From 6a67bd52a961fc40e4bec7b3e66cd4b013e2063d Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Thu, 12 Sep 2024 17:04:21 +0100 Subject: [PATCH 01/10] Add tests for MaD inheritance --- .../dataflow/ExternalFlowInheritance/go.mod | 5 + ...dingAndOverridingI1_subtypes_true.expected | 40 +++++++ ...ddingAndOverridingI1_subtypes_true.ext.yml | 16 +++ ...tEmbeddingAndOverridingI1_subtypes_true.ql | 20 ++++ ...d_StructEmbeddingI1_subtypes_true.expected | 40 +++++++ ...ad_StructEmbeddingI1_subtypes_true.ext.yml | 16 +++ .../mad_StructEmbeddingI1_subtypes_true.ql | 18 +++ .../mad_i1_subtypes_false.expected | 10 ++ .../mad_i1_subtypes_false.ext.yml | 16 +++ .../mad_i1_subtypes_false.ql | 18 +++ .../mad_i1_subtypes_true.expected | 40 +++++++ .../mad_i1_subtypes_true.ext.yml | 16 +++ .../mad_i1_subtypes_true.ql | 18 +++ .../mad_i2_subtypes_false.expected | 10 ++ .../mad_i2_subtypes_false.ext.yml | 16 +++ .../mad_i2_subtypes_false.ql | 18 +++ .../mad_i2_subtypes_true.expected | 22 ++++ .../mad_i2_subtypes_true.ext.yml | 16 +++ .../mad_i2_subtypes_true.ql | 18 +++ .../mad_s1_subtypes_false.expected | 10 ++ .../mad_s1_subtypes_false.ext.yml | 16 +++ .../mad_s1_subtypes_false.ql | 18 +++ .../mad_s1_subtypes_true.expected | 10 ++ .../mad_s1_subtypes_true.ext.yml | 16 +++ .../mad_s1_subtypes_true.ql | 18 +++ .../ExternalFlowInheritance/ql_i1.expected | 10 ++ .../dataflow/ExternalFlowInheritance/ql_i1.ql | 46 +++++++ .../ExternalFlowInheritance/ql_s1.expected | 16 +++ .../dataflow/ExternalFlowInheritance/ql_s1.ql | 46 +++++++ .../dataflow/ExternalFlowInheritance/test.go | 77 ++++++++++++ .../github.com/nonexistent/test/stub.go | 112 ++++++++++++++++++ .../vendor/modules.txt | 3 + 32 files changed, 771 insertions(+) create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/go.mod create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/modules.txt diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/go.mod b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/go.mod new file mode 100644 index 00000000000..57813acac55 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/go.mod @@ -0,0 +1,5 @@ +module semmle.go.Packages + +go 1.21 + +require github.com/nonexistent/test v0.0.0-20200203000000-0000000000000 diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.expected new file mode 100644 index 00000000000..369f3c66603 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.expected @@ -0,0 +1,40 @@ +invalidModelRow +paths +| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | +| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | +| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | +| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | +| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | +| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | +| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | +| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | +| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | +| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +sources +| test.go:8:7:8:16 | call to Source | +| test.go:14:7:14:16 | call to Source | +| test.go:20:7:20:16 | call to Source | +| test.go:26:7:26:16 | call to Source | +| test.go:32:7:32:16 | call to Source | +| test.go:38:7:38:16 | call to Source | +| test.go:44:7:44:16 | call to Source | +| test.go:50:7:50:16 | call to Source | +| test.go:56:7:56:16 | call to Source | +| test.go:62:7:62:16 | call to Source | +| test.go:68:7:68:16 | call to Source | +| test.go:74:7:74:16 | call to Source | +sinks +| test.go:10:9:10:9 | y | +| test.go:16:9:16:9 | y | +| test.go:22:9:22:9 | y | +| test.go:28:9:28:9 | y | +| test.go:34:9:34:9 | y | +| test.go:40:9:40:9 | y | +| test.go:46:9:46:9 | y | +| test.go:52:9:52:9 | y | +| test.go:58:9:58:9 | y | +| test.go:64:9:64:9 | y | +| test.go:70:9:70:9 | y | +| test.go:76:9:76:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ext.yml new file mode 100644 index 00000000000..5b033d5574e --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "StructEmbeddingAndOverridingI1", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "StructEmbeddingAndOverridingI1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "StructEmbeddingAndOverridingI1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ql new file mode 100644 index 00000000000..c86d36f20f9 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ql @@ -0,0 +1,20 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } +// predicate foo() { +// } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.expected new file mode 100644 index 00000000000..369f3c66603 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.expected @@ -0,0 +1,40 @@ +invalidModelRow +paths +| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | +| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | +| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | +| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | +| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | +| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | +| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | +| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | +| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | +| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +sources +| test.go:8:7:8:16 | call to Source | +| test.go:14:7:14:16 | call to Source | +| test.go:20:7:20:16 | call to Source | +| test.go:26:7:26:16 | call to Source | +| test.go:32:7:32:16 | call to Source | +| test.go:38:7:38:16 | call to Source | +| test.go:44:7:44:16 | call to Source | +| test.go:50:7:50:16 | call to Source | +| test.go:56:7:56:16 | call to Source | +| test.go:62:7:62:16 | call to Source | +| test.go:68:7:68:16 | call to Source | +| test.go:74:7:74:16 | call to Source | +sinks +| test.go:10:9:10:9 | y | +| test.go:16:9:16:9 | y | +| test.go:22:9:22:9 | y | +| test.go:28:9:28:9 | y | +| test.go:34:9:34:9 | y | +| test.go:40:9:40:9 | y | +| test.go:46:9:46:9 | y | +| test.go:52:9:52:9 | y | +| test.go:58:9:58:9 | y | +| test.go:64:9:64:9 | y | +| test.go:70:9:70:9 | y | +| test.go:76:9:76:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ext.yml new file mode 100644 index 00000000000..c24fadddd89 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "StructEmbeddingI1", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "StructEmbeddingI1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "StructEmbeddingI1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected new file mode 100644 index 00000000000..1a6dc55986c --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected @@ -0,0 +1,10 @@ +invalidModelRow +paths +| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | +| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | +sources +| test.go:8:7:8:16 | call to Source | +| test.go:32:7:32:16 | call to Source | +sinks +| test.go:10:9:10:9 | y | +| test.go:34:9:34:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ext.yml new file mode 100644 index 00000000000..11067b1760d --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "I1", False, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "I1", False, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "I1", False, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected new file mode 100644 index 00000000000..369f3c66603 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected @@ -0,0 +1,40 @@ +invalidModelRow +paths +| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | +| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | +| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | +| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | +| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | +| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | +| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | +| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | +| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | +| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +sources +| test.go:8:7:8:16 | call to Source | +| test.go:14:7:14:16 | call to Source | +| test.go:20:7:20:16 | call to Source | +| test.go:26:7:26:16 | call to Source | +| test.go:32:7:32:16 | call to Source | +| test.go:38:7:38:16 | call to Source | +| test.go:44:7:44:16 | call to Source | +| test.go:50:7:50:16 | call to Source | +| test.go:56:7:56:16 | call to Source | +| test.go:62:7:62:16 | call to Source | +| test.go:68:7:68:16 | call to Source | +| test.go:74:7:74:16 | call to Source | +sinks +| test.go:10:9:10:9 | y | +| test.go:16:9:16:9 | y | +| test.go:22:9:22:9 | y | +| test.go:28:9:28:9 | y | +| test.go:34:9:34:9 | y | +| test.go:40:9:40:9 | y | +| test.go:46:9:46:9 | y | +| test.go:52:9:52:9 | y | +| test.go:58:9:58:9 | y | +| test.go:64:9:64:9 | y | +| test.go:70:9:70:9 | y | +| test.go:76:9:76:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ext.yml new file mode 100644 index 00000000000..48c3a4daca8 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "I1", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "I1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "I1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected new file mode 100644 index 00000000000..35fc35829a7 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected @@ -0,0 +1,10 @@ +invalidModelRow +paths +| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | +| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +sources +| test.go:14:7:14:16 | call to Source | +| test.go:38:7:38:16 | call to Source | +sinks +| test.go:16:9:16:9 | y | +| test.go:40:9:40:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ext.yml new file mode 100644 index 00000000000..8b01fd00176 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "I2", False, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "I2", False, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "I2", False, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected new file mode 100644 index 00000000000..9989b831c34 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected @@ -0,0 +1,22 @@ +invalidModelRow +paths +| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | +| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | +| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | +| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | +| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +sources +| test.go:14:7:14:16 | call to Source | +| test.go:26:7:26:16 | call to Source | +| test.go:38:7:38:16 | call to Source | +| test.go:50:7:50:16 | call to Source | +| test.go:62:7:62:16 | call to Source | +| test.go:74:7:74:16 | call to Source | +sinks +| test.go:16:9:16:9 | y | +| test.go:28:9:28:9 | y | +| test.go:40:9:40:9 | y | +| test.go:52:9:52:9 | y | +| test.go:64:9:64:9 | y | +| test.go:76:9:76:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ext.yml new file mode 100644 index 00000000000..d9fbc304b51 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "I2", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "I2", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "I2", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected new file mode 100644 index 00000000000..2b6a7e94228 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected @@ -0,0 +1,10 @@ +invalidModelRow +paths +| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | +| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +sources +| test.go:20:7:20:16 | call to Source | +| test.go:56:7:56:16 | call to Source | +sinks +| test.go:22:9:22:9 | y | +| test.go:58:9:58:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ext.yml new file mode 100644 index 00000000000..b0322a6ecd3 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "S1", False, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "S1", False, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "S1", False, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected new file mode 100644 index 00000000000..2b6a7e94228 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected @@ -0,0 +1,10 @@ +invalidModelRow +paths +| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | +| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +sources +| test.go:20:7:20:16 | call to Source | +| test.go:56:7:56:16 | call to Source | +sinks +| test.go:22:9:22:9 | y | +| test.go:58:9:58:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ext.yml new file mode 100644 index 00000000000..3adf2d35ca4 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "S1", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "S1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "S1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected