mirror of
https://github.com/github/codeql.git
synced 2026-05-01 03:35:13 +02:00
Merge pull request #8883 from erik-krogh/pyMaD
Python: add MaD implementation
This commit is contained in:
Rasmus Wriedt Larsen
46
python/ql/test/experimental/meta/MaDTest.qll
Normal file
46
python/ql/test/experimental/meta/MaDTest.qll
Normal file
@@ -0,0 +1,46 @@
|
||||
import python
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.dataflow.new.internal.PrintNode
|
||||
private import semmle.python.frameworks.data.ModelsAsData
|
||||
// need to import Frameworks to get the actual modeling imported
|
||||
private import semmle.python.Frameworks
|
||||
// this import needs to be public to get the query predicates propagated to the actual test files
|
||||
import TestUtilities.InlineExpectationsTest
|
||||
|
||||
class MadSinkTest extends InlineExpectationsTest {
|
||||
MadSinkTest() { this = "MadSinkTest" }
|
||||
|
||||
override string getARelevantTag() {
|
||||
exists(string kind | exists(ModelOutput::getASinkNode(kind)) | result = "mad-sink__" + kind)
|
||||
}
|
||||
|
||||
override predicate hasActualResult(Location location, string element, string tag, string value) {
|
||||
exists(location.getFile().getRelativePath()) and
|
||||
exists(DataFlow::Node sink, string kind |
|
||||
sink = ModelOutput::getASinkNode(kind).getARhs() and
|
||||
location = sink.getLocation() and
|
||||
element = sink.toString() and
|
||||
value = prettyNodeForInlineTest(sink) and
|
||||
tag = "mad-sink__" + kind
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
class MadSourceTest extends InlineExpectationsTest {
|
||||
MadSourceTest() { this = "MadSourceTest" }
|
||||
|
||||
override string getARelevantTag() {
|
||||
exists(string kind | exists(ModelOutput::getASourceNode(kind)) | result = "mad-source__" + kind)
|
||||
}
|
||||
|
||||
override predicate hasActualResult(Location location, string element, string tag, string value) {
|
||||
exists(location.getFile().getRelativePath()) and
|
||||
exists(DataFlow::Node source, string kind |
|
||||
source = ModelOutput::getASourceNode(kind).getAnImmediateUse() and
|
||||
location = source.getLocation() and
|
||||
element = source.toString() and
|
||||
value = prettyNodeForInlineTest(source) and
|
||||
tag = "mad-source__" + kind
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,2 @@
|
||||
import python
|
||||
import experimental.meta.MaDTest
|
||||
@@ -7,17 +7,17 @@ async def test_connection():
|
||||
try:
|
||||
# The file-like object is passed in as a keyword-only argument.
|
||||
# See https://magicstack.github.io/asyncpg/current/api/index.html#asyncpg.connection.Connection.copy_from_query
|
||||
await conn.copy_from_query("sql", output="filepath") # $ getSql="sql" getAPathArgument="filepath"
|
||||
await conn.copy_from_query("sql", "arg1", "arg2", output="filepath") # $ getSql="sql" getAPathArgument="filepath"
|
||||
await conn.copy_from_query("sql", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__path-injection="filepath"
|
||||
await conn.copy_from_query("sql", "arg1", "arg2", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__path-injection="filepath"
|
||||
|
||||
await conn.copy_from_table("table", output="filepath") # $ getAPathArgument="filepath"
|
||||
await conn.copy_to_table("table", source="filepath") # $ getAPathArgument="filepath"
|
||||
await conn.copy_from_table("table", output="filepath") # $ mad-sink__path-injection="filepath"
|
||||
