/** * Helper library for implementing data or taint flow inline expectation tests. * As long as data or taint flow configurations for IR and/or AST based data/taint flow * are in scope, provides inline expectations tests. * All sinks that have flow are annotated with `ast` (or respective `ir`) if there * is a unique source for the flow. * Otherwise, if there are multiple sources that can reach a given sink, the annotations * have the form `ast=lineno:column` (or `ir=lineno:column`). * If a sink is reachable through both AST and IR flow, the annotations have the form * `ast,ir` or `ast,ir=lineno:column`. * Intermediate steps from the source to the sink are not annotated. */ import cpp private import semmle.code.cpp.ir.dataflow.DataFlow::DataFlow as IRDataFlow private import semmle.code.cpp.dataflow.DataFlow::DataFlow as AstDataFlow import utils.test.InlineExpectationsTest module IRFlowTest implements TestSig { string getARelevantTag() { result = "ir" } predicate hasActualResult(Location location, string element, string tag, string value) { exists(IRDataFlow::Node source, IRDataFlow::Node sink, int n | tag = "ir" and Flow::flow(source, sink) and n = strictcount(int line, int column | Flow::flow(any(IRDataFlow::Node otherSource | otherSource.hasLocationInfo(_, line, column, _, _) ), sink) ) and ( n = 1 and value = "" or // If there is more than one source for this sink // we specify the source location explicitly. n > 1 and value = source.getLocation().getStartLine().toString() + ":" + source.getLocation().getStartColumn() ) and location = sink.getLocation() and element = sink.toString() ) } } module AstFlowTest implements TestSig { string getARelevantTag() { result = "ast" } predicate hasActualResult(Location location, string element, string tag, string value) { exists(AstDataFlow::Node source, AstDataFlow::Node sink, int n | tag = "ast" and Flow::flow(source, sink) and n = strictcount(int line, int column | Flow::flow(any(AstDataFlow::Node otherSource | otherSource.hasLocationInfo(_, line, column, _, _) ), sink) ) and ( n = 1 and value = "" or // If there is more than one source for this sink // we specify the source location explicitly. n > 1 and value = source.getLocation().getStartLine().toString() + ":" + source.getLocation().getStartColumn() ) and location = sink.getLocation() and element = sink.toString() ) } }