Skip to content

Commit 959ce3b

Browse files
author
Robert Marsh
committed
C++: add diff tests for DefaultTaintTracking
1 parent 0180672 commit 959ce3b

4 files changed

Lines changed: 76 additions & 0 deletions

File tree

‎cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:50:15:50:24 | envStr_ptr | AST only |
2+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:50:28:50:40 | & ... | AST only |
3+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:50:29:50:40 | envStrGlobal | AST only |
4+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:2:52:12 | * ... | AST only |
5+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:3:52:12 | envStr_ptr | AST only |
6+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |
7+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:67:7:67:13 | copying | AST only |
8+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:69:10:69:13 | copy | AST only |
9+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:5:70:10 | call to strcpy | AST only |
10+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:12:70:15 | copy | AST only |
11+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | copy | AST only |

‎cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.ql‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import semmle.code.cpp.security.TaintTracking as AST
2+
import semmle.code.cpp.ir.dataflow.DefaultTaintTracking as IR
3+
import cpp
4+
5+
from Expr source, Element tainted, string side
6+
where
7+
AST::taintedIncludingGlobalVars(source, tainted, _) and
8+
not IR::taintedIncludingGlobalVars(source, tainted, _) and
9+
not tainted.getLocation().getFile().getExtension() = "h" and
10+
side = "AST only"
11+
or
12+
IR::taintedIncludingGlobalVars(source, tainted, _) and
13+
not AST::taintedIncludingGlobalVars(source, tainted, _) and
14+
not tainted.getLocation().getFile().getExtension() = "h" and
15+
side = "IR only"
16+
17+
select source, tainted, side

‎cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:8:24:8:25 | s1 | |
2+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:23:14:23:19 | envStr | |
3+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:23:23:23:28 | call to getenv | |
4+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:23:23:23:40 | (const char *)... | |
5+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:6:25:29 | ! ... | |
6+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:7:25:12 | call to strcmp | |
7+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:7:25:29 | (bool)... | |
8+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:25:14:25:19 | envStr | |
9+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:6:29:28 | ! ... | |
10+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:7:29:12 | call to strcmp | |
11+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:7:29:28 | (bool)... | |
12+
| test.cpp:23:23:23:28 | call to getenv | test.cpp:29:14:29:19 | envStr | |
13+
| test.cpp:38:23:38:28 | call to getenv | test.cpp:8:24:8:25 | s1 | |
14+
| test.cpp:38:23:38:28 | call to getenv | test.cpp:38:14:38:19 | envStr | |
15+
| test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:28 | call to getenv | |
16+
| test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:40 | (const char *)... | |
17+
| test.cpp:38:23:38:28 | call to getenv | test.cpp:40:14:40:19 | envStr | |
18+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:8:24:8:25 | s1 | |
19+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:45:13:45:24 | envStrGlobal | |
20+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:14:49:19 | envStr | |
21+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:28 | call to getenv | |
22+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:40 | (const char *)... | |
23+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:16:52:21 | envStr | |
24+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:6:54:35 | ! ... | |
25+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:12 | call to strcmp | |
26+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:35 | (bool)... | |
27+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:14:54:25 | envStrGlobal | |
28+
| test.cpp:60:29:60:34 | call to getenv | test.cpp:10:27:10:27 | s | |
29+
| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:18:60:25 | userName | |
30+
| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:34 | call to getenv | |
31+
| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:47 | (const char *)... | |
32+
| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:25:64:32 | userName | |
33+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:11:36:11:37 | s2 | |
34+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:17:68:24 | userName | |
35+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:33 | call to getenv | |
36+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:46 | (const char *)... | |
37+
| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:18:70:25 | userName | |
38+
| test.cpp:75:20:75:25 | call to getenv | test.cpp:15:22:15:25 | nptr | |
39+
| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:15:75:18 | call to atoi | |
40+
| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:25 | call to getenv | |
41+
| test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:45 | (const char *)... | |

‎cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.ql‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
import semmle.code.cpp.ir.dataflow.DefaultTaintTracking
2+
3+
from Expr source, Element tainted, string globalVar
4+
where
5+
taintedIncludingGlobalVars(source, tainted, globalVar) and
6+
not tainted.getLocation().getFile().getExtension() = "h"
7+
select source, tainted, globalVar

0 commit comments

Comments
 (0)