new file mode 100644 index 00000000000..1a6dc55986c --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected @@ -0,0 +1,10 @@ +invalidModelRow +paths +| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | +| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | +sources +| test.go:8:7:8:16 | call to Source | +| test.go:32:7:32:16 | call to Source | +sinks +| test.go:10:9:10:9 | y | +| test.go:34:9:34:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql new file mode 100644 index 00000000000..bf113c3330c --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql @@ -0,0 +1,46 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +class MySource extends RemoteFlowSource::Range instanceof DataFlow::Node { + MySource() { + exists(Method m | + m.hasQualifiedName("github.com/nonexistent/test", "I1", "Source") and + this = m.getACall().getResult() + ) + } +} + +class MyStep extends DataFlow::FunctionModel, Method { + MyStep() { this.hasQualifiedName("github.com/nonexistent/test", "I1", "Step") } + + override predicate hasDataFlow(FunctionInput input, FunctionOutput output) { + input.isParameter(0) and output.isResult() + } +} + +class MySink extends FileSystemAccess::Range, DataFlow::CallNode { + MySink() { + exists(Method m | + m.hasQualifiedName("github.com/nonexistent/test", "I1", "Sink") and + this = m.getACall() + ) + } + + override DataFlow::Node getAPathArgument() { result = this.getArgument(0) } +} + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected new file mode 100644 index 00000000000..5f186108a58 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected @@ -0,0 +1,16 @@ +invalidModelRow +paths +| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | +| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | +| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | +| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +sources +| test.go:8:7:8:16 | call to Source | +| test.go:20:7:20:16 | call to Source | +| test.go:32:7:32:16 | call to Source | +| test.go:56:7:56:16 | call to Source | +sinks +| test.go:10:9:10:9 | y | +| test.go:22:9:22:9 | y | +| test.go:34:9:34:9 | y | +| test.go:58:9:58:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql new file mode 100644 index 00000000000..6d9371308ef --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql @@ -0,0 +1,46 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +class MySource extends RemoteFlowSource::Range instanceof DataFlow::Node { + MySource() { + exists(Method m | + m.hasQualifiedName("github.com/nonexistent/test", "S1", "Source") and + this = m.getACall().getResult() + ) + } +} + +class MyStep extends DataFlow::FunctionModel, Method { + MyStep() { this.hasQualifiedName("github.com/nonexistent/test", "S1", "Step") } + + override predicate hasDataFlow(FunctionInput input, FunctionOutput output) { + input.isParameter(0) and output.isResult() + } +} + +class MySink extends FileSystemAccess::Range, DataFlow::CallNode { + MySink() { + exists(Method m | + m.hasQualifiedName("github.com/nonexistent/test", "S1", "Sink") and + this = m.getACall() + ) + } + + override DataFlow::Node getAPathArgument() { result = this.getArgument(0) } +} + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go new file mode 100644 index 00000000000..87e6eab8532 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go @@ -0,0 +1,77 @@ +package main + +import ( + "github.com/nonexistent/test" +) + +func TestI1(t test.I1) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestI2(t test.I2) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestS1(t test.S1) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestS2(t test.S2) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestStructEmbeddingI1(t test.StructEmbeddingI1) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestStructEmbeddingI2(t test.StructEmbeddingI2) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestStructEmbeddingAndOverridingI1(t test.StructEmbeddingAndOverridingI1) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestStructEmbeddingAndOverridingI2(t test.StructEmbeddingAndOverridingI2) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestStructEmbeddingS1(t test.StructEmbeddingS1) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestStructEmbeddingS2(t test.StructEmbeddingS2) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestStructEmbeddingAndOverridingS1(t test.StructEmbeddingAndOverridingS1) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestStructEmbeddingAndOverridingS2(t test.StructEmbeddingAndOverridingS2) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go new file mode 100644 index 00000000000..9e5ec515b0b --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go @@ -0,0 +1,112 @@ +package test + +// An interface +type I1 interface { + Source() interface{} + Step(interface{}) interface{} + Sink(interface{}) +} + +// An interface which is a subtype of I1 +type I2 interface { + Source() interface{} + Step(interface{}) interface{} + Sink(interface{}) + ExtraMethod() +} + +// A struct type implementing I1 +type S1 struct{} + +func (t *S1) Source() interface{} { + return nil +} + +func (t *S1) Sink(interface{}) {} + +func (t *S1) Step(val interface{}) interface{} { + return val +} + +// A struct type implementing I2 +type S2 struct{} + +func (t *S2) Source() interface{} { + return nil +} + +func (t *S2) Sink(interface{}) {} + +func (t *S2) Step(val interface{}) interface{} { + return val +} + +func (t *S2) ExtraMethod() {} + +// A struct type embedding I1 +type StructEmbeddingI1 struct{ I1 } + +// A struct type embedding I2 +type StructEmbeddingI2 struct{ I2 } + +// A struct type embedding I1 and "overriding" its methods +type StructEmbeddingAndOverridingI1 struct{ I1 } + +func (t *StructEmbeddingAndOverridingI1) Source() interface{} { + return nil +} + +func (t *StructEmbeddingAndOverridingI1) Sink(interface{}) {} + +func (t *StructEmbeddingAndOverridingI1) Step(val interface{}) interface{} { + return val +} + +// A struct type embedding I2 and "overriding" its methods +type StructEmbeddingAndOverridingI2 struct{ I2 } + +func (t *StructEmbeddingAndOverridingI2) Source() interface{} { + return nil +} + +func (t *StructEmbeddingAndOverridingI2) Sink(interface{}) {} + +func (t *StructEmbeddingAndOverridingI2) Step(val interface{}) interface{} { + return val +} + +func (t *StructEmbeddingAndOverridingI2) ExtraMethod() {} + +// A struct type embedding S1 +type StructEmbeddingS1 struct{ S1 } + +// A struct type embedding S2 +type StructEmbeddingS2 struct{ S2 } + +// A struct type embedding S1 and "overriding" its methods +type StructEmbeddingAndOverridingS1 struct{ S1 } + +func (t *StructEmbeddingAndOverridingS1) Source() interface{} { + return nil +} + +func (t *StructEmbeddingAndOverridingS1) Sink(interface{}) {} + +func (t *StructEmbeddingAndOverridingS1) Step(val interface{}) interface{} { + return val +} + +// A struct type embedding S2 and "overriding" its methods +type StructEmbeddingAndOverridingS2 struct{ S2 } + +func (t *StructEmbeddingAndOverridingS2) Source() interface{} { + return nil +} + +func (t *StructEmbeddingAndOverridingS2) Sink(interface{}) {} + +func (t *StructEmbeddingAndOverridingS2) Step(val interface{}) interface{} { + return val +} + +func (t *StructEmbeddingAndOverridingS2) ExtraMethod() {} diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/modules.txt b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/modules.txt new file mode 100644 index 00000000000..b62dbf8819b --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/modules.txt @@ -0,0 +1,3 @@ +# github.com/nonexistent/test v0.0.0-20200203000000-0000000000000 +## explicit +github.com/nonexistent/test From 279800ea626d678fb7185f26499f1493d152b71b Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 24 Sep 2024 07:24:48 +0100 Subject: [PATCH 02/10] Use shorter naming scheme for types --- ...ed => mad_SEmbedI1_subtypes_true.expected} | 0 .../mad_SEmbedI1_subtypes_true.ext.yml | 16 ++++++ ..._true.ql => mad_SEmbedI1_subtypes_true.ql} | 0 .../mad_SEmbedI2_subtypes_true.expected | 22 ++++++++ .../mad_SEmbedI2_subtypes_true.ext.yml | 16 ++++++ ..._true.ql => mad_SEmbedI2_subtypes_true.ql} | 2 - .../mad_SEmbedS1_subtypes_true.expected | 4 ++ .../mad_SEmbedS1_subtypes_true.ext.yml | 16 ++++++ .../mad_SEmbedS1_subtypes_true.ql | 18 +++++++ .../mad_SEmbedS2_subtypes_true.expected | 4 ++ .../mad_SEmbedS2_subtypes_true.ext.yml | 16 ++++++ .../mad_SEmbedS2_subtypes_true.ql | 18 +++++++ ...> mad_SImplEmbedI1_subtypes_true.expected} | 0 .../mad_SImplEmbedI1_subtypes_true.ext.yml | 16 ++++++ .../mad_SImplEmbedI1_subtypes_true.ql | 18 +++++++ .../mad_SImplEmbedI2_subtypes_true.expected | 22 ++++++++ .../mad_SImplEmbedI2_subtypes_true.ext.yml | 16 ++++++ .../mad_SImplEmbedI2_subtypes_true.ql | 18 +++++++ .../mad_SImplEmbedS1_subtypes_true.expected | 7 +++ .../mad_SImplEmbedS1_subtypes_true.ext.yml | 16 ++++++ .../mad_SImplEmbedS1_subtypes_true.ql | 18 +++++++ .../mad_SImplEmbedS2_subtypes_true.expected | 7 +++ .../mad_SImplEmbedS2_subtypes_true.ext.yml | 16 ++++++ .../mad_SImplEmbedS2_subtypes_true.ql | 18 +++++++ ...ddingAndOverridingI1_subtypes_true.ext.yml | 16 ------ ...ad_StructEmbeddingI1_subtypes_true.ext.yml | 16 ------ .../dataflow/ExternalFlowInheritance/test.go | 16 +++--- .../github.com/nonexistent/test/stub.go | 54 ++++++++++--------- 28 files changed, 338 insertions(+), 68 deletions(-) rename go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/{mad_StructEmbeddingAndOverridingI1_subtypes_true.expected => mad_SEmbedI1_subtypes_true.expected} (100%) create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ext.yml rename go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/{mad_StructEmbeddingI1_subtypes_true.ql => mad_SEmbedI1_subtypes_true.ql} (100%) create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ext.yml rename go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/{mad_StructEmbeddingAndOverridingI1_subtypes_true.ql => mad_SEmbedI2_subtypes_true.ql} (96%) create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql rename go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/{mad_StructEmbeddingI1_subtypes_true.expected => mad_SImplEmbedI1_subtypes_true.expected} (100%) create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql delete mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ext.yml delete mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ext.yml diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected similarity index 100% rename from go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.expected rename to go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ext.yml new file mode 100644 index 00000000000..93f8f74dfb5 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "SEmbedI1", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "SEmbedI1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "SEmbedI1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql similarity index 100% rename from go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ql rename to go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected new file mode 100644 index 00000000000..9989b831c34 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected @@ -0,0 +1,22 @@ +invalidModelRow +paths +| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | +| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | +| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | +| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | +| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +sources +| test.go:14:7:14:16 | call to Source | +| test.go:26:7:26:16 | call to Source | +| test.go:38:7:38:16 | call to Source | +| test.go:50:7:50:16 | call to Source | +| test.go:62:7:62:16 | call to Source | +| test.go:74:7:74:16 | call to Source | +sinks +| test.go:16:9:16:9 | y | +| test.go:28:9:28:9 | y | +| test.go:40:9:40:9 | y | +| test.go:52:9:52:9 | y | +| test.go:64:9:64:9 | y | +| test.go:76:9:76:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ext.yml new file mode 100644 index 00000000000..ba94082e7e3 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "SEmbedI2", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "SEmbedI2", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "SEmbedI2", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql similarity index 96% rename from go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ql rename to go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql index c86d36f20f9..e1f1ca3bd62 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql @@ -16,5 +16,3 @@ query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(s