await conn.copy_to_table("table", source="filepath") # $ mad-sink__path-injection="filepath"
|
||||
|
||||
await conn.execute("sql") # $ getSql="sql"
|
||||
await conn.executemany("sql") # $ getSql="sql"
|
||||
await conn.fetch("sql") # $ getSql="sql"
|
||||
await conn.fetchrow("sql") # $ getSql="sql"
|
||||
await conn.fetchval("sql") # $ getSql="sql"
|
||||
await conn.execute("sql") # $ mad-sink__sql-injection="sql"
|
||||
await conn.executemany("sql") # $ mad-sink__sql-injection="sql"
|
||||
await conn.fetch("sql") # $ mad-sink__sql-injection="sql"
|
||||
await conn.fetchrow("sql") # $ mad-sink__sql-injection="sql"
|
||||
await conn.fetchval("sql") # $ mad-sink__sql-injection="sql"
|
||||
|
||||
finally:
|
||||
await conn.close()
|
||||
@@ -27,11 +27,11 @@ async def test_prepared_statement():
|
||||
conn = await asyncpg.connect()
|
||||
|
||||
try:
|
||||
pstmt = await conn.prepare("psql") # $ constructedSql="psql"
|
||||
pstmt.executemany() # $ getSql="psql"
|
||||
pstmt.fetch() # $ getSql="psql"
|
||||
pstmt.fetchrow() # $ getSql="psql"
|
||||
pstmt.fetchval() # $ getSql="psql"
|
||||
pstmt = await conn.prepare("psql") # $ mad-sink__sql-injection="psql"
|
||||
pstmt.executemany()
|
||||
pstmt.fetch()
|
||||
pstmt.fetchrow()
|
||||
pstmt.fetchval()
|
||||
|
||||
finally:
|
||||
await conn.close()
|
||||
@@ -46,7 +46,7 @@ async def test_cursor():
|
||||
cursor = await conn.cursor("sql") # $ getSql="sql" constructedSql="sql"
|
||||
await cursor.fetch()
|
||||
|
||||
pstmt = await conn.prepare("psql") # $ constructedSql="psql"
|
||||
pstmt = await conn.prepare("psql") # $ mad-sink__sql-injection="psql"
|
||||
pcursor = await pstmt.cursor() # $ getSql="psql"
|
||||
await pcursor.fetch()
|
||||
|
||||
@@ -69,23 +69,23 @@ async def test_connection_pool():
|
||||
pool = await asyncpg.create_pool()
|
||||
|
||||
try:
|
||||
await pool.copy_from_query("sql", output="filepath") # $ getSql="sql" getAPathArgument="filepath"
|
||||
await pool.copy_from_query("sql", "arg1", "arg2", output="filepath") # $ getSql="sql" getAPathArgument="filepath"
|
||||
await pool.copy_from_table("table", output="filepath") # $ getAPathArgument="filepath"
|
||||
await pool.copy_to_table("table", source="filepath") # $ getAPathArgument="filepath"
|
||||
await pool.copy_from_query("sql", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__path-injection="filepath"
|
||||
await pool.copy_from_query("sql", "arg1", "arg2", output="filepath") # $ mad-sink__sql-injection="sql" mad-sink__path-injection="filepath"
|
||||
await pool.copy_from_table("table", output="filepath") # $ mad-sink__path-injection="filepath"
|
||||
await pool.copy_to_table("table", source="filepath") # $ mad-sink__path-injection="filepath"
|
||||
|
||||
await pool.execute("sql") # $ getSql="sql"
|
||||
await pool.executemany("sql") # $ getSql="sql"
|
||||
await pool.fetch("sql") # $ getSql="sql"
|
||||
await pool.fetchrow("sql") # $ getSql="sql"
|
||||
await pool.fetchval("sql") # $ getSql="sql"
|
||||
await pool.execute("sql") # $ mad-sink__sql-injection="sql"
|
||||
await pool.executemany("sql") # $ mad-sink__sql-injection="sql"
|
||||
await pool.fetch("sql") # $ mad-sink__sql-injection="sql"
|
||||
await pool.fetchrow("sql") # $ mad-sink__sql-injection="sql"
|
||||
await pool.fetchval("sql") # $ mad-sink__sql-injection="sql"
|
||||
|
||||
async with pool.acquire() as conn:
|
||||
await conn.execute("sql") # $ getSql="sql"
|
||||
await conn.execute("sql") # $ mad-sink__sql-injection="sql"
|
||||
|
||||
