Skip to content

Commit 594e8ac

Browse files
hvitvedhvitved
committed
Rust: Taint flow tests for operations
1 parent c95a2ea commit 594e8ac

File tree

3 files changed

+93
-71
lines changed

3 files changed

+93
-71
lines changed

‎rust/ql/test/library-tests/dataflow/taint/TaintFlowStep.expected‎

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,24 @@
11
| main.rs:4:5:4:8 | 1000 | main.rs:4:5:4:12 | ... + ... |
22
| main.rs:4:12:4:12 | i | main.rs:4:5:4:12 | ... + ... |
33
| main.rs:8:20:8:20 | s | main.rs:8:14:8:20 | FormatArgsExpr |
4-
| main.rs:13:10:13:10 | a | main.rs:13:10:13:14 | ... + ... |
5-
| main.rs:13:14:13:14 | 1 | main.rs:13:10:13:14 | ... + ... |
6-
| main.rs:18:11:18:11 | a | main.rs:18:10:18:11 | - ... |
7-
| main.rs:23:13:23:13 | a | main.rs:23:13:23:19 | a as u8 |
8-
| main.rs:24:10:24:10 | b | main.rs:24:10:24:17 | b as i64 |
9-
| main.rs:24:10:24:17 | [post] b as i64 | main.rs:24:10:24:10 | [post] b |
10-
| main.rs:29:23:29:23 | i | main.rs:29:17:29:23 | FormatArgsExpr |
11-
| main.rs:33:24:33:24 | s | main.rs:33:18:33:24 | FormatArgsExpr |
12-
| main.rs:38:23:38:23 | [post] s [borrowed] | main.rs:38:23:38:23 | [post] s |
13-
| main.rs:38:23:38:23 | s | main.rs:38:23:38:29 | s[...] |
14-
| main.rs:38:23:38:29 | s[...] [pre-dereferenced] | main.rs:38:23:38:29 | s[...] |
15-
| main.rs:49:24:49:24 | i | main.rs:49:18:49:24 | FormatArgsExpr |
16-
| main.rs:54:14:54:16 | [post] arr [borrowed] | main.rs:54:14:54:16 | [post] arr |
17-
| main.rs:54:14:54:19 | arr[1] [pre-dereferenced] | main.rs:54:14:54:19 | arr[1] |
18-
| main.rs:64:24:64:24 | [post] s [borrowed] | main.rs:64:24:64:24 | [post] s |
19-
| main.rs:64:24:64:27 | s[1] | main.rs:64:18:64:27 | FormatArgsExpr |
20-
| main.rs:64:24:64:27 | s[1] [pre-dereferenced] | main.rs:64:24:64:27 | s[1] |
21-
| main.rs:69:9:69:12 | [post] arr2 [borrowed] | main.rs:69:9:69:12 | [post] arr2 |
22-
| main.rs:69:9:69:15 | arr2[1] [pre-dereferenced] | main.rs:69:9:69:15 | arr2[1] |
4+
| main.rs:13:10:13:10 | a | main.rs:13:10:13:17 | ... + ... |
5+
| main.rs:13:14:13:17 | 1i64 | main.rs:13:10:13:17 | ... + ... |
6+
| main.rs:16:5:16:5 | [post] b [borrowed] | main.rs:16:5:16:5 | [post] b |
7+
| main.rs:20:5:20:5 | [post] c [borrowed] | main.rs:20:5:20:5 | [post] c |
8+
| main.rs:26:11:26:11 | a | main.rs:26:10:26:11 | - ... |
9+
| main.rs:31:13:31:13 | a | main.rs:31:13:31:19 | a as u8 |
10+
| main.rs:32:10:32:10 | b | main.rs:32:10:32:17 | b as i64 |
11+
| main.rs:32:10:32:17 | [post] b as i64 | main.rs:32:10:32:10 | [post] b |
12+
| main.rs:37:23:37:23 | i | main.rs:37:17:37:23 | FormatArgsExpr |
13+
| main.rs:41:24:41:24 | s | main.rs:41:18:41:24 | FormatArgsExpr |
14+
| main.rs:46:23:46:23 | [post] s [borrowed] | main.rs:46:23:46:23 | [post] s |
15+
| main.rs:46:23:46:23 | s | main.rs:46:23:46:29 | s[...] |
16+
| main.rs:46:23:46:29 | s[...] [pre-dereferenced] | main.rs:46:23:46:29 | s[...] |
17+
| main.rs:57:24:57:24 | i | main.rs:57:18:57:24 | FormatArgsExpr |
18+
| main.rs:62:14:62:16 | [post] arr [borrowed] | main.rs:62:14:62:16 | [post] arr |
19+
| main.rs:62:14:62:19 | arr[1] [pre-dereferenced] | main.rs:62:14:62:19 | arr[1] |
20+
| main.rs:72:24:72:24 | [post] s [borrowed] | main.rs:72:24:72:24 | [post] s |
21+
| main.rs:72:24:72:27 | s[1] | main.rs:72:18:72:27 | FormatArgsExpr |
22+
| main.rs:72:24:72:27 | s[1] [pre-dereferenced] | main.rs:72:24:72:27 | s[1] |
23+
| main.rs:77:9:77:12 | [post] arr2 [borrowed] | main.rs:77:9:77:12 | [post] arr2 |
24+
| main.rs:77:9:77:15 | arr2[1] [pre-dereferenced] | main.rs:77:9:77:15 | arr2[1] |

