Skip to content

Commit 19c7360

Browse files
calumgrantcalumgrant
authored
Merge pull request github#1301 from hvitved/csharp/more-dataflow-tests
C#: Add more data flow tests
2 parents ceda0d5 + dfdfae8 commit 19c7360

File tree

9 files changed

+4640
-0
lines changed

9 files changed

+4640
-0
lines changed

‎csharp/ql/test/library-tests/dataflow/global/DataFlow.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,7 @@
3838
| Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
3939
| Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x |
4040
| Splitting.cs:11:19:11:19 | access to local variable x |
41+
| Splitting.cs:21:28:21:32 | access to parameter value |
42+
| Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x |
43+
| Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x |
44+
| Splitting.cs:34:19:34:19 | access to local variable x |

‎csharp/ql/test/library-tests/dataflow/global/DataFlowEdges.expected

Lines changed: 1683 additions & 0 deletions
Large diffs are not rendered by default.

‎csharp/ql/test/library-tests/dataflow/global/DataFlowEdges.ql

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import csharp
2+
import DataFlow
3+
4+
class ConfigAny extends Configuration {
5+
ConfigAny() { this = "ConfigAny" }
6+
7+
override predicate isSource(Node source) { any() }
8+
9+
override predicate isSink(Node sink) { any() }
10+
}
11+
12+
query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }

