hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ruby: Add test for spurious splat flow

Browse Source 
We don't yet properly model splat flow when a positional argument
follows a splat argument.
This commit is contained in:
Harry Maclean
2023-08-21 16:11:10 +01:00
parent 0bbda992fb
commit c615f183c1
2 changed files with 26 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
ruby/ql/test/library-tests/dataflow/params/params-flow.expected
View File

@@ -107,6 +107,15 @@ edges
| params_flow.rb:118:12:118:13 | * ... [element] | params_flow.rb:9:16:9:17 | p1 |
| params_flow.rb:118:12:118:13 | * ... [element] | params_flow.rb:9:20:9:21 | p2 |
| params_flow.rb:118:13:118:13 | x [element] | params_flow.rb:118:12:118:13 | * ... [element] |
| params_flow.rb:130:1:130:4 | args [element 0] | params_flow.rb:131:11:131:14 | args [element 0] |
| params_flow.rb:130:1:130:4 | args [element 1] | params_flow.rb:131:11:131:14 | args [element 1] |
| params_flow.rb:130:9:130:17 | call to taint | params_flow.rb:130:1:130:4 | args [element 0] |
| params_flow.rb:130:20:130:28 | call to taint | params_flow.rb:130:1:130:4 | args [element 1] |
| params_flow.rb:131:10:131:14 | * ... [element 0] | params_flow.rb:83:14:83:14 | t |
| params_flow.rb:131:10:131:14 | * ... [element 1] | params_flow.rb:83:17:83:17 | u |
| params_flow.rb:131:11:131:14 | args [element 0] | params_flow.rb:131:10:131:14 | * ... [element 0] |
| params_flow.rb:131:11:131:14 | args [element 1] | params_flow.rb:131:10:131:14 | * ... [element 1] |
| params_flow.rb:131:17:131:25 | call to taint | params_flow.rb:83:17:83:17 | u |
nodes
| params_flow.rb:9:16:9:17 | p1 | semmle.label | p1 |
| params_flow.rb:9:20:9:21 | p2 | semmle.label | p2 |
@@ -235,6 +244,15 @@ nodes
| params_flow.rb:117:19:117:27 | call to taint | semmle.label | call to taint |
| params_flow.rb:118:12:118:13 | * ... [element] | semmle.label | * ... [element] |
| params_flow.rb:118:13:118:13 | x [element] | semmle.label | x [element] |
| params_flow.rb:130:1:130:4 | args [element 0] | semmle.label | args [element 0] |
| params_flow.rb:130:1:130:4 | args [element 1] | semmle.label | args [element 1] |
| params_flow.rb:130:9:130:17 | call to taint | semmle.label | call to taint |
| params_flow.rb:130:20:130:28 | call to taint | semmle.label | call to taint |
| params_flow.rb:131:10:131:14 | * ... [element 0] | semmle.label | * ... [element 0] |
| params_flow.rb:131:10:131:14 | * ... [element 1] | semmle.label | * ... [element 1] |
| params_flow.rb:131:11:131:14 | args [element 0] | semmle.label | args [element 0] |
| params_flow.rb:131:11:131:14 | args [element 1] | semmle.label | args [element 1] |
| params_flow.rb:131:17:131:25 | call to taint | semmle.label | call to taint |
subpaths
#select
| params_flow.rb:10:10:10:11 | p1 | params_flow.rb:14:12:14:19 | call to taint | params_flow.rb:10:10:10:11 | p1 | $@ | params_flow.rb:14:12:14:19 | call to taint | call to taint |
@@ -275,7 +293,10 @@ subpaths
| params_flow.rb:75:10:75:10 | r | params_flow.rb:78:54:78:62 | call to taint | params_flow.rb:75:10:75:10 | r | $@ | params_flow.rb:78:54:78:62 | call to taint | call to taint |
| params_flow.rb:75:10:75:10 | r | params_flow.rb:96:79:96:87 | call to taint | params_flow.rb:75:10:75:10 | r | $@ | params_flow.rb:96:79:96:87 | call to taint | call to taint |
| params_flow.rb:84:10:84:10 | t | params_flow.rb:94:10:94:18 | call to taint | params_flow.rb:84:10:84:10 | t | $@ | params_flow.rb:94:10:94:18 | call to taint | call to taint |
| params_flow.rb:84:10:84:10 | t | params_flow.rb:130:9:130:17 | call to taint | params_flow.rb:84:10:84:10 | t | $@ | params_flow.rb:130:9:130:17 | call to taint | call to taint |
| params_flow.rb:85:10:85:10 | u | params_flow.rb:94:21:94:29 | call to taint | params_flow.rb:85:10:85:10 | u | $@ | params_flow.rb:94:21:94:29 | call to taint | call to taint |
| params_flow.rb:85:10:85:10 | u | params_flow.rb:130:20:130:28 | call to taint | params_flow.rb:85:10:85:10 | u | $@ | params_flow.rb:130:20:130:28 | call to taint | call to taint |
| params_flow.rb:85:10:85:10 | u | params_flow.rb:131:17:131:25 | call to taint | params_flow.rb:85:10:85:10 | u | $@ | params_flow.rb:131:17:131:25 | call to taint | call to taint |
| params_flow.rb:87:10:87:10 | w | params_flow.rb:94:39:94:47 | call to taint | params_flow.rb:87:10:87:10 | w | $@ | params_flow.rb:94:39:94:47 | call to taint | call to taint |
| params_flow.rb:99:10:99:10 | a | params_flow.rb:105:15:105:23 | call to taint | params_flow.rb:99:10:99:10 | a | $@ | params_flow.rb:105:15:105:23 | call to taint | call to taint |
| params_flow.rb:99:10:99:10 | a | params_flow.rb:106:15:106:23 | call to taint | params_flow.rb:99:10:99:10 | a | $@ | params_flow.rb:106:15:106:23 | call to taint | call to taint |

7
ruby/ql/test/library-tests/dataflow/params/params_flow.rb
View File

@@ -81,8 +81,8 @@ args = [taint(33), taint(34), taint(35), taint(36)]
splatmid(taint(32), *args, taint(37))
def pos_many(t, u, v, w, x, y, z)
sink t # $ hasValueFlow=38
sink u # $ hasValueFlow=39
sink t # $ hasValueFlow=38 $ hasValueFlow=66
sink u # $ hasValueFlow=39 $ hasValueFlow=67 $ SPURIOUS: hasValueFlow=68
sink v # $ MISSING: hasValueFlow=40
sink w # $ MISSING: hasValueFlow=41 $ SPURIOUS: hasValueFlow=44
sink x # $ MISSING: hasValueFlow=42
@@ -126,3 +126,6 @@ def destruct((a,b), (c,(d,e)))
end
destruct([taint(62), taint(63)], [taint(64), [0, taint(65)]])
args = [taint(66), taint(67)]
pos_many(*args, taint(68), nil, nil, nil, nil)