mirror of
https://github.com/github/codeql.git
synced 2026-04-27 09:45:15 +02:00
Python: use standard test format
This commit is contained in:
@@ -0,0 +1,4 @@
|
||||
failures
|
||||
argumentToEnsureNotTaintedNotMarkedAsSpurious
|
||||
untaintedArgumentToEnsureTaintedNotMarkedAsMissing
|
||||
testFailures
|
||||
@@ -0,0 +1,2 @@
|
||||
import experimental.meta.InlineTaintTest
|
||||
import MakeInlineTaintTest<TestTaintTrackingConfig>
|
||||
@@ -1,2 +0,0 @@
|
||||
failures
|
||||
testFailures
|
||||
@@ -1,20 +0,0 @@
|
||||
import python
|
||||
import TestUtilities.InlineExpectationsTest
|
||||
|
||||
private module RemoteFlowTest implements TestSig {
|
||||
private import semmle.python.dataflow.new.RemoteFlowSources
|
||||
private import semmle.python.dataflow.new.internal.PrintNode
|
||||
|
||||
string getARelevantTag() { result = "remoteFlow" }
|
||||
|
||||
predicate hasActualResult(Location location, string element, string tag, string value) {
|
||||
exists(RemoteFlowSource source |
|
||||
location = source.getLocation() and
|
||||
tag = "remoteFlow" and
|
||||
value = prettyNode(source) and
|
||||
element = source.toString()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
import MakeTest<RemoteFlowTest>
|
||||
@@ -1,5 +1,13 @@
|
||||
def handler1(event, context): # $ remoteFlow=event
|
||||
def handler1(event, context):
|
||||
ensure_tainted(event) # $ tainted
|
||||
return "Hello World!"
|
||||
|
||||
def handler2(event, context): # $ remoteFlow=event
|
||||
def handler2(event, context):
|
||||
ensure_tainted(event) # $ tainted
|
||||
return "Hello World!"
|
||||
|
||||
# This function is not mentioned in template.yml
|
||||
# and so it is not receiving user input.
|
||||
def non_handler(event, context):
|
||||
ensure_not_tainted(event)
|
||||
return "Hello World!"
|
||||
|
||||
@@ -1,2 +1,11 @@
|
||||
def lambda_handler(event, context): # $ remoteFlow=event
|
||||
def lambda_handler(event, context):
|
||||
ensure_tainted(
|
||||
event, # $ tainted
|
||||
# event is usually a dict, see https://docs.aws.amazon.com/lambda/latest/dg/python-handler.html
|
||||
event["key"], # $ tainted
|
||||
event["key"]["key2"], # $ tainted
|
||||
event["key"][0], # $ tainted
|
||||
# but can also be a list
|
||||
event[0], # $ tainted
|
||||
)
|
||||
return "OK"
|
||||
|
||||
Reference in New Issue
Block a user