Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f6770c5

Browse files
geoffw0geoffw0
committed
C++: Add tests for std::string 'operator[]' and 'at()'.
1 parent d56a033 commit f6770c5

3 files changed

Lines changed: 47 additions & 0 deletions

File tree

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -677,6 +677,27 @@
677677
| string.cpp:319:16:319:24 | call to basic_string | string.cpp:322:19:322:19 | b | |
678678
| string.cpp:321:7:321:7 | a | string.cpp:321:9:321:14 | call to substr | TAINT |
679679
| string.cpp:322:7:322:7 | b | string.cpp:322:9:322:14 | call to substr | TAINT |
680+
| string.cpp:327:16:327:20 | 123 | string.cpp:327:16:327:21 | call to basic_string | TAINT |
681+
| string.cpp:327:16:327:21 | call to basic_string | string.cpp:331:7:331:7 | a | |
682+
| string.cpp:327:16:327:21 | call to basic_string | string.cpp:335:2:335:2 | a | |
683+
| string.cpp:327:16:327:21 | call to basic_string | string.cpp:337:9:337:9 | a | |
684+
| string.cpp:327:16:327:21 | call to basic_string | string.cpp:339:7:339:7 | a | |
685+
| string.cpp:328:16:328:20 | 123 | string.cpp:328:16:328:21 | call to basic_string | TAINT |
686+
| string.cpp:328:16:328:21 | call to basic_string | string.cpp:332:7:332:7 | b | |
687+
| string.cpp:328:16:328:21 | call to basic_string | string.cpp:336:2:336:2 | b | |
688+
| string.cpp:328:16:328:21 | call to basic_string | string.cpp:340:7:340:7 | b | |
689+
| string.cpp:329:16:329:20 | 123 | string.cpp:329:16:329:21 | call to basic_string | TAINT |
690+
| string.cpp:329:16:329:21 | call to basic_string | string.cpp:333:7:333:7 | c | |
691+
| string.cpp:329:16:329:21 | call to basic_string | string.cpp:337:2:337:2 | c | |
692+
| string.cpp:329:16:329:21 | call to basic_string | string.cpp:341:7:341:7 | c | |
693+
| string.cpp:335:2:335:2 | ref arg a | string.cpp:337:9:337:9 | a | |
694+
| string.cpp:335:2:335:2 | ref arg a | string.cpp:339:7:339:7 | a | |
695+
| string.cpp:335:9:335:23 | call to source | string.cpp:335:2:335:25 | ... = ... | |
696+
| string.cpp:336:2:336:2 | ref arg b | string.cpp:340:7:340:7 | b | |
697+
| string.cpp:336:12:336:26 | call to source | string.cpp:336:2:336:28 | ... = ... | |
698+
| string.cpp:337:2:337:2 | ref arg c | string.cpp:341:7:341:7 | c | |
699+
| string.cpp:337:9:337:9 | ref arg a | string.cpp:339:7:339:7 | a | |
700+
| string.cpp:337:10:337:10 | call to operator[] | string.cpp:337:2:337:12 | ... = ... | |
680701
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:16:2:16:4 | ss1 | |
681702
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:22:7:22:9 | ss1 | |
682703
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:27:7:27:9 | ss1 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,9 @@ namespace std
3838
template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT> >
3939
class basic_string {
4040
public:
41+
using value_type = charT;
42+
using reference = value_type&;
43+
using const_reference = const value_type&;
4144
typedef typename Allocator::size_type size_type;
4245
static const size_type npos = -1;
4346

@@ -58,6 +61,10 @@ namespace std
5861
const_iterator cbegin() const;
5962
const_iterator cend() const;
6063

64+
const_reference operator[](size_type pos) const;
65+
reference operator[](size_type pos);
66+
const_reference at(size_type n) const;
67+
reference at(size_type n);
6168
template<class T> basic_string& operator+=(const T& t);
6269
basic_string& operator+=(const charT* s);
6370
basic_string& append(const basic_string& str);

‎cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -321,3 +321,22 @@ void test_string_substr()
321321
sink(a.substr(0, a.length()));
322322
sink(b.substr(0, b.length())); // tainted
323323
}
324+
325+
void test_string_at()
326+
{
327+
std::string a("123");
328+
std::string b("123");
329+
std::string c("123");
330+
331+
sink(a);
332+
sink(b);
333+
sink(c);
334+
335+
a[0] = ns_char::source();
336+
b.at(0) = ns_char::source();
337+
c[0] = a[0];
338+
339+
sink(a); // tainted [NOT DETECTED]
340+
sink(b); // tainted [NOT DETECTED]
341+
sink(c); // tainted [NOT DETECTED]
342+
}

0 commit comments

Comments
 (0)