‎rust/ql/test/library-tests/dataflow/taint/inline-taint-flow.expected‎

Lines changed: 63 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,72 @@
11
models
2-
| 1 | Summary: <_ as core::ops::index::Index>::index; Argument[self].Reference.Element; ReturnValue.Reference; value |
3-
| 2 | Summary: <core::i64 as core::ops::arith::Neg>::neg; Argument[self]; ReturnValue; taint |
2+
| 1 | Summary: <_ as core::ops::arith::Add>::add; Argument[self]; ReturnValue; taint |
3+
| 2 | Summary: <_ as core::ops::index::Index>::index; Argument[self].Reference.Element; ReturnValue.Reference; value |
4+
| 3 | Summary: <core::i64 as core::ops::arith::Add>::add; Argument[self]; ReturnValue; taint |
5+
| 4 | Summary: <core::i64 as core::ops::arith::Neg>::neg; Argument[self]; ReturnValue; taint |
46
edges
5-
| main.rs:12:9:12:9 | a | main.rs:13:10:13:14 | ... + ... | provenance | |
7+
| main.rs:12:9:12:9 | a | main.rs:13:10:13:10 | a | provenance | |
8+
| main.rs:12:9:12:9 | a | main.rs:13:10:13:17 | ... + ... | provenance | |
69
| main.rs:12:13:12:22 | source(...) | main.rs:12:9:12:9 | a | provenance | |
7-
| main.rs:17:9:17:9 | a | main.rs:18:10:18:11 | - ... | provenance | |
8-
| main.rs:17:9:17:9 | a | main.rs:18:11:18:11 | a | provenance | |
9-
| main.rs:17:13:17:22 | source(...) | main.rs:17:9:17:9 | a | provenance | |
10-
| main.rs:18:11:18:11 | a | main.rs:18:10:18:11 | - ... | provenance | MaD:2 |
11-
| main.rs:22:9:22:9 | a | main.rs:23:9:23:9 | b | provenance | |
12-
| main.rs:22:13:22:22 | source(...) | main.rs:22:9:22:9 | a | provenance | |
13-
| main.rs:23:9:23:9 | b | main.rs:24:10:24:17 | b as i64 | provenance | |
14-
| main.rs:37:13:37:13 | s | main.rs:38:23:38:23 | s | provenance | |
15-
| main.rs:37:13:37:13 | s | main.rs:38:23:38:29 | s[...] | provenance | |
16-
| main.rs:37:17:37:26 | source(...) | main.rs:37:13:37:13 | s | provenance | |
17-
| main.rs:38:13:38:18 | sliced [&ref] | main.rs:39:14:39:19 | sliced | provenance | |
18-
| main.rs:38:22:38:29 | &... [&ref] | main.rs:38:13:38:18 | sliced [&ref] | provenance | |
19-
| main.rs:38:23:38:23 | s | main.rs:38:23:38:29 | s[...] | provenance | MaD:1 |
20-
| main.rs:38:23:38:29 | s[...] | main.rs:38:22:38:29 | &... [&ref] | provenance | |
21-
| main.rs:53:13:53:15 | arr | main.rs:54:14:54:16 | arr | provenance | |
22-
| main.rs:53:19:53:28 | source(...) | main.rs:53:13:53:15 | arr | provenance | |
23-
| main.rs:54:14:54:16 | arr | main.rs:54:14:54:19 | arr[1] | provenance | MaD:1 |
24-
| main.rs:69:9:69:12 | [post] arr2 [element] | main.rs:70:14:70:17 | arr2 | provenance | |
25-
| main.rs:69:19:69:28 | source(...) | main.rs:69:9:69:12 | [post] arr2 [element] | provenance | |
