Skip to content

Commit c196ea2

Browse files
geoffw0geoffw0
committed
C++: Add taint tests of class constructors and assignment.
1 parent ea9e9a7 commit c196ea2

File tree

3 files changed

+212
-0
lines changed

3 files changed

+212
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/copyableclass.cpp

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
2+
int source();
3+
void sink(...) {};
4+
5+
class MyCopyableClass {
6+
public:
7+
MyCopyableClass(int _v = 0) : v(_v) {} // Constructor
8+
MyCopyableClass(const MyCopyableClass &other) : v(other.v) {} // CopyConstructor
9+
MyCopyableClass &operator=(const MyCopyableClass &other) { // CopyAssignmentOperator
10+
v = other.v;
11+
return *this;
12+
}
13+
14+
int v;
15+
};
16+
17+
void test_copyableclass()
18+
{
19+
{
20+
MyCopyableClass s1(1);
21+
MyCopyableClass s2 = 1;
22+
MyCopyableClass s3(s1);
23+
MyCopyableClass s4;
24+
s4 = 1;
25+
26+
sink(s1);
27+
sink(s2);
28+
sink(s3);
29+
sink(s4);
30+
}
31+
32+
{
33+
MyCopyableClass s1(source());
34+
MyCopyableClass s2 = source();
35+
MyCopyableClass s3(s1);
36+
MyCopyableClass s4;
37+
s4 = source();
38+
39+
sink(s1); // tainted [NOT DETECTED]
40+
sink(s2); // tainted [NOT DETECTED]
41+
sink(s3); // tainted [NOT DETECTED]
42+
sink(s4); // tainted [NOT DETECTED]
43+
}
44+
45+
{
46+
MyCopyableClass s1;
47+
MyCopyableClass s2 = s1;
48+
MyCopyableClass s3(s1);
49+
MyCopyableClass s4;
50+
s4 = s1;
51+
52+
sink(s1);
53+
sink(s2);
54+
sink(s3);
55+
sink(s4);
56+
}
57+
58+
{
59+
MyCopyableClass s1 = MyCopyableClass(source());
60+
MyCopyableClass s2;
61+
MyCopyableClass s3;
62+
s2 = MyCopyableClass(source());
63+
64+
sink(s1); // tainted [NOT DETECTED]
65+
sink(s2); // tainted [NOT DETECTED]
66+
sink(s3 = source()); // tainted [NOT DETECTED]
67+
}
68+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,44 @@
1+
| copyableclass.cpp:7:2:7:16 | this | copyableclass.cpp:7:32:7:36 | constructor init of field v [pre-this] | |
2+
| copyableclass.cpp:7:22:7:23 | _v | copyableclass.cpp:7:34:7:35 | _v | |
3+
| copyableclass.cpp:7:34:7:35 | _v | copyableclass.cpp:7:32:7:36 | constructor init of field v | TAINT |
4+
| copyableclass.cpp:8:2:8:16 | this | copyableclass.cpp:8:50:8:59 | constructor init of field v [pre-this] | |
5+
| copyableclass.cpp:8:41:8:45 | other | copyableclass.cpp:8:52:8:56 | other | |
6+
| copyableclass.cpp:8:58:8:58 | v | copyableclass.cpp:8:50:8:59 | constructor init of field v | TAINT |
7+
| copyableclass.cpp:8:58:8:58 | v | copyableclass.cpp:8:58:8:58 | v | |
8+
| copyableclass.cpp:9:19:9:27 | this | copyableclass.cpp:10:3:10:3 | this | |
9+
| copyableclass.cpp:9:52:9:56 | other | copyableclass.cpp:10:7:10:11 | other | |
10+
| copyableclass.cpp:10:3:10:3 | this | copyableclass.cpp:11:11:11:14 | this | |
11+
| copyableclass.cpp:10:3:10:3 | this [post update] | copyableclass.cpp:11:11:11:14 | this | |
12+
| copyableclass.cpp:10:13:10:13 | v | copyableclass.cpp:10:3:10:13 | ... = ... | |
13+
| copyableclass.cpp:11:11:11:14 | this | copyableclass.cpp:11:10:11:14 | * ... | TAINT |
14+
| copyableclass.cpp:20:22:20:23 | call to MyCopyableClass | copyableclass.cpp:22:22:22:23 | s1 | |
15+
| copyableclass.cpp:20:22:20:23 | call to MyCopyableClass | copyableclass.cpp:26:8:26:9 | s1 | |
16+
| copyableclass.cpp:21:23:21:24 | call to MyCopyableClass | copyableclass.cpp:27:8:27:9 | s2 | |
