Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 45b24a9

Browse files
MathiasVPMathiasVP
committed
Python: Update inline-expectation tests
1 parent 6ac740a commit 45b24a9

17 files changed

Lines changed: 92 additions & 92 deletions

File tree

‎python/ql/test/experimental/dataflow/global-flow/test.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
# Multiple assignment
88

9-
g1, g2 = [6], [7] # $writes=g1 $writes=g2
9+
g1, g2 = [6], [7] # $writes=g1 writes=g2
1010

1111
# Assignment that's only referenced in this scope. This one will not give rise to a `ModuleVariableNode`.
1212

@@ -22,7 +22,7 @@
2222

2323
# The following assignment should not be a `ModuleVariableNode`,
2424
# but currently our analysis thinks `g_mod` might be used in the `print` call
25-
g_mod = [10] # $f+:writes=g_mod
25+
g_mod = [10] # $ SPURIOUS: writes=g_mod
2626
print("foo")
2727
g_mod = [100] # $writes=g_mod
2828

@@ -81,10 +81,10 @@ def use_foo():
8181

8282
# Partial imports
8383

84-
from bar import baz_attr, quux_attr # $writes=baz_attr $writes=quux_attr
84+
from bar import baz_attr, quux_attr # $writes=baz_attr writes=quux_attr
8585

8686
def use_partial_import():
87-
print(baz_attr, quux_attr) # $reads=baz_attr $reads=quux_attr
87+
print(baz_attr, quux_attr) # $reads=baz_attr reads=quux_attr
8888

8989
# Aliased imports
9090

‎python/ql/test/experimental/dataflow/typetracking/attribute_tests.py‎

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -3,99 +3,99 @@ class SomeClass:
33

44
def simple_read_write():
55
x = SomeClass() # $tracked=foo
6-
x.foo = tracked # $tracked $tracked=foo
7-
y = x.foo # $tracked=foo $tracked
6+
x.foo = tracked # $tracked tracked=foo
7+
y = x.foo # $tracked=foo tracked
88
do_stuff(y) # $tracked
99

1010
def foo():
1111
x = SomeClass() # $tracked=attr
1212
bar(x) # $tracked=attr
13-
x.attr = tracked # $tracked=attr $tracked
13+
x.attr = tracked # $tracked=attr tracked
1414
baz(x) # $tracked=attr
1515

1616
def bar(x): # $tracked=attr
17-
z = x.attr # $tracked $tracked=attr
17+
z = x.attr # $tracked tracked=attr
1818
do_stuff(z) # $tracked
1919

20-
def expects_int(x): # $int=field $f+:str=field
21-
do_int_stuff(x.field) # $int $f+:str $int=field $f+:str=field
20+
def expects_int(x): # $int=field SPURIOUS: str=field
21+
do_int_stuff(x.field) # $int int=field SPURIOUS: str str=field
2222

23-
def expects_string(x): # $f+:int=field $str=field
24-
do_string_stuff(x.field) # $f+:int $str $f+:int=field $str=field
23+
def expects_string(x): # $ str=field SPURIOUS: int=field
24+
do_string_stuff(x.field) # $str str=field SPURIOUS: int int=field
2525

2626
def test_incompatible_types():
2727
x = SomeClass() # $int,str=field
28-
x.field = int(5) # $int=field $f+:str=field $int $f+:str
29-
expects_int(x) # $int=field $f+:str=field
30-
x.field = str("Hello") # $f+:int=field $str=field $f+:int $str
31-
expects_string(x) # $f+:int=field $str=field
28+
x.field = int(5) # $int=field int SPURIOUS: str=field str
29+
expects_int(x) # $int=field SPURIOUS: str=field
30+
x.field = str("Hello") # $str=field str SPURIOUS: int=field int
31+
expects_string(x) # $ str=field SPURIOUS: int=field
3232

3333

3434
# Attributes assigned statically to a class
3535

3636
class MyClass: # $tracked=field
3737
field = tracked # $tracked
3838

39-
lookup = MyClass.field # $tracked $tracked=field
39+
lookup = MyClass.field # $tracked tracked=field
4040
instance = MyClass() # $tracked=field
41-
lookup2 = instance.field # $f-:tracked
41+
lookup2 = instance.field # MISSING: tracked
4242

4343
## Dynamic attribute access
4444

4545
# Via `getattr`/`setattr`
4646

4747
def setattr_immediate_write():
4848
x = SomeClass() # $tracked=foo
49-
setattr(x,"foo", tracked) # $tracked $tracked=foo
50-
y = x.foo # $tracked $tracked=foo
49+
setattr(x,"foo", tracked) # $tracked tracked=foo
50+
y = x.foo # $tracked tracked=foo
5151
do_stuff(y) # $tracked
5252