10+
| main.rs:13:10:13:10 | a | main.rs:13:10:13:17 | ... + ... | provenance | MaD:1 |
11+
| main.rs:13:10:13:10 | a | main.rs:13:10:13:17 | ... + ... | provenance | MaD:3 |
12+
| main.rs:15:9:15:13 | mut b | main.rs:17:10:17:10 | b | provenance | |
13+
| main.rs:15:17:15:26 | source(...) | main.rs:15:9:15:13 | mut b | provenance | |
14+
| main.rs:25:9:25:9 | a | main.rs:26:10:26:11 | - ... | provenance | |
15+
| main.rs:25:9:25:9 | a | main.rs:26:11:26:11 | a | provenance | |
16+
| main.rs:25:13:25:22 | source(...) | main.rs:25:9:25:9 | a | provenance | |
17+
| main.rs:26:11:26:11 | a | main.rs:26:10:26:11 | - ... | provenance | MaD:4 |
18+
| main.rs:30:9:30:9 | a | main.rs:31:9:31:9 | b | provenance | |
19+
| main.rs:30:13:30:22 | source(...) | main.rs:30:9:30:9 | a | provenance | |
20+
| main.rs:31:9:31:9 | b | main.rs:32:10:32:17 | b as i64 | provenance | |
21+
| main.rs:45:13:45:13 | s | main.rs:46:23:46:23 | s | provenance | |
22+
| main.rs:45:13:45:13 | s | main.rs:46:23:46:29 | s[...] | provenance | |
23+
| main.rs:45:17:45:26 | source(...) | main.rs:45:13:45:13 | s | provenance | |
24+
| main.rs:46:13:46:18 | sliced [&ref] | main.rs:47:14:47:19 | sliced | provenance | |
25+
| main.rs:46:22:46:29 | &... [&ref] | main.rs:46:13:46:18 | sliced [&ref] | provenance | |
26+
| main.rs:46:23:46:23 | s | main.rs:46:23:46:29 | s[...] | provenance | MaD:2 |
27+
| main.rs:46:23:46:29 | s[...] | main.rs:46:22:46:29 | &... [&ref] | provenance | |
28+
| main.rs:61:13:61:15 | arr | main.rs:62:14:62:16 | arr | provenance | |
29+
| main.rs:61:19:61:28 | source(...) | main.rs:61:13:61:15 | arr | provenance | |
30+
| main.rs:62:14:62:16 | arr | main.rs:62:14:62:19 | arr[1] | provenance | MaD:2 |
31+
| main.rs:77:9:77:12 | [post] arr2 [element] | main.rs:78:14:78:17 | arr2 | provenance | |
32+
| main.rs:77:19:77:28 | source(...) | main.rs:77:9:77:12 | [post] arr2 [element] | provenance | |
2633
nodes
2734
| main.rs:12:9:12:9 | a | semmle.label | a |
2835
| main.rs:12:13:12:22 | source(...) | semmle.label | source(...) |
29-
| main.rs:13:10:13:14 | ... + ... | semmle.label | ... + ... |
30-
| main.rs:17:9:17:9 | a | semmle.label | a |
31-
| main.rs:17:13:17:22 | source(...) | semmle.label | source(...) |
32-
| main.rs:18:10:18:11 | - ... | semmle.label | - ... |
33-
| main.rs:18:11:18:11 | a | semmle.label | a |
34-
| main.rs:22:9:22:9 | a | semmle.label | a |
35-
| main.rs:22:13:22:22 | source(...) | semmle.label | source(...) |
36-
| main.rs:23:9:23:9 | b | semmle.label | b |
37-
| main.rs:24:10:24:17 | b as i64 | semmle.label | b as i64 |
38-
| main.rs:37:13:37:13 | s | semmle.label | s |
