Python: use standard test format

This commit is contained in:
Rasmus Lerchedahl Petersen
2023-08-15 15:26:18 +02:00
parent 99bc050366
commit e6943ce98e
6 changed files with 26 additions and 25 deletions

View File

@@ -0,0 +1,4 @@
failures
argumentToEnsureNotTaintedNotMarkedAsSpurious
untaintedArgumentToEnsureTaintedNotMarkedAsMissing
testFailures

View File

@@ -0,0 +1,2 @@
import experimental.meta.InlineTaintTest
import MakeInlineTaintTest<TestTaintTrackingConfig>

View File

@@ -1,20 +0,0 @@
import python
import TestUtilities.InlineExpectationsTest
private module RemoteFlowTest implements TestSig {
private import semmle.python.dataflow.new.RemoteFlowSources
private import semmle.python.dataflow.new.internal.PrintNode
string getARelevantTag() { result = "remoteFlow" }
predicate hasActualResult(Location location, string element, string tag, string value) {
exists(RemoteFlowSource source |
location = source.getLocation() and
tag = "remoteFlow" and
value = prettyNode(source) and
element = source.toString()
)
}
}
import MakeTest<RemoteFlowTest>

View File

@@ -1,5 +1,13 @@
def handler1(event, context): # $ remoteFlow=event
def handler1(event, context):
ensure_tainted(event) # $ tainted
return "Hello World!"
def handler2(event, context): # $ remoteFlow=event
def handler2(event, context):
ensure_tainted(event) # $ tainted
return "Hello World!"
# This function is not mentioned in template.yml
# and so it is not receiving user input.
def non_handler(event, context):
ensure_not_tainted(event)
return "Hello World!"

View File

@@ -1,2 +1,11 @@
def lambda_handler(event, context): # $ remoteFlow=event
def lambda_handler(event, context):
ensure_tainted(
event, # $ tainted
# event is usually a dict, see https://docs.aws.amazon.com/lambda/latest/dg/python-handler.html
event["key"], # $ tainted
event["key"]["key2"], # $ tainted
event["key"][0], # $ tainted
# but can also be a list
event[0], # $ tainted
)
return "OK"