Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 19718fa

Browse files
geoffw0geoffw0
committed
C++: Add a couple of new test cases.
1 parent da740cf commit 19718fa

2 files changed

Lines changed: 7 additions & 2 deletions

File tree

‎cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/ExposedSystemData.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ edges
22
| tests2.cpp:63:13:63:18 | call to getenv | tests2.cpp:63:13:63:26 | (const char *)... |
33
| tests2.cpp:64:13:64:18 | call to getenv | tests2.cpp:64:13:64:26 | (const char *)... |
44
| tests2.cpp:65:13:65:18 | call to getenv | tests2.cpp:65:13:65:30 | (const char *)... |
5+
| tests2.cpp:66:13:66:18 | call to getenv | tests2.cpp:66:13:66:34 | (const char *)... |
56
| tests2.cpp:78:18:78:38 | call to mysql_get_client_info | tests2.cpp:81:14:81:19 | (const char *)... |
67
| tests2.cpp:80:14:80:34 | call to mysql_get_client_info | tests2.cpp:80:14:80:34 | call to mysql_get_client_info |
78
| tests2.cpp:80:14:80:34 | call to mysql_get_client_info | tests2.cpp:80:14:80:34 | call to mysql_get_client_info |
@@ -21,6 +22,9 @@ nodes
2122
| tests2.cpp:65:13:65:18 | call to getenv | semmle.label | call to getenv |
2223
| tests2.cpp:65:13:65:18 | call to getenv | semmle.label | call to getenv |
2324
| tests2.cpp:65:13:65:30 | (const char *)... | semmle.label | (const char *)... |
25+
| tests2.cpp:66:13:66:18 | call to getenv | semmle.label | call to getenv |
26+
| tests2.cpp:66:13:66:18 | call to getenv | semmle.label | call to getenv |
27+
| tests2.cpp:66:13:66:34 | (const char *)... | semmle.label | (const char *)... |
2428
| tests2.cpp:78:18:78:38 | call to mysql_get_client_info | semmle.label | call to mysql_get_client_info |
2529
| tests2.cpp:80:14:80:34 | call to mysql_get_client_info | semmle.label | call to mysql_get_client_info |
2630
| tests2.cpp:80:14:80:34 | call to mysql_get_client_info | semmle.label | call to mysql_get_client_info |
@@ -39,6 +43,7 @@ subpaths
3943
| tests2.cpp:63:13:63:18 | call to getenv | tests2.cpp:63:13:63:18 | call to getenv | tests2.cpp:63:13:63:18 | call to getenv | This operation exposes system data from $@. | tests2.cpp:63:13:63:18 | call to getenv | call to getenv |
4044
| tests2.cpp:64:13:64:18 | call to getenv | tests2.cpp:64:13:64:18 | call to getenv | tests2.cpp:64:13:64:18 | call to getenv | This operation exposes system data from $@. | tests2.cpp:64:13:64:18 | call to getenv | call to getenv |
4145
| tests2.cpp:65:13:65:18 | call to getenv | tests2.cpp:65:13:65:18 | call to getenv | tests2.cpp:65:13:65:18 | call to getenv | This operation exposes system data from $@. | tests2.cpp:65:13:65:18 | call to getenv | call to getenv |
46+
| tests2.cpp:66:13:66:18 | call to getenv | tests2.cpp:66:13:66:18 | call to getenv | tests2.cpp:66:13:66:18 | call to getenv | This operation exposes system data from $@. | tests2.cpp:66:13:66:18 | call to getenv | call to getenv |
4247
| tests2.cpp:80:14:80:34 | call to mysql_get_client_info | tests2.cpp:80:14:80:34 | call to mysql_get_client_info | tests2.cpp:80:14:80:34 | call to mysql_get_client_info | This operation exposes system data from $@. | tests2.cpp:80:14:80:34 | call to mysql_get_client_info | call to mysql_get_client_info |
4348
| tests2.cpp:80:14:80:34 | call to mysql_get_client_info | tests2.cpp:80:14:80:34 | call to mysql_get_client_info | tests2.cpp:80:14:80:34 | call to mysql_get_client_info | This operation exposes system data from $@. | tests2.cpp:80:14:80:34 | call to mysql_get_client_info | call to mysql_get_client_info |
4449
| tests2.cpp:81:14:81:19 | (const char *)... | tests2.cpp:78:18:78:38 | call to mysql_get_client_info | tests2.cpp:81:14:81:19 | (const char *)... | This operation exposes system data from $@. | tests2.cpp:78:18:78:38 | call to mysql_get_client_info | call to mysql_get_client_info |

‎cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests2.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,12 +63,12 @@ void test1()
6363
send(sock, getenv("HOME"), val(), val()); // BAD
6464
send(sock, getenv("PATH"), val(), val()); // BAD
6565
send(sock, getenv("USERNAME"), val(), val()); // BAD
66-
66+
send(sock, getenv("APP_PASSWORD"), val(), val()); // BAD
6767
send(sock, getenv("HARMLESS"), val(), val()); // GOOD: harmless information
6868
send(sock, "HOME", val(), val()); // GOOD: not system data
6969
send(sock, "PATH", val(), val()); // GOOD: not system data
7070
send(sock, "USERNAME", val(), val()); // GOOD: not system data
71-
71+
send(sock, "APP_PASSWORD", val(), val()); // GOOD: not system data
7272
send(sock, "HARMLESS", val(), val()); // GOOD: not system data
7373

7474
// tests for `mysql_get_client_info`, including via a global

0 commit comments

Comments
 (0)