Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 397efd1

Browse files
geoffw0geoffw0
committed
C++: Split off the createLSParser tests into their own file.
1 parent b02519b commit 397efd1

4 files changed

Lines changed: 77 additions & 52 deletions

File tree

‎cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.expected‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
edges
22
| tests2.cpp:20:17:20:31 | SAXParser output argument | tests2.cpp:22:2:22:2 | p |
33
| tests2.cpp:33:17:33:31 | SAXParser output argument | tests2.cpp:37:2:37:2 | p |
4+
| tests5.cpp:18:25:18:38 | call to createLSParser | tests5.cpp:20:2:20:2 | p |
45
| tests.cpp:33:23:33:43 | XercesDOMParser output argument | tests.cpp:35:2:35:2 | p |
56
| tests.cpp:46:23:46:43 | XercesDOMParser output argument | tests.cpp:49:2:49:2 | p |
67
| tests.cpp:53:19:53:19 | VariableAddress [post update] | tests.cpp:55:2:55:2 | p |
@@ -27,12 +28,13 @@ edges
2728
| tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:146:18:146:18 | q |
2829
| tests.cpp:144:18:144:18 | q | tests.cpp:130:39:130:39 | p |
2930
| tests.cpp:146:18:146:18 | q | tests.cpp:134:39:134:39 | p |
30-
| tests.cpp:150:25:150:38 | call to createLSParser | tests.cpp:152:2:152:2 | p |
3131
nodes
3232
| tests2.cpp:20:17:20:31 | SAXParser output argument | semmle.label | SAXParser output argument |
3333
| tests2.cpp:22:2:22:2 | p | semmle.label | p |
3434
| tests2.cpp:33:17:33:31 | SAXParser output argument | semmle.label | SAXParser output argument |
3535
| tests2.cpp:37:2:37:2 | p | semmle.label | p |
36+
| tests5.cpp:18:25:18:38 | call to createLSParser | semmle.label | call to createLSParser |
37+
| tests5.cpp:20:2:20:2 | p | semmle.label | p |
3638
| tests.cpp:33:23:33:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
3739
| tests.cpp:35:2:35:2 | p | semmle.label | p |
3840
| tests.cpp:46:23:46:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
@@ -68,12 +70,11 @@ nodes
6870
| tests.cpp:140:23:140:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
6971
| tests.cpp:144:18:144:18 | q | semmle.label | q |
7072
| tests.cpp:146:18:146:18 | q | semmle.label | q |
71-
| tests.cpp:150:25:150:38 | call to createLSParser | semmle.label | call to createLSParser |
72-
| tests.cpp:152:2:152:2 | p | semmle.label | p |
7373
subpaths
7474
#select
7575
| tests2.cpp:22:2:22:2 | p | tests2.cpp:20:17:20:31 | SAXParser output argument | tests2.cpp:22:2:22:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests2.cpp:20:17:20:31 | SAXParser output argument | XML parser |
7676
| tests2.cpp:37:2:37:2 | p | tests2.cpp:33:17:33:31 | SAXParser output argument | tests2.cpp:37:2:37:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests2.cpp:33:17:33:31 | SAXParser output argument | XML parser |
77+
| tests5.cpp:20:2:20:2 | p | tests5.cpp:18:25:18:38 | call to createLSParser | tests5.cpp:20:2:20:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests5.cpp:18:25:18:38 | call to createLSParser | XML parser |
7778
| tests.cpp:35:2:35:2 | p | tests.cpp:33:23:33:43 | XercesDOMParser output argument | tests.cpp:35:2:35:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:33:23:33:43 | XercesDOMParser output argument | XML parser |
7879
| tests.cpp:49:2:49:2 | p | tests.cpp:46:23:46:43 | XercesDOMParser output argument | tests.cpp:49:2:49:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:46:23:46:43 | XercesDOMParser output argument | XML parser |
7980
| tests.cpp:57:2:57:2 | p | tests.cpp:53:23:53:43 | XercesDOMParser output argument | tests.cpp:57:2:57:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:53:23:53:43 | XercesDOMParser output argument | XML parser |
@@ -85,4 +86,3 @@ subpaths
8586
| tests.cpp:122:3:122:3 | q | tests.cpp:118:24:118:44 | XercesDOMParser output argument | tests.cpp:122:3:122:3 | q | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:118:24:118:44 | XercesDOMParser output argument | XML parser |
8687
| tests.cpp:131:2:131:2 | p | tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:131:2:131:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:140:23:140:43 | XercesDOMParser output argument | XML parser |
8788
| tests.cpp:135:2:135:2 | p | tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:135:2:135:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:140:23:140:43 | XercesDOMParser output argument | XML parser |
88-
| tests.cpp:152:2:152:2 | p | tests.cpp:150:25:150:38 | call to createLSParser | tests.cpp:152:2:152:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:150:25:150:38 | call to createLSParser | XML parser |