query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } -// predicate foo() { -// } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected new file mode 100644 index 00000000000..b2263b2664e --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected @@ -0,0 +1,4 @@ +invalidModelRow +paths +sources +sinks diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ext.yml new file mode 100644 index 00000000000..89218840c0b --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "SEmbedS1", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "SEmbedS1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "SEmbedS1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected new file mode 100644 index 00000000000..b2263b2664e --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected @@ -0,0 +1,4 @@ +invalidModelRow +paths +sources +sinks diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ext.yml new file mode 100644 index 00000000000..e773cf215b4 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "SEmbedS2", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "SEmbedS2", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "SEmbedS2", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected similarity index 100% rename from go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.expected rename to go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ext.yml new file mode 100644 index 00000000000..4b572ad124c --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "SImplEmbedI1", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "SImplEmbedI1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "SImplEmbedI1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected new file mode 100644 index 00000000000..9989b831c34 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected @@ -0,0 +1,22 @@ +invalidModelRow +paths +| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | +| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | +| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | +| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | +| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +sources +| test.go:14:7:14:16 | call to Source | +| test.go:26:7:26:16 | call to Source | +| test.go:38:7:38:16 | call to Source | +| test.go:50:7:50:16 | call to Source | +| test.go:62:7:62:16 | call to Source | +| test.go:74:7:74:16 | call to Source | +sinks +| test.go:16:9:16:9 | y | +| test.go:28:9:28:9 | y | +| test.go:40:9:40:9 | y | +| test.go:52:9:52:9 | y | +| test.go:64:9:64:9 | y | +| test.go:76:9:76:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ext.yml new file mode 100644 index 00000000000..9d695502c29 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "SImplEmbedI2", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "SImplEmbedI2", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "SImplEmbedI2", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected new file mode 100644 index 00000000000..b757a515433 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected @@ -0,0 +1,7 @@ +invalidModelRow +paths +| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | +sources +| test.go:68:7:68:16 | call to Source | +sinks +| test.go:70:9:70:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ext.yml new file mode 100644 index 00000000000..0936a7d253b --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "SImplEmbedS1", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "SImplEmbedS1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "SImplEmbedS1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected new file mode 100644 index 00000000000..f487470f4ae --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected @@ -0,0 +1,7 @@ +invalidModelRow +paths +| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +sources +| test.go:74:7:74:16 | call to Source | +sinks +| test.go:76:9:76:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ext.yml new file mode 100644 index 00000000000..04bc012e7f4 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "SImplEmbedS2", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "SImplEmbedS2", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "SImplEmbedS2", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ext.yml deleted file mode 100644 index 5b033d5574e..00000000000 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingAndOverridingI1_subtypes_true.ext.yml +++ /dev/null @@ -1,16 +0,0 @@ -extensions: - - addsTo: - pack: codeql/go-all - extensible: sourceModel - data: - - ["github.com/nonexistent/test", "StructEmbeddingAndOverridingI1", True, "Source", "", "", "ReturnValue", "remote", "manual"] - - addsTo: - pack: codeql/go-all - extensible: summaryModel - data: - - ["github.com/nonexistent/test", "StructEmbeddingAndOverridingI1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] - - addsTo: - pack: codeql/go-all - extensible: sinkModel - data: - - ["github.com/nonexistent/test", "StructEmbeddingAndOverridingI1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ext.yml deleted file mode 100644 index c24fadddd89..00000000000 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_StructEmbeddingI1_subtypes_true.ext.yml +++ /dev/null @@ -1,16 +0,0 @@ -extensions: - - addsTo: - pack: codeql/go-all - extensible: sourceModel - data: - - ["github.com/nonexistent/test", "StructEmbeddingI1", True, "Source", "", "", "ReturnValue", "remote", "manual"] - - addsTo: - pack: codeql/go-all - extensible: summaryModel - data: - - ["github.com/nonexistent/test", "StructEmbeddingI1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] - - addsTo: - pack: codeql/go-all - extensible: sinkModel - data: - - ["github.com/nonexistent/test", "StructEmbeddingI1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go index 87e6eab8532..8329420910c 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go @@ -28,49 +28,49 @@ func TestS2(t test.S2) { t.Sink(y) } -func TestStructEmbeddingI1(t test.StructEmbeddingI1) { +func TestSEmbedI1(t test.SEmbedI1) { x := t.Source() y := t.Step(x) t.Sink(y) } -func TestStructEmbeddingI2(t test.StructEmbeddingI2) { +func TestSEmbedI2(t test.SEmbedI2) { x := t.Source() y := t.Step(x) t.Sink(y) } -func TestStructEmbeddingAndOverridingI1(t test.StructEmbeddingAndOverridingI1) { +func TestSImplEmbedI1(t test.SImplEmbedI1) { x := t.Source() y := t.Step(x) t.Sink(y) } -func TestStructEmbeddingAndOverridingI2(t test.StructEmbeddingAndOverridingI2) { +func TestSImplEmbedI2(t test.SImplEmbedI2) { x := t.Source() y := t.Step(x) t.Sink(y) } -func TestStructEmbeddingS1(t test.StructEmbeddingS1) { +func TestSEmbedS1(t test.SEmbedS1) { x := t.Source() y := t.Step(x) t.Sink(y) } -func TestStructEmbeddingS2(t test.StructEmbeddingS2) { +func TestSEmbedS2(t test.SEmbedS2) { x := t.Source() y := t.Step(x) t.Sink(y) } -func TestStructEmbeddingAndOverridingS1(t test.StructEmbeddingAndOverridingS1) { +func TestSImplEmbedS1(t test.SImplEmbedS1) { x := t.Source() y := t.Step(x) t.Sink(y) } -func TestStructEmbeddingAndOverridingS2(t test.StructEmbeddingAndOverridingS2) { +func TestSImplEmbedS2(t test.SImplEmbedS2) { x := t.Source() y := t.Step(x) t.Sink(y) diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go index 9e5ec515b0b..db0a217dc77 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go @@ -12,7 +12,7 @@ type I2 interface { Source() interface{} Step(interface{}) interface{} Sink(interface{}) - ExtraMethod() + ExtraMethodI2() } // A struct type implementing I1 @@ -41,72 +41,74 @@ func (t *S2) Step(val interface{}) interface{} { return val } -func (t *S2) ExtraMethod() {} +func (t *S2) ExtraMethodI2() {} // A struct type embedding I1 -type StructEmbeddingI1 struct{ I1 } +type SEmbedI1 struct{ I1 } // A struct type embedding I2 -type StructEmbeddingI2 struct{ I2 } +type SEmbedI2 struct{ I2 } -// A struct type embedding I1 and "overriding" its methods -type StructEmbeddingAndOverridingI1 struct{ I1 } +// A struct type embedding I1 and separately implementing its methods, so the +// methods of the embedded field are not promoted. +type SImplEmbedI1 struct{ I1 } -func (t *StructEmbeddingAndOverridingI1) Source() interface{} { +func (t *SImplEmbedI1) Source() interface{} { return nil } -func (t *StructEmbeddingAndOverridingI1) Sink(interface{}) {} +func (t *SImplEmbedI1) Sink(interface{}) {} -func (t *StructEmbeddingAndOverridingI1) Step(val interface{}) interface{} { +func (t *SImplEmbedI1) Step(val interface{}) interface{} { return val } -// A struct type embedding I2 and "overriding" its methods -type StructEmbeddingAndOverridingI2 struct{ I2 } +// A struct type embedding I2 and separately implementing its methods, so the +// methods of the embedded field are not promoted. +type SImplEmbedI2 struct{ I2 } -func (t *StructEmbeddingAndOverridingI2) Source() interface{} { +func (t *SImplEmbedI2) Source() interface{} { return nil } -func (t *StructEmbeddingAndOverridingI2) Sink(interface{}) {} +func (t *SImplEmbedI2) Sink(interface{}) {} -func (t *StructEmbeddingAndOverridingI2) Step(val interface{}) interface{} { +func (t *SImplEmbedI2) Step(val interface{}) interface{} { return val } -func (t *StructEmbeddingAndOverridingI2) ExtraMethod() {} +func (t *SImplEmbedI2) ExtraMethodI2() {} // A struct type embedding S1 -type StructEmbeddingS1 struct{ S1 } +type SEmbedS1 struct{ S1 } // A struct type embedding S2 -type StructEmbeddingS2 struct{ S2 } +type SEmbedS2 struct{ S2 } // A struct type embedding S1 and "overriding" its methods -type StructEmbeddingAndOverridingS1 struct{ S1 } +type SImplEmbedS1 struct{ S1 } -func (t *StructEmbeddingAndOverridingS1) Source() interface{} { +func (t *SImplEmbedS1) Source() interface{} { return nil } -func (t *StructEmbeddingAndOverridingS1) Sink(interface{}) {} +func (t *SImplEmbedS1) Sink(interface{}) {} -func (t *StructEmbeddingAndOverridingS1) Step(val interface{}) interface{} { +func (t *SImplEmbedS1) Step(val interface{}) interface{} { return val } // A struct type embedding S2 and "overriding" its methods -type StructEmbeddingAndOverridingS2 struct{ S2 } +type SImplEmbedS2 struct{ S2 } -func (t *StructEmbeddingAndOverridingS2) Source() interface{} { +func (t *SImplEmbedS2) Source() interface{} { return nil } -func (t *StructEmbeddingAndOverridingS2) Sink(interface{}) {} +func (t *SImplEmbedS2) Sink(interface{}) {} -func (t *StructEmbeddingAndOverridingS2) Step(val interface{}) interface{} { +func (t *SImplEmbedS2) Step(val interface{}) interface{} { return val } -func (t *StructEmbeddingAndOverridingS2) ExtraMethod() {} +func (t *SImplEmbedS2) ExtraMethodI2() {} From 5490f3a957a809b1384ea13e27cdd8b285c8f304 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 24 Sep 2024 07:31:14 +0100 Subject: [PATCH 03/10] Add tests for interface embedding interface --- .../mad_IEmbedI1_subtypes_true.expected | 46 +++++++++++++++++++ .../mad_IEmbedI1_subtypes_true.ext.yml | 16 +++++++ .../mad_IEmbedI1_subtypes_true.ql | 18 ++++++++ .../mad_IEmbedI2_subtypes_true.expected | 25 ++++++++++ .../mad_IEmbedI2_subtypes_true.ext.yml | 16 +++++++ .../mad_IEmbedI2_subtypes_true.ql | 18 ++++++++ .../mad_SEmbedI1_subtypes_true.expected | 6 +++ .../mad_SEmbedI2_subtypes_true.expected | 3 ++ .../mad_SImplEmbedI1_subtypes_true.expected | 6 +++ .../mad_SImplEmbedI2_subtypes_true.expected | 3 ++ .../mad_SImplEmbedS1_subtypes_true.expected | 6 +-- .../mad_SImplEmbedS2_subtypes_true.expected | 6 +-- .../mad_i1_subtypes_false.expected | 3 ++ .../mad_i1_subtypes_true.expected | 6 +++ .../mad_i2_subtypes_false.expected | 3 ++ .../mad_i2_subtypes_true.expected | 3 ++ .../mad_s1_subtypes_false.expected | 6 +-- .../mad_s1_subtypes_true.expected | 6 +-- .../ExternalFlowInheritance/ql_i1.expected | 3 ++ .../ExternalFlowInheritance/ql_s1.expected | 9 ++-- .../dataflow/ExternalFlowInheritance/test.go | 12 +++++ .../github.com/nonexistent/test/stub.go | 12 +++++ 22 files changed, 217 insertions(+), 15 deletions(-) create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ext.yml create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected new file mode 100644 index 00000000000..51ebdd2ad0e --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected @@ -0,0 +1,46 @@ +invalidModelRow +paths +| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | +| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | +| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | +| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | +| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | +| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | +| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | +| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | +| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | +| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | +| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +sources +| test.go:8:7:8:16 | call to Source | +| test.go:14:7:14:16 | call to Source | +| test.go:20:7:20:16 | call to Source | +| test.go:26:7:26:16 | call to Source | +| test.go:32:7:32:16 | call to Source | +| test.go:38:7:38:16 | call to Source | +| test.go:44:7:44:16 | call to Source | +| test.go:50:7:50:16 | call to Source | +| test.go:56:7:56:16 | call to Source | +| test.go:62:7:62:16 | call to Source | +| test.go:68:7:68:16 | call to Source | +| test.go:74:7:74:16 | call to Source | +| test.go:80:7:80:16 | call to Source | +| test.go:86:7:86:16 | call to Source | +sinks +| test.go:10:9:10:9 | y | +| test.go:16:9:16:9 | y | +| test.go:22:9:22:9 | y | +| test.go:28:9:28:9 | y | +| test.go:34:9:34:9 | y | +| test.go:40:9:40:9 | y | +| test.go:46:9:46:9 | y | +| test.go:52:9:52:9 | y | +| test.go:58:9:58:9 | y | +| test.go:64:9:64:9 | y | +| test.go:70:9:70:9 | y | +| test.go:76:9:76:9 | y | +| test.go:82:9:82:9 | y | +| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ext.yml new file mode 100644 index 00000000000..7d2e45d89f3 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "IEmbedI1", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "IEmbedI1", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "IEmbedI1", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected new file mode 100644 index 00000000000..dbe68c279b3 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected @@ -0,0 +1,25 @@ +invalidModelRow +paths +| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | +| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | +| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | +| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | +| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +sources +| test.go:14:7:14:16 | call to Source | +| test.go:26:7:26:16 | call to Source | +| test.go:38:7:38:16 | call to Source | +| test.go:50:7:50:16 | call to Source | +| test.go:62:7:62:16 | call to Source | +| test.go:74:7:74:16 | call to Source | +| test.go:86:7:86:16 | call to Source | +sinks +| test.go:16:9:16:9 | y | +| test.go:28:9:28:9 | y | +| test.go:40:9:40:9 | y | +| test.go:52:9:52:9 | y | +| test.go:64:9:64:9 | y | +| test.go:76:9:76:9 | y | +| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ext.yml b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ext.yml new file mode 100644 index 00000000000..b723867e3e7 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ext.yml @@ -0,0 +1,16 @@ +extensions: + - addsTo: + pack: codeql/go-all + extensible: sourceModel + data: + - ["github.com/nonexistent/test", "IEmbedI2", True, "Source", "", "", "ReturnValue", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: summaryModel + data: + - ["github.com/nonexistent/test", "IEmbedI2", True, "Step", "", "", "Argument[0]", "ReturnValue", "value", "manual"] + - addsTo: + pack: codeql/go-all + extensible: sinkModel + data: + - ["github.com/nonexistent/test", "IEmbedI2", True, "Sink", "", "", "Argument[0]", "path-injection", "manual"] diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql new file mode 100644 index 00000000000..e1f1ca3bd62 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql @@ -0,0 +1,18 @@ +import go +import semmle.go.dataflow.ExternalFlow +import ModelValidation +import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { sources(source) } + + predicate isSink(DataFlow::Node sink) { sinks(sink) } +} + +module Flow = DataFlow::Global; + +query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } + +query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } + +query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected index 369f3c66603..51ebdd2ad0e 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected @@ -12,6 +12,8 @@ paths | test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | | test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | | test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | +| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | sources | test.go:8:7:8:16 | call to Source | | test.go:14:7:14:16 | call to Source | @@ -25,6 +27,8 @@ sources | test.go:62:7:62:16 | call to Source | | test.go:68:7:68:16 | call to Source | | test.go:74:7:74:16 | call to Source | +| test.go:80:7:80:16 | call to Source | +| test.go:86:7:86:16 | call to Source | sinks | test.go:10:9:10:9 | y | | test.go:16:9:16:9 | y | @@ -38,3 +42,5 @@ sinks | test.go:64:9:64:9 | y | | test.go:70:9:70:9 | y | | test.go:76:9:76:9 | y | +| test.go:82:9:82:9 | y | +| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected index 9989b831c34..dbe68c279b3 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected @@ -6,6 +6,7 @@ paths | test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | | test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | | test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | sources | test.go:14:7:14:16 | call to Source | | test.go:26:7:26:16 | call to Source | @@ -13,6 +14,7 @@ sources | test.go:50:7:50:16 | call to Source | | test.go:62:7:62:16 | call to Source | | test.go:74:7:74:16 | call to Source | +| test.go:86:7:86:16 | call to Source | sinks | test.go:16:9:16:9 | y | | test.go:28:9:28:9 | y | @@ -20,3 +22,4 @@ sinks | test.go:52:9:52:9 | y | | test.go:64:9:64:9 | y | | test.go:76:9:76:9 | y | +| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected index 369f3c66603..51ebdd2ad0e 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected @@ -12,6 +12,8 @@ paths | test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | | test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | | test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | +| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | sources | test.go:8:7:8:16 | call to Source | | test.go:14:7:14:16 | call to Source | @@ -25,6 +27,8 @@ sources | test.go:62:7:62:16 | call to Source | | test.go:68:7:68:16 | call to Source | | test.go:74:7:74:16 | call to Source | +| test.go:80:7:80:16 | call to Source | +| test.go:86:7:86:16 | call to Source | sinks | test.go:10:9:10:9 | y | | test.go:16:9:16:9 | y | @@ -38,3 +42,5 @@ sinks | test.go:64:9:64:9 | y | | test.go:70:9:70:9 | y | | test.go:76:9:76:9 | y | +| test.go:82:9:82:9 | y | +| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected index 9989b831c34..dbe68c279b3 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected @@ -6,6 +6,7 @@ paths | test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | | test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | | test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | sources | test.go:14:7:14:16 | call to Source | | test.go:26:7:26:16 | call to Source | @@ -13,6 +14,7 @@ sources | test.go:50:7:50:16 | call to Source | | test.go:62:7:62:16 | call to Source | | test.go:74:7:74:16 | call to Source | +| test.go:86:7:86:16 | call to Source | sinks | test.go:16:9:16:9 | y | | test.go:28:9:28:9 | y | @@ -20,3 +22,4 @@ sinks | test.go:52:9:52:9 | y | | test.go:64:9:64:9 | y | | test.go:76:9:76:9 | y | +| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected index b757a515433..710110560e6 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected @@ -1,7 +1,7 @@ invalidModelRow paths -| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | +| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | sources -| test.go:68:7:68:16 | call to Source | +| test.go:80:7:80:16 | call to Source | sinks -| test.go:70:9:70:9 | y | +| test.go:82:9:82:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected index f487470f4ae..b7f99718d58 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected @@ -1,7 +1,7 @@ invalidModelRow paths -| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | sources -| test.go:74:7:74:16 | call to Source | +| test.go:86:7:86:16 | call to Source | sinks -| test.go:76:9:76:9 | y | +| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected index 1a6dc55986c..d58288abca7 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected @@ -2,9 +2,12 @@ invalidModelRow paths | test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | | test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | +| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | sources | test.go:8:7:8:16 | call to Source | | test.go:32:7:32:16 | call to Source | +| test.go:44:7:44:16 | call to Source | sinks | test.go:10:9:10:9 | y | | test.go:34:9:34:9 | y | +| test.go:46:9:46:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected index 369f3c66603..51ebdd2ad0e 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected @@ -12,6 +12,8 @@ paths | test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | | test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | | test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | +| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | sources | test.go:8:7:8:16 | call to Source | | test.go:14:7:14:16 | call to Source | @@ -25,6 +27,8 @@ sources | test.go:62:7:62:16 | call to Source | | test.go:68:7:68:16 | call to Source | | test.go:74:7:74:16 | call to Source | +| test.go:80:7:80:16 | call to Source | +| test.go:86:7:86:16 | call to Source | sinks | test.go:10:9:10:9 | y | | test.go:16:9:16:9 | y | @@ -38,3 +42,5 @@ sinks | test.go:64:9:64:9 | y | | test.go:70:9:70:9 | y | | test.go:76:9:76:9 | y | +| test.go:82:9:82:9 | y | +| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected index 35fc35829a7..3fd0e492065 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected @@ -2,9 +2,12 @@ invalidModelRow paths | test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | | test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | +| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | sources | test.go:14:7:14:16 | call to Source | | test.go:38:7:38:16 | call to Source | +| test.go:50:7:50:16 | call to Source | sinks | test.go:16:9:16:9 | y | | test.go:40:9:40:9 | y | +| test.go:52:9:52:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected index 9989b831c34..dbe68c279b3 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected @@ -6,6 +6,7 @@ paths | test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | | test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | | test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | +| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | sources | test.go:14:7:14:16 | call to Source | | test.go:26:7:26:16 | call to Source | @@ -13,6 +14,7 @@ sources | test.go:50:7:50:16 | call to Source | | test.go:62:7:62:16 | call to Source | | test.go:74:7:74:16 | call to Source | +| test.go:86:7:86:16 | call to Source | sinks | test.go:16:9:16:9 | y | | test.go:28:9:28:9 | y | @@ -20,3 +22,4 @@ sinks | test.go:52:9:52:9 | y | | test.go:64:9:64:9 | y | | test.go:76:9:76:9 | y | +| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected index 2b6a7e94228..034a14d6a93 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected @@ -1,10 +1,10 @@ invalidModelRow paths | test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | -| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | sources | test.go:20:7:20:16 | call to Source | -| test.go:56:7:56:16 | call to Source | +| test.go:68:7:68:16 | call to Source | sinks | test.go:22:9:22:9 | y | -| test.go:58:9:58:9 | y | +| test.go:70:9:70:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected index 2b6a7e94228..034a14d6a93 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected @@ -1,10 +1,10 @@ invalidModelRow paths | test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | -| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | sources | test.go:20:7:20:16 | call to Source | -| test.go:56:7:56:16 | call to Source | +| test.go:68:7:68:16 | call to Source | sinks | test.go:22:9:22:9 | y | -| test.go:58:9:58:9 | y | +| test.go:70:9:70:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected index 1a6dc55986c..d58288abca7 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected @@ -2,9 +2,12 @@ invalidModelRow paths | test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | | test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | +| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | sources | test.go:8:7:8:16 | call to Source | | test.go:32:7:32:16 | call to Source | +| test.go:44:7:44:16 | call to Source | sinks | test.go:10:9:10:9 | y | | test.go:34:9:34:9 | y | +| test.go:46:9:46:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected index 5f186108a58..39cd1eaca94 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected @@ -3,14 +3,17 @@ paths | test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | | test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | | test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | -| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | +| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | +| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | sources | test.go:8:7:8:16 | call to Source | | test.go:20:7:20:16 | call to Source | | test.go:32:7:32:16 | call to Source | -| test.go:56:7:56:16 | call to Source | +| test.go:44:7:44:16 | call to Source | +| test.go:68:7:68:16 | call to Source | sinks | test.go:10:9:10:9 | y | | test.go:22:9:22:9 | y | | test.go:34:9:34:9 | y | -| test.go:58:9:58:9 | y | +| test.go:46:9:46:9 | y | +| test.go:70:9:70:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go index 8329420910c..88bf41fba4a 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go @@ -40,6 +40,18 @@ func TestSEmbedI2(t test.SEmbedI2) { t.Sink(y) } +func TestIEmbedI1(t test.IEmbedI1) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + +func TestIEmbedI2(t test.IEmbedI2) { + x := t.Source() + y := t.Step(x) + t.Sink(y) +} + func TestSImplEmbedI1(t test.SImplEmbedI1) { x := t.Source() y := t.Step(x) diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go index db0a217dc77..e5a417bcbd3 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go @@ -49,6 +49,18 @@ type SEmbedI1 struct{ I1 } // A struct type embedding I2 type SEmbedI2 struct{ I2 } +// An interface type embedding I1 +type IEmbedI1 interface { + I1 + ExtraMethodIEmbedI1() +} + +// An interface type embedding I2 +type IEmbedI2 interface { + I2 + ExtraMethodIEmbedI2() +} + // A struct type embedding I1 and separately implementing its methods, so the // methods of the embedded field are not promoted. type SImplEmbedI1 struct{ I1 } From afa4b6dd4aeff8a95fb2480c05692d582a568926 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 24 Sep 2024 13:50:53 +0100 Subject: [PATCH 04/10] Make `paths` test an inline expectations test --- .../mad_IEmbedI1_subtypes_true.expected | 17 ++--------- .../mad_IEmbedI1_subtypes_true.ql | 18 ++++++++++-- .../mad_IEmbedI2_subtypes_true.expected | 10 ++----- .../mad_IEmbedI2_subtypes_true.ql | 18 ++++++++++-- .../mad_SEmbedI1_subtypes_true.expected | 17 ++--------- .../mad_SEmbedI1_subtypes_true.ql | 18 ++++++++++-- .../mad_SEmbedI2_subtypes_true.expected | 10 ++----- .../mad_SEmbedI2_subtypes_true.ql | 18 ++++++++++-- .../mad_SEmbedS1_subtypes_true.expected | 3 +- .../mad_SEmbedS1_subtypes_true.ql | 18 ++++++++++-- .../mad_SEmbedS2_subtypes_true.expected | 3 +- .../mad_SEmbedS2_subtypes_true.ql | 18 ++++++++++-- .../mad_SImplEmbedI1_subtypes_true.expected | 17 ++--------- .../mad_SImplEmbedI1_subtypes_true.ql | 18 ++++++++++-- .../mad_SImplEmbedI2_subtypes_true.expected | 10 ++----- .../mad_SImplEmbedI2_subtypes_true.ql | 18 ++++++++++-- .../mad_SImplEmbedS1_subtypes_true.expected | 4 +-- .../mad_SImplEmbedS1_subtypes_true.ql | 18 ++++++++++-- .../mad_SImplEmbedS2_subtypes_true.expected | 4 +-- .../mad_SImplEmbedS2_subtypes_true.ql | 18 ++++++++++-- .../mad_i1_subtypes_false.expected | 6 ++-- .../mad_i1_subtypes_false.ql | 18 ++++++++++-- .../mad_i1_subtypes_true.expected | 17 ++--------- .../mad_i1_subtypes_true.ql | 18 ++++++++++-- .../mad_i2_subtypes_false.expected | 6 ++-- .../mad_i2_subtypes_false.ql | 18 ++++++++++-- .../mad_i2_subtypes_true.expected | 10 ++----- .../mad_i2_subtypes_true.ql | 18 ++++++++++-- .../mad_s1_subtypes_false.expected | 5 ++-- .../mad_s1_subtypes_false.ql | 18 ++++++++++-- .../mad_s1_subtypes_true.expected | 5 ++-- .../mad_s1_subtypes_true.ql | 18 ++++++++++-- .../dataflow/ExternalFlowInheritance/test.go | 28 +++++++++---------- 33 files changed, 302 insertions(+), 158 deletions(-) diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected index 51ebdd2ad0e..cbf95dd4367 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected @@ -1,19 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | -| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | -| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | -| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | -| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | -| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | -| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | -| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | -| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | -| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | -| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | -| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | -| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | -| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +failures sources | test.go:8:7:8:16 | call to Source | | test.go:14:7:14:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql index e1f1ca3bd62..8e2b2d851f8 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "IEmbedI1[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "IEmbedI1[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected index dbe68c279b3..fd2bac1acf5 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected @@ -1,12 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | -| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | -| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | -| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | -| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | -| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | -| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +failures sources | test.go:14:7:14:16 | call to Source | | test.go:26:7:26:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql index e1f1ca3bd62..7941f126967 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "IEmbedI2[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "IEmbedI2[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected index 51ebdd2ad0e..cbf95dd4367 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected @@ -1,19 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | -| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | -| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | -| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | -| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | -| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | -| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | -| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | -| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | -| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | -| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | -| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | -| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | -| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +failures sources | test.go:8:7:8:16 | call to Source | | test.go:14:7:14:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql index e1f1ca3bd62..6221720a45e 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "SEmbedI1[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "SEmbedI1[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected index dbe68c279b3..fd2bac1acf5 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected @@ -1,12 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | -| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | -| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | -| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | -| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | -| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | -| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +failures sources | test.go:14:7:14:16 | call to Source | | test.go:26:7:26:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql index e1f1ca3bd62..e1a2ff93d95 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "SEmbedI2[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "SEmbedI2[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected index b2263b2664e..3b436cd843b 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected @@ -1,4 +1,5 @@ +testFailures invalidModelRow -paths +failures sources sinks diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql index e1f1ca3bd62..fba25acec59 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "SEmbedS1[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "SEmbedS1[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected index b2263b2664e..3b436cd843b 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected @@ -1,4 +1,5 @@ +testFailures invalidModelRow -paths +failures sources sinks diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql index e1f1ca3bd62..817a7b60ae3 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "SEmbedS2[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "SEmbedS2[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected index 51ebdd2ad0e..cbf95dd4367 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected @@ -1,19 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | -| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | -| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | -| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | -| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | -| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | -| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | -| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | -| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | -| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | -| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | -| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | -| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | -| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +failures sources | test.go:8:7:8:16 | call to Source | | test.go:14:7:14:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql index e1f1ca3bd62..d04767396da 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "SImplEmbedI1[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "SImplEmbedI1[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected index dbe68c279b3..fd2bac1acf5 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected @@ -1,12 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | -| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | -| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | -| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | -| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | -| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | -| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +failures sources | test.go:14:7:14:16 | call to Source | | test.go:26:7:26:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql index e1f1ca3bd62..6fe3df19734 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "SImplEmbedI2[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "SImplEmbedI2[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected index 710110560e6..432cb871c80 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected @@ -1,6 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | +failures sources | test.go:80:7:80:16 | call to Source | sinks diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql index e1f1ca3bd62..559e33dfe74 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "SImplEmbedS1[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "SImplEmbedS1[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected index b7f99718d58..bdb17db38b6 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected @@ -1,6 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +failures sources | test.go:86:7:86:16 | call to Source | sinks diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql index e1f1ca3bd62..492bc2f9fd6 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "SImplEmbedS2[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "SImplEmbedS2[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected index d58288abca7..4175a026f36 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected @@ -1,8 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | -| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | -| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | +failures sources | test.go:8:7:8:16 | call to Source | | test.go:32:7:32:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql index e1f1ca3bd62..f9f2bf6ebfc 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "I1[f]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "I1[f]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected index 51ebdd2ad0e..cbf95dd4367 