mirror of
https://github.com/github/codeql.git
synced 2025-12-20 10:46:30 +01:00
9bd5694c3f
Although this is actually using taint-tracking (so we can use the += statement), I would personally forget to check under the dataflow/tainttracking folder to look for such a test, so I'm opting to keep it under the dataflow/ folder.
35 lines
1.1 KiB
Plaintext
35 lines
1.1 KiB
Plaintext
/**
|
|
* @kind path-problem
|
|
*/
|
|
|
|
import python
|
|
import semmle.python.dataflow.new.DataFlow
|
|
import semmle.python.dataflow.new.TaintTracking
|
|
import experimental.dataflow.testConfig
|
|
import TestUtilities.InlineExpectationsTest
|
|
|
|
module TestTaintFlow = TaintTracking::Global<TestConfig>;
|
|
|
|
module PathNodeTest implements TestSig {
|
|
string getARelevantTag() { result = "path-node" }
|
|
|
|
predicate hasActualResult(Location location, string element, string tag, string value) {
|
|
exists(TestTaintFlow::PathNode pn |
|
|
location = pn.getNode().getLocation() and
|
|
tag = "path-node" and
|
|
value = "" and
|
|
element = pn.toString()
|
|
)
|
|
}
|
|
}
|
|
|
|
import MakeTest<PathNodeTest>
|
|
// running the query to inspect the results can be quite nice!
|
|
// just uncomment these lines!
|
|
// import TestTaintFlow::PathGraph
|
|
// from TestTaintFlow::PathNode source, TestTaintFlow::PathNode sink
|
|
// where TestTaintFlow::flowPath(source, sink)
|
|
// select sink.getNode(), source, sink,
|
|
// sink.getNode().getEnclosingCallable().toString() + ": --> " +
|
|
// sink.getNode().getLocation().getStartLine().toString()
|