Skip to content

Commit 11b039c

Browse files
erik-krogherik-krogh
committed
add tests
1 parent 31c09ba commit 11b039c

File tree

4 files changed

+192
-0
lines changed

4 files changed

+192
-0
lines changed

‎javascript/ql/test/library-tests/TaintTracking/BasicTaintTracking.expected

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,14 @@
11
typeInferenceMismatch
2+
| call-apply.js:25:14:25:21 | source() | call-apply.js:1:1:3:1 | the arguments object of function foo1 |
3+
| call-apply.js:25:14:25:21 | source() | call-apply.js:5:1:7:1 | the arguments object of function foo2 |
4+
| call-apply.js:25:14:25:21 | source() | call-apply.js:10:10:10:30 | reflective call |
5+
| call-apply.js:25:14:25:21 | source() | call-apply.js:14:10:14:40 | reflective call |
6+
| call-apply.js:25:14:25:21 | source() | call-apply.js:21:1:23:1 | the arguments object of function foo1_sink |
7+
| call-apply.js:25:14:25:21 | source() | call-apply.js:27:6:27:32 | reflective call |
8+
| call-apply.js:25:14:25:21 | source() | call-apply.js:30:6:30:35 | reflective call |
9+
| call-apply.js:25:14:25:21 | source() | call-apply.js:62:3:64:3 | the arguments object of function sinkArguments1 |
10+
| call-apply.js:25:14:25:21 | source() | call-apply.js:65:3:67:3 | the arguments object of function sinkArguments0 |
11+
| call-apply.js:25:14:25:21 | source() | call-apply.js:69:3:72:3 | the arguments object of function fowardArguments |
212
| destruct.js:20:7:20:14 | source() | destruct.js:13:14:13:19 | [a, b] |
313
#select
414
| access-path-sanitizer.js:2:18:2:25 | source() | access-path-sanitizer.js:4:8:4:12 | obj.x |
@@ -12,6 +22,19 @@ typeInferenceMismatch
1222
| array-mutation.js:31:33:31:40 | source() | array-mutation.js:32:8:32:8 | h |
1323
| array-mutation.js:35:36:35:43 | source() | array-mutation.js:36:8:36:8 | i |
1424
| array-mutation.js:39:17:39:24 | source() | array-mutation.js:40:8:40:8 | j |
25+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:17:8:17:13 | arr[1] |
26+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:22:8:22:13 | arr[6] |
27+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:27:8:27:13 | arr[0] |
28+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:28:8:28:13 | arr[1] |
29+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:33:8:33:13 | arr[0] |
30+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:34:8:34:13 | arr[1] |
31+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:35:8:35:13 | arr[2] |
32+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:36:8:36:13 | arr[3] |
33+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:37:8:37:13 | arr[4] |
34+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:38:8:38:13 | arr[5] |
35+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:43:10:43:15 | arr[i] |
36+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:55:10:55:15 | arr[i] |
37+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:61:10:61:13 | item |
1538
| arrays.js:2:15:2:22 | source() | arrays.js:5:10:5:20 | arrify(foo) |
1639
| arrays.js:2:15:2:22 | source() | arrays.js:8:10:8:22 | arrayIfy(foo) |
1740
| arrays.js:2:15:2:22 | source() | arrays.js:11:10:11:28 | union(["bla"], foo) |
@@ -28,6 +51,14 @@ typeInferenceMismatch
2851
| bound-function.js:45:10:45:17 | source() | bound-function.js:45:6:45:18 | id3(source()) |
2952
| bound-function.js:49:12:49:19 | source() | bound-function.js:54:6:54:14 | source0() |
3053
| bound-function.js:49:12:49:19 | source() | bound-function.js:55:6:55:14 | source1() |
54+
| call-apply.js:25:14:25:21 | source() | call-apply.js:22:8:22:11 | arg1 |
55+
| call-apply.js:25:14:25:21 | source() | call-apply.js:27:6:27:32 | foo1.ca ... ce, "") |
56+
| call-apply.js:25:14:25:21 | source() | call-apply.js:30:6:30:35 | foo1.ap ... e, ""]) |
57+
| call-apply.js:25:14:25:21 | source() | call-apply.js:44:6:44:28 | foo1_ca ... e, ""]) |
58+
| call-apply.js:25:14:25:21 | source() | call-apply.js:45:6:45:28 | foo1_ca ... ource]) |
59+
| call-apply.js:25:14:25:21 | source() | call-apply.js:63:10:63:21 | arguments[1] |
60+
| call-apply.js:25:14:25:21 | source() | call-apply.js:66:10:66:21 | arguments[0] |
61+
| call-apply.js:85:17:85:24 | source() | call-apply.js:82:8:82:11 | this |
3162
| callbacks.js:4:6:4:13 | source() | callbacks.js:34:27:34:27 | x |
3263
| callbacks.js:4:6:4:13 | source() | callbacks.js:35:27:35:27 | x |
3364
| callbacks.js:5:6:5:13 | source() | callbacks.js:34:27:34:27 | x |