conn = await pool.acquire()
|
||||
try:
|
||||
await conn.fetch("sql") # $ getSql="sql"
|
||||
await conn.fetch("sql") # $ mad-sink__sql-injection="sql"
|
||||
finally:
|
||||
await pool.release(conn)
|
||||
|
||||
@@ -93,13 +93,13 @@ async def test_connection_pool():
|
||||
await pool.close()
|
||||
|
||||
async with asyncpg.create_pool() as pool:
|
||||
await pool.execute("sql") # $ getSql="sql"
|
||||
await pool.execute("sql") # $ mad-sink__sql-injection="sql"
|
||||
|
||||
async with pool.acquire() as conn:
|
||||
await conn.execute("sql") # $ getSql="sql"
|
||||
await conn.execute("sql") # $ mad-sink__sql-injection="sql"
|
||||
|
||||
conn = await pool.acquire()
|
||||
try:
|
||||
await conn.fetch("sql") # $ getSql="sql"
|
||||
await conn.fetch("sql") # $ mad-sink__sql-injection="sql"
|
||||
finally:
|
||||
await pool.release(conn)
|
||||
|
||||
103
python/ql/test/library-tests/frameworks/data/test.expected
Normal file
103
python/ql/test/library-tests/frameworks/data/test.expected
Normal file
@@ -0,0 +1,103 @@
|
||||
taintFlow
|
||||
| test.py:3:5:3:15 | ControlFlowNode for getSource() | test.py:4:8:4:8 | ControlFlowNode for x |
|
||||
| test.py:3:5:3:15 | ControlFlowNode for getSource() | test.py:7:17:7:17 | ControlFlowNode for x |
|
||||
| test.py:9:8:9:14 | ControlFlowNode for alias() | test.py:9:8:9:14 | ControlFlowNode for alias() |
|
||||
| test.py:10:8:10:22 | ControlFlowNode for Attribute() | test.py:10:8:10:22 | ControlFlowNode for Attribute() |
|
||||
| test.py:11:8:11:30 | ControlFlowNode for Attribute() | test.py:11:8:11:30 | ControlFlowNode for Attribute() |
|
||||
| test.py:71:28:71:38 | ControlFlowNode for getSource() | test.py:71:8:71:39 | ControlFlowNode for Attribute() |
|
||||
| test.py:75:5:75:15 | ControlFlowNode for getSource() | test.py:76:22:76:22 | ControlFlowNode for x |
|
||||
| test.py:75:5:75:15 | ControlFlowNode for getSource() | test.py:77:22:77:22 | ControlFlowNode for y |
|
||||
| test.py:81:36:81:46 | ControlFlowNode for getSource() | test.py:81:8:81:47 | ControlFlowNode for Attribute() |
|
||||
| test.py:83:50:83:60 | ControlFlowNode for getSource() | test.py:83:8:83:61 | ControlFlowNode for Attribute() |
|
||||
| test.py:86:49:86:59 | ControlFlowNode for getSource() | test.py:86:8:86:60 | ControlFlowNode for Attribute() |
|
||||
| test.py:87:56:87:66 | ControlFlowNode for getSource() | test.py:87:8:87:67 | ControlFlowNode for Attribute() |
|
||||
isSink
|
||||
| test.py:4:8:4:8 | ControlFlowNode for x | test-sink |
|
||||
| test.py:7:17:7:17 | ControlFlowNode for x | test-sink |
|
||||
| test.py:9:8:9:14 | ControlFlowNode for alias() | test-sink |
|
||||
| test.py:10:8:10:22 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:11:8:11:30 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:12:8:12:34 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:16:11:16:13 | ControlFlowNode for one | test-sink |
|
||||
| test.py:17:19:17:21 | ControlFlowNode for two | test-sink |
|
||||
| test.py:17:24:17:28 | ControlFlowNode for three | test-sink |
|
||||
| test.py:17:31:17:34 | ControlFlowNode for four | test-sink |
|
||||
| test.py:18:37:18:40 | ControlFlowNode for five | test-sink |
|
||||
| test.py:19:21:19:26 | ControlFlowNode for second | test-sink |
|
||||
| test.py:30:21:30:23 | ControlFlowNode for one | test-sink |
|
||||
| test.py:32:22:32:24 | ControlFlowNode for one | test-sink |
|
||||
| test.py:32:27:32:29 | ControlFlowNode for two | test-sink |
|
||||
