Skip to content

Commit ab8096b

Browse files
owen-mcowen-mc
committed
Add tests for more content types (Element, MapKey, MapValue)
1 parent b7aa85b commit ab8096b

File tree

6 files changed

+114
-35
lines changed

6 files changed

+114
-35
lines changed

‎ql/test/library-tests/semmle/go/dataflow/ExternalFlow/completetest.ql‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,17 @@ class SummaryModelTest extends SummaryModelCsv {
2121
"github.com/nonexistent/test;T;false;StepQualRes;;;Argument[-1];ReturnValue;taint",
2222
"github.com/nonexistent/test;T;false;StepQualArg;;;Argument[-1];Argument[0];taint",
2323
"github.com/nonexistent/test;;false;StepArgResNoQual;;;Argument[0];ReturnValue;taint",
24-
"github.com/nonexistent/test;;false;StepArgResContent;;;Argument[0];ArrayElement of ReturnValue;taint",
25-
"github.com/nonexistent/test;;false;StepArgContentRes;;;ArrayElement of Argument[0];ReturnValue;taint",
24+
"github.com/nonexistent/test;;false;StepArgResArrayContent;;;Argument[0];ArrayElement of ReturnValue;taint",
25+
"github.com/nonexistent/test;;false;StepArgArrayContentRes;;;ArrayElement of Argument[0];ReturnValue;taint",
26+
"github.com/nonexistent/test;;false;StepArgResCollectionContent;;;Argument[0];Element of ReturnValue;taint",
27+
"github.com/nonexistent/test;;false;StepArgCollectionContentRes;;;Element of Argument[0];ReturnValue;taint",
28+
"github.com/nonexistent/test;;false;StepArgResMapKeyContent;;;Argument[0];MapKey of ReturnValue;taint",
29+
"github.com/nonexistent/test;;false;StepArgMapKeyContentRes;;;MapKey of Argument[0];ReturnValue;taint",
30+
"github.com/nonexistent/test;;false;StepArgResMapValueContent;;;Argument[0];MapValue of ReturnValue;taint",
31+
"github.com/nonexistent/test;;false;StepArgMapValueContentRes;;;MapValue of Argument[0];ReturnValue;taint",
32+
"github.com/nonexistent/test;;false;GetElement;;;Element of Argument[0];ReturnValue;value",
33+
"github.com/nonexistent/test;;false;GetMapKey;;;MapKey of Argument[0];ReturnValue;value",
34+
"github.com/nonexistent/test;;false;SetElement;;;Argument[0];Element of ReturnValue;value",
2635
]
2736
}
2837
}

‎ql/test/library-tests/semmle/go/dataflow/ExternalFlow/sinks.expected‎

Lines changed: 20 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,22 @@
11
invalidModelRow
22
#select
3-
| test.go:43:10:43:12 | arg | qltest |
4-
| test.go:57:10:57:15 | taint1 | qltest |
5-
| test.go:60:10:60:15 | taint2 | qltest |
6-
| test.go:64:10:64:15 | taint3 | qltest |
7-
| test.go:68:10:68:15 | taint4 | qltest |
8-
| test.go:71:10:71:15 | taint5 | qltest |
9-
| test.go:75:10:75:15 | taint6 | qltest |
10-
| test.go:78:10:78:15 | taint7 | qltest |
11-
| test.go:81:10:81:18 | index expression | qltest |
12-
| test.go:85:10:85:15 | taint9 | qltest |
13-
| test.go:89:10:89:17 | index expression | qltest |
3+
| test.go:49:10:49:12 | arg | qltest |
4+
| test.go:63:10:63:15 | taint1 | qltest |
5+
| test.go:66:10:66:15 | taint2 | qltest |
6+
| test.go:70:10:70:15 | taint3 | qltest |
7+
| test.go:74:10:74:15 | taint4 | qltest |
8+
| test.go:77:10:77:15 | taint5 | qltest |
9+
| test.go:81:10:81:15 | taint6 | qltest |
10+
| test.go:84:10:84:15 | taint7 | qltest |
11+
| test.go:87:10:87:18 | index expression | qltest |
12+
| test.go:91:10:91:15 | taint9 | qltest |
13+
| test.go:94:10:94:33 | call to GetElement | qltest |
14+
| test.go:95:10:95:18 | <-... | qltest |
15+
| test.go:99:10:99:16 | taint11 | qltest |
16+
| test.go:102:10:102:32 | call to GetMapKey | qltest |
17+
| test.go:104:11:104:11 | k | qltest |
18+
| test.go:109:10:109:16 | taint13 | qltest |
19+
| test.go:112:10:112:20 | index expression | qltest |
20+
| test.go:116:10:116:16 | taint15 | qltest |
21+
| test.go:120:10:120:17 | index expression | qltest |
22+
| test.go:125:10:125:16 | taint16 | qltest |

