JS: Add tests

asgerf · asgerf · commit 3691b836cb94 · 2023-07-11T11:37:30.000+02:00
diff --git a/javascript/ql/test/library-tests/TaintBarriers/ExampleConfiguration.qll b/javascript/ql/test/library-tests/TaintBarriers/ExampleConfiguration.qll
@@ -1,19 +1,33 @@
 import javascript
 
+DataFlow::Node sourceVariable() { result.asExpr().(VarRef).getName() = "sourceVariable" }
+
+StringOps::ConcatenationRoot sinkConcatenation() {
+  result.getConstantStringParts().matches("<sink>%</sink>")
+}
+
 class ExampleConfiguration extends TaintTracking::Configuration {
   ExampleConfiguration() { this = "ExampleConfiguration" }
 
   override predicate isSource(DataFlow::Node source) {
     source.asExpr().(CallExpr).getCalleeName() = "SOURCE"
+    or
+    source = sourceVariable()
   }
 
   override predicate isSink(DataFlow::Node sink) {
     exists(CallExpr callExpr |
       callExpr.getCalleeName() = "SINK" and
       DataFlow::valueNode(callExpr.getArgument(0)) = sink
     )
+    or
+    sink = sinkConcatenation()
   }
 
+  override predicate isSanitizerIn(DataFlow::Node node) { node = sourceVariable() }
+
+  override predicate isSanitizerOut(DataFlow::Node node) { node = sinkConcatenation() }
+
   override predicate isSanitizer(DataFlow::Node node) {
     exists(CallExpr callExpr |
       callExpr.getCalleeName() = "SANITIZE" and
diff --git a/javascript/ql/test/library-tests/TaintBarriers/sanitizer-in-out.js b/javascript/ql/test/library-tests/TaintBarriers/sanitizer-in-out.js
@@ -0,0 +1,18 @@
+import 'dummy';
+
+function barrierIn() {
+    var sourceVariable = 123;
+    SINK(sourceVariable); // NOT OK
+
+    flowWithSourceParam(sourceVariable);
+}
+
+function barrierInParameter(sourceVariable) {
+    SINK(sourceVariable); // NOT OK, but only report the parameter as the source
+}
+
+function barrierOut() {
+    let taint = SOURCE();
+    taint = "<sink>" + taint + "</sink>"; // NOT OK
+    taint = "<sink>" + taint + "</sink>"; // OK - only report first instance
+}
diff --git a/javascript/ql/test/library-tests/TaintBarriers/tests.expected b/javascript/ql/test/library-tests/TaintBarriers/tests.expected
@@ -133,6 +133,9 @@ sanitizingGuard
 | tst.js:399:16:399:41 | o.hasOw ... "p.q"]) | tst.js:399:33:399:40 | v["p.q"] | true |
 | tst.js:401:16:401:34 | Object.hasOwn(o, v) | tst.js:401:33:401:33 | v | true |
 taintedSink
+| sanitizer-in-out.js:5:10:5:23 | sourceVariable | sanitizer-in-out.js:5:10:5:23 | sourceVariable |
+| sanitizer-in-out.js:11:10:11:23 | sourceVariable | sanitizer-in-out.js:11:10:11:23 | sourceVariable |
+| sanitizer-in-out.js:15:17:15:24 | SOURCE() | sanitizer-in-out.js:16:13:16:40 | "<sink> ... /sink>" |
 | tst.js:2:13:2:20 | SOURCE() | tst.js:3:10:3:10 | v |
 | tst.js:2:13:2:20 | SOURCE() | tst.js:8:14:8:14 | v |
 | tst.js:2:13:2:20 | SOURCE() | tst.js:12:14:12:14 | v |
