Merge pull request #9420 from RasmusWL/sync-go-inline

Go: Sync InlineExpectationsTest
This commit is contained in:
Rasmus Wriedt Larsen 2022-06-03 11:37:13 +02:00 коммит произвёл GitHub
Родитель aa78ce3c75 0b486ade9b
Коммит 07c22a857f
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
39 изменённых файлов: 185 добавлений и 117 удалений

Просмотреть файл

@ -390,7 +390,8 @@
"java/ql/test/TestUtilities/InlineExpectationsTest.qll",
"python/ql/test/TestUtilities/InlineExpectationsTest.qll",
"ruby/ql/test/TestUtilities/InlineExpectationsTest.qll",
"ql/ql/test/TestUtilities/InlineExpectationsTest.qll"
"ql/ql/test/TestUtilities/InlineExpectationsTest.qll",
"go/ql/test/TestUtilities/InlineExpectationsTest.qll"
],
"C++ ExternalAPIs": [
"cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll",

Просмотреть файл

@ -93,7 +93,7 @@
private import InlineExpectationsTestPrivate
/**
* Base class for tests with inline expectations. The test extends this class to provide the actual
* The base class for tests with inline expectations. The test extends this class to provide the actual
* results of the query, which are then compared with the expected results in comments to produce a
* list of failure messages that point out where the actual results differ from the expected
* results.
@ -121,11 +121,17 @@ abstract class InlineExpectationsTest extends string {
* - `value` - The value of the result, which will be matched against the value associated with
* `tag` in any expected result comment on that line.
*/
abstract predicate hasActualResult(string file, int line, string element, string tag, string value);
abstract predicate hasActualResult(Location location, string element, string tag, string value);
predicate hasActualResult(Location location, string element, string tag, string value) {
this.hasActualResult(location.getFile().getAbsolutePath(), location.getStartLine(), element,
tag, value)
/**
* Holds if there is an optional result on the specified location.
*
* This is similar to `hasActualResult`, but returns results that do not require a matching annotation.
* A failure will still arise if there is an annotation that does not match any results, but not vice versa.
* Override this predicate to specify optional results.
*/
predicate hasOptionalResult(Location location, string element, string tag, string value) {
none()
}
final predicate hasFailureMessage(FailureLocatable element, string message) {
@ -139,13 +145,14 @@ abstract class InlineExpectationsTest extends string {
)
or
not exists(ValidExpectation expectation | expectation.matchesActualResult(actualResult)) and
message = "Unexpected result: " + actualResult.getExpectationText()
message = "Unexpected result: " + actualResult.getExpectationText() and
not actualResult.isOptional()
)
)
or
exists(ValidExpectation expectation |
not exists(ActualResult actualResult | expectation.matchesActualResult(actualResult)) and
expectation.getTag() = this.getARelevantTag() and
expectation.getTag() = getARelevantTag() and
element = expectation and
(
expectation instanceof GoodExpectation and
@ -174,7 +181,7 @@ private string expectationCommentPattern() { result = "\\s*\\$((?:[^/]|/[^/])*)(
/**
* The possible columns in an expectation comment. The `TDefaultColumn` branch represents the first
* column in a comment. This column is not precedeeded by a name. `TNamedColumn(name)` represents a
* column containing expected results preceeded by the string `name:`.
* column containing expected results preceded by the string `name:`.
*/
private newtype TColumn =
TDefaultColumn() or
@ -248,9 +255,13 @@ private string expectationPattern() {
private newtype TFailureLocatable =
TActualResult(
InlineExpectationsTest test, Location location, string element, string tag, string value
InlineExpectationsTest test, Location location, string element, string tag, string value,
boolean optional
) {
test.hasActualResult(location, element, tag, value)
test.hasActualResult(location, element, tag, value) and
optional = false
or
test.hasOptionalResult(location, element, tag, value) and optional = true
} or
TValidExpectation(ExpectationComment comment, string tag, string value, string knownFailure) {
exists(TColumn column, string tags |
@ -269,7 +280,7 @@ class FailureLocatable extends TFailureLocatable {
Location getLocation() { none() }
final string getExpectationText() { result = this.getTag() + "=" + this.getValue() }
final string getExpectationText() { result = getTag() + "=" + getValue() }
string getTag() { none() }
@ -282,8 +293,9 @@ class ActualResult extends FailureLocatable, TActualResult {
string element;
string tag;
string value;
boolean optional;
ActualResult() { this = TActualResult(test, location, element, tag, value) }
ActualResult() { this = TActualResult(test, location, element, tag, value, optional) }
override string toString() { result = element }
@ -294,6 +306,8 @@ class ActualResult extends FailureLocatable, TActualResult {
override string getTag() { result = tag }
override string getValue() { result = value }
predicate isOptional() { optional = true }
}
abstract private class Expectation extends FailureLocatable {
@ -318,24 +332,24 @@ private class ValidExpectation extends Expectation, TValidExpectation {
string getKnownFailure() { result = knownFailure }
predicate matchesActualResult(ActualResult actualResult) {
this.getLocation().getStartLine() = actualResult.getLocation().getStartLine() and
this.getLocation().getFile() = actualResult.getLocation().getFile() and
this.getTag() = actualResult.getTag() and
this.getValue() = actualResult.getValue()
getLocation().getStartLine() = actualResult.getLocation().getStartLine() and
getLocation().getFile() = actualResult.getLocation().getFile() and
getTag() = actualResult.getTag() and
getValue() = actualResult.getValue()
}
}
/* Note: These next three classes correspond to all the possible values of type `TColumn`. */
class GoodExpectation extends ValidExpectation {
GoodExpectation() { this.getKnownFailure() = "" }
GoodExpectation() { getKnownFailure() = "" }
}
class FalsePositiveExpectation extends ValidExpectation {
FalsePositiveExpectation() { this.getKnownFailure() = "SPURIOUS" }
FalsePositiveExpectation() { getKnownFailure() = "SPURIOUS" }
}
class FalseNegativeExpectation extends ValidExpectation {
FalseNegativeExpectation() { this.getKnownFailure() = "MISSING" }
FalseNegativeExpectation() { getKnownFailure() = "MISSING" }
}
class InvalidExpectation extends Expectation, TInvalidExpectation {

