3 + } + target(source('t2.1'), source('t2.2'), source('t2.3')); +} + +function t3() { + function finalTarget(x, y, z) { + sink(x); // $ hasValueFlow=t3.1 + sink(y); // $ hasValueFlow=t3.2 + sink(z); // $ hasValueFlow=t3.3 + } + function target(...rest) { + finalTarget(...rest); + } + target(source('t3.1'), source('t3.2'), source('t3.3')); +} + +function t4() { + function finalTarget(w, x, y, z) { + sink(w); // $ hasValueFlow=t4.0 + sink(x); // $ hasValueFlow=t4.1 + sink(y); // $ hasValueFlow=t4.2 + sink(z); // $ hasValueFlow=t4.3 + } + function target(...rest) { + finalTarget(source('t4.0'), ...rest); + } + target(source('t4.1'), source('t4.2'), source('t4.3')); +} + +function t5() { + function finalTarget(w, x, y, z) { + sink(w); // $ hasValueFlow=t5.0 + sink(x); // $ hasValueFlow=t5.1 + sink(y); // $ hasValueFlow=t5.2 + sink(z); // $ hasValueFlow=t5.3 + } + function target(array) { + finalTarget(source('t5.0'), ...array); + } + target([source('t5.1'), source('t5.2'), source('t5.3')]); +} + +function t6() { + function target(x) { + sink(x); // $ hasValueFlow=t6.1 + sink(arguments[0]);// $ hasValueFlow=t6.1 + sink(arguments[1]);// $ hasValueFlow=t6.2 + sink(arguments[2]);// $ hasValueFlow=t6.3 + } + target(source('t6.1'), source('t6.2'), source('t6.3')); +} + +function t7() { + function finalTarget(x, y, z) { + sink(x); // $ hasValueFlow=t7.1 + sink(y); // $ hasValueFlow=t7.2 + sink(z); // $ hasValueFlow=t7.3 + } + function target() { + finalTarget(...arguments); + } + target(source('t7.1'), source('t7.2'), source('t7.3')); +} + +function t8() { + function finalTarget(x, y, z) { + sink(x); // $ hasValueFlow=t8.1 SPURIOUS: hasValueFlow=t8.3 + sink(y); // $ hasValueFlow=t8.2 SPURIOUS: hasValueFlow=t8.3 hasValueFlow=t8.4 + sink(z); // $ hasValueFlow=t8.3 SPURIOUS: hasValueFlow=t8.3 hasValueFlow=t8.4 + } + function target(array1, array2) { + finalTarget(...array1, ...array2); + } + target([source('t8.1'), source('t8.2')], [source('t8.3'), source('t8.4')]); +} + +function t9() { + function finalTarget(x, y, z) { + sink(x); // $ hasValueFlow=t9.1 + sink(y); // $ hasValueFlow=t9.2 + sink(z); // $ hasValueFlow=t9.3 + } + function target() { + finalTarget.apply(undefined, arguments); + } + target(source('t9.1'), source('t9.2'), source('t9.3')); +} + +function t10() { + function finalTarget(x, y, z) { + sink(x); // $ hasValueFlow=t10.1 + sink(y); // $ hasValueFlow=t10.2 + sink(z); // $ hasValueFlow=t10.3 + } + function target(...rest) { + finalTarget.apply(undefined, rest); + } + target(source('t10.1'), source('t10.2'), source('t10.3')); +}