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected @@ -1,19 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | -| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | -| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | -| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | -| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | -| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | -| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | -| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | -| test.go:56:7:56:16 | call to Source | test.go:58:9:58:9 | y | -| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | -| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | -| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | -| test.go:80:7:80:16 | call to Source | test.go:82:9:82:9 | y | -| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +failures sources | test.go:8:7:8:16 | call to Source | | test.go:14:7:14:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql index e1f1ca3bd62..2dbf85ef9d0 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "I1[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "I1[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected index 3fd0e492065..fcf4ee6e4c7 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected @@ -1,8 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | -| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | -| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | +failures sources | test.go:14:7:14:16 | call to Source | | test.go:38:7:38:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql index e1f1ca3bd62..6324fc52cf8 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "I2[f]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "I2[f]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected index dbe68c279b3..fd2bac1acf5 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected @@ -1,12 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:14:7:14:16 | call to Source | test.go:16:9:16:9 | y | -| test.go:26:7:26:16 | call to Source | test.go:28:9:28:9 | y | -| test.go:38:7:38:16 | call to Source | test.go:40:9:40:9 | y | -| test.go:50:7:50:16 | call to Source | test.go:52:9:52:9 | y | -| test.go:62:7:62:16 | call to Source | test.go:64:9:64:9 | y | -| test.go:74:7:74:16 | call to Source | test.go:76:9:76:9 | y | -| test.go:86:7:86:16 | call to Source | test.go:88:9:88:9 | y | +failures sources | test.go:14:7:14:16 | call to Source | | test.go:26:7:26:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql index e1f1ca3bd62..5c936b10dbc 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "I2[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "I2[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected index 034a14d6a93..bec552c8551 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected @@ -1,7 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | -| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | +failures sources | test.go:20:7:20:16 | call to Source | | test.go:68:7:68:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql index e1f1ca3bd62..b11b64c4a13 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "S1[f]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "S1[f]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected index 034a14d6a93..bec552c8551 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected @@ -1,7 +1,6 @@ +testFailures invalidModelRow -paths -| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | -| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | +failures sources | test.go:20:7:20:16 | call to Source | | test.go:68:7:68:16 | call to Source | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql index e1f1ca3bd62..7809f59c3d7 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql @@ -2,6 +2,8 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest module Config implements DataFlow::ConfigSig { predicate isSource(DataFlow::Node source) { sources(source) } @@ -9,9 +11,21 @@ module Config implements DataFlow::ConfigSig { predicate isSink(DataFlow::Node sink) { sinks(sink) } } -module Flow = DataFlow::Global; +module Flow = TaintTracking::Global; -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } +module FlowTest implements TestSig { + string getARelevantTag() { result = "S1[t]" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "S1[t]" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go index 88bf41fba4a..88ffaff711a 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go @@ -7,83 +7,83 @@ import ( func TestI1(t test.I1) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] } func TestI2(t test.I2) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] } func TestS1(t test.S1) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] SImplEmbedI1[t] } func TestS2(t test.S2) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] } func TestSEmbedI1(t test.SEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] } func TestSEmbedI2(t test.SEmbedI2) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] } func TestIEmbedI1(t test.IEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] } func TestIEmbedI2(t test.IEmbedI2) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] } func TestSImplEmbedI1(t test.SImplEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] } func TestSImplEmbedI2(t test.SImplEmbedI2) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] } func TestSEmbedS1(t test.SEmbedS1) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] SImplEmbedI1[t] } func TestSEmbedS2(t test.SEmbedS2) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] } func TestSImplEmbedS1(t test.SImplEmbedS1) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] SImplEmbedS1[t] } func TestSImplEmbedS2(t test.SImplEmbedS2) { x := t.Source() y := t.Step(x) - t.Sink(y) + t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] SImplEmbedS2[t] } From 0255edf524a33c01dfc3f26cfec98ee8359e670a Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 24 Sep 2024 13:55:39 +0100 Subject: [PATCH 05/10] Remove tests for sources and sinks This is redundant given that we test for paths, and for a path we need the source, step and sink methods to be modeled. --- .../mad_IEmbedI1_subtypes_true.expected | 30 ------------------- .../mad_IEmbedI1_subtypes_true.ql | 8 ++--- .../mad_IEmbedI2_subtypes_true.expected | 16 ---------- .../mad_IEmbedI2_subtypes_true.ql | 8 ++--- .../mad_SEmbedI1_subtypes_true.expected | 30 ------------------- .../mad_SEmbedI1_subtypes_true.ql | 8 ++--- .../mad_SEmbedI2_subtypes_true.expected | 16 ---------- .../mad_SEmbedI2_subtypes_true.ql | 8 ++--- .../mad_SEmbedS1_subtypes_true.expected | 2 -- .../mad_SEmbedS1_subtypes_true.ql | 8 ++--- .../mad_SEmbedS2_subtypes_true.expected | 2 -- .../mad_SEmbedS2_subtypes_true.ql | 8 ++--- .../mad_SImplEmbedI1_subtypes_true.expected | 30 ------------------- .../mad_SImplEmbedI1_subtypes_true.ql | 8 ++--- .../mad_SImplEmbedI2_subtypes_true.expected | 16 ---------- .../mad_SImplEmbedI2_subtypes_true.ql | 8 ++--- .../mad_SImplEmbedS1_subtypes_true.expected | 4 --- .../mad_SImplEmbedS1_subtypes_true.ql | 8 ++--- .../mad_SImplEmbedS2_subtypes_true.expected | 4 --- .../mad_SImplEmbedS2_subtypes_true.ql | 8 ++--- .../mad_i1_subtypes_false.expected | 8 ----- .../mad_i1_subtypes_false.ql | 8 ++--- .../mad_i1_subtypes_true.expected | 30 ------------------- .../mad_i1_subtypes_true.ql | 8 ++--- .../mad_i2_subtypes_false.expected | 8 ----- .../mad_i2_subtypes_false.ql | 8 ++--- .../mad_i2_subtypes_true.expected | 16 ---------- .../mad_i2_subtypes_true.ql | 8 ++--- .../mad_s1_subtypes_false.expected | 6 ---- .../mad_s1_subtypes_false.ql | 8 ++--- .../mad_s1_subtypes_true.expected | 6 ---- .../mad_s1_subtypes_true.ql | 8 ++--- .../ExternalFlowInheritance/ql_i1.expected | 8 ----- .../dataflow/ExternalFlowInheritance/ql_i1.ql | 8 ++--- .../ExternalFlowInheritance/ql_s1.expected | 12 -------- .../dataflow/ExternalFlowInheritance/ql_s1.ql | 8 ++--- 36 files changed, 36 insertions(+), 352 deletions(-) diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected index cbf95dd4367..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.expected @@ -1,33 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:8:7:8:16 | call to Source | -| test.go:14:7:14:16 | call to Source | -| test.go:20:7:20:16 | call to Source | -| test.go:26:7:26:16 | call to Source | -| test.go:32:7:32:16 | call to Source | -| test.go:38:7:38:16 | call to Source | -| test.go:44:7:44:16 | call to Source | -| test.go:50:7:50:16 | call to Source | -| test.go:56:7:56:16 | call to Source | -| test.go:62:7:62:16 | call to Source | -| test.go:68:7:68:16 | call to Source | -| test.go:74:7:74:16 | call to Source | -| test.go:80:7:80:16 | call to Source | -| test.go:86:7:86:16 | call to Source | -sinks -| test.go:10:9:10:9 | y | -| test.go:16:9:16:9 | y | -| test.go:22:9:22:9 | y | -| test.go:28:9:28:9 | y | -| test.go:34:9:34:9 | y | -| test.go:40:9:40:9 | y | -| test.go:46:9:46:9 | y | -| test.go:52:9:52:9 | y | -| test.go:58:9:58:9 | y | -| test.go:64:9:64:9 | y | -| test.go:70:9:70:9 | y | -| test.go:76:9:76:9 | y | -| test.go:82:9:82:9 | y | -| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql index 8e2b2d851f8..7af5b7795b9 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI1_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected index fd2bac1acf5..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.expected @@ -1,19 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:14:7:14:16 | call to Source | -| test.go:26:7:26:16 | call to Source | -| test.go:38:7:38:16 | call to Source | -| test.go:50:7:50:16 | call to Source | -| test.go:62:7:62:16 | call to Source | -| test.go:74:7:74:16 | call to Source | -| test.go:86:7:86:16 | call to Source | -sinks -| test.go:16:9:16:9 | y | -| test.go:28:9:28:9 | y | -| test.go:40:9:40:9 | y | -| test.go:52:9:52:9 | y | -| test.go:64:9:64:9 | y | -| test.go:76:9:76:9 | y | -| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql index 7941f126967..388370ba6b8 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_IEmbedI2_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected index cbf95dd4367..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.expected @@ -1,33 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:8:7:8:16 | call to Source | -| test.go:14:7:14:16 | call to Source | -| test.go:20:7:20:16 | call to Source | -| test.go:26:7:26:16 | call to Source | -| test.go:32:7:32:16 | call to Source | -| test.go:38:7:38:16 | call to Source | -| test.go:44:7:44:16 | call to Source | -| test.go:50:7:50:16 | call to Source | -| test.go:56:7:56:16 | call to Source | -| test.go:62:7:62:16 | call to Source | -| test.go:68:7:68:16 | call to Source | -| test.go:74:7:74:16 | call to Source | -| test.go:80:7:80:16 | call to Source | -| test.go:86:7:86:16 | call to Source | -sinks -| test.go:10:9:10:9 | y | -| test.go:16:9:16:9 | y | -| test.go:22:9:22:9 | y | -| test.go:28:9:28:9 | y | -| test.go:34:9:34:9 | y | -| test.go:40:9:40:9 | y | -| test.go:46:9:46:9 | y | -| test.go:52:9:52:9 | y | -| test.go:58:9:58:9 | y | -| test.go:64:9:64:9 | y | -| test.go:70:9:70:9 | y | -| test.go:76:9:76:9 | y | -| test.go:82:9:82:9 | y | -| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql index 6221720a45e..d56f8ae0f0f 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI1_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected index fd2bac1acf5..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.expected @@ -1,19 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:14:7:14:16 | call to Source | -| test.go:26:7:26:16 | call to Source | -| test.go:38:7:38:16 | call to Source | -| test.go:50:7:50:16 | call to Source | -| test.go:62:7:62:16 | call to Source | -| test.go:74:7:74:16 | call to Source | -| test.go:86:7:86:16 | call to Source | -sinks -| test.go:16:9:16:9 | y | -| test.go:28:9:28:9 | y | -| test.go:40:9:40:9 | y | -| test.go:52:9:52:9 | y | -| test.go:64:9:64:9 | y | -| test.go:76:9:76:9 | y | -| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql index e1a2ff93d95..dd46393546f 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedI2_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected index 3b436cd843b..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.expected @@ -1,5 +1,3 @@ testFailures invalidModelRow failures -sources -sinks diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql index fba25acec59..0789ada5c51 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS1_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected index 3b436cd843b..