| test.py:33:22:33:24 | ControlFlowNode for one | test-sink |
|
||||
| test.py:33:27:33:29 | ControlFlowNode for two | test-sink |
|
||||
| test.py:33:32:33:36 | ControlFlowNode for three | test-sink |
|
||||
| test.py:57:27:57:33 | ControlFlowNode for arg_pos | test-sink |
|
||||
| test.py:66:17:66:20 | ControlFlowNode for arg1 | test-sink |
|
||||
| test.py:66:23:66:26 | ControlFlowNode for arg2 | test-sink |
|
||||
| test.py:66:34:66:43 | ControlFlowNode for namedThing | test-sink |
|
||||
| test.py:67:34:67:44 | ControlFlowNode for secondNamed | test-sink |
|
||||
| test.py:71:8:71:39 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:72:8:72:47 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:76:22:76:22 | ControlFlowNode for x | test-sink |
|
||||
| test.py:77:22:77:22 | ControlFlowNode for y | test-sink |
|
||||
| test.py:78:22:78:22 | ControlFlowNode for z | test-sink |
|
||||
| test.py:81:8:81:47 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:82:8:82:54 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:83:8:83:61 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:85:8:85:53 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:86:8:86:60 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:87:8:87:67 | ControlFlowNode for Attribute() | test-sink |
|
||||
| test.py:89:21:89:23 | ControlFlowNode for one | test-sink |
|
||||
| test.py:91:21:91:23 | ControlFlowNode for one | test-sink |
|
||||
| test.py:91:30:91:32 | ControlFlowNode for two | test-sink |
|
||||
| test.py:98:6:98:9 | ControlFlowNode for baz2 | test-sink |
|
||||
isSource
|
||||
| test.py:3:5:3:15 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:9:8:9:14 | ControlFlowNode for alias() | test-source |
|
||||
| test.py:10:8:10:14 | ControlFlowNode for alias() | test-source |
|
||||
| test.py:10:8:10:22 | ControlFlowNode for Attribute() | test-source |
|
||||
| test.py:11:8:11:14 | ControlFlowNode for alias() | test-source |
|
||||
| test.py:11:8:11:22 | ControlFlowNode for Attribute() | test-source |
|
||||
| test.py:11:8:11:30 | ControlFlowNode for Attribute() | test-source |
|
||||
| test.py:12:8:12:14 | ControlFlowNode for alias() | test-source |
|
||||
| test.py:12:8:12:22 | ControlFlowNode for Attribute() | test-source |
|
||||
| test.py:23:24:23:26 | ControlFlowNode for one | test-source |
|
||||
| test.py:24:33:24:35 | ControlFlowNode for two | test-source |
|
||||
| test.py:24:38:24:42 | ControlFlowNode for three | test-source |
|
||||
| test.py:24:45:24:48 | ControlFlowNode for four | test-source |
|
||||
| test.py:25:34:25:39 | ControlFlowNode for second | test-source |
|
||||
| test.py:39:11:39:20 | ControlFlowNode for Await | test-source |
|
||||
| test.py:41:8:41:27 | ControlFlowNode for Attribute() | test-source |
|
||||
| test.py:46:7:46:16 | ControlFlowNode for SubClass() | test-source |
|
||||
| test.py:53:7:53:16 | ControlFlowNode for Attribute() | test-source |
|
||||
| test.py:60:13:60:16 | ControlFlowNode for self | test-source |
|
||||
| test.py:60:24:60:28 | ControlFlowNode for named | test-source |
|
||||
| test.py:63:36:63:39 | ControlFlowNode for arg2 | test-source |
|
||||
| test.py:63:42:63:45 | ControlFlowNode for arg3 | test-source |
|
||||
| test.py:63:48:63:51 | ControlFlowNode for arg4 | test-source |
|
||||
| test.py:63:54:63:57 | ControlFlowNode for arg5 | test-source |
|
||||
