Skip to content

Commit 7958822

Browse files
hvitvedhvitved
committed
Rust: Taint flow tests for operations
1 parent 918c553 commit 7958822

File tree

3 files changed

+79
-63
lines changed

3 files changed

+79
-63
lines changed

‎rust/ql/test/library-tests/dataflow/taint/TaintFlowStep.expected‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,22 @@
33
| main.rs:8:20:8:20 | s | main.rs:8:14:8:20 | FormatArgsExpr |
44
| main.rs:13:10:13:10 | a | main.rs:13:10:13:14 | ... + ... |
55
| main.rs:13:14:13:14 | 1 | main.rs:13:10:13:14 | ... + ... |
6-
| main.rs:18:11:18:11 | a | main.rs:18:10:18:11 | - ... |
7-
| main.rs:23:13:23:13 | a | main.rs:23:13:23:19 | a as u8 |
8-
| main.rs:24:10:24:10 | b | main.rs:24:10:24:17 | b as i64 |
9-
| main.rs:24:10:24:17 | [post] b as i64 | main.rs:24:10:24:10 | [post] b |
10-
| main.rs:29:23:29:23 | i | main.rs:29:17:29:23 | FormatArgsExpr |
11-
| main.rs:33:24:33:24 | s | main.rs:33:18:33:24 | FormatArgsExpr |
12-
| main.rs:38:23:38:23 | [post] s [borrowed] | main.rs:38:23:38:23 | [post] s |
13-
| main.rs:38:23:38:23 | s | main.rs:38:23:38:29 | s[...] |
14-
| main.rs:38:23:38:29 | s[...] [pre-dereferenced] | main.rs:38:23:38:29 | s[...] |
15-
| main.rs:49:24:49:24 | i | main.rs:49:18:49:24 | FormatArgsExpr |
16-
| main.rs:54:14:54:16 | [post] arr [borrowed] | main.rs:54:14:54:16 | [post] arr |
17-
| main.rs:54:14:54:19 | arr[1] [pre-dereferenced] | main.rs:54:14:54:19 | arr[1] |
18-
| main.rs:64:24:64:24 | [post] s [borrowed] | main.rs:64:24:64:24 | [post] s |
19-
| main.rs:64:24:64:27 | s[1] | main.rs:64:18:64:27 | FormatArgsExpr |
20-
| main.rs:64:24:64:27 | s[1] [pre-dereferenced] | main.rs:64:24:64:27 | s[1] |
21-
| main.rs:69:9:69:12 | [post] arr2 [borrowed] | main.rs:69:9:69:12 | [post] arr2 |
22-
| main.rs:69:9:69:15 | arr2[1] [pre-dereferenced] | main.rs:69:9:69:15 | arr2[1] |
6+
| main.rs:16:5:16:5 | [post] b [borrowed] | main.rs:16:5:16:5 | [post] b |
7+
| main.rs:20:5:20:5 | [post] c [borrowed] | main.rs:20:5:20:5 | [post] c |
8+
| main.rs:26:11:26:11 | a | main.rs:26:10:26:11 | - ... |
9+
| main.rs:31:13:31:13 | a | main.rs:31:13:31:19 | a as u8 |
10+
| main.rs:32:10:32:10 | b | main.rs:32:10:32:17 | b as i64 |
11+
| main.rs:32:10:32:17 | [post] b as i64 | main.rs:32:10:32:10 | [post] b |
12+
| main.rs:37:23:37:23 | i | main.rs:37:17:37:23 | FormatArgsExpr |
13+
| main.rs:41:24:41:24 | s | main.rs:41:18:41:24 | FormatArgsExpr |
14+
| main.rs:46:23:46:23 | [post] s [borrowed] | main.rs:46:23:46:23 | [post] s |
15+
| main.rs:46:23:46:23 | s | main.rs:46:23:46:29 | s[...] |
16+
| main.rs:46:23:46:29 | s[...] [pre-dereferenced] | main.rs:46:23:46:29 | s[...] |
17+
| main.rs:57:24:57:24 | i | main.rs:57:18:57:24 | FormatArgsExpr |
18+
| main.rs:62:14:62:16 | [post] arr [borrowed] | main.rs:62:14:62:16 | [post] arr |
19+
| main.rs:62:14:62:19 | arr[1] [pre-dereferenced] | main.rs:62:14:62:19 | arr[1] |
20+
| main.rs:72:24:72:24 | [post] s [borrowed] | main.rs:72:24:72:24 | [post] s |
21+
| main.rs:72:24:72:27 | s[1] | main.rs:72:18:72:27 | FormatArgsExpr |
22+
| main.rs:72:24:72:27 | s[1] [pre-dereferenced] | main.rs:72:24:72:27 | s[1] |
23+
| main.rs:77:9:77:12 | [post] arr2 [borrowed] | main.rs:77:9:77:12 | [post] arr2 |
24+
| main.rs:77:9:77:15 | arr2[1] [pre-dereferenced] | main.rs:77:9:77:15 | arr2[1] |

