Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b632ca4

Browse files
criemencriemen
committed
C++: Port dataflow/taint-tests to inline expectations test.
1 parent 644a0fa commit b632ca4

23 files changed

Lines changed: 803 additions & 2011 deletions

‎cpp/ql/test/library-tests/dataflow/taint-tests/IRTaintTestCommon.qll‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import cpp
22
import semmle.code.cpp.ir.IR
33
import semmle.code.cpp.ir.dataflow.TaintTracking
4+
import TestUtilities.InlineExpectationsTest
45

56
/** Common data flow configuration to be used by tests. */
67
class TestAllocationConfig extends TaintTracking::Configuration {
@@ -10,9 +11,6 @@ class TestAllocationConfig extends TaintTracking::Configuration {
1011
source.(DataFlow::ExprNode).getConvertedExpr().(FunctionCall).getTarget().getName() = "source"
1112
or
1213
source.asParameter().getName().matches("source%")
13-
or
14-
// Track uninitialized variables
15-
exists(source.asUninitialized())
1614
}
1715

1816
override predicate isSink(DataFlow::Node sink) {

‎cpp/ql/test/library-tests/dataflow/taint-tests/TaintTestCommon.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import cpp
22
import semmle.code.cpp.dataflow.TaintTracking
33
import semmle.code.cpp.models.interfaces.Taint
4+
import TestUtilities.InlineExpectationsTest
45

56
/** Common data flow configuration to be used by tests. */
67
class TestAllocationConfig extends TaintTracking::Configuration {

‎cpp/ql/test/library-tests/dataflow/taint-tests/arrayassignment.cpp‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ void test_pointer_deref_assignment()
1313

1414
*p_x = source();
1515

16-
sink(x); // tainted [DETECTED BY IR ONLY]
17-
sink(*p_x); // tainted
18-
sink(*p2_x); // tainted [DETECTED BY IR ONLY]
19-
sink(r_x); // tainted [DETECTED BY IR ONLY]
16+
sink(x); // $ ir MISSING: ast
17+
sink(*p_x); // $ ast,ir
18+
sink(*p2_x); // $ ir MISSING: ast
19+
sink(r_x); // $ ir MISSING: ast
2020
}
2121

2222
void test_reference_deref_assignment()
@@ -28,10 +28,10 @@ void test_reference_deref_assignment()
2828

2929
r_x = source();
3030

31-
sink(x); // tainted [DETECTED BY IR ONLY]
32-
sink(*p_x); // tainted [DETECTED BY IR ONLY]
33-
sink(r_x); // tainted
34-
sink(r2_x); // tainted [DETECTED BY IR ONLY]
31+
sink(x); // $ ir MISSING: ast
32+
sink(*p_x); // $ ir MISSING: ast
33+
sink(r_x); // $ ast,ir
34+
sink(r2_x); // $ ir MISSING: ast
3535
}
3636

3737
class MyInt
@@ -53,8 +53,8 @@ void test_myint_member_assignment()
5353

5454
mi.i = source();
5555

56-
sink(mi); // tainted [DETECTED BY IR ONLY]
57-
sink(mi.get()); // tainted
56+
sink(mi); // $ ir MISSING: ast
57+
sink(mi.get()); // $ ast,ir
5858
}
5959

6060
void test_myint_method_assignment()
@@ -63,8 +63,8 @@ void test_myint_method_assignment()
6363

6464
mi.get() = source();
6565

66-
sink(mi); // tainted [DETECTED BY IR ONLY]
67-
sink(mi.get()); // tainted
66+
sink(mi); // $ ir MISSING: ast
67+
sink(mi.get()); // $ ast,ir
6868
}
6969

7070
void test_myint_overloaded_assignment()
@@ -74,10 +74,10 @@ void test_myint_overloaded_assignment()
7474
mi = source();
7575
mi2 = mi;
7676

77-
sink(mi); // tainted [NOT DETECTED]
78-
sink(mi.get()); // tainted [NOT DETECTED]
79-
sink(mi2); // tainted [NOT DETECTED]
80-
sink(mi2.get()); // tainted [NOT DETECTED]
77+
sink(mi); // $ MISSING: ast,ir
78+
sink(mi.get()); // $ MISSING: ast,ir
79+
sink(mi2); // $ MISSING: ast,ir
80+
sink(mi2.get()); // $ MISSING: ast,ir
8181
}
8282

