Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0d1ff4d

Browse files
MathiasVPMathiasVP
committed
C++: Respond to review comments and accept test changes.
1 parent ae4b6c5 commit 0d1ff4d

3 files changed

Lines changed: 32 additions & 24 deletions

File tree

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/dispatch.cpp‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@ void testStruct() {
2828
globalStruct.sinkPtr(atoi(getenv("TAINTED"))); // $ ir MISSING: ast
2929
globalStruct.notSinkPtr(atoi(getenv("TAINTED"))); // clean
3030

31-
globalUnion.sinkPtr(atoi(getenv("TAINTED"))); // $ ast ir-path=31:28 ir-path=32:31 ir-path=34:22
32-
globalUnion.notSinkPtr(atoi(getenv("TAINTED"))); // $ ast ir-path=31:28 ir-path=32:31 ir-path=34:22
31+
globalUnion.sinkPtr(atoi(getenv("TAINTED"))); // $ ast ir-path
32+
globalUnion.notSinkPtr(atoi(getenv("TAINTED"))); // $ ast ir-path
3333

34-
globalSinkPtr(atoi(getenv("TAINTED"))); // $ ast ir-path=31:28 ir-path=32:31 ir-path=34:22
34+
globalSinkPtr(atoi(getenv("TAINTED"))); // $ ast ir-path
3535
}
3636

3737
class B {
@@ -55,12 +55,12 @@ class D3 : public D2 {
5555

5656
void test_dynamic_cast() {
5757
B* b = new D3();
58-
b->f(getenv("VAR")); // $ ast ir-path=58:10 ir-path=60:17 ir-path=61:28 ir-path=62:29 ir-path=63:33 ir-path=73:30
58+
b->f(getenv("VAR")); // $ ast ir-path
5959

60-
((D2*)b)->f(getenv("VAR")); // $ ast ir-path=58:10 ir-path=60:17 ir-path=61:28 ir-path=62:29 ir-path=63:33 ir-path=73:30
61-
static_cast<D2*>(b)->f(getenv("VAR")); // $ ast ir-path=58:10 ir-path=60:17 ir-path=61:28 ir-path=62:29 ir-path=63:33 ir-path=73:30
62-
dynamic_cast<D2*>(b)->f(getenv("VAR")); // $ ast ir-path=58:10 ir-path=60:17 ir-path=61:28 ir-path=62:29 ir-path=63:33 ir-path=73:30
63-
reinterpret_cast<D2*>(b)->f(getenv("VAR")); // $ ast ir-path=58:10 ir-path=60:17 ir-path=61:28 ir-path=62:29 ir-path=63:33 ir-path=73:30
60+
((D2*)b)->f(getenv("VAR")); // $ ast ir-path
61+
static_cast<D2*>(b)->f(getenv("VAR")); // $ ast ir-path
62+
dynamic_cast<D2*>(b)->f(getenv("VAR")); // $ ast ir-path
63+
reinterpret_cast<D2*>(b)->f(getenv("VAR")); // $ ast ir-path
6464

6565
B* b2 = new D2();
6666
b2->f(getenv("VAR"));
@@ -70,5 +70,5 @@ void test_dynamic_cast() {
7070
dynamic_cast<D2*>(b2)->f(getenv("VAR"));
7171
reinterpret_cast<D2*>(b2)->f(getenv("VAR"));
7272

73-
dynamic_cast<D3*>(b2)->f(getenv("VAR")); // $ SPURIOUS: ast ir-path=58:10 ir-path=60:17 ir-path=61:28 ir-path=62:29 ir-path=63:33 ir-path=73:30
73+
dynamic_cast<D3*>(b2)->f(getenv("VAR")); // $ SPURIOUS: ast ir-path
7474
}

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/tainted.ql‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import cpp
77
import semmle.code.cpp.security.TaintTrackingImpl as ASTTaintTracking
88
import semmle.code.cpp.ir.dataflow.DefaultTaintTracking as IRDefaultTaintTracking
99
import IRDefaultTaintTracking::TaintedWithPath as TaintedWithPath
10+
import TaintedWithPath::Private
1011
import TestUtilities.InlineExpectationsTest
1112