5353
def getattr_immediate_read():
5454
x = SomeClass() # $tracked=foo
55-
x.foo = tracked # $tracked $tracked=foo
56-
y = getattr(x,"foo") # $tracked $tracked=foo
55+
x.foo = tracked # $tracked tracked=foo
56+
y = getattr(x,"foo") # $tracked tracked=foo
5757
do_stuff(y) # $tracked
5858

5959
def setattr_indirect_write():
6060
attr = "foo"
6161
x = SomeClass() # $tracked=foo
62-
setattr(x, attr, tracked) # $tracked $tracked=foo
63-
y = x.foo # $tracked $tracked=foo
62+
setattr(x, attr, tracked) # $tracked tracked=foo
63+
y = x.foo # $tracked tracked=foo
6464
do_stuff(y) # $tracked
6565

6666
def getattr_indirect_read():
6767
attr = "foo"
6868
x = SomeClass() # $tracked=foo
69-
x.foo = tracked # $tracked $tracked=foo
70-
y = getattr(x, attr) #$tracked $tracked=foo
69+
x.foo = tracked # $tracked tracked=foo
70+
y = getattr(x, attr) #$tracked tracked=foo
7171
do_stuff(y) # $tracked
7272

7373
# Via `__dict__` -- not currently implemented.
7474

7575
def dunder_dict_immediate_write():
76-
x = SomeClass() # $f-:tracked=foo
77-
x.__dict__["foo"] = tracked # $tracked $f-:tracked=foo
78-
y = x.foo # $f-:tracked $f-:tracked=foo
79-
do_stuff(y) # $f-:tracked
76+
x = SomeClass() # $ MISSING: tracked=foo
77+
x.__dict__["foo"] = tracked # $tracked MISSING: tracked=foo
78+
y = x.foo # $ MISSING: tracked tracked=foo
79+
do_stuff(y) # $ MISSING: tracked
8080

8181
def dunder_dict_immediate_read():
8282
x = SomeClass() # $tracked=foo
83-
x.foo = tracked # $tracked $tracked=foo
84-
y = x.__dict__["foo"] # $f-:tracked $tracked=foo
85-
do_stuff(y) # $f-:tracked
83+
x.foo = tracked # $tracked tracked=foo
84+
y = x.__dict__["foo"] # $ tracked=foo MISSING: tracked
85+
do_stuff(y) # $ MISSING: tracked
8686

8787
def dunder_dict_indirect_write():
8888
attr = "foo"
89-
x = SomeClass() # $f-:tracked=foo
90-
x.__dict__[attr] = tracked # $tracked $f-:tracked=foo
91-
y = x.foo # $f-:tracked $f-:tracked=foo
92-
do_stuff(y) # $f-:tracked
89+
x = SomeClass() # $ MISSING: tracked=foo
90+
x.__dict__[attr] = tracked # $tracked MISSING: tracked=foo
91+
y = x.foo # $ MISSING: tracked tracked=foo
92+
do_stuff(y) # $ MISSING: tracked
9393

9494
def dunder_dict_indirect_read():
9595
attr = "foo"
9696
x = SomeClass() # $tracked=foo
97-
x.foo = tracked # $tracked $tracked=foo
98-
y = x.__dict__[attr] # $f-:tracked $tracked=foo
99-
do_stuff(y) # $f-:tracked
97+
x.foo = tracked # $tracked tracked=foo
98+
y = x.__dict__[attr] # $ tracked=foo MISSING: tracked
99+
do_stuff(y) # $ MISSING: tracked
100100

101101

‎python/ql/test/experimental/dataflow/typetracking/test.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ def baz():
2727
def id(x): # $tracked
2828
return x # $tracked
2929

30-
def use_tracked_quux(x): # $f-:tracked
30+
def use_tracked_quux(x): # $ MISSING: tracked
3131
do_stuff(y) # call after return -- not tracked in here.
3232

3333
def quux():

‎python/ql/test/experimental/library-tests/frameworks/dill/Decoding.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
import dill
22

3-
dill.loads(payload) # $decodeInput=payload $decodeOutput=Attribute() $decodeFormat=dill $decodeMayExecuteInput
3+
dill.loads(payload) # $decodeInput=payload decodeOutput=Attribute() decodeFormat=dill decodeMayExecuteInput

‎python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
from django.views.generic import View
55

66

7-
def url_match_xss(request, foo, bar, no_taint=None): # $routeHandler $routedParameter=foo $routedParameter=bar
7+
def url_match_xss(request, foo, bar, no_taint=None): # $routeHandler routedParameter=foo routedParameter=bar
88
return HttpResponse('url_match_xss: {} {}'.format(foo, bar))
99

