hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Swift: update test output

Browse Source 
The 'first' field is seen as a TaintInheritingContent, which means any read step for 'first' becomes a taint step too.
This type of taint step does not permit an implicit read before it, because it wasn't contributed by a configuration.
So there is no way for the taint to get out of the collection content before the taint step through '.first'.
The test previously passed because an implicit read at once of the earlier sinks could follow use-use flow down to the receiver of .first,
allowing it to escape the collection content.
This commit is contained in:
Asger F
2024-08-23 11:30:50 +02:00
parent d27b28d371
commit 8df7fbf6d6
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
swift/ql/test/library-tests/dataflow/taint/libraries/set.swift
View File

@@ -28,7 +28,7 @@ func testSet(ix: Int) {
sink(arg: taintedSet.max()!) // $ tainted=t1
sink(arg: taintedSet.firstIndex(of: source("t2"))!)
sink(arg: taintedSet[taintedSet.firstIndex(of: source("t3"))!]) // $ tainted=t1
sink(arg: taintedSet.first!) // $ tainted=t1
sink(arg: taintedSet.first!) // $ MISSING: tainted=t1
for elem in taintedSet {
sink(arg: elem) // $ tainted=t1
}
@@ -100,7 +100,7 @@ func testSet(ix: Int) {
sink(arg: taintedSet.sorted().randomElement()!) // $ tainted=t1
sink(arg: taintedSet.shuffled().randomElement()!) // $ tainted=t1
sink(arg: taintedSet.lazy[taintedSet.firstIndex(of: source("t11"))!]) // $ tainted=t1
sink(arg: taintedSet.lazy[taintedSet.firstIndex(of: source("t11"))!]) // $ MISSING: tainted=t1
var it = taintedSet.makeIterator()
sink(arg: it.next()!) // $ tainted=t1