Use of inline tests for dataflow queries

Sim4n6 · Sim4n6 · commit 10d6ebf95b52 · 2023-01-25T19:28:05.000+01:00
diff --git a/python/ql/test/experimental/query-tests/Security/CWE-022/DataflowQueryTest.expected b/python/ql/test/experimental/query-tests/Security/CWE-022/DataflowQueryTest.expected
@@ -0,0 +1,4 @@
+missingAnnotationOnSink
+failures
+| UnsafeUnpack.py:12:46:12:58 | Comment # $result=BAD | Missing result:result=BAD |
+| UnsafeUnpack.py:55:53:55:65 | Comment # $result=BAD | Missing result:result=BAD |
diff --git a/python/ql/test/experimental/query-tests/Security/CWE-022/DataflowQueryTest.ql b/python/ql/test/experimental/query-tests/Security/CWE-022/DataflowQueryTest.ql
@@ -0,0 +1,2 @@
+import python
+import experimental.dataflow.TestUtil.DataflowQueryTest
diff --git a/python/ql/test/experimental/query-tests/Security/CWE-022/UnsafeUnpack.py b/python/ql/test/experimental/query-tests/Security/CWE-022/UnsafeUnpack.py
@@ -9,7 +9,7 @@
       f.write(response.raw.read())
 
 untarredpath = "/tmp/tmp123"
-shutil.unpack_archive(tarpath, untarredpath)
+shutil.unpack_archive(tarpath, untarredpath) # $result=BAD
 
 
 import tempfile
@@ -52,5 +52,5 @@
             )
         fs.get(uri, to_path, recursive=True)
     if unpack_path:
-        shutil.unpack_archive(to_path, unpack_path)
+        shutil.unpack_archive(to_path, unpack_path) # $result=BAD
         to_path = unpack_path

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+import python`
	`2`	`+import experimental.dataflow.TestUtil.DataflowQueryTest`