1010

@@ -26,22 +26,22 @@ class Foo(object):
2626
# Note: since Foo is used as the super type in a class view, it will be able to handle requests.
2727

2828

29-
def post(self, request, untrusted): # $f-:routeHandler $f-:routedParameter=untrusted
29+
def post(self, request, untrusted): # $ MISSING: routeHandler routedParameter=untrusted
3030
return HttpResponse('Foo post: {}'.format(untrusted))
3131

3232

3333
class ClassView(View, Foo):
3434

35-
def get(self, request, untrusted): # $f-:routeHandler $f-:routedParameter=untrusted
35+
def get(self, request, untrusted): # $ MISSING: routeHandler routedParameter=untrusted
3636
return HttpResponse('ClassView get: {}'.format(untrusted))
3737

3838

39-
def show_articles(request, page_number=1): # $routeHandler $routedParameter=page_number
39+
def show_articles(request, page_number=1): # $routeHandler routedParameter=page_number
4040
page_number = int(page_number)
4141
return HttpResponse('articles page: {}'.format(page_number))
4242

4343

44-
def xxs_positional_arg(request, arg0, arg1, no_taint=None): # $routeHandler $routedParameter=arg0 $routedParameter=arg1
44+
def xxs_positional_arg(request, arg0, arg1, no_taint=None): # $routeHandler routedParameter=arg0 routedParameter=arg1
4545
return HttpResponse('xxs_positional_arg: {} {}'.format(arg0, arg1))
4646

4747

@@ -62,7 +62,7 @@ def xxs_positional_arg(request, arg0, arg1, no_taint=None): # $routeHandler $ro
6262
################################################################################
6363
# Using patterns() for routing
6464

65-
def show_user(request, username): # $routeHandler $routedParameter=username
65+
def show_user(request, username): # $routeHandler routedParameter=username
6666
return HttpResponse('show_user {}'.format(username))
6767

6868

‎python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
from django.views import View
55

66

7-
def url_match_xss(request, foo, bar, no_taint=None): # $routeHandler $routedParameter=foo $routedParameter=bar
7+
def url_match_xss(request, foo, bar, no_taint=None): # $routeHandler routedParameter=foo routedParameter=bar
88
return HttpResponse('url_match_xss: {} {}'.format(foo, bar))
99

1010

@@ -26,22 +26,22 @@ class Foo(object):
2626
# Note: since Foo is used as the super type in a class view, it will be able to handle requests.
2727

2828

29-
def post(self, request, untrusted): # $f-:routeHandler $f-:routedParameter=untrusted
29+
def post(self, request, untrusted): # $ MISSING: routeHandler routedParameter=untrusted
3030
return HttpResponse('Foo post: {}'.format(untrusted))
3131

3232

3333
class ClassView(View, Foo):
3434

35-
def get(self, request, untrusted): # $f-:routeHandler $f-:routedParameter=untrusted
35+
def get(self, request, untrusted): # $ MISSING: routeHandler routedParameter=untrusted
3636
return HttpResponse('ClassView get: {}'.format(untrusted))
3737

3838

39-
def show_articles(request, page_number=1): # $routeHandler $routedParameter=page_number
39+
def show_articles(request, page_number=1): # $routeHandler routedParameter=page_number
4040
page_number = int(page_number)
4141
return HttpResponse('articles page: {}'.format(page_number))
4242

4343

44-
def xxs_positional_arg(request, arg0, arg1, no_taint=None): # $routeHandler $routedParameter=arg0 $routedParameter=arg1
44+
def xxs_positional_arg(request, arg0, arg1, no_taint=None): # $routeHandler routedParameter=arg0 routedParameter=arg1
4545
return HttpResponse('xxs_positional_arg: {} {}'.format(arg0, arg1))
4646

4747

@@ -75,13 +75,13 @@ def re_path_kwargs(request): # $routeHandler
7575
################################################################################
7676

7777
# saying page_number is an externally controlled *string* is a bit strange, when we have an int converter :O
78-
def page_number(request, page_number=1): # $routeHandler $routedParameter=page_number
78+
def page_number(request, page_number=1): # $routeHandler routedParameter=page_number
7979
return HttpResponse('page_number: {}'.format(page_number))
8080

81-
def foo_bar_baz(request, foo, bar, baz): # $routeHandler $routedParameter=foo $routedParameter=bar $routedParameter=baz
81+
def foo_bar_baz(request, foo, bar, baz): # $routeHandler routedParameter=foo routedParameter=bar routedParameter=baz
8282
return HttpResponse('foo_bar_baz: {} {} {}'.format(foo, bar, baz))
8383