39-
| main.rs:37:17:37:26 | source(...) | semmle.label | source(...) |
40-
| main.rs:38:13:38:18 | sliced [&ref] | semmle.label | sliced [&ref] |
41-
| main.rs:38:22:38:29 | &... [&ref] | semmle.label | &... [&ref] |
42-
| main.rs:38:23:38:23 | s | semmle.label | s |
43-
| main.rs:38:23:38:29 | s[...] | semmle.label | s[...] |
44-
| main.rs:39:14:39:19 | sliced | semmle.label | sliced |
45-
| main.rs:53:13:53:15 | arr | semmle.label | arr |
46-
| main.rs:53:19:53:28 | source(...) | semmle.label | source(...) |
47-
| main.rs:54:14:54:16 | arr | semmle.label | arr |
48-
| main.rs:54:14:54:19 | arr[1] | semmle.label | arr[1] |
49-
| main.rs:69:9:69:12 | [post] arr2 [element] | semmle.label | [post] arr2 [element] |
50-
| main.rs:69:19:69:28 | source(...) | semmle.label | source(...) |
51-
| main.rs:70:14:70:17 | arr2 | semmle.label | arr2 |
36+
| main.rs:13:10:13:10 | a | semmle.label | a |
37+
| main.rs:13:10:13:17 | ... + ... | semmle.label | ... + ... |
38+
| main.rs:15:9:15:13 | mut b | semmle.label | mut b |
39+
| main.rs:15:17:15:26 | source(...) | semmle.label | source(...) |
40+
| main.rs:17:10:17:10 | b | semmle.label | b |
41+
| main.rs:25:9:25:9 | a | semmle.label | a |
42+
| main.rs:25:13:25:22 | source(...) | semmle.label | source(...) |
43+
| main.rs:26:10:26:11 | - ... | semmle.label | - ... |
44+
| main.rs:26:11:26:11 | a | semmle.label | a |
45+
| main.rs:30:9:30:9 | a | semmle.label | a |
46+
| main.rs:30:13:30:22 | source(...) | semmle.label | source(...) |
47+
| main.rs:31:9:31:9 | b | semmle.label | b |
48+
| main.rs:32:10:32:17 | b as i64 | semmle.label | b as i64 |
49+
| main.rs:45:13:45:13 | s | semmle.label | s |
50+
| main.rs:45:17:45:26 | source(...) | semmle.label | source(...) |
51+
| main.rs:46:13:46:18 | sliced [&ref] | semmle.label | sliced [&ref] |
52+
| main.rs:46:22:46:29 | &... [&ref] | semmle.label | &... [&ref] |
53+
| main.rs:46:23:46:23 | s | semmle.label | s |
54+
| main.rs:46:23:46:29 | s[...] | semmle.label | s[...] |
55+
| main.rs:47:14:47:19 | sliced | semmle.label | sliced |
56+
| main.rs:61:13:61:15 | arr | semmle.label | arr |
57+
| main.rs:61:19:61:28 | source(...) | semmle.label | source(...) |
58+
| main.rs:62:14:62:16 | arr | semmle.label | arr |
59+
| main.rs:62:14:62:19 | arr[1] | semmle.label | arr[1] |
60+
| main.rs:77:9:77:12 | [post] arr2 [element] | semmle.label | [post] arr2 [element] |
61+
| main.rs:77:19:77:28 | source(...) | semmle.label | source(...) |
62+
| main.rs:78:14:78:17 | arr2 | semmle.label | arr2 |
5263
subpaths
5364
testFailures
5465
#select
55-
| main.rs:13:10:13:14 | ... + ... | main.rs:12:13:12:22 | source(...) | main.rs:13:10:13:14 | ... + ... | $@ | main.rs:12:13:12:22 | source(...) | source(...) |