17+
| copyableclass.cpp:22:22:22:24 | call to MyCopyableClass | copyableclass.cpp:28:8:28:9 | s3 | |
18+
| copyableclass.cpp:23:19:23:20 | call to MyCopyableClass | copyableclass.cpp:24:3:24:4 | s4 | |
19+
| copyableclass.cpp:23:19:23:20 | call to MyCopyableClass | copyableclass.cpp:29:8:29:9 | s4 | |
20+
| copyableclass.cpp:24:3:24:4 | ref arg s4 | copyableclass.cpp:29:8:29:9 | s4 | |
21+
| copyableclass.cpp:33:22:33:30 | call to MyCopyableClass | copyableclass.cpp:35:22:35:23 | s1 | |
22+
| copyableclass.cpp:33:22:33:30 | call to MyCopyableClass | copyableclass.cpp:39:8:39:9 | s1 | |
23+
| copyableclass.cpp:34:23:34:31 | call to MyCopyableClass | copyableclass.cpp:40:8:40:9 | s2 | |
24+
| copyableclass.cpp:35:22:35:24 | call to MyCopyableClass | copyableclass.cpp:41:8:41:9 | s3 | |
25+
| copyableclass.cpp:36:19:36:20 | call to MyCopyableClass | copyableclass.cpp:37:3:37:4 | s4 | |
26+
| copyableclass.cpp:36:19:36:20 | call to MyCopyableClass | copyableclass.cpp:42:8:42:9 | s4 | |
27+
| copyableclass.cpp:37:3:37:4 | ref arg s4 | copyableclass.cpp:42:8:42:9 | s4 | |
28+
| copyableclass.cpp:46:19:46:20 | call to MyCopyableClass | copyableclass.cpp:47:24:47:25 | s1 | |
29+
| copyableclass.cpp:46:19:46:20 | call to MyCopyableClass | copyableclass.cpp:48:22:48:23 | s1 | |
30+
| copyableclass.cpp:46:19:46:20 | call to MyCopyableClass | copyableclass.cpp:50:8:50:9 | s1 | |
31+
| copyableclass.cpp:46:19:46:20 | call to MyCopyableClass | copyableclass.cpp:52:8:52:9 | s1 | |
32+
| copyableclass.cpp:47:23:47:25 | call to MyCopyableClass | copyableclass.cpp:53:8:53:9 | s2 | |
33+
| copyableclass.cpp:48:22:48:24 | call to MyCopyableClass | copyableclass.cpp:54:8:54:9 | s3 | |
34+
| copyableclass.cpp:49:19:49:20 | call to MyCopyableClass | copyableclass.cpp:50:3:50:4 | s4 | |
35+
| copyableclass.cpp:49:19:49:20 | call to MyCopyableClass | copyableclass.cpp:55:8:55:9 | s4 | |
36+
| copyableclass.cpp:50:3:50:4 | ref arg s4 | copyableclass.cpp:55:8:55:9 | s4 | |
37+
| copyableclass.cpp:59:23:59:48 | call to MyCopyableClass | copyableclass.cpp:64:8:64:9 | s1 | |
38+
| copyableclass.cpp:60:19:60:20 | call to MyCopyableClass | copyableclass.cpp:62:3:62:4 | s2 | |
39+
| copyableclass.cpp:60:19:60:20 | call to MyCopyableClass | copyableclass.cpp:65:8:65:9 | s2 | |
40+
| copyableclass.cpp:61:19:61:20 | call to MyCopyableClass | copyableclass.cpp:66:8:66:9 | s3 | |
41+
| copyableclass.cpp:62:3:62:4 | ref arg s2 | copyableclass.cpp:65:8:65:9 | s2 | |
142
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
243
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
344
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
@@ -132,6 +173,43 @@
132173
| format.cpp:158:13:158:18 | call to wcslen | format.cpp:158:13:158:26 | ... / ... | TAINT |
133174
| format.cpp:158:13:158:26 | ... / ... | format.cpp:158:7:158:27 | ... + ... | TAINT |
134175
| format.cpp:158:26:158:26 | 2 | format.cpp:158:13:158:26 | ... / ... | TAINT |
176+
| movableclass.cpp:7:2:7:15 | this | movableclass.cpp:7:31:7:35 | constructor init of field v [pre-this] | |
177+
| movableclass.cpp:7:21:7:22 | _v | movableclass.cpp:7:33:7:34 | _v | |
178+
| movableclass.cpp:7:33:7:34 | _v | movableclass.cpp:7:31:7:35 | constructor init of field v | TAINT |
179+
| movableclass.cpp:8:2:8:15 | this | movableclass.cpp:9:3:9:3 | this | |
180+