8383
class MyArray
@@ -98,7 +98,7 @@ void test_myarray_member_assignment()
9898

9999
ma.values[0] = source();
100100

101-
sink(ma.values[0]); // tainted
101+
sink(ma.values[0]); // $ ast,ir
102102
}
103103

104104
void test_myarray_method_assignment()
@@ -107,7 +107,7 @@ void test_myarray_method_assignment()
107107

108108
ma.get(0) = source();
109109

110-
sink(ma.get(0)); // tainted [NOT DETECTED]
110+
sink(ma.get(0)); // $ MISSING: ast,ir
111111
}
112112

113113
void test_myarray_overloaded_assignment()
@@ -117,8 +117,8 @@ void test_myarray_overloaded_assignment()
117117
ma[0] = source();
118118
ma2 = ma;
119119

120-
sink(ma[0]); // tainted [NOT DETECTED]
121-
sink(ma2[0]); // tainted [NOT DETECTED]
120+
sink(ma[0]); // $ MISSING: ast,ir
121+
sink(ma2[0]); // $ MISSING: ast,ir
122122
}
123123

124124
void sink(int *);
@@ -132,16 +132,16 @@ void test_array_reference_assignment()
132132
int *ptr2, *ptr3;
133133

134134
ref1 = source();
135-
sink(ref1); // tainted
136-
sink(arr1[5]); // tainted [DETECTED BY IR ONLY]
135+
sink(ref1); // $ ast,ir
136+
sink(arr1[5]); // $ ir MISSING: ast
137137

138138
ptr2 = &(arr2[5]);
139139
*ptr2 = source();
140-
sink(*ptr2); // tainted
141-
sink(arr2[5]); // tainted [DETECTED BY IR ONLY]
140+
sink(*ptr2); // $ ast,ir
141+
sink(arr2[5]); // $ ir MISSING: ast
142142

143143
ptr3 = arr3;
144144
ptr3[5] = source();
145-
sink(ptr3[5]); // tainted
146-
sink(arr3[5]); // tainted [DETECTED BY IR ONLY]
145+
sink(ptr3[5]); // $ ast,ir
146+
sink(arr3[5]); // $ ir MISSING: ast
147147
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/copyableclass.cpp‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@ void test_copyableclass()
3737
MyCopyableClass s4;
3838
s4 = source();
3939

40-
sink(s1); // tainted
41-
sink(s2); // tainted
42-
sink(s3); // tainted
43-
sink(s4); // tainted
40+
sink(s1); // $ ast,ir
41+
sink(s2); // $ ast,ir
42+
sink(s3); // $ ast,ir
43+
sink(s4); // $ ast,ir
4444
}
4545

4646
{
@@ -62,8 +62,8 @@ void test_copyableclass()
6262
MyCopyableClass s3;
6363
s2 = MyCopyableClass(source());
6464

65-
sink(s1); // tainted
66-
sink(s2); // tainted
67-
sink(s3 = source()); // tainted
65+
sink(s1); // $ ast,ir
66+
sink(s2); // $ ast,ir
67+
sink(s3 = source()); // $ ast,ir
6868
}
6969
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/copyableclass_declonly.cpp‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@ void test_copyableclass_declonly()
3737
MyCopyableClassDeclOnly s4;
3838
s4 = source();
3939

40-
sink(s1); // tainted
41-
sink(s2); // tainted
42-
sink(s3); // tainted
43-
sink(s4); // tainted
40+
sink(s1); // $ ast,ir
41+
sink(s2); // $ ast,ir
42+
sink(s3); // $ ast,ir
43+
sink(s4); // $ ast,ir
4444
}
4545

4646
{
@@ -62,8 +62,8 @@ void test_copyableclass_declonly()
6262
MyCopyableClassDeclOnly s3;
6363
s2 = MyCopyableClassDeclOnly(source());
6464