‎javascript/ql/test/library-tests/TaintTracking/DataFlowTracking.expected

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
| access-path-sanitizer.js:2:18:2:25 | source() | access-path-sanitizer.js:4:8:4:12 | obj.x |
22
| advanced-callgraph.js:2:13:2:20 | source() | advanced-callgraph.js:6:22:6:22 | v |
3+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:17:8:17:13 | arr[1] |
4+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:22:8:22:13 | arr[6] |
5+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:28:8:28:13 | arr[1] |
6+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:34:8:34:13 | arr[1] |
7+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:43:10:43:15 | arr[i] |
8+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:55:10:55:15 | arr[i] |
9+
| arrays-init.js:2:16:2:23 | source() | arrays-init.js:61:10:61:13 | item |
310
| booleanOps.js:2:11:2:18 | source() | booleanOps.js:4:8:4:8 | x |
411
| booleanOps.js:2:11:2:18 | source() | booleanOps.js:7:10:7:10 | x |
512
| booleanOps.js:2:11:2:18 | source() | booleanOps.js:10:10:10:10 | x |
@@ -12,6 +19,12 @@
1219
| bound-function.js:45:10:45:17 | source() | bound-function.js:45:6:45:18 | id3(source()) |
1320
| bound-function.js:49:12:49:19 | source() | bound-function.js:54:6:54:14 | source0() |
1421
| bound-function.js:49:12:49:19 | source() | bound-function.js:55:6:55:14 | source1() |
22+
| call-apply.js:25:14:25:21 | source() | call-apply.js:22:8:22:11 | arg1 |
23+
| call-apply.js:25:14:25:21 | source() | call-apply.js:27:6:27:32 | foo1.ca ... ce, "") |
24+
| call-apply.js:25:14:25:21 | source() | call-apply.js:30:6:30:35 | foo1.ap ... e, ""]) |
25+
| call-apply.js:25:14:25:21 | source() | call-apply.js:44:6:44:28 | foo1_ca ... e, ""]) |
26+
| call-apply.js:25:14:25:21 | source() | call-apply.js:66:10:66:21 | arguments[0] |
27+
| call-apply.js:85:17:85:24 | source() | call-apply.js:82:8:82:11 | this |
1528
| callbacks.js:4:6:4:13 | source() | callbacks.js:34:27:34:27 | x |
1629
| callbacks.js:4:6:4:13 | source() | callbacks.js:35:27:35:27 | x |
1730
| callbacks.js:5:6:5:13 | source() | callbacks.js:34:27:34:27 | x |