| movableclass.cpp:8:34:8:38 | other | movableclass.cpp:8:34:8:38 | other | |
181+
| movableclass.cpp:8:34:8:38 | other | movableclass.cpp:9:7:9:11 | other | |
182+
| movableclass.cpp:8:34:8:38 | other | movableclass.cpp:10:3:10:7 | other | |
183+
| movableclass.cpp:9:13:9:13 | v | movableclass.cpp:9:3:9:13 | ... = ... | |
184+
| movableclass.cpp:10:3:10:7 | other [post update] | movableclass.cpp:8:34:8:38 | other | |
185+
| movableclass.cpp:10:13:10:13 | 0 | movableclass.cpp:10:3:10:13 | ... = ... | |
186+
| movableclass.cpp:12:18:12:26 | this | movableclass.cpp:13:3:13:3 | this | |
187+
| movableclass.cpp:12:45:12:49 | other | movableclass.cpp:12:45:12:49 | other | |
188+
| movableclass.cpp:12:45:12:49 | other | movableclass.cpp:13:7:13:11 | other | |
189+
| movableclass.cpp:12:45:12:49 | other | movableclass.cpp:14:3:14:7 | other | |
190+
| movableclass.cpp:13:3:13:3 | this | movableclass.cpp:15:11:15:14 | this | |
191+
| movableclass.cpp:13:3:13:3 | this [post update] | movableclass.cpp:15:11:15:14 | this | |
192+
| movableclass.cpp:13:13:13:13 | v | movableclass.cpp:13:3:13:13 | ... = ... | |
193+
| movableclass.cpp:14:3:14:7 | other [post update] | movableclass.cpp:12:45:12:49 | other | |
194+
| movableclass.cpp:14:13:14:13 | 0 | movableclass.cpp:14:3:14:13 | ... = ... | |
195+
| movableclass.cpp:15:11:15:14 | this | movableclass.cpp:15:10:15:14 | * ... | TAINT |
196+
| movableclass.cpp:27:21:27:22 | call to MyMovableClass | movableclass.cpp:32:8:32:9 | s1 | |
197+
| movableclass.cpp:28:22:28:23 | call to MyMovableClass | movableclass.cpp:33:8:33:9 | s2 | |
198+
| movableclass.cpp:29:18:29:19 | call to MyMovableClass | movableclass.cpp:30:3:30:4 | s3 | |
199+
| movableclass.cpp:29:18:29:19 | call to MyMovableClass | movableclass.cpp:34:8:34:9 | s3 | |
200+
| movableclass.cpp:30:3:30:4 | ref arg s3 | movableclass.cpp:34:8:34:9 | s3 | |
201+
| movableclass.cpp:38:21:38:29 | call to MyMovableClass | movableclass.cpp:43:8:43:9 | s1 | |
202+
| movableclass.cpp:39:22:39:30 | call to MyMovableClass | movableclass.cpp:44:8:44:9 | s2 | |
203+
| movableclass.cpp:40:18:40:19 | call to MyMovableClass | movableclass.cpp:41:3:41:4 | s3 | |
204+
| movableclass.cpp:40:18:40:19 | call to MyMovableClass | movableclass.cpp:45:8:45:9 | s3 | |
205+
| movableclass.cpp:41:3:41:4 | ref arg s3 | movableclass.cpp:45:8:45:9 | s3 | |
206+
| movableclass.cpp:49:22:49:46 | call to MyMovableClass | movableclass.cpp:53:8:53:9 | s1 | |
207+
| movableclass.cpp:50:18:50:19 | call to MyMovableClass | movableclass.cpp:51:3:51:4 | s2 | |
208+
| movableclass.cpp:50:18:50:19 | call to MyMovableClass | movableclass.cpp:54:8:54:9 | s2 | |
209+
| movableclass.cpp:51:3:51:4 | ref arg s2 | movableclass.cpp:54:8:54:9 | s2 | |
210+
| movableclass.cpp:58:21:58:35 | call to MyMovableClass | movableclass.cpp:62:8:62:9 | s1 | |
211+
| movableclass.cpp:59:21:59:33 | call to MyMovableClass | movableclass.cpp:63:8:63:9 | s2 | |
212+
| movableclass.cpp:60:18:60:19 | call to MyMovableClass | movableclass.cpp:64:8:64:9 | s3 | |
135213
| stl.cpp:67:12:67:17 | call to source | stl.cpp:71:7:71:7 | a | |
136214
| stl.cpp:68:16:68:20 | 123 | stl.cpp:68:16:68:21 | call to basic_string | TAINT |
137215
| stl.cpp:68:16:68:21 | call to basic_string | stl.cpp:72:7:72:7 | b | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/movableclass.cpp