‎ql/test/library-tests/semmle/go/dataflow/ExternalFlow/srcs.expected‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
11
invalidModelRow
22
#select
33
| test.go:12:6:12:8 | definition of arg | qltest-arg |
4-
| test.go:31:6:31:6 | definition of a | qltest-arg |
5-
| test.go:34:8:34:15 | call to Src1 | qltest |
6-
| test.go:35:8:35:15 | call to Src2 | qltest |
7-
| test.go:35:8:35:15 | call to Src2 | qltest-w-subtypes |
8-
| test.go:36:8:36:16 | call to Src2 | qltest-w-subtypes |
9-
| test.go:37:2:37:21 | ... = ...[0] | qltest |
10-
| test.go:37:2:37:21 | ... = ...[1] | qltest-w-subtypes |
11-
| test.go:38:2:38:22 | ... = ...[1] | qltest-w-subtypes |
12-
| test.go:54:9:54:16 | call to Src1 | qltest |
4+
| test.go:37:6:37:6 | definition of a | qltest-arg |
5+
| test.go:40:8:40:15 | call to Src1 | qltest |
6+
| test.go:41:8:41:15 | call to Src2 | qltest |
7+
| test.go:41:8:41:15 | call to Src2 | qltest-w-subtypes |
8+
| test.go:42:8:42:16 | call to Src2 | qltest-w-subtypes |
9+
| test.go:43:2:43:21 | ... = ...[0] | qltest |
10+
| test.go:43:2:43:21 | ... = ...[1] | qltest-w-subtypes |
11+
| test.go:44:2:44:22 | ... = ...[1] | qltest-w-subtypes |
12+
| test.go:60:9:60:16 | call to Src1 | qltest |
13+
| test.go:93:46:93:53 | call to Src1 | qltest |
14+
| test.go:97:35:97:42 | call to Src1 | qltest |
15+
| test.go:101:42:101:49 | call to Src1 | qltest |
16+
| test.go:123:8:123:15 | call to Src1 | qltest |

‎ql/test/library-tests/semmle/go/dataflow/ExternalFlow/steps.expected‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ invalidModelRow
77
| test.go:23:10:23:10 | t | test.go:23:10:23:24 | call to StepQualRes |
88
| test.go:24:2:24:2 | t | test.go:12:6:12:8 | definition of arg |
99
| test.go:25:32:25:34 | arg | test.go:25:10:25:35 | call to StepArgResNoQual |
10-
| test.go:56:25:56:27 | src | test.go:56:12:56:28 | call to StepArgRes |
11-
| test.go:59:29:59:31 | src | test.go:59:2:59:32 | ... := ...[1] |
12-
| test.go:63:15:63:17 | src | test.go:62:6:62:11 | definition of taint3 |
13-
| test.go:67:21:67:23 | src | test.go:66:6:66:11 | definition of taint4 |
14-
| test.go:70:13:70:25 | type assertion | test.go:70:12:70:40 | call to StepQualRes |
15-
| test.go:74:3:74:15 | type assertion | test.go:73:6:73:11 | definition of taint6 |
16-
| test.go:77:34:77:36 | src | test.go:77:12:77:37 | call to StepArgResNoQual |
10+
| test.go:62:25:62:27 | src | test.go:62:12:62:28 | call to StepArgRes |
11+
| test.go:65:29:65:31 | src | test.go:65:2:65:32 | ... := ...[1] |
12+
| test.go:69:15:69:17 | src | test.go:68:6:68:11 | definition of taint3 |
13+
| test.go:73:21:73:23 | src | test.go:72:6:72:11 | definition of taint4 |
14+
| test.go:76:13:76:25 | type assertion | test.go:76:12:76:40 | call to StepQualRes |
15+
| test.go:80:3:80:15 | type assertion | test.go:79:6:79:11 | definition of taint6 |
16+
| test.go:83:34:83:36 | src | test.go:83:12:83:37 | call to StepArgResNoQual |