84-
def path_kwargs(request, foo, bar): # $routeHandler $routedParameter=foo $routedParameter=bar
84+
def path_kwargs(request, foo, bar): # $routeHandler routedParameter=foo routedParameter=bar
8585
return HttpResponse('path_kwargs: {} {} {}'.format(foo, bar))
8686

8787
def not_valid_identifier(request): # $routeHandler

‎python/ql/test/experimental/library-tests/frameworks/django-v2-v3/taint_test.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
from django.http import HttpRequest
44

55

6-
def test_taint(request: HttpRequest, foo, bar, baz=None): # $routeHandler $routedParameter=foo $routedParameter=bar
6+
def test_taint(request: HttpRequest, foo, bar, baz=None): # $routeHandler routedParameter=foo routedParameter=bar
77
ensure_tainted(foo, bar)
88
ensure_not_tainted(baz)
99

‎python/ql/test/experimental/library-tests/frameworks/django/SqlExecution.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ def test_model():
2323
User.objects.annotate(RawSQL("foo"), RawSQL("bar")) # $getSql="foo" $getSql="bar"
2424
User.objects.annotate(val=RawSQL("some sql")) # $getSql="some sql"
2525
User.objects.extra("some sql") # $getSql="some sql"
26-
User.objects.extra(select="select", where="where", tables="tables", order_by="order_by") # $getSql="select" $getSql="where" $getSql="tables" $getSql="order_by"
26+
User.objects.extra(select="select", where="where", tables="tables", order_by="order_by") # $getSql="select" getSql="where" getSql="tables" getSql="order_by"
2727

2828
raw = RawSQL("so raw")
2929
User.objects.annotate(val=raw) # $getSql="so raw"

‎python/ql/test/experimental/library-tests/frameworks/flask/old_test.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ def hello_world(): # $routeHandler
1111

1212
class MyView(MethodView):
1313

14-
def get(self, user_id): # $f-:routeHandler
14+
def get(self, user_id): # $ MISSING: routeHandler
1515
if user_id is None:
1616
# return a list of users
1717
pass
@@ -46,21 +46,21 @@ def safe(): # $routeHandler
4646
return make_response("Your name is " + escape(first_name))
4747

4848
@app.route("/hello/<name>") # $routeSetup="/hello/<name>"
49-
def hello(name): # $routeHandler $routedParameter=name
49+
def hello(name): # $routeHandler routedParameter=name
5050
return make_response("Your name is " + name)
5151

5252
@app.route("/foo/<path:subpath>") # $routeSetup="/foo/<path:subpath>"
53-
def foo(subpath): # $routeHandler $routedParameter=subpath
53+
def foo(subpath): # $routeHandler routedParameter=subpath
5454
return make_response("The subpath is " + subpath)
5555

5656
@app.route("/multiple/") # $routeSetup="/multiple/"
5757
@app.route("/multiple/foo/<foo>") # $routeSetup="/multiple/foo/<foo>"
5858
@app.route("/multiple/bar/<bar>") # $routeSetup="/multiple/bar/<bar>"
59-
def multiple(foo=None, bar=None): # $routeHandler $routedParameter=foo $routedParameter=bar
59+
def multiple(foo=None, bar=None): # $routeHandler routedParameter=foo routedParameter=bar
6060
return make_response("foo={!r} bar={!r}".format(foo, bar))
6161

6262
@app.route("/complex/<string(length=2):lang_code>") # $routeSetup="/complex/<string(length=2):lang_code>"
63-
def complex(lang_code): # $routeHandler $routedParameter=lang_code
63+
def complex(lang_code): # $routeHandler routedParameter=lang_code
6464
return make_response("lang_code {}".format(lang_code))
6565

6666
if __name__ == "__main__":

‎python/ql/test/experimental/library-tests/frameworks/flask/routing_test.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,14 @@ def index(): # $routeHandler
1616

1717

1818
# We don't support this yet, and I think that's OK
19-
def later_set(): # $f-:routeHandler
19+
def later_set(): # $ MISSING: routeHandler
2020
return make_response("later_set")
2121
app.add_url_rule('/later-set', 'later_set', view_func=None) # $routeSetup="/later-set"
2222
app.view_functions['later_set'] = later_set
2323

2424

2525
@app.route(UNKNOWN_ROUTE) # $routeSetup
26-
def unkown_route(foo, bar): # $routeHandler $routedParameter=foo $routedParameter=bar
26+
def unkown_route(foo, bar): # $routeHandler routedParameter=foo routedParameter=bar
2727
return make_response("unkown_route")
2828

2929

0 commit comments

Comments
 (0)