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
2+
int source();
3+
void sink(...) {};
4+
5+
class MyMovableClass {
6+
public:
7+
MyMovableClass(int _v = 0) : v(_v) {} // Constructor
8+
MyMovableClass(MyMovableClass &&other) noexcept { // ConversionConstructor, MoveConstructor
9+
v = other.v;
10+
other.v = 0;
11+
}
12+
MyMovableClass &operator=(MyMovableClass &&other) noexcept { // MoveAssignmentOperator
13+
v = other.v;
14+
other.v = 0;
15+
return *this;
16+
}
17+
18+
int v;
19+
};
20+
21+
MyMovableClass &&getUnTainted() { return MyMovableClass(1); }
22+
MyMovableClass &&getTainted() { return MyMovableClass(source()); }
23+
24+
void test_copyableclass()
25+
{
26+
{
27+
MyMovableClass s1(1);
28+
MyMovableClass s2 = 1;
29+
MyMovableClass s3;
30+
s3 = 1;
31+
32+
sink(s1);
33+
sink(s2);
34+
sink(s3);
35+
}
36+
37+
{
38+
MyMovableClass s1(source());
39+
MyMovableClass s2 = source();
40+
MyMovableClass s3;
41+
s3 = source();
42+
43+
sink(s1); // tainted [NOT DETECTED]
44+
sink(s2); // tainted [NOT DETECTED]
45+
sink(s3); // tainted [NOT DETECTED]
46+
}
47+
48+
{
49+
MyMovableClass s1 = MyMovableClass(source());
50+
MyMovableClass s2;
51+
s2 = MyMovableClass(source());
52+
53+
sink(s1); // tainted [NOT DETECTED]
54+
sink(s2); // tainted [NOT DETECTED]
55+
}
56+
57+
{
58+
MyMovableClass s1(getUnTainted());
59+
MyMovableClass s2(getTainted());
60+
MyMovableClass s3;
61+
62+
sink(s1);
63+
sink(s2); // tainted [NOT DETECTED]
64+
sink(s3 = source()); // tainted [NOT DETECTED]
65+
}
66+
}

0 commit comments

Comments
 (0)