mirror of
https://github.com/github/codeql.git
synced 2026-05-31 03:21:23 +02:00
1bcaa56b10
Second batch of test reblessings, capturing changes in result content (not just toString labels): - Framework taint/concept tests (fastapi, sqlalchemy, aiohttp, lxml, stdlib, django-orm): mostly gained MISSING-tainted annotations where the new dataflow no longer reaches sinks. Some are real taint regressions; left as documented failures for follow-up. - Exception-handler tests (CWE-209-StackTraceExposure, EmptyExcept, CatchingBaseException, IncorrectExceptOrder, FileNotAlwaysClosed, FindSubclass/Find, Statements/exit/UseOfExit): the no-raise shared CFG abstraction does not emit ExceptionSuccessor abrupt-completion edges from arbitrary expressions, so except-handler bodies (and their exception target Names) are statically dead. Tracked separately under cfg-modelling-exceptions. - Dataflow-path / control-flow node toString polish across the security query suite (PathInjection, CodeInjection, UnsafeUnpacking, UnsafeUsageOfClientSideEncryptionVersion, RequestWithoutValidation, ReflectedXss, CallGraph): simple-leaf nodes now stringify as their AST text instead of 'After X'. - SSA / call-graph improvements (CmpTest, CallGraph/InlineCallGraphTest): fewer SSA mismatches between new and old; two previously-MISSING tt= annotations resolved. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The interesting ORM tests files can be found under testapp/orm_*.py. These are set up to be executed by the testapp/tests.py file.
List of interesting tests files (that might go out of date if it is forgotten 😳):
- testapp/orm_tests.py: which tests flow from source to sink
- testapp/orm_form_test.py: shows how forms can be used to save Models to the DB
- testapp/orm_security_tests.py: which highlights some interesting interactions with security queries
- testapp/orm_inheritance.py: which highlights how inheritance of ORM models works
Setup
pip install django pytest pytest-django django-polymorphic
Run server
python manage.py makemigrations && python manage.py migrate && python manage.py runserver
Run tests
pytest