‎javascript/ql/test/library-tests/TaintTracking/arrays-init.js

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
(function () {
2+
let source = source();
3+
4+
var str = "FALSE";
5+
6+
console.log("=== access by index (init by ctor) ===");
7+
var arr = new Array(2);
8+
arr[0] = str;
9+
arr[1] = source;
10+
arr[2] = 'b';
11+
arr[3] = 'c';
12+
arr[4] = 'd';
13+
arr[5] = 'e';
14+
arr[6] = source;
15+
16+
sink(arr[0]); // OK
17+
sink(arr[1]); // NOT OK
18+
sink(arr[2]); // OK
19+
sink(arr[3]); // OK
20+
sink(arr[4]); // OK
21+
sink(arr[5]); // OK
22+
sink(arr[6]); // NOT OK
23+
sink(str); // OK
24+
25+
console.log("=== access by index (init by [...]) ===");
26+
var arr = [str, source];
27+
sink(arr[0]); // OK
28+
sink(arr[1]); // NOT OK
29+
sink(str); // OK
30+
31+
console.log("=== access by index (init by [...], array.lenght > 5) ===");
32+
var arr = [str, source, 'b', 'c', 'd', source];
33+
sink(arr[0]); // OK
34+
sink(arr[1]); // NOT OK
35+
sink(arr[2]); // OK
36+
sink(arr[3]); // OK
37+
sink(arr[4]); // OK
38+
sink(arr[5]); // NOT OK - but not flagged [INCONSISTENCY]
39+
40+
console.log("=== access in for (init by [...]) ===");
41+
var arr = [str, source];
42+
for (let i = 0; i < arr.length; i++) {
43+
sink(arr[i]); // NOT OK
44+
}
45+
46+
console.log("=== access in for (init by [...]) w/o source ===");
47+
var arr = [str, 'a'];
48+
for (let i = 0; i < arr.length; i++) {
49+
sink(arr[i]); // OK
50+
}
51+
52+
console.log("=== access in for (init by [...], array.lenght > 5) ===");
53+
var arr = [str, 'a', 'b', 'c', 'd', source];
54+
for (let i = 0; i < arr.length; i++) {
55+
sink(arr[i]); // NOT OK
56+
}
57+
58+
console.log("=== access in forof (init by [...]) ===");
59+
var arr = [str, source];
60+
for (const item of arr) {
61+
sink(item); // NOT OK
62+
}
63+
}());

‎javascript/ql/test/library-tests/TaintTracking/call-apply.js

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
function foo1(arg1, arg2) {
2+
return arg1;
3+
}
4+
5+
function foo2(arg1, arg2) {
6+
return arg2;
7+
}
8+
9+
function foo1_apply(arr) {
10+
return foo1.apply(this, arr);
11+
}
12+
13+
function foo1_call(arr) {
14+
return foo1.call(this, arr[0], arr[1]);
15+
}
16+
17+
function foo1_apply_sink(arr) {
18+
foo1_sink.apply(this, arr);
19+
}
20+
21+
function foo1_sink(arg1, arg2) {
22+
sink(arg1); // NOT OK
23+
}
24+
25+
var source = source();
26+
27+
sink(foo1.call(null, source, "")); // NOT OK
28+
sink(foo2.call(null, source, "")); // OK
29+
30+
sink(foo1.apply(null, [source, ""])); // NOT OK
31+
sink(foo2.apply(null, [source, ""])); // OK
32+
33+
// doesn't work due to fundamental limitations of our dataflow analysis.
34+
// exactly (and I mean exactly) the same thing happens in the below `obj.foo` example.
35+
// in general we don't track flow that first goes through a call, and then a return, unless we can summarize it.
36+
// in the other examples we can summarize the flow, because it's quite simple, but here we can't.
37+
// (try to read the QLDoc in the top of `Configuration.qll`, that might help).
38+
sink(foo1_apply([source, ""])); // NOT OK - but not flagged [INCONSISTENCY]
39+
40+
foo1_apply_sink([source, ""]); // This works, because we don't need a return after a call (the sink is inside the called function).
41+
42+
sink(foo1_apply.apply(["", source])); // OK
43+
44+
sink(foo1_call([source, ""])); // NOT OK
45+
sink(foo1_call(["", source])); // OK
46+
47+
48+
var obj = {
49+
foo: source(),
50+
bar: "safe"
51+
};
52+
53+
function foo(x) {
54+
return bar(x);
55+
}
56+
function bar(x) {
57+
return x.foo;
58+
}
59+
sink(foo(obj)); // NOT OK - but not flagged [INCONSISTENCY]
60+
61+
function argumentsObject() {
62+
function sinkArguments1() {
63+
sink(arguments[1]); // OK
64+
}
65+
function sinkArguments0() {
66+
sink(arguments[0]); // NOT OK
67+
}
68+
69+
function fowardArguments() {
70+
sinkArguments1.apply(this, arguments);
71+
sinkArguments0.apply(this, arguments);
72+
}
73+
74+
fowardArguments.apply(this, [source, ""]);
75+
}
76+
77+
function sinksThis() {
78+
sinksThis2.apply(this, arguments);
79+
}
80+
81+
function sinksThis2() {
82+
sink(this); // NOT OK
83+
}
84+
85+
sinksThis.apply(source(), []);

0 commit comments

Comments
 (0)