Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 627363d

Browse files
RasmusWLRasmusWL
committed
Python: Test taint step for string augmented assignment
Apprently it just works 😕 :magic:
1 parent d0081df commit 627363d

2 files changed

Lines changed: 58 additions & 51 deletions

File tree

‎python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.expected‎

Lines changed: 53 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -71,57 +71,59 @@
7171
| string_.py:33 | ok | str_operations | str(..) |
7272
| string_.py:34 | ok | str_operations | bytes(..) |
7373
| string_.py:35 | ok | str_operations | unicode(..) |
74-
| string_.py:44 | ok | str_methods | ts.capitalize() |
75-
| string_.py:45 | ok | str_methods | ts.center(..) |
76-
| string_.py:46 | ok | str_methods | ts.expandtabs() |
77-
| string_.py:48 | ok | str_methods | ts.format() |
78-
| string_.py:49 | ok | str_methods | "{}".format(..) |
79-
| string_.py:50 | ok | str_methods | "{unsafe}".format(..) |
80-
| string_.py:52 | ok | str_methods | ts.join(..) |
81-
| string_.py:53 | ok | str_methods | "".join(..) |
82-
| string_.py:55 | ok | str_methods | ts.ljust(..) |
83-
| string_.py:56 | ok | str_methods | ts.lstrip() |
84-
| string_.py:57 | ok | str_methods | ts.lower() |
85-
| string_.py:59 | ok | str_methods | ts.replace(..) |
86-
| string_.py:60 | ok | str_methods | "safe".replace(..) |
87-
| string_.py:62 | ok | str_methods | ts.rjust(..) |
88-
| string_.py:63 | ok | str_methods | ts.rstrip() |
89-
| string_.py:64 | ok | str_methods | ts.strip() |
90-
| string_.py:65 | ok | str_methods | ts.swapcase() |
91-
| string_.py:66 | ok | str_methods | ts.title() |
92-
| string_.py:67 | ok | str_methods | ts.upper() |
93-
| string_.py:68 | ok | str_methods | ts.zfill(..) |
94-
| string_.py:70 | ok | str_methods | ts.encode(..) |
95-
| string_.py:71 | ok | str_methods | ts.encode(..).decode(..) |
96-
| string_.py:73 | ok | str_methods | tb.decode(..) |
97-
| string_.py:74 | ok | str_methods | tb.decode(..).encode(..) |
98-
| string_.py:77 | ok | str_methods | ts.partition(..) |
99-
| string_.py:78 | ok | str_methods | ts.rpartition(..) |
100-
| string_.py:79 | ok | str_methods | ts.rsplit(..) |
101-
| string_.py:80 | ok | str_methods | ts.split(..) |
102-
| string_.py:81 | ok | str_methods | ts.splitlines() |
103-
| string_.py:86 | ok | str_methods | "safe".replace(..) |
104-
| string_.py:88 | fail | str_methods | ts.join(..) |
105-
| string_.py:89 | fail | str_methods | ts.join(..) |
106-
| string_.py:99 | fail | non_syntactic | meth() |
107-
| string_.py:100 | fail | non_syntactic | _str(..) |
108-
| string_.py:109 | ok | percent_fmt | BinaryExpr |
109-
| string_.py:110 | ok | percent_fmt | BinaryExpr |
110-
| string_.py:111 | ok | percent_fmt | BinaryExpr |
111-
| string_.py:121 | fail | binary_decode_encode | base64.b64encode(..) |
112-
| string_.py:122 | fail | binary_decode_encode | base64.b64decode(..) |
113-
| string_.py:124 | fail | binary_decode_encode | base64.standard_b64encode(..) |
114-
| string_.py:125 | fail | binary_decode_encode | base64.standard_b64decode(..) |
115-
| string_.py:127 | fail | binary_decode_encode | base64.urlsafe_b64encode(..) |
116-
| string_.py:128 | fail | binary_decode_encode | base64.urlsafe_b64decode(..) |
117-
| string_.py:130 | fail | binary_decode_encode | base64.b32encode(..) |
118-
| string_.py:131 | fail | binary_decode_encode | base64.b32decode(..) |
119-
| string_.py:133 | fail | binary_decode_encode | base64.b16encode(..) |
120-
| string_.py:134 | fail | binary_decode_encode | base64.b16decode(..) |
121-
| string_.py:137 | fail | binary_decode_encode | base64.encodestring(..) |
122-
| string_.py:138 | fail | binary_decode_encode | base64.decodestring(..) |
123-
| string_.py:143 | fail | binary_decode_encode | quopri.encodestring(..) |
124-
| string_.py:144 | fail | binary_decode_encode | quopri.decodestring(..) |
74+