| test.py:71:28:71:38 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:72:36:72:46 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:75:5:75:15 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:81:36:81:46 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:82:43:82:53 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:83:50:83:60 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:85:42:85:52 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:86:49:86:59 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:87:56:87:66 | ControlFlowNode for getSource() | test-source |
|
||||
| test.py:101:29:101:31 | ControlFlowNode for arg | test-source |
|
||||
| test.py:104:24:104:29 | ControlFlowNode for param1 | test-source |
|
||||
| test.py:104:32:104:37 | ControlFlowNode for param2 | test-source |
|
||||
| test.py:107:24:107:28 | ControlFlowNode for name1 | test-source |
|
||||
| test.py:107:31:107:35 | ControlFlowNode for name2 | test-source |
|
||||
syntaxErrors
|
||||
| Member[foo |
|
||||
| Member[foo] .Member[bar] |
|
||||
| Member[foo] Member[bar] |
|
||||
| Member[foo], Member[bar] |
|
||||
| Member[foo],Member[bar] |
|
||||
| Member[foo]. Member[bar] |
|
||||
| Member[foo]..Member[bar] |
|
||||
| Member[foo]Member[bar] |
|
||||
| Member[foo]] |
|
||||
| Member[foo]].Member[bar] |
|
||||
warning
|
||||
108
python/ql/test/library-tests/frameworks/data/test.py
Normal file
108
python/ql/test/library-tests/frameworks/data/test.py
Normal file
@@ -0,0 +1,108 @@
|
||||
from testlib import getSource, mySink, alias
|
||||
|
||||
x = getSource()
|
||||
mySink(x)
|
||||
|
||||
mySink(foo=x) # OK
|
||||
mySink(sinkName=x) # NOT OK
|
||||
|
||||
mySink(alias()) # NOT OK
|
||||
mySink(alias().chain()) # NOT OK
|
||||
mySink(alias().chain().chain()) # NOT OK
|
||||
mySink(alias().chain().safeThing()) # OK
|
||||
|
||||
from testlib import Args
|
||||
|
||||
Args.arg0(one, two, three, four, five)
|
||||
Args.arg1to3(one, two, three, four, five)
|
||||
Args.lastarg(one, two, three, four, five)
|
||||
Args.nonFist(first, second)
|
||||
|
||||
from testlib import Callbacks
|
||||
|
||||
Callbacks.first(lambda one, two, three, four, five: 0)
|
||||
Callbacks.param1to3(lambda one, two, three, four, five: 0)
|
||||
Callbacks.nonFirst(lambda first, second: 0)
|
||||
|
||||
from testlib import CallFilter
|
||||
|
||||
CallFilter.arityOne(one, two) # NO match
|
||||
CallFilter.arityOne(one) # Match
|
||||
CallFilter.twoOrMore(one) # NO match
|
||||
CallFilter.twoOrMore(one, two) # Match
|
||||
CallFilter.twoOrMore(one, two, three) # Match
|
||||
|
||||
from testlib import CommonTokens
|
||||
|
||||
async def async_func():
|
||||
prom = CommonTokens.makePromise(1);
|
||||
val = await prom
|
||||
|
||||
inst = CommonTokens.Class()
|
||||
|
||||
class SubClass (CommonTokens.Super):
|
||||
pass
|
||||
|
||||
sub = SubClass()
|
||||
|
||||
class Sub2Class (CommonTokens.Class):
|
||||
pass
|
||||
|
||||
sub2 = Sub2Class() # TODO: Currently not recognized as an instance of CommonTokens.Class
|
||||
|
||||
val = inst.foo()
|
||||
|
||||
from testlib import ArgPos
|
||||
|
||||
arg_pos = ArgPos(); val = arg_pos.self_thing(arg, named=2);
|
||||
|
||||
class SubClass (ArgPos.MyClass):
|
||||
def foo(self, arg, named=2, otherName=3):
|
||||
pass
|
||||
|
||||
def secondAndAfter(self, arg1, arg2, arg3, arg4, arg5):
|
||||
pass
|
||||
|
||||
ArgPos.anyParam(arg1, arg2, name=namedThing)
|
||||
ArgPos.anyNamed(arg4, arg5, name=secondNamed)
|
||||
|
||||
from testlib import Steps
|
||||
|
||||
mySink(Steps.preserveTaint(getSource())) # FLOW
|
||||