1213
predicate isSinkArgument(Element sink) {
@@ -25,8 +26,15 @@ class SourceConfiguration extends TaintedWithPath::TaintTrackingConfiguration {
2526
predicate irTaint(Element source, Element sink, string tag) {
2627
exists(TaintedWithPath::PathNode sinkNode, TaintedWithPath::PathNode predNode |
2728
TaintedWithPath::taintedWithPath(source, _, _, sinkNode) and
28-
predNode = TaintedWithPath::Private::getAPredecessor*(sinkNode) and
29-
sink = TaintedWithPath::Private::getElementFromPathNode(predNode) and
29+
predNode = getAPredecessor*(sinkNode) and
30+
sink = getElementFromPathNode(predNode) and
31+
// Make sure the path is actually reachable from this predecessor.
32+
// Otherwise, we could pick `predNode` to be b when `source` is
33+
// `source1` in this dataflow graph:
34+
// source1 ---> a ---> c ---> sinkNode
35+
// ^
36+
// source2 ---> b --/
37+
source = getElementFromPathNode(getAPredecessor*(predNode)) and
3038
if sinkNode = predNode then tag = "ir-sink" else tag = "ir-path"
3139
)
3240
}

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/annotate_path_to_sink/test_diff.cpp‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ class Derived2 : public Derived1 {
7979
class Derived3 : public Derived2 {
8080
public:
8181
void f(const char* p) override { // $ ir-path=124:19 ir-path=126:43 ir-path=128:44
82-
sink(p); // $ ir-sink=124:19 ir-sink=126:43 ir-sink=128:44 ast,ir=124:19 ast,ir=126:43 ast,ir=128:44
82+
sink(p); // $ ast,ir-sink=124:19 ast,ir-sink=126:43 ast,ir-sink=128:44
8383
}
8484
};
8585

@@ -89,41 +89,41 @@ class CRTPDoesNotCallSink : public CRTP<CRTPDoesNotCallSink> {
8989
};
9090

9191
int main(int argc, char *argv[]) {
92-
sink(argv[0]); // $ ast ir-path ir-sink
92+
sink(argv[0]); // $ ast,ir-path,ir-sink
9393

94-
sink(reinterpret_cast<int>(argv)); // $ ast ir-sink
94+
sink(reinterpret_cast<int>(argv)); // $ ast,ir-sink
9595

96-
calls_sink_with_argv(argv[1]); // $ ast ir-path=96:26 ir-path=98:18
96+
calls_sink_with_argv(argv[1]); // $ ast,ir-path
9797

98-
char*** p = &argv; // $ ast ir-path=96:26 ir-path=98:18
98+
char*** p = &argv; // $ ast,ir-path
9999

100-
sink(*p[0]); // $ ast ir-sink
100+
sink(*p[0]); // $ ast,ir-sink
101101

102102
calls_sink_with_argv(*p[i]); // $ MISSING: ast,ir-path
103103

104-
sink(*(argv + 1)); // $ ast ir-path ir-sink
104+
sink(*(argv + 1)); // $ ast,ir-path ir-sink
105105

106106
BaseWithPureVirtual* b = new DerivedCallsSink;
107107

108-
b->f(argv[1]); // $ ast ir-path
108+
b->f(argv[1]); // $ ast,ir-path
109109

110110
b = new DerivedDoesNotCallSink;
111111
b->f(argv[0]); // $ SPURIOUS: ast
112112

113113
BaseWithPureVirtual* b2 = new DerivesMultiple;
114114

115-
b2->f(argv[i]); // $ ast ir-path
115+
b2->f(argv[i]); // $ ast,ir-path
116116

117117
CRTP<CRTPDoesNotCallSink> crtp_not_call_sink;
118118
crtp_not_call_sink.f(argv[0]); // clean
119119

120120
CRTP<CRTPCallsSink> crtp_calls_sink;
121-
crtp_calls_sink.f(argv[0]); // $ ast ir-path
121+
crtp_calls_sink.f(argv[0]); // $ ast,ir-path
122122

123123
Derived1* calls_sink = new Derived3;
124-
calls_sink->f(argv[1]); // $ ast ir-path=124:19 ir-path=126:43 ir-path=128:44
124+
calls_sink->f(argv[1]); // $ ast,ir-path
125125

126-
static_cast<Derived2*>(calls_sink)->f(argv[1]); // $ ast ir-path=124:19 ir-path=126:43 ir-path=128:44
126+
static_cast<Derived2*>(calls_sink)->f(argv[1]); // $ ast,ir-path
127127

128-
dynamic_cast<Derived2*>(calls_sink)->f(argv[1]); // $ ast ir-path=124:19 ir-path=126:43 ir-path=128:44
128+
dynamic_cast<Derived2*>(calls_sink)->f(argv[1]); // $ ast,ir-path
129129
}

0 commit comments

Comments
 (0)