‎rust/ql/test/library-tests/dataflow/taint/inline-taint-flow.expected‎

Lines changed: 52 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -4,57 +4,63 @@ models
44
edges
55
| main.rs:12:9:12:9 | a | main.rs:13:10:13:14 | ... + ... | provenance | |
66
| main.rs:12:13:12:22 | source(...) | main.rs:12:9:12:9 | a | provenance | |
7-
| main.rs:17:9:17:9 | a | main.rs:18:10:18:11 | - ... | provenance | |
8-
| main.rs:17:9:17:9 | a | main.rs:18:11:18:11 | a | provenance | |
9-
| main.rs:17:13:17:22 | source(...) | main.rs:17:9:17:9 | a | provenance | |
10-
| main.rs:18:11:18:11 | a | main.rs:18:10:18:11 | - ... | provenance | MaD:2 |
11-
| main.rs:22:9:22:9 | a | main.rs:23:9:23:9 | b | provenance | |
12-
| main.rs:22:13:22:22 | source(...) | main.rs:22:9:22:9 | a | provenance | |
13-
| main.rs:23:9:23:9 | b | main.rs:24:10:24:17 | b as i64 | provenance | |
14-
| main.rs:37:13:37:13 | s | main.rs:38:23:38:23 | s | provenance | |
15-
| main.rs:37:13:37:13 | s | main.rs:38:23:38:29 | s[...] | provenance | |
16-
| main.rs:37:17:37:26 | source(...) | main.rs:37:13:37:13 | s | provenance | |
17-
| main.rs:38:13:38:18 | sliced [&ref] | main.rs:39:14:39:19 | sliced | provenance | |
18-
| main.rs:38:22:38:29 | &... [&ref] | main.rs:38:13:38:18 | sliced [&ref] | provenance | |
19-
| main.rs:38:23:38:23 | s | main.rs:38:23:38:29 | s[...] | provenance | MaD:1 |
20-
| main.rs:38:23:38:29 | s[...] | main.rs:38:22:38:29 | &... [&ref] | provenance | |
21-
| main.rs:53:13:53:15 | arr | main.rs:54:14:54:16 | arr | provenance | |
22-
| main.rs:53:19:53:28 | source(...) | main.rs:53:13:53:15 | arr | provenance | |
23-
| main.rs:54:14:54:16 | arr | main.rs:54:14:54:19 | arr[1] | provenance | MaD:1 |
24-
| main.rs:69:9:69:12 | [post] arr2 [element] | main.rs:70:14:70:17 | arr2 | provenance | |
25-
| main.rs:69:19:69:28 | source(...) | main.rs:69:9:69:12 | [post] arr2 [element] | provenance | |
7+
| main.rs:15:9:15:13 | mut b | main.rs:17:10:17:10 | b | provenance | |
8+
| main.rs:15:17:15:26 | source(...) | main.rs:15:9:15:13 | mut b | provenance | |
9+
| main.rs:25:9:25:9 | a | main.rs:26:10:26:11 | - ... | provenance | |
10+
| main.rs:25:9:25:9 | a | main.rs:26:11:26:11 | a | provenance | |
11+
| main.rs:25:13:25:22 | source(...) | main.rs:25:9:25:9 | a | provenance | |
12+
| main.rs:26:11:26:11 | a | main.rs:26:10:26:11 | - ... | provenance | MaD:2 |
13+
| main.rs:30:9:30:9 | a | main.rs:31:9:31:9 | b | provenance | |
14+
| main.rs:30:13:30:22 | source(...) | main.rs:30:9:30:9 | a | provenance | |
15+
| main.rs:31:9:31:9 | b | main.rs:32:10:32:17 | b as i64 | provenance | |
16+
| main.rs:45:13:45:13 | s | main.rs:46:23:46:23 | s | provenance | |
17+
| main.rs:45:13:45:13 | s | main.rs:46:23:46:29 | s[...] | provenance | |
18+
| main.rs:45:17:45:26 | source(...) | main.rs:45:13:45:13 | s | provenance | |
19+
| main.rs:46:13:46:18 | sliced [&ref] | main.rs:47:14:47:19 | sliced | provenance | |
20+
| main.rs:46:22:46:29 | &... [&ref] | main.rs:46:13:46:18 | sliced [&ref] | provenance | |
21+
