hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add failing test.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-10-23 19:29:28 +01:00
parent e301223644
commit c0b04eac7c
3 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -2199,6 +2199,19 @@ WARNING: Module TaintTracking has been deprecated and may be removed in future (
| map.cpp:436:55:436:59 | def | map.cpp:436:19:436:60 | call to pair | TAINT |
| map.cpp:436:63:436:67 | first | map.cpp:436:7:436:67 | call to iterator | |
| map.cpp:437:7:437:9 | m35 | map.cpp:437:7:437:9 | call to unordered_map | |
| map.cpp:446:23:446:23 | call to map | map.cpp:448:3:448:3 | m | |
| map.cpp:446:23:446:23 | call to map | map.cpp:449:12:449:12 | m | |
| map.cpp:446:23:446:23 | call to map | map.cpp:451:1:451:1 | m | |
| map.cpp:447:12:447:26 | call to indirect_source | map.cpp:448:10:448:10 | p | |
| map.cpp:448:3:448:3 | m | map.cpp:448:4:448:4 | call to operator[] | TAINT |
| map.cpp:448:3:448:3 | ref arg m | map.cpp:449:12:449:12 | m | |
| map.cpp:448:3:448:3 | ref arg m | map.cpp:451:1:451:1 | m | |
| map.cpp:448:3:448:10 | ... = ... | map.cpp:448:4:448:4 | call to operator[] [post update] | |
| map.cpp:448:4:448:4 | call to operator[] [post update] | map.cpp:448:3:448:3 | ref arg m | TAINT |
| map.cpp:448:10:448:10 | p | map.cpp:448:3:448:10 | ... = ... | |
| map.cpp:449:12:449:12 | m | map.cpp:449:13:449:13 | call to operator[] | TAINT |
| map.cpp:449:12:449:12 | ref arg m | map.cpp:451:1:451:1 | m | |
| map.cpp:449:13:449:13 | call to operator[] | map.cpp:450:8:450:8 | q | |
| movableclass.cpp:8:2:8:15 | this | movableclass.cpp:8:27:8:31 | constructor init of field v [pre-this] | |
| movableclass.cpp:8:21:8:22 | _v | movableclass.cpp:8:29:8:30 | _v | |
| movableclass.cpp:8:29:8:30 | _v | movableclass.cpp:8:27:8:31 | constructor init of field v | TAINT |

13
cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp
View File

@@ -436,3 +436,16 @@ void test_unordered_map()
sink(m35.emplace(std::pair<char *, char *>(source(), "def")).first); // $ MISSING: ast,ir
sink(m35); // $ MISSING: ast,ir
}
namespace {
int* indirect_source();
void indirect_sink(int*);
}
void test_indirect_taint() {
std::map<int, int*> m;
int* p = indirect_source();
m[1] = p;
int* q = m[1];
sink(q); // $ MISSING: ast ir
}

2
cpp/ql/test/library-tests/dataflow/taint-tests/taint.ql
View File

@@ -84,6 +84,8 @@ module IRTest {
or
source.asIndirectExpr().(FunctionCall).getTarget().getName() = "source"
or
source.asIndirectExpr().(FunctionCall).getTarget().getName() = "indirect_source"
or
source.asParameter().getName().matches("source%")
or
exists(FunctionCall fc |