‎ql/test/library-tests/semmle/go/dataflow/ExternalFlow/test.go‎

Lines changed: 43 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,14 @@ func main() {
2323
taint = t.StepQualRes()
2424
t.StepQualArg(arg)
2525
taint = test.StepArgResNoQual(arg)
26-
taintSlice = test.StepArgResContent(arg)
27-
taint = test.StepArgContentRes(array)
26+
taintSlice = test.StepArgResArrayContent(arg)
27+
taint = test.StepArgArrayContentRes(array)
28+
taint = test.StepArgResCollectionContent(arg)
29+
taint = test.StepArgCollectionContentRes(array)
30+
taint = test.StepArgResMapKeyContent(arg)
31+
taint = test.StepArgMapKeyContentRes(array)
32+
taint = test.StepArgResMapValueContent(arg)
33+
taint = test.StepArgMapValueContentRes(array)
2834

2935
var src interface{}
3036
var src1 interface{}
@@ -77,14 +83,47 @@ func simpleflow() {
7783
taint7 := test.StepArgResNoQual(src)
7884
b.Sink1(taint7) // $ hasTaintFlow="taint7"
7985

80-
taint8 := test.StepArgResContent(src)
86+
taint8 := test.StepArgResArrayContent(src)
8187
b.Sink1(taint8[0]) // $ hasTaintFlow="index expression"
8288

8389
srcArray := []interface{}{nil, src}
84-
taint9 := test.StepArgContentRes(srcArray)
90+
taint9 := test.StepArgArrayContentRes(srcArray)
8591
b.Sink1(taint9) // $ hasTaintFlow="taint9"
8692

93+
taint10 := test.StepArgResCollectionContent(a.Src1()).(chan interface{})
94+
b.Sink1(test.GetElement(taint10)) // $ hasTaintFlow="call to GetElement"
95+
b.Sink1(<-taint10) // $ MISSING: hasTaintFlow="<-..."
96+
97+
srcCollection := test.SetElement(a.Src1())
98+
taint11 := test.StepArgCollectionContentRes(srcCollection)
99+
b.Sink1(taint11) // $ hasTaintFlow="taint11"
100+
101+
taint12 := test.StepArgResMapKeyContent(a.Src1()).(map[string]string)
102+
b.Sink1(test.GetMapKey(taint12)) // $ hasTaintFlow="call to GetMapKey"
103+
for k, _ := range taint12 {
104+
b.Sink1(k) // $ hasTaintFlow="k"
105+
}
106+
for k := range taint12 {
107+
b.Sink1(k) // $ hasTaintFlow="k"
108+
}
109+
110+
srcMap13 := map[string]string{src.(string): ""}
111+
taint13 := test.StepArgMapKeyContentRes(srcMap13)
112+
b.Sink1(taint13) // $ MISSING: hasTaintFlow="taint13"
113+
114+
taint14 := test.StepArgResMapValueContent(src).(map[string]string)
115+
b.Sink1(taint14[""]) // $ hasTaintFlow="index expression"
116+
117+
srcMap15 := map[string]string{"": src.(string)}
118+
taint15 := test.StepArgMapValueContentRes(srcMap15)
119+
b.Sink1(taint15) // $ MISSING: hasTaintFlow="taint15"
120+
87121
slice := make([]interface{}, 0)
88122
slice = append(slice, src)
89123
b.Sink1(slice[0]) // $ hasTaintFlow="index expression"
124+
125+
ch := make(chan string)
126+
ch <- a.Src1()
127+
taint16 := test.StepArgCollectionContentRes(ch)
128+
b.Sink1(taint16) // $ MISSING: hasTaintFlow="taint16" // currently fails due to lack of post-update nodes after send statements
90129
}

‎ql/test/library-tests/semmle/go/dataflow/ExternalFlow/vendor/github.com/nonexistent/test/stub.go‎

Lines changed: 20 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)