mirror of
https://github.com/github/codeql.git
synced 2025-12-19 18:33:16 +01:00
ce4b192caa
Before, results from `dca` would look something like
## + py/meta/alerts/remote-flow-sources-reach
- django/django@c2250cf_cb8f: tests/messages_tests/urls.py:38:16:38:48
reachable with taint-tracking from RemoteFlowSource
- django/django@c2250cf_cb8f: tests/messages_tests/urls.py:38:9:38:12
reachable with taint-tracking from RemoteFlowSource
now it should make it easier to spot _what_ it is that actually changed,
since we pretty-print the node.
41 lines
1.3 KiB
Plaintext
41 lines
1.3 KiB
Plaintext
import python
|
|
import semmle.python.dataflow.new.DataFlow
|
|
import TestUtilities.InlineExpectationsTest
|
|
private import semmle.python.dataflow.new.internal.PrintNode
|
|
|
|
abstract class FlowTest extends InlineExpectationsTest {
|
|
bindingset[this]
|
|
FlowTest() { any() }
|
|
|
|
abstract string flowTag();
|
|
|
|
abstract predicate relevantFlow(DataFlow::Node fromNode, DataFlow::Node toNode);
|
|
|
|
override string getARelevantTag() { result = this.flowTag() }
|
|
|
|
override predicate hasActualResult(Location location, string element, string tag, string value) {
|
|
exists(DataFlow::Node fromNode, DataFlow::Node toNode | this.relevantFlow(fromNode, toNode) |
|
|
location = toNode.getLocation() and
|
|
tag = this.flowTag() and
|
|
value =
|
|
"\"" + prettyNode(fromNode).replaceAll("\"", "'") + lineStr(fromNode, toNode) + " -> " +
|
|
prettyNode(toNode).replaceAll("\"", "'") + "\"" and
|
|
element = toNode.toString()
|
|
)
|
|
}
|
|
|
|
pragma[inline]
|
|
private string lineStr(DataFlow::Node fromNode, DataFlow::Node toNode) {
|
|
exists(int delta |
|
|
delta = fromNode.getLocation().getStartLine() - toNode.getLocation().getStartLine()
|
|
|
|
|
if delta = 0
|
|
then result = ""
|
|
else
|
|
if delta > 0
|
|
then result = ", l:+" + delta.toString()
|
|
else result = ", l:" + delta.toString()
|
|
)
|
|
}
|
|
}
|