Просмотреть файл

@ -76,10 +76,11 @@ class InlineFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = ["hasValueFlow", "hasTaintFlow"] }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "hasValueFlow" and
exists(DataFlow::Node src, DataFlow::Node sink | getValueFlowConfig().hasFlow(src, sink) |
sink.hasLocationInfo(file, line, _, _, _) and
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = sink.toString() and
value = "\"" + sink.toString() + "\""
)
@ -88,7 +89,8 @@ class InlineFlowTest extends InlineExpectationsTest {
exists(DataFlow::Node src, DataFlow::Node sink |
getTaintFlowConfig().hasFlow(src, sink) and not getValueFlowConfig().hasFlow(src, sink)
|
sink.hasLocationInfo(file, line, _, _, _) and
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = sink.toString() and
value = "\"" + sink.toString() + "\""
)

Просмотреть файл

@ -9,10 +9,11 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
result = ["headerKeyNode", "headerValNode", "headerKey", "headerVal"]
}
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
// Dynamic key-value header:
exists(HTTP::HeaderWrite hw |
hw.hasLocationInfo(file, line, _, _, _) and
hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
(
element = hw.getName().toString() and
value = hw.getName().toString() and
@ -26,7 +27,8 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
or
// Static key, dynamic value header:
exists(HTTP::HeaderWrite hw |
hw.hasLocationInfo(file, line, _, _, _) and
hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
(
element = hw.getHeaderName().toString() and
value = hw.getHeaderName() and
@ -40,7 +42,8 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
or
// Static key, static value header:
exists(HTTP::HeaderWrite hw |
hw.hasLocationInfo(file, line, _, _, _) and
hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
(
element = hw.getHeaderName().toString() and
value = hw.getHeaderName() and

Просмотреть файл

@ -7,10 +7,11 @@ class HttpRedirectTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "redirectUrl" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "redirectUrl" and
exists(HTTP::Redirect rd |
rd.hasLocationInfo(file, line, _, _, _) and
rd.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = rd.getUrl().toString() and
value = rd.getUrl().toString()
)

Просмотреть файл

@ -7,9 +7,10 @@ class HttpResponseBodyTest extends InlineExpectationsTest {
override string getARelevantTag() { result = ["contentType", "responseBody"] }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(HTTP::ResponseBody rd |
rd.hasLocationInfo(file, line, _, _, _) and
rd.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
(
element = rd.getAContentType().toString() and
value = rd.getAContentType().toString() and

