Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b02519b

Browse files
geoffw0geoffw0
committed
C++: Make the createLSParser test a bit closer to real life.
1 parent a154232 commit b02519b

2 files changed

Lines changed: 22 additions & 14 deletions

File tree

‎cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ edges
2727
| tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:146:18:146:18 | q |
2828
| tests.cpp:144:18:144:18 | q | tests.cpp:130:39:130:39 | p |
2929
| tests.cpp:146:18:146:18 | q | tests.cpp:134:39:134:39 | p |
30-
| tests.cpp:150:19:150:32 | call to createLSParser | tests.cpp:152:2:152:2 | p |
30+
| tests.cpp:150:25:150:38 | call to createLSParser | tests.cpp:152:2:152:2 | p |
3131
nodes
3232
| tests2.cpp:20:17:20:31 | SAXParser output argument | semmle.label | SAXParser output argument |
3333
| tests2.cpp:22:2:22:2 | p | semmle.label | p |
@@ -68,7 +68,7 @@ nodes
6868
| tests.cpp:140:23:140:43 | XercesDOMParser output argument | semmle.label | XercesDOMParser output argument |
6969
| tests.cpp:144:18:144:18 | q | semmle.label | q |
7070
| tests.cpp:146:18:146:18 | q | semmle.label | q |
71-
| tests.cpp:150:19:150:32 | call to createLSParser | semmle.label | call to createLSParser |
71+
| tests.cpp:150:25:150:38 | call to createLSParser | semmle.label | call to createLSParser |
7272
| tests.cpp:152:2:152:2 | p | semmle.label | p |
7373
subpaths
7474
#select
@@ -85,4 +85,4 @@ subpaths
8585
| tests.cpp:122:3:122:3 | q | tests.cpp:118:24:118:44 | XercesDOMParser output argument | tests.cpp:122:3:122:3 | q | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:118:24:118:44 | XercesDOMParser output argument | XML parser |
8686
| tests.cpp:131:2:131:2 | p | tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:131:2:131:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:140:23:140:43 | XercesDOMParser output argument | XML parser |
8787
| tests.cpp:135:2:135:2 | p | tests.cpp:140:23:140:43 | XercesDOMParser output argument | tests.cpp:135:2:135:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:140:23:140:43 | XercesDOMParser output argument | XML parser |
88-
| tests.cpp:152:2:152:2 | p | tests.cpp:150:19:150:32 | call to createLSParser | tests.cpp:152:2:152:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:150:19:150:32 | call to createLSParser | XML parser |
88+
| tests.cpp:152:2:152:2 | p | tests.cpp:150:25:150:38 | call to createLSParser | tests.cpp:152:2:152:2 | p | This $@ is not configured to prevent an XML external entity (XXE) attack. | tests.cpp:150:25:150:38 | call to createLSParser | XML parser |

‎cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,6 @@
44

55
// ---
66

7-
8-
9-
107
class AbstractDOMParser {
118
public:
129
AbstractDOMParser();
@@ -25,7 +22,10 @@ class XercesDOMParser: public AbstractDOMParser {
2522
class DOMLSParser : public AbstractDOMParser {
2623
};
2724

28-
DOMLSParser *createLSParser();
25+
class DOMImplementationLS {
26+
public:
27+
DOMLSParser *createLSParser();
28+
};
2929

3030
// ---
3131

@@ -146,25 +146,33 @@ void test10(InputSource &data) {
146146
test10_doParseC(q, data);
147147
}
148148

149-
void test11(InputSource &data) {
150-
DOMLSParser *p = createLSParser();
149+
void test11(DOMImplementationLS *impl, InputSource &data) {
150+
DOMLSParser *p = impl->createLSParser();
151151

152152
p->parse(data); // BAD (parser not correctly configured)
153153
}
154154

155-
void test12(InputSource &data) {
156-
DOMLSParser *p = createLSParser();
155+
void test12(DOMImplementationLS *impl, InputSource &data) {
156+
DOMLSParser *p = impl->createLSParser();
157157

158158
p->setDisableDefaultEntityResolution(true);
159159
p->parse(data); // GOOD
160160
}
161161

162-
DOMLSParser *g_p1 = createLSParser();
163-
DOMLSParser *g_p2 = createLSParser();
162+
DOMImplementationLS *g_impl;
163+
DOMLSParser *g_p1, *g_p2;
164164
InputSource *g_data;
165165

166-
void test13() {
166+
void test13_init() {
167+
g_p1 = g_impl->createLSParser();
167168
g_p1->setDisableDefaultEntityResolution(true);
169+
170+
g_p2 = g_impl->createLSParser();
171+
}
172+
173+
void test13() {
174+
test13_init();
175+
168176
g_p1->parse(*g_data); // GOOD
169177
g_p2->parse(*g_data); // BAD (parser not correctly configured) [NOT DETECTED]
170178
}

0 commit comments

Comments
 (0)