mySink(Steps.preserveTaint("safe", getSource())) # NO FLOW
|
||||
|
||||
Steps.taintIntoCallback(
|
||||
getSource(),
|
||||
lambda x: mySink(x), # FLOW
|
||||
lambda y: mySink(y), # FLOW
|
||||
lambda z: mySink(z) # NO FLOW
|
||||
)
|
||||
|
||||
mySink(Steps.preserveArgZeroAndTwo(getSource())) # FLOW
|
||||
mySink(Steps.preserveArgZeroAndTwo("foo", getSource())) # NO FLOW
|
||||
mySink(Steps.preserveArgZeroAndTwo("foo", "bar", getSource())) # FLOW
|
||||
|
||||
mySink(Steps.preserveAllButFirstArgument(getSource())) # NO FLOW
|
||||
mySink(Steps.preserveAllButFirstArgument("foo", getSource())) # FLOW
|
||||
mySink(Steps.preserveAllButFirstArgument("foo", "bar", getSource())) # FLOW
|
||||
|
||||
CallFilter.arityOne(one) # match
|
||||
CallFilter.arityOne(one=one) # NO match
|
||||
CallFilter.arityOne(one, two=two) # match - on both the named and positional arguments
|
||||
CallFilter.arityOne(one=one, two=two) # NO match
|
||||
|
||||
from foo1.bar import baz1
|
||||
baz1(baz1) # no match, and that's the point.
|
||||
|
||||
from foo2.bar import baz2
|
||||
baz2(baz2) # match
|
||||
|
||||
class OtherSubClass (ArgPos.MyClass):
|
||||
def otherSelfTest(self, arg, named=2, otherName=3): # test that Parameter[0] hits `arg`.
|
||||
pass
|
||||
|
||||
def anyParam(self, param1, param2): # Parameter[any] matches all non-self parameters
|
||||
pass
|
||||
|
||||
def anyNamed(self, name1, name2=2): # Parameter[any-named] matches all non-self named parameters
|
||||
pass
|
||||
127
python/ql/test/library-tests/frameworks/data/test.ql
Normal file
127
python/ql/test/library-tests/frameworks/data/test.ql
Normal file
@@ -0,0 +1,127 @@
|
||||
import python
|
||||
import semmle.python.frameworks.data.internal.AccessPathSyntax as AccessPathSyntax
|
||||
import semmle.python.frameworks.data.ModelsAsData
|
||||
import semmle.python.dataflow.new.TaintTracking
|
||||
import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.ApiGraphs
|
||||
|
||||
class Steps extends ModelInput::SummaryModelCsv {
|
||||
override predicate row(string row) {
|
||||
// package;type;path;input;output;kind
|
||||
row =
|
||||
[
|
||||
"testlib;;Member[Steps].Member[preserveTaint].Call;Argument[0];ReturnValue;taint",
|
||||
"testlib;;Member[Steps].Member[taintIntoCallback];Argument[0];Argument[1..2].Parameter[0];taint",
|
||||
"testlib;;Member[Steps].Member[preserveArgZeroAndTwo];Argument[0,2];ReturnValue;taint",
|
||||
"testlib;;Member[Steps].Member[preserveAllButFirstArgument].Call;Argument[1..];ReturnValue;taint",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
class Types extends ModelInput::TypeModelCsv {
|
||||
override predicate row(string row) {
|
||||
// package1;type1;package2;type2;path
|
||||
row =
|
||||
[
|
||||
"testlib;Alias;testlib;;Member[alias].ReturnValue",
|
||||
"testlib;Alias;testlib;Alias;Member[chain].ReturnValue",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
class Sinks extends ModelInput::SinkModelCsv {
|
||||
override predicate row(string row) {
|
||||
// package;type;path;kind
|
||||
row =
|
||||
[
|
||||
"testlib;;Member[mySink].Argument[0,sinkName:];test-sink",
|
||||
// testing argument syntax
|
||||
"testlib;;Member[Args].Member[arg0].Argument[0];test-sink", //
|
||||
"testlib;;Member[Args].Member[arg1to3].Argument[1..3];test-sink", //
|
||||
"testlib;;Member[Args].Member[lastarg].Argument[N-1];test-sink", //
|
||||
"testlib;;Member[Args].Member[nonFist].Argument[1..];test-sink", //
|
||||
// callsite filter.