65-
sink(s1); // tainted
66-
sink(s2); // tainted
67-
sink(s3 = source()); // tainted
65+
sink(s1); // $ ast,ir
66+
sink(s2); // $ ast,ir
67+
sink(s3 = source()); // $ ast MISSING: ir
6868
}
6969
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/format.cpp‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -54,22 +54,22 @@ void test1()
5454
{
5555
char buffer[256] = {0};
5656
sink(snprintf(buffer, 256, "%s", string::source()));
57-
sink(buffer); // tainted
57+
sink(buffer); // $ ast,ir
5858
}
5959
{
6060
char buffer[256] = {0};
6161
sink(snprintf(buffer, 256, string::source(), "Hello."));
62-
sink(buffer); // tainted
62+
sink(buffer); // $ ast,ir
6363
}
6464
{
6565
char buffer[256] = {0};
6666
sink(snprintf(buffer, 256, "%s %s %s", "a", "b", string::source()));
67-
sink(buffer); // tainted
67+
sink(buffer); // $ ast,ir
6868
}
6969
{
7070
char buffer[256] = {0};
7171
sink(snprintf(buffer, 256, "%.*s", 10, string::source()));
72-
sink(buffer); // tainted
72+
sink(buffer); // $ ast,ir
7373
}
7474

7575
{
@@ -80,39 +80,39 @@ void test1()
8080
{
8181
char buffer[256] = {0};
8282
sink(snprintf(buffer, 256, "%i", source()));
83-
sink(buffer); // tainted
83+
sink(buffer); // $ ast,ir
8484
}
8585
{
8686
char buffer[256] = {0};
8787
sink(snprintf(buffer, 256, "%.*s", source(), "Hello."));
88-
sink(buffer); // tainted
88+
sink(buffer); // $ ast,ir
8989
}
9090

9191
{
9292
char buffer[256] = {0};
9393
sink(snprintf(buffer, 256, "%p", string::source()));
94-
sink(buffer); // tainted (debatable)
94+
sink(buffer); // $ ast,ir // tainted (debatable)
9595
}
9696

9797
{
9898
char buffer[256] = {0};
9999
sink(sprintf(buffer, "%s", string::source()));
100-
sink(buffer); // tainted
100+
sink(buffer); // $ ast,ir
101101
}
102102
{
103103
char buffer[256] = {0};
104104
sink(sprintf(buffer, "%ls", wstring::source()));
105-
sink(buffer); // tainted
105+
sink(buffer); // $ ast,ir
106106
}
107107
{
108108
wchar_t wbuffer[256] = {0};
109109
sink(swprintf(wbuffer, 256, L"%s", wstring::source()));
110-
sink(wbuffer); // tainted
110+
sink(wbuffer); // $ ast,ir
111111
}
112112
{
113113
char buffer[256] = {0};
114114
sink(mysprintf(buffer, 256, "%s", string::source()));
115-
sink(buffer); // tainted
115+
sink(buffer); // $ ast,ir
116116
}
117117

118118
{
@@ -123,7 +123,7 @@ void test1()
123123
{
124124
int i = 0;
125125
sink(sscanf(string::source(), "%i", &i));
126-
sink(i); // tainted [NOT DETECTED]
126+
sink(i); // $ MISSING: ast,ir
127127
}
128128
{
129129
char buffer[256] = {0};
@@ -133,7 +133,7 @@ void test1()
133133
{
134134
char buffer[256] = {0};
135135
sink(sscanf(string::source(), "%s", &buffer));
136-
sink(buffer); // tainted [NOT DETECTED]
136+
sink(buffer); // $ MISSING: ast,ir
137137
}
138138
}
139139

@@ -154,6 +154,6 @@ void test2()
154154
i = strlen(s) + 1;
155155
sink(i);
156156