Просмотреть файл

@ -19,12 +19,13 @@ class TaintTrackingTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "taintSink" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "taintSink" and
exists(DataFlow::Node sink | any(Configuration c).hasFlow(_, sink) |
element = sink.toString() and
value = "" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -7,7 +7,7 @@ class UntrustedFlowSourceTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "untrustedFlowSource" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "untrustedFlowSource" and
exists(DataFlow::CallNode sinkCall, DataFlow::ArgumentNode arg |
sinkCall.getCalleeName() = "sink" and
@ -16,7 +16,8 @@ class UntrustedFlowSourceTest extends InlineExpectationsTest {
|
element = arg.toString() and
value = "" and
arg.hasLocationInfo(file, line, _, _, _)
arg.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -9,10 +9,11 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
result = ["headerKeyNode", "headerValNode", "headerKey", "headerVal"]
}
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
// Dynamic key-value header:
exists(HTTP::HeaderWrite hw |
hw.hasLocationInfo(file, line, _, _, _) and
hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
(
element = hw.getName().toString() and
value = hw.getName().toString() and
@ -26,7 +27,8 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
or
// Static key, dynamic value header:
exists(HTTP::HeaderWrite hw |
hw.hasLocationInfo(file, line, _, _, _) and
hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
(
element = hw.getHeaderName().toString() and
value = hw.getHeaderName() and
@ -40,7 +42,8 @@ class HttpHeaderWriteTest extends InlineExpectationsTest {
or
// Static key, static value header:
exists(HTTP::HeaderWrite hw |
hw.hasLocationInfo(file, line, _, _, _) and
hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
(
element = hw.getHeaderName().toString() and
value = hw.getHeaderName() and

Просмотреть файл

@ -7,10 +7,11 @@ class HttpRedirectTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "redirectUrl" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "redirectUrl" and
exists(HTTP::Redirect rd |
rd.hasLocationInfo(file, line, _, _, _) and
rd.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = rd.getUrl().toString() and
value = rd.getUrl().toString()
)

Просмотреть файл

@ -7,9 +7,10 @@ class HttpResponseBodyTest extends InlineExpectationsTest {
override string getARelevantTag() { result = ["contentType", "responseBody"] }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(HTTP::ResponseBody rd |
rd.hasLocationInfo(file, line, _, _, _) and
rd.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
(
element = rd.getAContentType().toString() and
value = rd.getAContentType().toString() and

Просмотреть файл

@ -19,12 +19,13 @@ class TaintTrackingTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "taintSink" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "taintSink" and
exists(DataFlow::Node sink | any(Configuration c).hasFlow(_, sink) |
element = sink.toString() and
value = "" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -7,7 +7,7 @@ class UntrustedFlowSourceTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "untrustedFlowSource" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "untrustedFlowSource" and
exists(DataFlow::CallNode sinkCall, DataFlow::ArgumentNode arg |
sinkCall.getCalleeName() = "sink" and
@ -16,7 +16,8 @@ class UntrustedFlowSourceTest extends InlineExpectationsTest {
|
element = arg.toString() and
value = "" and
arg.hasLocationInfo(file, line, _, _, _)
arg.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -6,10 +6,11 @@ class FunctionIsVariadicTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "isVariadic" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(CallExpr ce |
ce.getTarget().isVariadic() and
ce.hasLocationInfo(file, line, _, _, _) and
ce.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = ce.toString() and
value = "" and
tag = "isVariadic"

Просмотреть файл

@ -6,14 +6,15 @@ class ImplementsComparableTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "implementsComparable" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
// file = "interface.go" and
tag = "implementsComparable" and
exists(TypeSpec ts |
ts.getName().matches("testComparable%") and
ts.getATypeParameterDecl().getTypeConstraint().implementsComparable()
|
ts.hasLocationInfo(file, line, _, _, _) and
ts.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = ts.getName() and
value = ""
)

Просмотреть файл

@ -6,10 +6,11 @@ class SignatureTypeIsVariadicTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "isVariadic" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(FuncDef fd |
fd.isVariadic() and
fd.hasLocationInfo(file, line, _, _, _) and
fd.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = fd.toString() and
value = "" and
tag = "isVariadic"

Просмотреть файл

@ -6,12 +6,13 @@ class HttpHandler extends InlineExpectationsTest {
override string getARelevantTag() { result = "handler" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "handler" and
exists(HTTP::RequestHandler h, DataFlow::Node check |
element = h.toString() and value = check.toString()
|
h.hasLocationInfo(file, line, _, _, _) and
h.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
h.guardedBy(check)
)
}

Просмотреть файл

@ -6,9 +6,10 @@ class LoggerTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "logger" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(LoggerCall log |
log.hasLocationInfo(file, line, _, _, _) and
log.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = log.toString() and
value = log.getAMessageComponent().toString() and
tag = "logger"