|
||||
"testlib;;Member[CallFilter].Member[arityOne].WithArity[1].Argument[any];test-sink", //
|
||||
"testlib;;Member[CallFilter].Member[twoOrMore].WithArity[2..].Argument[0..];test-sink", //
|
||||
// testing non-positional arguments
|
||||
"testlib;;Member[ArgPos].Instance.Member[self_thing].Argument[self];test-sink", //
|
||||
// any argument
|
||||
"testlib;;Member[ArgPos].Member[anyParam].Argument[any];test-sink", //
|
||||
"testlib;;Member[ArgPos].Member[anyNamed].Argument[any-named];test-sink", //
|
||||
// testing package syntax
|
||||
"foo1.bar;;Member[baz1].Argument[any];test-sink", //
|
||||
"foo2;;Member[bar].Member[baz2].Argument[any];test-sink", //
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
class Sources extends ModelInput::SourceModelCsv {
|
||||
// package;type;path;kind
|
||||
override predicate row(string row) {
|
||||
row =
|
||||
[
|
||||
"testlib;;Member[getSource].ReturnValue;test-source", //
|
||||
"testlib;Alias;;test-source",
|
||||
// testing parameter syntax
|
||||
"testlib;;Member[Callbacks].Member[first].Argument[0].Parameter[0];test-source", //
|
||||
"testlib;;Member[Callbacks].Member[param1to3].Argument[0].Parameter[1..3];test-source", //
|
||||
"testlib;;Member[Callbacks].Member[nonFirst].Argument[0].Parameter[1..];test-source", //
|
||||
// Common tokens.
|
||||
"testlib;;Member[CommonTokens].Member[makePromise].ReturnValue.Awaited;test-source", //
|
||||
"testlib;;Member[CommonTokens].Member[Class].Instance;test-source", //
|
||||
"testlib;;Member[CommonTokens].Member[Super].Subclass.Instance;test-source", //
|
||||
// method
|
||||
"testlib;;Member[CommonTokens].Member[Class].Instance.Method[foo];test-source", //
|
||||
// testing non-positional arguments
|
||||
"testlib;;Member[ArgPos].Member[MyClass].Subclass.Member[foo].Parameter[self];test-source", //
|
||||
"testlib;;Member[ArgPos].Member[MyClass].Subclass.Member[foo].Parameter[named:];test-source", //
|
||||
"testlib;;Member[ArgPos].Member[MyClass].Subclass.Member[secondAndAfter].Parameter[1..];test-source", //
|
||||
"testlib;;Member[ArgPos].Member[MyClass].Subclass.Member[otherSelfTest].Parameter[0];test-source", //
|
||||
"testlib;;Member[ArgPos].Member[MyClass].Subclass.Member[anyParam].Parameter[any];test-source", //
|
||||
"testlib;;Member[ArgPos].Member[MyClass].Subclass.Member[anyNamed].Parameter[any-named];test-source", //
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
class BasicTaintTracking extends TaintTracking::Configuration {
|
||||
BasicTaintTracking() { this = "BasicTaintTracking" }
|
||||
|
||||
override predicate isSource(DataFlow::Node source) {
|
||||
source = ModelOutput::getASourceNode("test-source").getAnImmediateUse()
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) {
|
||||
sink = ModelOutput::getASinkNode("test-sink").getARhs()
|
||||
}
|
||||
}
|
||||
|
||||
query predicate taintFlow(DataFlow::Node source, DataFlow::Node sink) {
|
||||
any(BasicTaintTracking tr).hasFlow(source, sink)
|
||||