157-
sink(s[strlen(s) - 1]); // tainted
158-
sink(ws + (wcslen(ws) / 2)); // tainted
157+
sink(s[strlen(s) - 1]); // $ ast,ir
158+
sink(ws + (wcslen(ws) / 2)); // $ ast,ir
159159
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -787,8 +787,6 @@
787787
| map.cpp:152:15:152:19 | call to begin | map.cpp:154:9:154:10 | i2 | |
788788
| map.cpp:152:15:152:19 | call to begin | map.cpp:155:8:155:9 | i2 | |
789789
| map.cpp:152:15:152:19 | call to begin | map.cpp:156:8:156:9 | i2 | |
790-
| map.cpp:152:15:152:19 | call to begin | map.cpp:161:8:161:9 | i2 | |
791-
| map.cpp:152:15:152:19 | call to begin | map.cpp:162:8:162:9 | i2 | |
792790
| map.cpp:152:30:152:31 | m2 | map.cpp:152:33:152:35 | call to end | TAINT |
793791
| map.cpp:152:30:152:31 | ref arg m2 | map.cpp:152:30:152:31 | m2 | |
794792
| map.cpp:152:30:152:31 | ref arg m2 | map.cpp:182:7:182:8 | m2 | |
@@ -804,8 +802,6 @@
804802
| map.cpp:152:40:152:41 | ref arg i2 | map.cpp:154:9:154:10 | i2 | |
805803
| map.cpp:152:40:152:41 | ref arg i2 | map.cpp:155:8:155:9 | i2 | |
806804
| map.cpp:152:40:152:41 | ref arg i2 | map.cpp:156:8:156:9 | i2 | |
807-
| map.cpp:152:40:152:41 | ref arg i2 | map.cpp:161:8:161:9 | i2 | |
808-
| map.cpp:152:40:152:41 | ref arg i2 | map.cpp:162:8:162:9 | i2 | |
809805
| map.cpp:154:8:154:8 | call to operator* | map.cpp:154:8:154:10 | call to pair | TAINT |
810806
| map.cpp:154:9:154:10 | i2 | map.cpp:154:8:154:8 | call to operator* | TAINT |
811807
| map.cpp:155:8:155:9 | i2 | map.cpp:155:10:155:10 | call to operator-> | TAINT |
@@ -817,17 +813,21 @@
817813
| map.cpp:158:15:158:19 | call to begin | map.cpp:158:24:158:25 | i3 | |
818814
| map.cpp:158:15:158:19 | call to begin | map.cpp:158:40:158:41 | i3 | |
819815
| map.cpp:158:15:158:19 | call to begin | map.cpp:160:9:160:10 | i3 | |
816+
| map.cpp:158:15:158:19 | call to begin | map.cpp:161:8:161:9 | i3 | |
817+
| map.cpp:158:15:158:19 | call to begin | map.cpp:162:8:162:9 | i3 | |
820818
| map.cpp:158:30:158:31 | m3 | map.cpp:158:33:158:35 | call to end | TAINT |
821819
| map.cpp:158:30:158:31 | ref arg m3 | map.cpp:158:30:158:31 | m3 | |
822820
| map.cpp:158:30:158:31 | ref arg m3 | map.cpp:252:1:252:1 | m3 | |
823821
| map.cpp:158:40:158:41 | i3 | map.cpp:158:42:158:42 | call to operator++ | |
824822
| map.cpp:158:40:158:41 | ref arg i3 | map.cpp:158:24:158:25 | i3 | |
825823
| map.cpp:158:40:158:41 | ref arg i3 | map.cpp:158:40:158:41 | i3 | |
826824
| map.cpp:158:40:158:41 | ref arg i3 | map.cpp:160:9:160:10 | i3 | |
825+
| map.cpp:158:40:158:41 | ref arg i3 | map.cpp:161:8:161:9 | i3 | |
826+
| map.cpp:158:40:158:41 | ref arg i3 | map.cpp:162:8:162:9 | i3 | |
827827
| map.cpp:160:8:160:8 | call to operator* | map.cpp:160:8:160:10 | call to pair | TAINT |
828828
| map.cpp:160:9:160:10 | i3 | map.cpp:160:8:160:8 | call to operator* | TAINT |
829-
| map.cpp:161:8:161:9 | i2 | map.cpp:161:10:161:10 | call to operator-> | TAINT |
830-
| map.cpp:162:8:162:9 | i2 | map.cpp:162:10:162:10 | call to operator-> | TAINT |
829+
| map.cpp:161:8:161:9 | i3 | map.cpp:161:10:161:10 | call to operator-> | TAINT |
830+
| map.cpp:162:8:162:9 | i3 | map.cpp:162:10:162:10 | call to operator-> | TAINT |
831831
| map.cpp:166:27:166:29 | call to map | map.cpp:167:7:167:9 | m10 | |
832832
| map.cpp:166:27:166:29 | call to map | map.cpp:171:7:171:9 | m10 | |
833833
| map.cpp:166:27:166:29 | call to map | map.cpp:252:1:252:1 | m10 | |

0 commit comments

Comments
 (0)