Просмотреть файл

@ -34,12 +34,13 @@ class DataFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "dataflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "dataflow" and
exists(DataFlow::Node sink | any(DataConfiguration c).hasFlow(_, sink) |
element = sink.toString() and
value = "" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}
@ -61,12 +62,13 @@ class TaintFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "taintflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "taintflow" and
exists(DataFlow::Node sink | any(TaintConfiguration c).hasFlow(_, sink) |
element = sink.toString() and
value = "" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -28,12 +28,13 @@ class DataFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "dataflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "dataflow" and
exists(DataFlow::Node sink | any(TestConfig c).hasFlow(_, sink) |
element = sink.toString() and
value = sink.toString() and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -18,12 +18,13 @@ class DataFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "dataflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "dataflow" and
exists(DataFlow::Node sink | any(TestConfig c).hasFlow(_, sink) |
element = sink.toString() and
value = sink.toString() and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -26,10 +26,11 @@ class PromotedFieldsTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "promotedfields" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(TestConfig config, DataFlow::PathNode source, DataFlow::PathNode sink |
config.hasFlowPath(source, sink) and
sink.hasLocationInfo(file, line, _, _, _) and
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = sink.toString() and
value = "" and
tag = "promotedfields"

Просмотреть файл

@ -26,11 +26,12 @@ class PromotedMethodsTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "promotedmethods" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(TestConfig config, DataFlow::Node source, DataFlow::Node sink |
config.hasFlow(source, sink)
|
sink.hasLocationInfo(file, line, _, _, _) and
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = sink.toString() and
value = source.getEnclosingCallable().getName() and
tag = "promotedmethods"

Просмотреть файл

@ -18,12 +18,13 @@ class DataFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "dataflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "dataflow" and
exists(DataFlow::Node sink | any(Configuration c).hasFlow(_, sink) |
element = sink.toString() and
value = sink.toString() and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -18,12 +18,13 @@ class DataFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "dataflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "dataflow" and
exists(DataFlow::Node sink | any(DataConfiguration c).hasFlow(_, sink) |
element = sink.toString() and
value = "" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}
@ -45,12 +46,13 @@ class TaintFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "taintflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "taintflow" and
exists(DataFlow::Node sink | any(TaintConfiguration c).hasFlow(_, sink) |
element = sink.toString() and
value = "" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -50,12 +50,13 @@ class DataFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "dataflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "dataflow" and
exists(DataFlow::Node sink | any(DataConfiguration c).hasFlow(_, sink) |
element = sink.toString() and
value = "" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}
@ -79,12 +80,13 @@ class TaintFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "taintflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "taintflow" and
exists(DataFlow::Node sink | any(TaintConfiguration c).hasFlow(_, sink) |
element = sink.toString() and
value = "" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -7,12 +7,13 @@ class SqlInjectionTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "sqlinjection" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "sqlinjection" and
exists(DataFlow::Node sink | any(SqlInjection::Configuration c).hasFlow(_, sink) |
element = sink.toString() and
value = sink.toString() and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -6,11 +6,12 @@ class UntrustedFlowSourceTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "untrustedflowsource" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "untrustedflowsource" and
value = element and
exists(UntrustedFlowSource src | value = "\"" + src.toString() + "\"" |
src.hasLocationInfo(file, line, _, _, _)
src.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}
@ -20,12 +21,13 @@ class HeaderWriteTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "headerwrite" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "headerwrite" and
exists(HTTP::HeaderWrite hw, string name, string val | element = hw.toString() |
hw.definesHeader(name, val) and
value = name + ":" + val and
hw.hasLocationInfo(file, line, _, _, _)
hw.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}
@ -35,9 +37,10 @@ class LoggerTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "logger" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(LoggerCall log |
log.hasLocationInfo(file, line, _, _, _) and
log.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = log.toString() and
value = log.getAMessageComponent().toString() and
tag = "logger"

Просмотреть файл

@ -21,12 +21,13 @@ class TaintFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "taintflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "taintflow" and
exists(DataFlow::Node sink | any(Configuration c).hasFlow(_, sink) |
element = sink.toString() and
value = "" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}

Просмотреть файл

@ -7,9 +7,11 @@ class UntrustedFlowSourceTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "source" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(UntrustedFlowSource source |
source.hasLocationInfo(file, line, _, _, _) and
source
.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = source.toString() and
value = "\"" + source.toString() + "\"" and
tag = "source"

Просмотреть файл

@ -26,10 +26,11 @@ class K8sIoApiCoreV1Test extends InlineExpectationsTest {
override string getARelevantTag() { result = "KsIoApiCoreV" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(TestConfig config, DataFlow::PathNode source, DataFlow::PathNode sink |
config.hasFlowPath(source, sink) and
sink.hasLocationInfo(file, line, _, _, _) and
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = sink.toString() and
value = "" and
tag = "KsIoApiCoreV"