| main.rs:46:23:46:23 | s | main.rs:46:23:46:29 | s[...] | provenance | MaD:1 |
22+
| main.rs:46:23:46:29 | s[...] | main.rs:46:22:46:29 | &... [&ref] | provenance | |
23+
| main.rs:61:13:61:15 | arr | main.rs:62:14:62:16 | arr | provenance | |
24+
| main.rs:61:19:61:28 | source(...) | main.rs:61:13:61:15 | arr | provenance | |
25+
| main.rs:62:14:62:16 | arr | main.rs:62:14:62:19 | arr[1] | provenance | MaD:1 |
26+
| main.rs:77:9:77:12 | [post] arr2 [element] | main.rs:78:14:78:17 | arr2 | provenance | |
27+
| main.rs:77:19:77:28 | source(...) | main.rs:77:9:77:12 | [post] arr2 [element] | provenance | |
2628
nodes
2729
| main.rs:12:9:12:9 | a | semmle.label | a |
2830
| main.rs:12:13:12:22 | source(...) | semmle.label | source(...) |
2931
| main.rs:13:10:13:14 | ... + ... | semmle.label | ... + ... |
30-
| main.rs:17:9:17:9 | a | semmle.label | a |
31-
| main.rs:17:13:17:22 | source(...) | semmle.label | source(...) |
32-
| main.rs:18:10:18:11 | - ... | semmle.label | - ... |
33-
| main.rs:18:11:18:11 | a | semmle.label | a |
34-
| main.rs:22:9:22:9 | a | semmle.label | a |
35-
| main.rs:22:13:22:22 | source(...) | semmle.label | source(...) |
36-
| main.rs:23:9:23:9 | b | semmle.label | b |
37-
| main.rs:24:10:24:17 | b as i64 | semmle.label | b as i64 |
38-
| main.rs:37:13:37:13 | s | semmle.label | s |
39-
| main.rs:37:17:37:26 | source(...) | semmle.label | source(...) |
40-
| main.rs:38:13:38:18 | sliced [&ref] | semmle.label | sliced [&ref] |
41-
| main.rs:38:22:38:29 | &... [&ref] | semmle.label | &... [&ref] |
42-
| main.rs:38:23:38:23 | s | semmle.label | s |
43-
| main.rs:38:23:38:29 | s[...] | semmle.label | s[...] |
44-
| main.rs:39:14:39:19 | sliced | semmle.label | sliced |
45-
| main.rs:53:13:53:15 | arr | semmle.label | arr |
46-
| main.rs:53:19:53:28 | source(...) | semmle.label | source(...) |
47-
| main.rs:54:14:54:16 | arr | semmle.label | arr |
48-
| main.rs:54:14:54:19 | arr[1] | semmle.label | arr[1] |
49-
| main.rs:69:9:69:12 | [post] arr2 [element] | semmle.label | [post] arr2 [element] |
50-
| main.rs:69:19:69:28 | source(...) | semmle.label | source(...) |
51-
| main.rs:70:14:70:17 | arr2 | semmle.label | arr2 |
32+
| main.rs:15:9:15:13 | mut b | semmle.label | mut b |
33+
| main.rs:15:17:15:26 | source(...) | semmle.label | source(...) |
34+
| main.rs:17:10:17:10 | b | semmle.label | b |
35+
| main.rs:25:9:25:9 | a | semmle.label | a |
36+
| main.rs:25:13:25:22 | source(...) | semmle.label | source(...) |
37+
| main.rs:26:10:26:11 | - ... | semmle.label | - ... |
38+
| main.rs:26:11:26:11 | a | semmle.label | a |
39+
| main.rs:30:9:30:9 | a | semmle.label | a |
40+
| main.rs:30:13:30:22 | source(...) | semmle.label | source(...) |
41+
| main.rs:31:9:31:9 | b | semmle.label | b |
42+
| main.rs:32:10:32:17 | b as i64 | semmle.label | b as i64 |
43+
| main.rs:45:13:45:13 | s | semmle.label | s |
44+
| main.rs:45:17:45:26 | source(...) | semmle.label | source(...) |
45+
| main.rs:46:13:46:18 | sliced [&ref] | semmle.label | sliced [&ref] |
46+
| main.rs:46:22:46:29 | &... [&ref] | semmle.label | &... [&ref] |
47+
