Skip to content

Commit 1e4caca

Browse files
MathiasVPMathiasVP
committed
C++: Accept query changes. Nothing bad to see here.
1 parent 2cb4a55 commit 1e4caca

7 files changed

Lines changed: 185 additions & 152 deletions

File tree

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
edges
2-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | (const char *)... indirection |
2+
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection |
33
nodes
44
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | semmle.label | fgets output argument |
5-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | (const char *)... indirection | semmle.label | (const char *)... indirection |
5+
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection | semmle.label | data indirection |
66
subpaths
77
#select
8-
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | user input (string read by fgets) |
8+
| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | data indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | user input (string read by fgets) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,32 @@
11
edges
2-
| test.c:8:27:8:30 | argv | test.c:17:11:17:18 | (const char *)... indirection |
3-
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | (const char *)... indirection |
4-
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | (const char *)... indirection |
5-
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | (const char *)... indirection |
6-
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | (const char *)... indirection |
2+
| test.c:8:27:8:30 | argv | test.c:17:11:17:18 | fileName indirection |
3+
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | fileName indirection |
4+
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | fileName indirection |
5+
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | fileName indirection |
6+
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | fileName indirection |
77
| test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection |
88
| test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection |
9-
| test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | (const char *)... indirection |
10-
| test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | (const char *)... indirection |
9+
| test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | fileName indirection |
10+
| test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | fileName indirection |
1111
nodes
1212
| test.c:8:27:8:30 | argv | semmle.label | argv |
1313
| test.c:8:27:8:30 | argv indirection | semmle.label | argv indirection |
1414
| test.c:8:27:8:30 | argv indirection | semmle.label | argv indirection |
15-
| test.c:17:11:17:18 | (const char *)... indirection | semmle.label | (const char *)... indirection |
16-
| test.c:32:11:32:18 | (const char *)... indirection | semmle.label | (const char *)... indirection |
15+
| test.c:17:11:17:18 | fileName indirection | semmle.label | fileName indirection |
16+
| test.c:32:11:32:18 | fileName indirection | semmle.label | fileName indirection |
1717
| test.c:37:17:37:24 | scanf output argument | semmle.label | scanf output argument |
18-
| test.c:38:11:38:18 | (const char *)... indirection | semmle.label | (const char *)... indirection |
18+
| test.c:38:11:38:18 | fileName indirection | semmle.label | fileName indirection |
1919
| test.c:43:17:43:24 | scanf output argument | semmle.label | scanf output argument |
20-
| test.c:44:11:44:18 | (const char *)... indirection | semmle.label | (const char *)... indirection |
20+
| test.c:44:11:44:18 | fileName indirection | semmle.label | fileName indirection |
2121
| test.c:57:10:57:16 | access to array indirection | semmle.label | access to array indirection |
2222
subpaths
2323
#select
24-
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv | test.c:17:11:17:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv | user input (a command-line argument) |
25-
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
26-
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
27-
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
28-
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
29-
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | scanf output argument | user input (value read by scanf) |
30-
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | (const char *)... indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | scanf output argument | user input (value read by scanf) |
24+
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv | test.c:17:11:17:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv | user input (a command-line argument) |
25+
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
26+
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
27+
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
28+
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
29+
