Add extension method dataflow tests

This commit is contained in:
Tamas Vajk
2022-03-31 13:57:49 +02:00
committed by Ian Lynagh
parent fac3699a5b
commit 6fccbaa93b
3 changed files with 61 additions and 0 deletions

View File

@@ -0,0 +1,2 @@
| test.kt:20:29:20:31 | new C(...) | test.kt:23:22:23:28 | self1(...) |
| test.kt:20:29:20:31 | new C(...) | test.kt:29:18:29:29 | fn1(...) |

View File

@@ -0,0 +1,40 @@
class C {
fun self1() = this
fun fn1(o: C) = o
fun Int.fn3(o: C) = o
fun Int.fn4() = this@C
fun call1(o: C) = 1.fn3(o)
fun call2() = 1.fn4()
}
fun C.self2() = this
fun C.fn2(o: C) = o
class Test {
fun <T> taint(t: T) = t
fun sink(a: Any) {}
fun test(s1: String) {
val tainted = taint(C())
sink(C().self1())
sink(tainted.self1())
sink(C().self2())
sink(tainted.self2())
sink(C().fn1(C()))
sink(C().fn1(tainted))
sink(C().fn2(C()))
sink(C().fn2(tainted))
sink(C().call1(C()))
sink(C().call1(tainted))
sink(C().call2())
sink(tainted.call2())
}
}

View File

@@ -0,0 +1,19 @@
import java
import semmle.code.java.dataflow.TaintTracking
import semmle.code.java.dataflow.ExternalFlow
class Conf extends TaintTracking::Configuration {
Conf() { this = "qltest:extension-method" }
override predicate isSource(DataFlow::Node n) {
n.asExpr().(Argument).getCall().getCallee().hasName("taint")
}
override predicate isSink(DataFlow::Node n) {
n.asExpr().(Argument).getCall().getCallee().hasName("sink")
}
}
from DataFlow::Node src, DataFlow::Node sink, Conf conf
where conf.hasFlow(src, sink)
select src, sink