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.expected @@ -1,5 +1,3 @@ testFailures invalidModelRow failures -sources -sinks diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql index 817a7b60ae3..76d0b6fcd1a 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SEmbedS2_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected index cbf95dd4367..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.expected @@ -1,33 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:8:7:8:16 | call to Source | -| test.go:14:7:14:16 | call to Source | -| test.go:20:7:20:16 | call to Source | -| test.go:26:7:26:16 | call to Source | -| test.go:32:7:32:16 | call to Source | -| test.go:38:7:38:16 | call to Source | -| test.go:44:7:44:16 | call to Source | -| test.go:50:7:50:16 | call to Source | -| test.go:56:7:56:16 | call to Source | -| test.go:62:7:62:16 | call to Source | -| test.go:68:7:68:16 | call to Source | -| test.go:74:7:74:16 | call to Source | -| test.go:80:7:80:16 | call to Source | -| test.go:86:7:86:16 | call to Source | -sinks -| test.go:10:9:10:9 | y | -| test.go:16:9:16:9 | y | -| test.go:22:9:22:9 | y | -| test.go:28:9:28:9 | y | -| test.go:34:9:34:9 | y | -| test.go:40:9:40:9 | y | -| test.go:46:9:46:9 | y | -| test.go:52:9:52:9 | y | -| test.go:58:9:58:9 | y | -| test.go:64:9:64:9 | y | -| test.go:70:9:70:9 | y | -| test.go:76:9:76:9 | y | -| test.go:82:9:82:9 | y | -| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql index d04767396da..4fb7909d761 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI1_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected index fd2bac1acf5..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.expected @@ -1,19 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:14:7:14:16 | call to Source | -| test.go:26:7:26:16 | call to Source | -| test.go:38:7:38:16 | call to Source | -| test.go:50:7:50:16 | call to Source | -| test.go:62:7:62:16 | call to Source | -| test.go:74:7:74:16 | call to Source | -| test.go:86:7:86:16 | call to Source | -sinks -| test.go:16:9:16:9 | y | -| test.go:28:9:28:9 | y | -| test.go:40:9:40:9 | y | -| test.go:52:9:52:9 | y | -| test.go:64:9:64:9 | y | -| test.go:76:9:76:9 | y | -| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql index 6fe3df19734..f5dba02a152 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedI2_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected index 432cb871c80..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.expected @@ -1,7 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:80:7:80:16 | call to Source | -sinks -| test.go:82:9:82:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql index 559e33dfe74..e08c787aa10 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS1_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected index bdb17db38b6..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.expected @@ -1,7 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:86:7:86:16 | call to Source | -sinks -| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql index 492bc2f9fd6..4c2d832620c 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_SImplEmbedS2_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected index 4175a026f36..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.expected @@ -1,11 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:8:7:8:16 | call to Source | -| test.go:32:7:32:16 | call to Source | -| test.go:44:7:44:16 | call to Source | -sinks -| test.go:10:9:10:9 | y | -| test.go:34:9:34:9 | y | -| test.go:46:9:46:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql index f9f2bf6ebfc..82d63025f22 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_false.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected index cbf95dd4367..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.expected @@ -1,33 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:8:7:8:16 | call to Source | -| test.go:14:7:14:16 | call to Source | -| test.go:20:7:20:16 | call to Source | -| test.go:26:7:26:16 | call to Source | -| test.go:32:7:32:16 | call to Source | -| test.go:38:7:38:16 | call to Source | -| test.go:44:7:44:16 | call to Source | -| test.go:50:7:50:16 | call to Source | -| test.go:56:7:56:16 | call to Source | -| test.go:62:7:62:16 | call to Source | -| test.go:68:7:68:16 | call to Source | -| test.go:74:7:74:16 | call to Source | -| test.go:80:7:80:16 | call to Source | -| test.go:86:7:86:16 | call to Source | -sinks -| test.go:10:9:10:9 | y | -| test.go:16:9:16:9 | y | -| test.go:22:9:22:9 | y | -| test.go:28:9:28:9 | y | -| test.go:34:9:34:9 | y | -| test.go:40:9:40:9 | y | -| test.go:46:9:46:9 | y | -| test.go:52:9:52:9 | y | -| test.go:58:9:58:9 | y | -| test.go:64:9:64:9 | y | -| test.go:70:9:70:9 | y | -| test.go:76:9:76:9 | y | -| test.go:82:9:82:9 | y | -| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql index 2dbf85ef9d0..85a18e65096 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i1_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected index fcf4ee6e4c7..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.expected @@ -1,11 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:14:7:14:16 | call to Source | -| test.go:38:7:38:16 | call to Source | -| test.go:50:7:50:16 | call to Source | -sinks -| test.go:16:9:16:9 | y | -| test.go:40:9:40:9 | y | -| test.go:52:9:52:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql index 6324fc52cf8..f8dafe8b4f7 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_false.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected index fd2bac1acf5..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.expected @@ -1,19 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:14:7:14:16 | call to Source | -| test.go:26:7:26:16 | call to Source | -| test.go:38:7:38:16 | call to Source | -| test.go:50:7:50:16 | call to Source | -| test.go:62:7:62:16 | call to Source | -| test.go:74:7:74:16 | call to Source | -| test.go:86:7:86:16 | call to Source | -sinks -| test.go:16:9:16:9 | y | -| test.go:28:9:28:9 | y | -| test.go:40:9:40:9 | y | -| test.go:52:9:52:9 | y | -| test.go:64:9:64:9 | y | -| test.go:76:9:76:9 | y | -| test.go:88:9:88:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql index 5c936b10dbc..14059181392 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_i2_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected index bec552c8551..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.expected @@ -1,9 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:20:7:20:16 | call to Source | -| test.go:68:7:68:16 | call to Source | -sinks -| test.go:22:9:22:9 | y | -| test.go:70:9:70:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql index b11b64c4a13..72cea1afe96 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_false.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected index bec552c8551..db33d6d2504 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.expected @@ -1,9 +1,3 @@ testFailures invalidModelRow failures -sources -| test.go:20:7:20:16 | call to Source | -| test.go:68:7:68:16 | call to Source | -sinks -| test.go:22:9:22:9 | y | -| test.go:70:9:70:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql index 7809f59c3d7..4afbff7ac9e 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/mad_s1_subtypes_true.ql @@ -6,9 +6,9 @@ import TestUtilities.InlineExpectationsTest import MakeTest module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = TaintTracking::Global; @@ -26,7 +26,3 @@ module FlowTest implements TestSig { ) } } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected index d58288abca7..7547cc92e0b 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected @@ -3,11 +3,3 @@ paths | test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | | test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | | test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | -sources -| test.go:8:7:8:16 | call to Source | -| test.go:32:7:32:16 | call to Source | -| test.go:44:7:44:16 | call to Source | -sinks -| test.go:10:9:10:9 | y | -| test.go:34:9:34:9 | y | -| test.go:46:9:46:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql index bf113c3330c..7e0108da764 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql @@ -32,15 +32,11 @@ class MySink extends FileSystemAccess::Range, DataFlow::CallNode { } module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = DataFlow::Global; query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected index 39cd1eaca94..4b10ac1b7b0 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected @@ -5,15 +5,3 @@ paths | test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | | test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | | test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | -sources -| test.go:8:7:8:16 | call to Source | -| test.go:20:7:20:16 | call to Source | -| test.go:32:7:32:16 | call to Source | -| test.go:44:7:44:16 | call to Source | -| test.go:68:7:68:16 | call to Source | -sinks -| test.go:10:9:10:9 | y | -| test.go:22:9:22:9 | y | -| test.go:34:9:34:9 | y | -| test.go:46:9:46:9 | y | -| test.go:70:9:70:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql index 6d9371308ef..27c8d4aec86 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql @@ -32,15 +32,11 @@ class MySink extends FileSystemAccess::Range, DataFlow::CallNode { } module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { sources(source) } + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - predicate isSink(DataFlow::Node sink) { sinks(sink) } + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } } module Flow = DataFlow::Global; query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } - -query predicate sources(DataFlow::Node source) { source instanceof RemoteFlowSource } - -query predicate sinks(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } From 6e428d508300cbdedff9d3c6f5aa0e5043356610 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 24 Sep 2024 15:03:48 +0100 Subject: [PATCH 06/10] Fix bug where some methods were inappropriately promoted --- go/ql/lib/semmle/go/Types.qll | 2 +- .../dataflow/ExternalFlowInheritance/test.go | 28 +++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go/ql/lib/semmle/go/Types.qll b/go/ql/lib/semmle/go/Types.qll index 645f0e3fe67..b01e0a7f4dd 100644 --- a/go/ql/lib/semmle/go/Types.qll +++ b/go/ql/lib/semmle/go/Types.qll @@ -1000,7 +1000,7 @@ class NamedType extends @namedtype, CompositeType { s.hasOwnField(_, _, embedded, true) and // ensure `m` can be promoted not s.hasOwnField(_, m, _, _) and - not exists(Method m2 | m2.getReceiverType() = this and m2.getName() = m) + not exists(Method m2 | m2.getReceiverBaseType() = this and m2.getName() = m) | // If S contains an embedded field T, the method set of S includes promoted methods with receiver T result = embedded.getMethod(m) diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go index 88ffaff711a..6291f991cf1 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go @@ -7,83 +7,83 @@ import ( func TestI1(t test.I1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] + t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] } func TestI2(t test.I2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] + t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] } func TestS1(t test.S1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] SImplEmbedI1[t] + t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] } func TestS2(t test.S2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] + t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] } func TestSEmbedI1(t test.SEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] + t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] } func TestSEmbedI2(t test.SEmbedI2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] + t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] } func TestIEmbedI1(t test.IEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] + t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] } func TestIEmbedI2(t test.IEmbedI2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] + t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] } func TestSImplEmbedI1(t test.SImplEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] + t.Sink(y) // $ I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] } func TestSImplEmbedI2(t test.SImplEmbedI2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] + t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI2[t] } func TestSEmbedS1(t test.SEmbedS1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] SImplEmbedI1[t] + t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] } func TestSEmbedS2(t