‎cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp‎

Lines changed: 17 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,31 @@
1-
// test cases for rule CWE-611
1+
// test cases for rule CWE-611 (XercesDOMParser)
22

33
#include "tests.h"
44

55
// ---
66

7-
class AbstractDOMParser {
8-
public:
9-
AbstractDOMParser();
10-
11-
void setDisableDefaultEntityResolution(bool); // default is false
12-
void setCreateEntityReferenceNodes(bool); // default is true
13-
void setSecurityManager(SecurityManager *const manager);
14-
void parse(const InputSource &data);
15-
};
16-
177
class XercesDOMParser: public AbstractDOMParser {
188
public:
199
XercesDOMParser();
2010
};
2111

22-
class DOMLSParser : public AbstractDOMParser {
23-
};
2412

25-
class DOMImplementationLS {
26-
public:
27-
DOMLSParser *createLSParser();
28-
};
13+
14+
15+
16+
17+
18+
19+
20+
21+
22+
23+
24+
25+
26+
27+
28+
2929

3030
// ---
3131

@@ -145,34 +145,3 @@ void test10(InputSource &data) {
145145
test10_doParseC(p, data);
146146
test10_doParseC(q, data);
147147
}
148-
149-
void test11(DOMImplementationLS *impl, InputSource &data) {
150-
DOMLSParser *p = impl->createLSParser();
151-
152-
p->parse(data); // BAD (parser not correctly configured)
153-
}
154-
155-
void test12(DOMImplementationLS *impl, InputSource &data) {
156-
DOMLSParser *p = impl->createLSParser();
157-
158-
p->setDisableDefaultEntityResolution(true);
159-
p->parse(data); // GOOD
160-
}
161-
162-
DOMImplementationLS *g_impl;
163-
DOMLSParser *g_p1, *g_p2;
164-
InputSource *g_data;
165-
166-
void test13_init() {
167-
g_p1 = g_impl->createLSParser();
168-
g_p1->setDisableDefaultEntityResolution(true);
169-
170-
g_p2 = g_impl->createLSParser();
171-
}
172-
173-
void test13() {
174-
test13_init();
175-
176-
g_p1->parse(*g_data); // GOOD
177-
g_p2->parse(*g_data); // BAD (parser not correctly configured) [NOT DETECTED]
178-
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,13 @@
22

33
class SecurityManager;
44
class InputSource;
5+
6+
class AbstractDOMParser {
7+
public:
8+
AbstractDOMParser();
9+
10+
void setDisableDefaultEntityResolution(bool); // default is false
11+
void setCreateEntityReferenceNodes(bool); // default is true
12+
void setSecurityManager(SecurityManager *const manager);
13+
void parse(const InputSource &data);
14+
};

‎cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
// test cases for rule CWE-611 (createLSParser)
2+
3+
#include "tests.h"
4+
5+
// ---
6+
7+
class DOMLSParser : public AbstractDOMParser {
8+
};
9+
10+
class DOMImplementationLS {
11+
public:
12+
DOMLSParser *createLSParser();
13+
};
14+
15+
// ---
16+
17+
void test5_1(DOMImplementationLS *impl, InputSource &data) {
18+
DOMLSParser *p = impl->createLSParser();
19+
20+
p->parse(data); // BAD (parser not correctly configured)
21+
}
22+
23+
void test5_2(DOMImplementationLS *impl, InputSource &data) {
24+
DOMLSParser *p = impl->createLSParser();
25+
26+
p->setDisableDefaultEntityResolution(true);
27+
p->parse(data); // GOOD
28+
}
29+
30+
DOMImplementationLS *g_impl;
31+
DOMLSParser *g_p1, *g_p2;
32+
InputSource *g_data;
33+
34+
void test5_3_init() {
35+
g_p1 = g_impl->createLSParser();
36+
g_p1->setDisableDefaultEntityResolution(true);
37+
38+
g_p2 = g_impl->createLSParser();
39+
}
40+
41+
void test5_3() {
42+
test5_3_init();
43+
44+
g_p1->parse(*g_data); // GOOD
45+
g_p2->parse(*g_data); // BAD (parser not correctly configured) [NOT DETECTED]
46+
}

0 commit comments

Comments
 (0)