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | scanf output argument | user input (value read by scanf) |
30+
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | fileName indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | scanf output argument | user input (value read by scanf) |
3131
| test.c:57:10:57:16 | access to array | test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection | This argument to a file access function is derived from $@ and then passed to read(fileName), which calls fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
3232
| test.c:57:10:57:16 | access to array | test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection | This argument to a file access function is derived from $@ and then passed to read(fileName), which calls fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/ExecTainted.expected‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ edges
44
| tests.cpp:26:32:26:35 | data | tests.cpp:38:25:38:36 | strncat output argument |
55
| tests.cpp:26:32:26:35 | data indirection | tests.cpp:26:15:26:23 | badSource indirection |
66
| tests.cpp:26:32:26:35 | data indirection | tests.cpp:38:25:38:36 | strncat output argument |
7-
| tests.cpp:33:34:33:39 | call to getenv indirection | tests.cpp:38:39:38:49 | (const char *)... indirection |
7+
| tests.cpp:33:34:33:39 | call to getenv indirection | tests.cpp:38:39:38:49 | environment indirection |
88
| tests.cpp:38:25:38:36 | strncat output argument | tests.cpp:26:15:26:23 | badSource indirection |
99
| tests.cpp:38:25:38:36 | strncat output argument | tests.cpp:26:15:26:23 | badSource indirection |
1010
| tests.cpp:38:25:38:36 | strncat output argument | tests.cpp:26:15:26:23 | badSource indirection |
1111
| tests.cpp:38:25:38:36 | strncat output argument | tests.cpp:51:22:51:25 | badSource output argument |
12-
| tests.cpp:38:39:38:49 | (const char *)... indirection | tests.cpp:38:25:38:36 | strncat output argument |
13-
| tests.cpp:51:12:51:20 | call to badSource indirection | tests.cpp:53:16:53:19 | (const char *)... indirection |
12+
| tests.cpp:38:39:38:49 | environment indirection | tests.cpp:38:25:38:36 | strncat output argument |
13+
| tests.cpp:51:12:51:20 | call to badSource indirection | tests.cpp:53:16:53:19 | data indirection |
1414
| tests.cpp:51:22:51:25 | badSource output argument | tests.cpp:51:22:51:25 | data |
1515
| tests.cpp:51:22:51:25 | badSource output argument | tests.cpp:51:22:51:25 | data indirection |
1616
| tests.cpp:51:22:51:25 | data | tests.cpp:26:32:26:35 | data |
@@ -28,15 +28,15 @@ nodes
2828
| tests.cpp:38:25:38:36 | strncat output argument | semmle.label | strncat output argument |
2929
| tests.cpp:38:25:38:36 | strncat output argument | semmle.label | strncat output argument |
3030
| tests.cpp:38:25:38:36 | strncat output argument | semmle.label | strncat output argument |
31-
| tests.cpp:38:39:38:49 | (const char *)... indirection | semmle.label | (const char *)... indirection |
31+
| tests.cpp:38:39:38:49 | environment indirection | semmle.label | environment indirection |
3232
| tests.cpp:51:12:51:20 | call to badSource indirection | semmle.label | call to badSource indirection |
3333
| tests.cpp:51:22:51:25 | badSource output argument | semmle.label | badSource output argument |
3434
| tests.cpp:51:22:51:25 | data | semmle.label | data |
3535
| tests.cpp:51:22:51:25 | data indirection | semmle.label | data indirection |
36-
| tests.cpp:53:16:53:19 | (const char *)... indirection | semmle.label | (const char *)... indirection |
36+
| tests.cpp:53:16:53:19 | data indirection | semmle.label | data indirection |
3737
subpaths
3838
| tests.cpp:51:22:51:25 | data | tests.cpp:26:32:26:35 | data | tests.cpp:26:15:26:23 | badSource indirection | tests.cpp:51:12:51:20 | call to badSource indirection |
3939
| tests.cpp:51:22:51:25 | data | tests.cpp:26:32:26:35 | data | tests.cpp:38:25:38:36 | strncat output argument | tests.cpp:51:22:51:25 | badSource output argument |
4040
| tests.cpp:51:22:51:25 | data indirection | tests.cpp:26:32:26:35 | data indirection | tests.cpp:26:15:26:23 | badSource indirection | tests.cpp:51:12:51:20 | call to badSource indirection |
4141
#select
42-
| tests.cpp:53:16:53:19 | data | tests.cpp:33:34:33:39 | call to getenv indirection | tests.cpp:53:16:53:19 | (const char *)... indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | tests.cpp:33:34:33:39 | call to getenv indirection | user input (an environment variable) | tests.cpp:38:25:38:36 | strncat output argument | strncat output argument |
42+
| tests.cpp:53:16:53:19 | data | tests.cpp:33:34:33:39 | call to getenv indirection | tests.cpp:53:16:53:19 | data indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | tests.cpp:33:34:33:39 | call to getenv indirection | user input (an environment variable) | tests.cpp:38:25:38:36 | strncat output argument | strncat output argument |

0 commit comments

Comments
 (0)