mirror of
https://github.com/github/codeql.git
synced 2025-12-20 10:46:30 +01:00
85 lines
2.3 KiB
Ruby
85 lines
2.3 KiB
Ruby
tainted = identity source("tainted")
|
|
sink tainted # $ hasValueFlow=tainted
|
|
|
|
tainted2 = apply_block tainted do |x|
|
|
sink x # $ hasValueFlow=tainted
|
|
x
|
|
end
|
|
|
|
sink tainted2 # $ hasValueFlow=tainted
|
|
|
|
my_lambda = -> (x) {
|
|
sink x # $ hasValueFlow=tainted
|
|
x
|
|
}
|
|
|
|
tainted3 = apply_lambda(my_lambda, tainted)
|
|
|
|
sink(tainted3) # $ hasValueFlow=tainted
|
|
|
|
tainted4 = Foo.firstArg(tainted)
|
|
sink(tainted4) # $ hasTaintFlow=tainted
|
|
|
|
notTainted = Foo.firstArg(nil, tainted))
|
|
sink(notTainted)
|
|
|
|
tainted5 = Foo.secondArg(nil, tainted)
|
|
sink(tainted5) # $ hasTaintFlow=tainted
|
|
|
|
sink(Foo.onlyWithBlock(tainted))
|
|
sink(Foo.onlyWithBlock(tainted) do |x| end) # $ hasTaintFlow=tainted
|
|
sink(Foo.onlyWithoutBlock(tainted)) # $ hasTaintFlow=tainted
|
|
sink(Foo.onlyWithoutBlock(tainted) do |x| end)
|
|
|
|
Foo.new.method(tainted) # $ hasValueFlow=tainted
|
|
Bar.new.method(tainted) # $ hasValueFlow=tainted
|
|
Bar.new.next.method(tainted) # $ hasValueFlow=tainted
|
|
Bar.new.next.next.next.next.method(tainted) # $ hasValueFlow=tainted
|
|
|
|
def userDefinedFunction(x, y)
|
|
t = source("t")
|
|
sink(x.matchedByName(t)) # $ hasTaintFlow=t
|
|
sink(y.matchedByName(t)) # $ hasTaintFlow=t
|
|
sink(x.unmatchedName(t))
|
|
sink(t.matchedByNameRcv()) # $ hasTaintFlow=t
|
|
end
|
|
|
|
Foo.blockArg do |x|
|
|
sink(x.preserveTaint(source("blockArg"))) # $ hasTaintFlow=blockArg
|
|
end
|
|
|
|
sink(Foo.namedArg(foo: tainted)) # $ hasTaintFlow=tainted
|
|
sink(Foo.namedArg(tainted))
|
|
|
|
sink(Foo.anyArg(foo: tainted)) # $ hasTaintFlow=tainted
|
|
sink(Foo.anyArg(tainted)) # $ hasTaintFlow=tainted
|
|
|
|
sink(Foo.anyPositionFromOne(tainted))
|
|
sink(Foo.anyPositionFromOne(0, tainted)) # $ hasTaintFlow=tainted
|
|
|
|
Foo.intoNamedCallback(tainted, foo: ->(x) {
|
|
sink(x) # $ hasTaintFlow=tainted
|
|
})
|
|
Foo.intoNamedParameter(tainted, ->(foo:) {
|
|
sink(foo) # $ MISSING: hasTaintFlow=tainted
|
|
})
|
|
|
|
Foo.startInNamedCallback(foo: ->(x) {
|
|
sink(x.preserveTaint(source("startInNamedCallback"))) # $ hasTaintFlow=startInNamedCallback
|
|
})
|
|
Foo.startInNamedParameter(->(foo:) {
|
|
sink(foo.preserveTaint(source("startInNamedParameter"))) # $ hasTaintFlow=startInNamedParameter
|
|
})
|
|
|
|
a = ["elem0", source("elem1"), source("elem2")]
|
|
sink(a[0])
|
|
sink(a[1]) # $ hasValueFlow=elem1
|
|
sink(a[2]) # $ hasValueFlow=elem2
|
|
b = a.withElementOne()
|
|
sink(b[0])
|
|
sink(b[1]) # $ hasValueFlow=elem1
|
|
sink(b[2])
|
|
a.withoutElementOne()
|
|
sink(a[0])
|
|
sink(a[1])
|
|
sink(a[2]) # $ hasValueFlow=elem2 |