}
|
||||
|
||||
query predicate isSink(DataFlow::Node node, string kind) {
|
||||
node = ModelOutput::getASinkNode(kind).getARhs()
|
||||
}
|
||||
|
||||
query predicate isSource(DataFlow::Node node, string kind) {
|
||||
node = ModelOutput::getASourceNode(kind).getAnImmediateUse()
|
||||
}
|
||||
|
||||
class SyntaxErrorTest extends ModelInput::SinkModelCsv {
|
||||
override predicate row(string row) {
|
||||
row =
|
||||
[
|
||||
"testlib;;Member[foo],Member[bar];test-sink", "testlib;;Member[foo] Member[bar];test-sink",
|
||||
"testlib;;Member[foo]. Member[bar];test-sink",
|
||||
"testlib;;Member[foo], Member[bar];test-sink",
|
||||
"testlib;;Member[foo]..Member[bar];test-sink",
|
||||
"testlib;;Member[foo] .Member[bar];test-sink", "testlib;;Member[foo]Member[bar];test-sink",
|
||||
"testlib;;Member[foo;test-sink", "testlib;;Member[foo]];test-sink",
|
||||
"testlib;;Member[foo]].Member[bar];test-sink"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
query predicate syntaxErrors(AccessPathSyntax::AccessPath path) { path.hasSyntaxError() }
|
||||
|
||||
query predicate warning = ModelOutput::getAWarning/0;
|
||||
@@ -0,0 +1,7 @@
|
||||
| CSV type row should have 5 columns but has 2: test;TooFewColumns |
|
||||
| CSV type row should have 5 columns but has 8: test;TooManyColumns;;;Member[Foo].Instance;too;many;columns |
|
||||
| Invalid argument '0-1' in token 'Argument[0-1]' in access path: Method[foo].Argument[0-1] |
|
||||
| Invalid argument '*' in token 'Argument[*]' in access path: Method[foo].Argument[*] |
|
||||
| Invalid token 'Argument' is missing its arguments, in access path: Method[foo].Argument |
|
||||
| Invalid token 'Member' is missing its arguments, in access path: Method[foo].Member |
|
||||
| Invalid token name 'Arg' in access path: Method[foo].Arg[0] |
|
||||
25
python/ql/test/library-tests/frameworks/data/warnings.ql
Normal file
25
python/ql/test/library-tests/frameworks/data/warnings.ql
Normal file
@@ -0,0 +1,25 @@
|
||||
import python
|
||||
import semmle.python.frameworks.data.internal.AccessPathSyntax as AccessPathSyntax
|
||||
import semmle.python.frameworks.data.internal.ApiGraphModels as ApiGraphModels
|
||||
import semmle.python.frameworks.data.ModelsAsData
|
||||
|
||||
private class InvalidTypeModel extends ModelInput::TypeModelCsv {
|
||||
override predicate row(string row) {
|
||||
row =
|
||||
[
|
||||
"test;TooManyColumns;;;Member[Foo].Instance;too;many;columns", //
|
||||
"test;TooFewColumns", //
|
||||
"test;X;test;Y;Method[foo].Arg[0]", //
|
||||
"test;X;test;Y;Method[foo].Argument[0-1]", //
|
||||
"test;X;test;Y;Method[foo].Argument[*]", //
|
||||
"test;X;test;Y;Method[foo].Argument", //
|
||||
"test;X;test;Y;Method[foo].Member", //
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
class IsTesting extends ApiGraphModels::TestAllModels {
|
||||
IsTesting() { this = this }
|
||||
}
|
||||
|
||||
query predicate warning = ModelOutput::getAWarning/0;
|
||||
Reference in New Issue
Block a user