| string_.py:39 | ok | str_operations | aug_assignment |
75+
| string_.py:41 | ok | str_operations | aug_assignment |
76+
| string_.py:49 | ok | str_methods | ts.capitalize() |
77+
| string_.py:50 | ok | str_methods | ts.center(..) |
78+
| string_.py:51 | ok | str_methods | ts.expandtabs() |
79+
| string_.py:53 | ok | str_methods | ts.format() |
80+
| string_.py:54 | ok | str_methods | "{}".format(..) |
81+
| string_.py:55 | ok | str_methods | "{unsafe}".format(..) |
82+
| string_.py:57 | ok | str_methods | ts.join(..) |
83+
| string_.py:58 | ok | str_methods | "".join(..) |
84+
| string_.py:60 | ok | str_methods | ts.ljust(..) |
85+
| string_.py:61 | ok | str_methods | ts.lstrip() |
86+
| string_.py:62 | ok | str_methods | ts.lower() |
87+
| string_.py:64 | ok | str_methods | ts.replace(..) |
88+
| string_.py:65 | ok | str_methods | "safe".replace(..) |
89+
| string_.py:67 | ok | str_methods | ts.rjust(..) |
90+
| string_.py:68 | ok | str_methods | ts.rstrip() |
91+
| string_.py:69 | ok | str_methods | ts.strip() |
92+
| string_.py:70 | ok | str_methods | ts.swapcase() |
93+
| string_.py:71 | ok | str_methods | ts.title() |
94+
| string_.py:72 | ok | str_methods | ts.upper() |
95+
| string_.py:73 | ok | str_methods | ts.zfill(..) |
96+
| string_.py:75 | ok | str_methods | ts.encode(..) |
97+
| string_.py:76 | ok | str_methods | ts.encode(..).decode(..) |
98+
| string_.py:78 | ok | str_methods | tb.decode(..) |
99+
| string_.py:79 | ok | str_methods | tb.decode(..).encode(..) |
100+
| string_.py:82 | ok | str_methods | ts.partition(..) |
101+
| string_.py:83 | ok | str_methods | ts.rpartition(..) |
102+
| string_.py:84 | ok | str_methods | ts.rsplit(..) |
103+
| string_.py:85 | ok | str_methods | ts.split(..) |
104+
| string_.py:86 | ok | str_methods | ts.splitlines() |
105+
| string_.py:91 | ok | str_methods | "safe".replace(..) |
106+
| string_.py:93 | fail | str_methods | ts.join(..) |
107+
| string_.py:94 | fail | str_methods | ts.join(..) |
108+
| string_.py:104 | fail | non_syntactic | meth() |
109+
| string_.py:105 | fail | non_syntactic | _str(..) |
110+
| string_.py:114 | ok | percent_fmt | BinaryExpr |
111+
| string_.py:115 | ok | percent_fmt | BinaryExpr |
112+
| string_.py:116 | ok | percent_fmt | BinaryExpr |
113+
| string_.py:126 | fail | binary_decode_encode | base64.b64encode(..) |
114+
| string_.py:127 | fail | binary_decode_encode | base64.b64decode(..) |
115+
| string_.py:129 | fail | binary_decode_encode | base64.standard_b64encode(..) |
116+
| string_.py:130 | fail | binary_decode_encode | base64.standard_b64decode(..) |
117+
| string_.py:132 | fail | binary_decode_encode | base64.urlsafe_b64encode(..) |
118+
| string_.py:133 | fail | binary_decode_encode | base64.urlsafe_b64decode(..) |
119+
| string_.py:135 | fail | binary_decode_encode | base64.b32encode(..) |
120+
| string_.py:136 | fail | binary_decode_encode | base64.b32decode(..) |
121+
| string_.py:138 | fail | binary_decode_encode | base64.b16encode(..) |
122+
| string_.py:139 | fail | binary_decode_encode | base64.b16decode(..) |
123+
| string_.py:142 | fail | binary_decode_encode | base64.encodestring(..) |
124+
| string_.py:143 | fail | binary_decode_encode | base64.decodestring(..) |
125+
| string_.py:148 | fail | binary_decode_encode | quopri.encodestring(..) |
126+
| string_.py:149 | fail | binary_decode_encode | quopri.decodestring(..) |
125127
| unpacking_.py:16 | ok | unpacking | a |
126128
| unpacking_.py:16 | ok | unpacking | b |
127129
| unpacking_.py:16 | ok | unpacking | c |

‎python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/string_.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,11 @@ def str_operations():
3535
unicode(ts),
3636
)
3737

38+
aug_assignment = "safe"
39+
ensure_not_tainted(aug_assignment)
40+
aug_assignment += TAINTED_STRING
41+
ensure_tainted(aug_assignment)
42+
3843

3944
def str_methods():
4045
print("\n# str_methods")

0 commit comments

Comments
 (0)