mirror of
https://github.com/github/codeql.git
synced 2026-03-24 08:26:51 +01:00
5ee755db09
I had to rewrite the SINK1-SINK7 definitions, since this new requirement complained that we had to add this `MISSING: flow` annotation :D Doing this implementation also revealed that there was a bug, since I did not compare files when checking for these `MISSING:` annotations. So fixed that up in the implementation for inline taint tests as well. (extra whitespace in argumentPassing.py to avoid changing line numbers for other tests)
38 lines
1.4 KiB
Plaintext
38 lines
1.4 KiB
Plaintext
import python
|
|
import experimental.dataflow.TestUtil.FlowTest
|
|
import experimental.dataflow.testConfig
|
|
private import semmle.python.dataflow.new.internal.PrintNode
|
|
|
|
class DataFlowTest extends FlowTest {
|
|
DataFlowTest() { this = "DataFlowTest" }
|
|
|
|
override string flowTag() { result = "flow" }
|
|
|
|
override predicate relevantFlow(DataFlow::Node source, DataFlow::Node sink) {
|
|
exists(TestConfiguration cfg | cfg.hasFlow(source, sink))
|
|
}
|
|
|
|
override predicate hasActualResult(Location location, string element, string tag, string value) {
|
|
super.hasActualResult(location, element, tag, value)
|
|
}
|
|
}
|
|
|
|
query predicate missingAnnotationOnSINK(Location location, string error, string element) {
|
|
error = "ERROR, you should add `# $ MISSING: flow` annotation" and
|
|
exists(DataFlow::Node sink |
|
|
exists(DataFlow::CallCfgNode call |
|
|
// note: we only care about `SINK` and not `SINK_F`, so we have to reconstruct manually.
|
|
call.getFunction().asCfgNode().(NameNode).getId() = "SINK" and
|
|
(sink = call.getArg(_) or sink = call.getArgByName(_))
|
|
) and
|
|
location = sink.getLocation() and
|
|
element = prettyExpr(sink.asExpr()) and
|
|
not any(TestConfiguration config).hasFlow(_, sink) and
|
|
not exists(FalseNegativeExpectation missingResult |
|
|
missingResult.getTag() = "flow" and
|
|
missingResult.getLocation().getFile() = location.getFile() and
|
|
missingResult.getLocation().getStartLine() = location.getStartLine()
|
|
)
|
|
)
|
|
}
|