test.SEmbedS2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] + t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] } func TestSImplEmbedS1(t test.SImplEmbedS1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] SImplEmbedS1[t] + t.Sink(y) // $ I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedS1[t] } func TestSImplEmbedS2(t test.SImplEmbedS2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI1[t] SImplEmbedI2[t] SImplEmbedS2[t] + t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedS2[t] } From b0caabac8672d876db92a96c322d1b221b51e56b Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 24 Sep 2024 16:18:59 +0100 Subject: [PATCH 07/10] Also update QL tests --- .../ExternalFlowInheritance/ql_I1.expected | 3 ++ .../{ql_i1.ql => ql_I1.ql} | 34 +++++++++++++------ .../ExternalFlowInheritance/ql_S1.expected | 3 ++ .../{ql_s1.ql => ql_S1.ql} | 34 +++++++++++++------ .../ExternalFlowInheritance/ql_i1.expected | 5 --- .../ExternalFlowInheritance/ql_s1.expected | 7 ---- .../dataflow/ExternalFlowInheritance/test.go | 10 +++--- 7 files changed, 59 insertions(+), 37 deletions(-) create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_I1.expected rename go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/{ql_i1.ql => ql_I1.ql} (65%) create mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_S1.expected rename go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/{ql_s1.ql => ql_S1.ql} (65%) delete mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected delete mode 100644 go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_I1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_I1.expected new file mode 100644 index 00000000000..db33d6d2504 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_I1.expected @@ -0,0 +1,3 @@ +testFailures +invalidModelRow +failures diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_I1.ql similarity index 65% rename from go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql rename to go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_I1.ql index 7e0108da764..9e563a5bb70 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_I1.ql @@ -2,6 +2,30 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } + + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } +} + +module Flow = TaintTracking::Global; + +module FlowTest implements TestSig { + string getARelevantTag() { result = "ql_I1" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "ql_I1" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} class MySource extends RemoteFlowSource::Range instanceof DataFlow::Node { MySource() { @@ -30,13 +54,3 @@ class MySink extends FileSystemAccess::Range, DataFlow::CallNode { override DataFlow::Node getAPathArgument() { result = this.getArgument(0) } } - -module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - - predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } -} - -module Flow = DataFlow::Global; - -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_S1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_S1.expected new file mode 100644 index 00000000000..db33d6d2504 --- /dev/null +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_S1.expected @@ -0,0 +1,3 @@ +testFailures +invalidModelRow +failures diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_S1.ql similarity index 65% rename from go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql rename to go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_S1.ql index 27c8d4aec86..bf9f36358b9 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.ql +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_S1.ql @@ -2,6 +2,30 @@ import go import semmle.go.dataflow.ExternalFlow import ModelValidation import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl +import TestUtilities.InlineExpectationsTest +import MakeTest + +module Config implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } + + predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } +} + +module Flow = TaintTracking::Global; + +module FlowTest implements TestSig { + string getARelevantTag() { result = "ql_S1" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + tag = "ql_S1" and + exists(DataFlow::Node sink | Flow::flowTo(sink) | + sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(), + location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and + element = sink.toString() and + value = "" + ) + } +} class MySource extends RemoteFlowSource::Range instanceof DataFlow::Node { MySource() { @@ -30,13 +54,3 @@ class MySink extends FileSystemAccess::Range, DataFlow::CallNode { override DataFlow::Node getAPathArgument() { result = this.getArgument(0) } } - -module Config implements DataFlow::ConfigSig { - predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource } - - predicate isSink(DataFlow::Node sink) { sink = any(FileSystemAccess fsa).getAPathArgument() } -} - -module Flow = DataFlow::Global; - -query predicate paths(DataFlow::Node source, DataFlow::Node sink) { Flow::flow(source, sink) } diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected deleted file mode 100644 index 7547cc92e0b..00000000000 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_i1.expected +++ /dev/null @@ -1,5 +0,0 @@ -invalidModelRow -paths -| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | -| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | -| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected deleted file mode 100644 index 4b10ac1b7b0..00000000000 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/ql_s1.expected +++ /dev/null @@ -1,7 +0,0 @@ -invalidModelRow -paths -| test.go:8:7:8:16 | call to Source | test.go:10:9:10:9 | y | -| test.go:20:7:20:16 | call to Source | test.go:22:9:22:9 | y | -| test.go:32:7:32:16 | call to Source | test.go:34:9:34:9 | y | -| test.go:44:7:44:16 | call to Source | test.go:46:9:46:9 | y | -| test.go:68:7:68:16 | call to Source | test.go:70:9:70:9 | y | diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go index 6291f991cf1..141e51483c5 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go @@ -7,7 +7,7 @@ import ( func TestI1(t test.I1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] + t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] ql_I1 ql_S1 } func TestI2(t test.I2) { @@ -19,7 +19,7 @@ func TestI2(t test.I2) { func TestS1(t test.S1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] + t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] ql_S1 } func TestS2(t test.S2) { @@ -31,7 +31,7 @@ func TestS2(t test.S2) { func TestSEmbedI1(t test.SEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] + t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] ql_I1 ql_S1 } func TestSEmbedI2(t test.SEmbedI2) { @@ -43,7 +43,7 @@ func TestSEmbedI2(t test.SEmbedI2) { func TestIEmbedI1(t test.IEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] + t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] ql_I1 ql_S1 } func TestIEmbedI2(t test.IEmbedI2) { @@ -67,7 +67,7 @@ func TestSImplEmbedI2(t test.SImplEmbedI2) { func TestSEmbedS1(t test.SEmbedS1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] + t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] ql_S1 } func TestSEmbedS2(t test.SEmbedS2) { From 73209638e3fdd054f048e4eafe3e7f0a1a85035d Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 24 Sep 2024 16:41:10 +0100 Subject: [PATCH 08/10] Improve comments in test library --- .../vendor/github.com/nonexistent/test/stub.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go index e5a417bcbd3..206e1d99e38 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/vendor/github.com/nonexistent/test/stub.go @@ -97,7 +97,8 @@ type SEmbedS1 struct{ S1 } // A struct type embedding S2 type SEmbedS2 struct{ S2 } -// A struct type embedding S1 and "overriding" its methods +// A struct type embedding S1 and separately implementing I1's methods, so the +// methods of the embedded field are not promoted. type SImplEmbedS1 struct{ S1 } func (t *SImplEmbedS1) Source() interface{} { @@ -110,7 +111,8 @@ func (t *SImplEmbedS1) Step(val interface{}) interface{} { return val } -// A struct type embedding S2 and "overriding" its methods +// A struct type embedding S2 and separately implementing I2's methods, so the +// methods of the embedded field are not promoted. type SImplEmbedS2 struct{ S2 } func (t *SImplEmbedS2) Source() interface{} { From bcb718ac77251c60433935b3b3ec919c565d7178 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 24 Sep 2024 21:39:49 +0100 Subject: [PATCH 09/10] Add change note --- .../change-notes/2024-09-24-incorrectly-promoted-methods.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 go/ql/lib/change-notes/2024-09-24-incorrectly-promoted-methods.md diff --git a/go/ql/lib/change-notes/2024-09-24-incorrectly-promoted-methods.md b/go/ql/lib/change-notes/2024-09-24-incorrectly-promoted-methods.md new file mode 100644 index 00000000000..32802982b75 --- /dev/null +++ b/go/ql/lib/change-notes/2024-09-24-incorrectly-promoted-methods.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* A method in the method set of an embedded field of a struct should not be promoted to the method set of the struct if the struct has a method with the same name. This was not being enforced, which meant that there were two methods with the same qualified name, and models were sometimes being applied when they shouldn't have been. This has now been fixed. From ea4f9cad3c57cbf90a8c58e9dd6a642bd9aa3e70 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 24 Sep 2024 22:04:50 +0100 Subject: [PATCH 10/10] Mark some test results as SPURIOUS --- .../dataflow/ExternalFlowInheritance/test.go | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go index 141e51483c5..1c41bc05c76 100644 --- a/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go +++ b/go/ql/test/library-tests/semmle/go/dataflow/ExternalFlowInheritance/test.go @@ -7,83 +7,83 @@ import ( func TestI1(t test.I1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] ql_I1 ql_S1 + t.Sink(y) // $ I1[f] I1[t] ql_I1 SPURIOUS: IEmbedI1[t] SEmbedI1[t] ql_S1 } func TestI2(t test.I2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] + t.Sink(y) // $ I1[t] I2[f] I2[t] SPURIOUS: IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] } func TestS1(t test.S1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] ql_S1 + t.Sink(y) // $ I1[t] S1[f] S1[t] ql_S1 SPURIOUS: IEmbedI1[t] SEmbedI1[t] } func TestS2(t test.S2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] + t.Sink(y) // $ I1[t] I2[t] SPURIOUS: IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] } func TestSEmbedI1(t test.SEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] ql_I1 ql_S1 + t.Sink(y) // $ I1[t] SEmbedI1[t] ql_I1 SPURIOUS: I1[f] IEmbedI1[t] ql_S1 } func TestSEmbedI2(t test.SEmbedI2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] + t.Sink(y) // $ I1[t] I2[t] SEmbedI2[t] SPURIOUS: I2[f] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] } func TestIEmbedI1(t test.IEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[f] I1[t] IEmbedI1[t] SEmbedI1[t] ql_I1 ql_S1 + t.Sink(y) // $ I1[t] IEmbedI1[t] ql_I1 SPURIOUS: I1[f] SEmbedI1[t] ql_S1 } func TestIEmbedI2(t test.IEmbedI2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[f] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] + t.Sink(y) // $ I1[t] I2[t] IEmbedI2[t] SPURIOUS: I2[f] IEmbedI1[t] SEmbedI1[t] SEmbedI2[t] } func TestSImplEmbedI1(t test.SImplEmbedI1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedI1[t] + t.Sink(y) // $ I1[t] SImplEmbedI1[t] SPURIOUS: IEmbedI1[t] SEmbedI1[t] } func TestSImplEmbedI2(t test.SImplEmbedI2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedI2[t] + t.Sink(y) // $ I1[t] I2[t] SImplEmbedI2[t] SPURIOUS: IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] } func TestSEmbedS1(t test.SEmbedS1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] S1[f] S1[t] SEmbedI1[t] ql_S1 + t.Sink(y) // $ I1[t] S1[t] ql_S1 SPURIOUS: IEmbedI1[t] S1[f] SEmbedI1[t] } func TestSEmbedS2(t test.SEmbedS2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] + t.Sink(y) // $ I1[t] I2[t] SPURIOUS: IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] } func TestSImplEmbedS1(t test.SImplEmbedS1) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] IEmbedI1[t] SEmbedI1[t] SImplEmbedS1[t] + t.Sink(y) // $ I1[t] SImplEmbedS1[t] SPURIOUS: IEmbedI1[t] SEmbedI1[t] } func TestSImplEmbedS2(t test.SImplEmbedS2) { x := t.Source() y := t.Step(x) - t.Sink(y) // $ I1[t] I2[t] IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] SImplEmbedS2[t] + t.Sink(y) // $ I1[t] I2[t] SImplEmbedS2[t] SPURIOUS: IEmbedI1[t] IEmbedI2[t] SEmbedI1[t] SEmbedI2[t] }