‎csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,23 @@ edges
189189
| Splitting.cs:8:24:8:30 | [b (line 3): false] access to parameter tainted | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return |
190190
| Splitting.cs:8:24:8:30 | [b (line 3): true] access to parameter tainted | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return |
191191
| Splitting.cs:8:24:8:30 | [b (line 3): true] access to parameter tainted | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return |
192+
| Splitting.cs:21:9:21:11 | value | Splitting.cs:21:28:21:32 | access to parameter value |
193+
| Splitting.cs:24:28:24:34 | tainted | Splitting.cs:30:17:30:23 | [b (line 24): false] access to parameter tainted |
194+
| Splitting.cs:24:28:24:34 | tainted | Splitting.cs:30:17:30:23 | [b (line 24): true] access to parameter tainted |
195+
| Splitting.cs:24:28:24:34 | tainted | Splitting.cs:31:19:31:25 | [b (line 24): false] access to parameter tainted |
196+
| Splitting.cs:24:28:24:34 | tainted | Splitting.cs:31:19:31:25 | [b (line 24): true] access to parameter tainted |
197+
| Splitting.cs:30:17:30:23 | [b (line 24): false] access to parameter tainted | Splitting.cs:21:9:21:11 | value |
198+
| Splitting.cs:30:17:30:23 | [b (line 24): true] access to parameter tainted | Splitting.cs:21:9:21:11 | value |
199+
| Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element | Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x |
200+
| Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element | Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x |
201+
| Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element | Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x |
202+
| Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element | Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x |
203+
| Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element | Splitting.cs:34:19:34:19 | access to local variable x |
204+
| Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element | Splitting.cs:34:19:34:19 | access to local variable x |
205+
| Splitting.cs:31:19:31:25 | [b (line 24): false] access to parameter tainted | Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element |
206+
| Splitting.cs:31:19:31:25 | [b (line 24): false] access to parameter tainted | Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element |
207+
| Splitting.cs:31:19:31:25 | [b (line 24): true] access to parameter tainted | Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element |
208+
| Splitting.cs:31:19:31:25 | [b (line 24): true] access to parameter tainted | Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element |
192209
nodes
193210
| Capture.cs:7:20:7:26 | tainted |
194211
| Capture.cs:9:9:13:9 | SSA capture def(tainted) |
@@ -337,7 +354,28 @@ nodes
337354
| Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x |
338355
| Splitting.cs:11:19:11:19 | access to local variable x |
339356
| Splitting.cs:11:19:11:19 | access to local variable x |
357+
| Splitting.cs:21:9:21:11 | value |
358+
| Splitting.cs:21:28:21:32 | access to parameter value |
359+
| Splitting.cs:24:28:24:34 | tainted |
360+
| Splitting.cs:30:17:30:23 | [b (line 24): false] access to parameter tainted |
361+
| Splitting.cs:30:17:30:23 | [b (line 24): true] access to parameter tainted |
362+
| Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element |
363+
| Splitting.cs:31:17:31:26 | [b (line 24): false] dynamic access to element |
364+
| Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element |
365+
| Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element |
366+
| Splitting.cs:31:19:31:25 | [b (line 24): false] access to parameter tainted |
367+
| Splitting.cs:31:19:31:25 | [b (line 24): true] access to parameter tainted |
368+
| Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x |
369+
| Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x |
370+
| Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x |
371+
| Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x |
372+
| Splitting.cs:34:19:34:19 | access to local variable x |
373+
| Splitting.cs:34:19:34:19 | access to local variable x |
340374
#select
375+
| Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x | Splitting.cs:24:28:24:34 | tainted | Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x | [b (line 24): false] access to local variable x |
376+
| Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x | Splitting.cs:24:28:24:34 | tainted | Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x | [b (line 24): false] access to local variable x |
377+
| Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | Splitting.cs:24:28:24:34 | tainted | Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | [b (line 24): true] access to local variable x |
378+
| Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | Splitting.cs:24:28:24:34 | tainted | Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | [b (line 24): true] access to local variable x |
341379
| Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | Splitting.cs:3:28:3:34 | tainted | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | [b (line 3): false] access to local variable x |
342380
| Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | Splitting.cs:3:28:3:34 | tainted | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | [b (line 3): false] access to local variable x |
343381
| Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | Splitting.cs:3:28:3:34 | tainted | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | [b (line 3): true] access to local variable x |
@@ -372,6 +410,8 @@ nodes
372410
| GlobalDataFlow.cs:177:15:177:19 | access to local variable sink9 | GlobalDataFlow.cs:175:35:175:48 | "taint source" | GlobalDataFlow.cs:177:15:177:19 | access to local variable sink9 | access to local variable sink9 |
373411
| Splitting.cs:11:19:11:19 | access to local variable x | Splitting.cs:3:28:3:34 | tainted | Splitting.cs:11:19:11:19 | access to local variable x | access to local variable x |
374412
| Splitting.cs:11:19:11:19 | access to local variable x | Splitting.cs:3:28:3:34 | tainted | Splitting.cs:11:19:11:19 | access to local variable x | access to local variable x |
413+
| Splitting.cs:34:19:34:19 | access to local variable x | Splitting.cs:24:28:24:34 | tainted | Splitting.cs:34:19:34:19 | access to local variable x | access to local variable x |
414+
| Splitting.cs:34:19:34:19 | access to local variable x | Splitting.cs:24:28:24:34 | tainted | Splitting.cs:34:19:34:19 | access to local variable x | access to local variable x |
375415
| GlobalDataFlow.cs:233:15:233:24 | access to parameter sinkParam0 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:233:15:233:24 | access to parameter sinkParam0 | access to parameter sinkParam0 |
376416
| GlobalDataFlow.cs:233:15:233:24 | access to parameter sinkParam0 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:233:15:233:24 | access to parameter sinkParam0 | access to parameter sinkParam0 |
377417
| GlobalDataFlow.cs:238:15:238:24 | access to parameter sinkParam1 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:238:15:238:24 | access to parameter sinkParam1 | access to parameter sinkParam1 |
@@ -381,4 +421,5 @@ nodes
381421
| GlobalDataFlow.cs:253:15:253:24 | access to parameter sinkParam5 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:253:15:253:24 | access to parameter sinkParam5 | access to parameter sinkParam5 |
382422
| GlobalDataFlow.cs:258:15:258:24 | access to parameter sinkParam6 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:258:15:258:24 | access to parameter sinkParam6 | access to parameter sinkParam6 |
383423
| GlobalDataFlow.cs:263:15:263:24 | access to parameter sinkParam7 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:263:15:263:24 | access to parameter sinkParam7 | access to parameter sinkParam7 |
424+
| Splitting.cs:21:28:21:32 | access to parameter value | Splitting.cs:24:28:24:34 | tainted | Splitting.cs:21:28:21:32 | access to parameter value | access to parameter value |
384425
| GlobalDataFlow.cs:26:15:26:32 | access to property SinkProperty0 | GlobalDataFlow.cs:17:27:17:40 | "taint source" | GlobalDataFlow.cs:26:15:26:32 | access to property SinkProperty0 | access to property SinkProperty0 |

‎csharp/ql/test/library-tests/dataflow/global/Splitting.cs

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,23 @@ void M1(bool b, string tainted)
1414
static void Check<T>(T x) { }
1515

1616
static T Return<T>(T x) => x;
17+
18+
string this[string s]
19+
{
20+
get { return Return(s); }
21+
set { Check(Return(value)); }
22+
}
23+
24+
void M2(bool b, string tainted)
25+
{
26+
if (b)
27+
if (tainted == null)
28+
return;
29+
dynamic d = this;
30+
d[""] = tainted;
31+
var x = d[tainted];
32+
Check(x);
33+
if (b)
34+
Check(x);
35+
}
1736
}

‎csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,3 +54,7 @@
5454
| Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
5555
| Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x |
5656
| Splitting.cs:11:19:11:19 | access to local variable x |
57+
| Splitting.cs:21:28:21:32 | access to parameter value |
58+
| Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x |
59+
| Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x |
60+
| Splitting.cs:34:19:34:19 | access to local variable x |

0 commit comments

Comments
 (0)