hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: More test cases for salary.

Browse Source
This commit is contained in:
Geoffrey White
2022-03-29 15:05:27 +01:00
parent 0e3e145e53
commit cf5c6baadd
2 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected
View File

@@ -94,6 +94,8 @@ edges
| test3.cpp:429:7:429:14 | password | test3.cpp:431:8:431:15 | password |
| test3.cpp:526:44:526:54 | my_latitude | test3.cpp:527:15:527:20 | buffer |
| test3.cpp:532:45:532:58 | home_longitude | test3.cpp:533:15:533:20 | buffer |
| test3.cpp:551:47:551:58 | salaryString | test3.cpp:552:15:552:20 | buffer |
| test3.cpp:556:19:556:30 | salaryString | test3.cpp:559:15:559:20 | buffer |
| test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:21:48:27 | call to encrypt |
| test.cpp:41:23:41:43 | cleartext password! | test.cpp:48:29:48:39 | thePassword |
| test.cpp:66:23:66:43 | cleartext password! | test.cpp:76:21:76:27 | call to encrypt |
@@ -238,6 +240,10 @@ nodes
| test3.cpp:527:15:527:20 | buffer | semmle.label | buffer |
| test3.cpp:532:45:532:58 | home_longitude | semmle.label | home_longitude |
| test3.cpp:533:15:533:20 | buffer | semmle.label | buffer |
| test3.cpp:551:47:551:58 | salaryString | semmle.label | salaryString |
| test3.cpp:552:15:552:20 | buffer | semmle.label | buffer |
| test3.cpp:556:19:556:30 | salaryString | semmle.label | salaryString |
| test3.cpp:559:15:559:20 | buffer | semmle.label | buffer |
| test.cpp:41:23:41:43 | cleartext password! | semmle.label | cleartext password! |
| test.cpp:48:21:48:27 | call to encrypt | semmle.label | call to encrypt |
| test.cpp:48:29:48:39 | thePassword | semmle.label | thePassword |
@@ -284,3 +290,5 @@ subpaths
| test3.cpp:517:2:517:5 | call to send | test3.cpp:517:18:517:29 | medical_info | test3.cpp:517:18:517:29 | medical_info | This operation transmits 'medical_info', which may contain unencrypted sensitive data from $@ | test3.cpp:517:18:517:29 | medical_info | medical_info |
| test3.cpp:527:3:527:6 | call to send | test3.cpp:526:44:526:54 | my_latitude | test3.cpp:527:15:527:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:526:44:526:54 | my_latitude | my_latitude |
| test3.cpp:533:3:533:6 | call to send | test3.cpp:532:45:532:58 | home_longitude | test3.cpp:533:15:533:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:532:45:532:58 | home_longitude | home_longitude |
| test3.cpp:552:3:552:6 | call to send | test3.cpp:551:47:551:58 | salaryString | test3.cpp:552:15:552:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:551:47:551:58 | salaryString | salaryString |
| test3.cpp:559:3:559:6 | call to send | test3.cpp:556:19:556:30 | salaryString | test3.cpp:559:15:559:20 | buffer | This operation transmits 'buffer', which may contain unencrypted sensitive data from $@ | test3.cpp:556:19:556:30 | salaryString | salaryString |

15
cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
View File

@@ -495,7 +495,7 @@ struct person_info
double my_latitude;
double home_longitude;
int newSalary;
char *salaryString;
// not sensitive
char *license_key_hash;
char *my_zip_file;
@@ -545,4 +545,17 @@ void tests2(person_info *pi)
snprintf(buffer, 1024, "salary = %i\n", sal);
send(val(), buffer, strlen(buffer), val()); // BAD [NOT DETECTED]
}
{
char buffer[1024];
snprintf(buffer, 1024, "salary = %s\n", pi->salaryString);
send(val(), buffer, strlen(buffer), val()); // BAD
}
{
char buffer[1024];
char *sal = pi->salaryString;
snprintf(buffer, 1024, "salary = %s\n", sal);
send(val(), buffer, strlen(buffer), val()); // BAD
}
}