mirror of
https://github.com/github/codeql.git
synced 2026-04-28 10:15:14 +02:00
Add extension method dataflow tests
This commit is contained in:
@@ -0,0 +1,2 @@
|
||||
| test.kt:20:29:20:31 | new C(...) | test.kt:23:22:23:28 | self1(...) |
|
||||
| test.kt:20:29:20:31 | new C(...) | test.kt:29:18:29:29 | fn1(...) |
|
||||
@@ -0,0 +1,40 @@
|
||||
class C {
|
||||
fun self1() = this
|
||||
fun fn1(o: C) = o
|
||||
|
||||
fun Int.fn3(o: C) = o
|
||||
fun Int.fn4() = this@C
|
||||
|
||||
fun call1(o: C) = 1.fn3(o)
|
||||
fun call2() = 1.fn4()
|
||||
}
|
||||
|
||||
fun C.self2() = this
|
||||
fun C.fn2(o: C) = o
|
||||
|
||||
class Test {
|
||||
fun <T> taint(t: T) = t
|
||||
fun sink(a: Any) {}
|
||||
|
||||
fun test(s1: String) {
|
||||
val tainted = taint(C())
|
||||
|
||||
sink(C().self1())
|
||||
sink(tainted.self1())
|
||||
|
||||
sink(C().self2())
|
||||
sink(tainted.self2())
|
||||
|
||||
sink(C().fn1(C()))
|
||||
sink(C().fn1(tainted))
|
||||
|
||||
sink(C().fn2(C()))
|
||||
sink(C().fn2(tainted))
|
||||
|
||||
sink(C().call1(C()))
|
||||
sink(C().call1(tainted))
|
||||
|
||||
sink(C().call2())
|
||||
sink(tainted.call2())
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
import java
|
||||
import semmle.code.java.dataflow.TaintTracking
|
||||
import semmle.code.java.dataflow.ExternalFlow
|
||||
|
||||
class Conf extends TaintTracking::Configuration {
|
||||
Conf() { this = "qltest:extension-method" }
|
||||
|
||||
override predicate isSource(DataFlow::Node n) {
|
||||
n.asExpr().(Argument).getCall().getCallee().hasName("taint")
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node n) {
|
||||
n.asExpr().(Argument).getCall().getCallee().hasName("sink")
|
||||
}
|
||||
}
|
||||
|
||||
from DataFlow::Node src, DataFlow::Node sink, Conf conf
|
||||
where conf.hasFlow(src, sink)
|
||||
select src, sink
|
||||
Reference in New Issue
Block a user