Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 7385ea5

Browse files
RasmusWLRasmusWL
committed
Python: Add tests for ExternalFileObject
1 parent c479a77 commit 7385ea5

4 files changed

Lines changed: 29 additions & 0 deletions

File tree

‎python/ql/test/library-tests/taint/strings/Taint.qll‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,3 +34,11 @@ class ExceptionInfoSource extends TaintSource {
3434

3535
override string toString() { result = "Exception info source" }
3636
}
37+
38+
class ExternalFileObjectSource extends TaintSource {
39+
ExternalFileObjectSource() { this.(NameNode).getId() = "TAINTED_FILE" }
40+
41+
override predicate isSourceOf(TaintKind kind) { kind instanceof ExternalFileObject }
42+
43+
override string toString() { result = "Tainted file source" }
44+
}

‎python/ql/test/library-tests/taint/strings/TestStep.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,12 @@
6262
| Taint externally controlled string | test.py:66 | test.py:66:22:66:35 | TAINTED_STRING | | --> | Taint externally controlled string | test.py:68 | test.py:68:29:68:42 | tainted_string | |
6363
| Taint externally controlled string | test.py:67 | test.py:67:29:67:42 | tainted_string | | --> | Taint [externally controlled string] | test.py:67 | test.py:67:20:67:43 | urlsplit() | |
6464
| Taint externally controlled string | test.py:68 | test.py:68:29:68:42 | tainted_string | | --> | Taint [externally controlled string] | test.py:68 | test.py:68:20:68:43 | urlparse() | |
65+
| Taint file[externally controlled string] | test.py:72 | test.py:72:20:72:31 | TAINTED_FILE | | --> | Taint file[externally controlled string] | test.py:74 | test.py:74:9:74:20 | tainted_file | |
66+
| Taint file[externally controlled string] | test.py:72 | test.py:72:20:72:31 | TAINTED_FILE | | --> | Taint file[externally controlled string] | test.py:75 | test.py:75:9:75:20 | tainted_file | |
67+
| Taint file[externally controlled string] | test.py:72 | test.py:72:20:72:31 | TAINTED_FILE | | --> | Taint file[externally controlled string] | test.py:76 | test.py:76:9:76:20 | tainted_file | |
68+
| Taint file[externally controlled string] | test.py:72 | test.py:72:20:72:31 | TAINTED_FILE | | --> | Taint file[externally controlled string] | test.py:77 | test.py:77:9:77:20 | tainted_file | |
69+
| Taint file[externally controlled string] | test.py:72 | test.py:72:20:72:31 | TAINTED_FILE | | --> | Taint file[externally controlled string] | test.py:78 | test.py:78:27:78:38 | tainted_file | |
70+
| Taint file[externally controlled string] | test.py:75 | test.py:75:9:75:20 | tainted_file | | --> | Taint externally controlled string | test.py:75 | test.py:75:9:75:27 | Attribute() | |
6571
| Taint json[externally controlled string] | test.py:6 | test.py:6:20:6:45 | Attribute() | | --> | Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:20 | tainted_json | |
6672
| Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:20 | tainted_json | | --> | Taint externally controlled string | test.py:7 | test.py:7:9:7:25 | Subscript | |
6773
| Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:20 | tainted_json | | --> | Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:25 | Subscript | |

‎python/ql/test/library-tests/taint/strings/TestTaint.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,8 @@
2222
| test.py:58 | test_untrusted | res | externally controlled string |
2323
| test.py:69 | test_urlsplit_urlparse | urlparse_res | [externally controlled string] |
2424
| test.py:69 | test_urlsplit_urlparse | urlsplit_res | [externally controlled string] |
25+
| test.py:74 | test_tainted_file | tainted_file | file[externally controlled string] |
26+
| test.py:75 | test_tainted_file | Attribute() | externally controlled string |
27+
| test.py:76 | test_tainted_file | Attribute() | NO TAINT |
28+
| test.py:77 | test_tainted_file | Attribute() | NO TAINT |
29+
| test.py:78 | test_tainted_file | ListComp | NO TAINT |

‎python/ql/test/library-tests/taint/strings/test.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,13 @@ def test_urlsplit_urlparse():
6767
urlsplit_res = urlsplit(tainted_string)
6868
urlparse_res = urlparse(tainted_string)
6969
test(urlsplit_res, urlparse_res)
70+
71+
def test_tainted_file():
72+
tainted_file = TAINTED_FILE
73+
test(
74+
tainted_file,
75+
tainted_file.read(),
76+
tainted_file.readline(),
77+
tainted_file.readlines(),
78+
[line for line in tainted_file],
79+
)

0 commit comments

Comments
 (0)