hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Port threat-model test to ConfigSig

Browse Source
This commit is contained in:
Asger F
2024-11-28 11:05:52 +01:00
parent f758b67d30
commit a568d8c086
2 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
javascript/ql/test/library-tests/threat-models/sources/TestSources.expected
View File

@@ -1,2 +1,3 @@
legacyDataFlowDifference
testFailures
failures

21
javascript/ql/test/library-tests/threat-models/sources/TestSources.ql
View File

@@ -1,12 +1,10 @@
import javascript
import testUtilities.InlineExpectationsTest
class TestSourcesConfiguration extends TaintTracking::Configuration {
TestSourcesConfiguration() { this = "TestSources" }
module TestConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof ThreatModelSource }
override predicate isSource(DataFlow::Node source) { source instanceof ThreatModelSource }
override predicate isSink(DataFlow::Node sink) {
predicate isSink(DataFlow::Node sink) {
exists(CallExpr call |
call.getAnArgument() = sink.asExpr() and
call.getCalleeName() = "SINK"
@@ -14,12 +12,22 @@ class TestSourcesConfiguration extends TaintTracking::Configuration {
}
}
module TestFlow = TaintTracking::Global<TestConfig>;
deprecated class LegacyConfig extends TaintTracking::Configuration {
LegacyConfig() { this = "TestSources" }
override predicate isSource(DataFlow::Node source) { TestConfig::isSource(source) }
override predicate isSink(DataFlow::Node sink) { TestConfig::isSink(sink) }
}
private module InlineTestSources implements TestSig {
string getARelevantTag() { result in ["hasFlow", "threat-source"] }
predicate hasActualResult(Location location, string element, string tag, string value) {
exists(DataFlow::Node sink |
any(TestSourcesConfiguration c).hasFlow(_, sink) and
TestFlow::flowTo(sink) and
value = "" and
location = sink.getLocation() and
tag = "hasFlow" and
@@ -36,3 +44,4 @@ private module InlineTestSources implements TestSig {
}
import MakeTest<InlineTestSources>
deprecated import testUtilities.LegacyDataFlowDiff::DataFlowDiff<TestFlow, LegacyConfig>