Add test for a pattern-switch guard acting as a data-flow guard

smowton · smowton · commit 8406ee7ed561 · 2023-11-30T11:23:59.000Z
diff --git a/java/ql/test/library-tests/pattern-switch/dfg/test.expected b/java/ql/test/library-tests/pattern-switch/dfg/test.expected
@@ -1,3 +1,4 @@
+| GuardTest.java:6:27:6:34 | o | GuardTest.java:11:14:11:14 | s |
 | Test.java:11:23:11:25 | "A" | Test.java:15:14:15:20 | get(...) |
 | Test.java:11:23:11:25 | "A" | Test.java:25:24:25:30 | get(...) |
 | Test.java:11:23:11:25 | "A" | Test.java:32:20:32:26 | get(...) |
diff --git a/java/ql/test/library-tests/pattern-switch/dfg/test.ql b/java/ql/test/library-tests/pattern-switch/dfg/test.ql
@@ -1,11 +1,24 @@
 import java
 
+import semmle.code.java.controlflow.Guards
 import semmle.code.java.dataflow.DataFlow
 
+private predicate isSafe(Guard g, Expr checked, boolean branch) {
+  exists(MethodCall mc | g = mc |
+    mc.getMethod().hasName("isSafe") and
+    checked = mc.getAnArgument() and
+    branch = true
+  )
+}
+
 module TestConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) { source.asExpr() instanceof StringLiteral }
+  predicate isSource(DataFlow::Node source) { source.asExpr() instanceof StringLiteral or source.asParameter().getCallable().hasName("test") }
 
   predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(MethodCall mc | mc.getMethod().getName() = "sink").getAnArgument() }
+
+  predicate isBarrier(DataFlow::Node node) {
+    node = DataFlow::BarrierGuard<isSafe/3>::getABarrierNode()
+  }
 }
 
 module Flow = DataFlow::Global<TestConfig>;

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+\| GuardTest.java:6:27:6:34 \| o \| GuardTest.java:11:14:11:14 \| s \|`
`1`	`2`	`\| Test.java:11:23:11:25 \| "A" \| Test.java:15:14:15:20 \| get(...) \|`
`2`	`3`	`\| Test.java:11:23:11:25 \| "A" \| Test.java:25:24:25:30 \| get(...) \|`
`3`	`4`	`\| Test.java:11:23:11:25 \| "A" \| Test.java:32:20:32:26 \| get(...) \|`