Просмотреть файл

@ -26,10 +26,11 @@ class K8sIoApimachineryPkgRuntimeTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "KsIoApimachineryPkgRuntime" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(TestConfig config, DataFlow::PathNode source, DataFlow::PathNode sink |
config.hasFlowPath(source, sink) and
sink.hasLocationInfo(file, line, _, _, _) and
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = sink.toString() and
value = "" and
tag = "KsIoApimachineryPkgRuntime"

Просмотреть файл

@ -6,9 +6,11 @@ class K8sIoApimachineryPkgRuntimeTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "KsIoClientGo" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(K8sIoClientGo::SecretInterfaceSource source |
source.hasLocationInfo(file, line, _, _, _) and
source
.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = source.toString() and
value = "" and
tag = "KsIoClientGo"

Просмотреть файл

@ -6,9 +6,10 @@ class NoSQLQueryTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "nosqlquery" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(NoSQL::Query q |
q.hasLocationInfo(file, line, _, _, _) and
q.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = q.toString() and
value = q.toString() and
tag = "nosqlquery"

Просмотреть файл

@ -20,12 +20,13 @@ class MissingDataFlowTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "noflow" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "noflow" and
value = "" and
exists(Sink sink |
not any(TestConfig c).hasFlow(_, sink) and
sink.hasLocationInfo(file, line, _, _, _) and
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = sink.toString()
)
}
@ -36,10 +37,11 @@ class HttpResponseBodyTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "responsebody" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "responsebody" and
exists(HTTP::ResponseBody rb |
rb.hasLocationInfo(file, line, _, _, _) and
rb.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = rb.toString() and
value = "'" + rb.toString() + "'"
)

Просмотреть файл

@ -6,10 +6,11 @@ class SQLTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "query" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "query" and
exists(SQL::Query q, SQL::QueryString qs, string qsFile, int qsLine | qs = q.getAQueryString() |
q.hasLocationInfo(file, line, _, _, _) and
q.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
qs.hasLocationInfo(qsFile, qsLine, _, _, _) and
element = q.toString() and
value = qs.toString()
@ -22,11 +23,12 @@ class QueryString extends InlineExpectationsTest {
override string getARelevantTag() { result = "querystring" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "querystring" and
element = "" and
exists(SQL::QueryString qs | not exists(SQL::Query q | qs = q.getAQueryString()) |
qs.hasLocationInfo(file, line, _, _, _) and
qs.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
value = qs.toString()
)
}

Просмотреть файл

@ -6,9 +6,10 @@ class FileSystemAccessTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "fsaccess" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
exists(FileSystemAccess f |
f.hasLocationInfo(file, line, _, _, _) and
f.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = f.toString() and
value = f.getAPathArgument().toString() and
tag = "fsaccess"

Просмотреть файл

@ -6,10 +6,11 @@ class TaintFunctionModelTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "ttfnmodelstep" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "ttfnmodelstep" and
exists(TaintTracking::FunctionModel model, DataFlow::CallNode call | call = model.getACall() |
call.hasLocationInfo(file, line, _, _, _) and
call.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = call.toString() and
value = "\"" + model.getAnInputNode(call) + " -> " + model.getAnOutputNode(call) + "\""
)
@ -21,10 +22,11 @@ class MarshalerTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "marshaler" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "marshaler" and
exists(MarshalingFunction m, DataFlow::CallNode call | call = m.getACall() |
call.hasLocationInfo(file, line, _, _, _) and
call.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = call.toString() and
value =
"\"" + m.getFormat() + ": " + m.getAnInput().getNode(call) + " -> " +
@ -38,10 +40,11 @@ class UnmarshalerTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "unmarshaler" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "unmarshaler" and
exists(UnmarshalingFunction m, DataFlow::CallNode call | call = m.getACall() |
call.hasLocationInfo(file, line, _, _, _) and
call.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
element = call.toString() and
value =
"\"" + m.getFormat() + ": " + m.getAnInput().getNode(call) + " -> " +

Просмотреть файл

@ -18,12 +18,13 @@ class ZapTest extends InlineExpectationsTest {
override string getARelevantTag() { result = "zap" }
override predicate hasActualResult(string file, int line, string element, string tag, string value) {
override predicate hasActualResult(Location location, string element, string tag, string value) {
tag = "zap" and
exists(DataFlow::Node sink | any(TestConfig c).hasFlow(_, sink) |
element = sink.toString() and
value = "\"" + sink.toString() + "\"" and
sink.hasLocationInfo(file, line, _, _, _)
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
location.getStartColumn(), location.getEndLine(), location.getEndColumn())
)
}
}