hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add more expected collection taint steps

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2020-08-26 20:28:33 +02:00
parent 423139bc22
commit c24e3452f5
2 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.expected
View File

@@ -43,6 +43,14 @@
| collections.py:112 | fail | test_defaultdict | tainted_default_dict.copy() |
| collections.py:115 | fail | test_defaultdict | v |
| collections.py:117 | fail | test_defaultdict | v |
| collections.py:124 | ok | list_clear | tainted_list |
| collections.py:127 | fail | list_clear | tainted_list |
| collections.py:134 | ok | list_index_assign | my_list |
| collections.py:137 | fail | list_index_assign | my_list |
| collections.py:144 | ok | list_index_aug_assign | my_list |
| collections.py:147 | fail | list_index_aug_assign | my_list |
| collections.py:154 | ok | list_append | my_list |
| collections.py:157 | fail | list_append | my_list |
| json.py:26 | ok | test | json.dumps(..) |
| json.py:27 | ok | test | json.loads(..) |
| json.py:34 | fail | test | tainted_filelike |

40
python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/collections.py
View File

@@ -117,6 +117,46 @@ def test_defaultdict(key, x): # TODO: defaultdict currently not handled
ensure_tainted(v)
def list_clear():
tainted_string = TAINTED_STRING
tainted_list = [tainted_string]
ensure_tainted(tainted_list)
tainted_list.clear()
ensure_not_tainted(tainted_list)
def list_index_assign():
tainted_string = TAINTED_STRING
my_list = ["safe"]
ensure_not_tainted(my_list)
my_list[0] = tainted_string
ensure_tainted(my_list)
def list_index_aug_assign():
tainted_string = TAINTED_STRING
my_list = ["safe"]
ensure_not_tainted(my_list)
my_list[0] += tainted_string
ensure_tainted(my_list)
def list_append():
tainted_string = TAINTED_STRING
my_list = ["safe"]
ensure_not_tainted(my_list)
my_list.append(tainted_string)
ensure_tainted(my_list)
# Make tests runable
test_construction()