| main.rs:46:23:46:23 | s | semmle.label | s |
48+
| main.rs:46:23:46:29 | s[...] | semmle.label | s[...] |
49+
| main.rs:47:14:47:19 | sliced | semmle.label | sliced |
50+
| main.rs:61:13:61:15 | arr | semmle.label | arr |
51+
| main.rs:61:19:61:28 | source(...) | semmle.label | source(...) |
52+
| main.rs:62:14:62:16 | arr | semmle.label | arr |
53+
| main.rs:62:14:62:19 | arr[1] | semmle.label | arr[1] |
54+
| main.rs:77:9:77:12 | [post] arr2 [element] | semmle.label | [post] arr2 [element] |
55+
| main.rs:77:19:77:28 | source(...) | semmle.label | source(...) |
56+
| main.rs:78:14:78:17 | arr2 | semmle.label | arr2 |
5257
subpaths
5358
testFailures
5459
#select
5560
| main.rs:13:10:13:14 | ... + ... | main.rs:12:13:12:22 | source(...) | main.rs:13:10:13:14 | ... + ... | $@ | main.rs:12:13:12:22 | source(...) | source(...) |
56-
| main.rs:18:10:18:11 | - ... | main.rs:17:13:17:22 | source(...) | main.rs:18:10:18:11 | - ... | $@ | main.rs:17:13:17:22 | source(...) | source(...) |
57-
| main.rs:24:10:24:17 | b as i64 | main.rs:22:13:22:22 | source(...) | main.rs:24:10:24:17 | b as i64 | $@ | main.rs:22:13:22:22 | source(...) | source(...) |
58-
| main.rs:39:14:39:19 | sliced | main.rs:37:17:37:26 | source(...) | main.rs:39:14:39:19 | sliced | $@ | main.rs:37:17:37:26 | source(...) | source(...) |
59-
| main.rs:54:14:54:19 | arr[1] | main.rs:53:19:53:28 | source(...) | main.rs:54:14:54:19 | arr[1] | $@ | main.rs:53:19:53:28 | source(...) | source(...) |
60-
| main.rs:70:14:70:17 | arr2 | main.rs:69:19:69:28 | source(...) | main.rs:70:14:70:17 | arr2 | $@ | main.rs:69:19:69:28 | source(...) | source(...) |
61+
| main.rs:17:10:17:10 | b | main.rs:15:17:15:26 | source(...) | main.rs:17:10:17:10 | b | $@ | main.rs:15:17:15:26 | source(...) | source(...) |
62+
| main.rs:26:10:26:11 | - ... | main.rs:25:13:25:22 | source(...) | main.rs:26:10:26:11 | - ... | $@ | main.rs:25:13:25:22 | source(...) | source(...) |
63+
| main.rs:32:10:32:17 | b as i64 | main.rs:30:13:30:22 | source(...) | main.rs:32:10:32:17 | b as i64 | $@ | main.rs:30:13:30:22 | source(...) | source(...) |
64+
| main.rs:47:14:47:19 | sliced | main.rs:45:17:45:26 | source(...) | main.rs:47:14:47:19 | sliced | $@ | main.rs:45:17:45:26 | source(...) | source(...) |
65+
| main.rs:62:14:62:19 | arr[1] | main.rs:61:19:61:28 | source(...) | main.rs:62:14:62:19 | arr[1] | $@ | main.rs:61:19:61:28 | source(...) | source(...) |
66+
| main.rs:78:14:78:17 | arr2 | main.rs:77:19:77:28 | source(...) | main.rs:78:14:78:17 | arr2 | $@ | main.rs:77:19:77:28 | source(...) | source(...) |

‎rust/ql/test/library-tests/dataflow/taint/main.rs‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,14 @@ fn sink(s: i64) {
1111
fn addition() {
1212
let a = source(42);
1313
sink(a + 1); // $ hasTaintFlow=42
14+
15+
let mut b = source(58);
16+
b += 2;
17+
sink(b); // $ MISSING: hasTaintFlow=58 $ SPURIOUS: hasValueFlow=58
18+
19+
let mut c = 0;
20+
c += source(99);
21+
sink(c); // $ MISSING: hasTaintFlow=99
1422
}
1523

1624
fn negation() {

0 commit comments

Comments
 (0)