56-
| main.rs:18:10:18:11 | - ... | main.rs:17:13:17:22 | source(...) | main.rs:18:10:18:11 | - ... | $@ | main.rs:17:13:17:22 | source(...) | source(...) |
57-
| main.rs:24:10:24:17 | b as i64 | main.rs:22:13:22:22 | source(...) | main.rs:24:10:24:17 | b as i64 | $@ | main.rs:22:13:22:22 | source(...) | source(...) |
58-
| main.rs:39:14:39:19 | sliced | main.rs:37:17:37:26 | source(...) | main.rs:39:14:39:19 | sliced | $@ | main.rs:37:17:37:26 | source(...) | source(...) |
59-
| main.rs:54:14:54:19 | arr[1] | main.rs:53:19:53:28 | source(...) | main.rs:54:14:54:19 | arr[1] | $@ | main.rs:53:19:53:28 | source(...) | source(...) |
60-
| main.rs:70:14:70:17 | arr2 | main.rs:69:19:69:28 | source(...) | main.rs:70:14:70:17 | arr2 | $@ | main.rs:69:19:69:28 | source(...) | source(...) |
66+
| main.rs:13:10:13:17 | ... + ... | main.rs:12:13:12:22 | source(...) | main.rs:13:10:13:17 | ... + ... | $@ | main.rs:12:13:12:22 | source(...) | source(...) |
67+
| main.rs:17:10:17:10 | b | main.rs:15:17:15:26 | source(...) | main.rs:17:10:17:10 | b | $@ | main.rs:15:17:15:26 | source(...) | source(...) |
68+
| main.rs:26:10:26:11 | - ... | main.rs:25:13:25:22 | source(...) | main.rs:26:10:26:11 | - ... | $@ | main.rs:25:13:25:22 | source(...) | source(...) |
69+
| main.rs:32:10:32:17 | b as i64 | main.rs:30:13:30:22 | source(...) | main.rs:32:10:32:17 | b as i64 | $@ | main.rs:30:13:30:22 | source(...) | source(...) |
70+
| main.rs:47:14:47:19 | sliced | main.rs:45:17:45:26 | source(...) | main.rs:47:14:47:19 | sliced | $@ | main.rs:45:17:45:26 | source(...) | source(...) |
71+
| main.rs:62:14:62:19 | arr[1] | main.rs:61:19:61:28 | source(...) | main.rs:62:14:62:19 | arr[1] | $@ | main.rs:61:19:61:28 | source(...) | source(...) |
72+
| main.rs:78:14:78:17 | arr2 | main.rs:77:19:77:28 | source(...) | main.rs:78:14:78:17 | arr2 | $@ | main.rs:77:19:77:28 | source(...) | source(...) |

‎rust/ql/test/library-tests/dataflow/taint/main.rs‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,15 @@ fn sink(s: i64) {
1010

1111
fn addition() {
1212
let a = source(42);
13-
sink(a + 1); // $ hasTaintFlow=42
13+
sink(a + 1i64); // $ hasTaintFlow=42 -- for now, we cannot resolve `+` when `1i64` is replaced with `1`
14+
15+
let mut b = source(58);
16+
b += 2i64;
17+
sink(b); // $ MISSING: hasTaintFlow=58 $ SPURIOUS: hasValueFlow=58
18+
19+
let mut c = 0i64; // for now, we cannot resolve `+=` when `0i64` is replaced with `0`
20+
c += source(99);
21+
sink(c); // $ MISSING: hasTaintFlow=99
1422
}
1523

1624
fn negation() {

0 commit comments

Comments
 (0)