Skip to content

Commit 3e11dbd

Browse files
geoffw0geoffw0
committed
Rust: Accept test changes.
1 parent e56b9de commit 3e11dbd

File tree

4 files changed

+22
-82
lines changed

4 files changed

+22
-82
lines changed

‎rust/ql/test/library-tests/dataflow/sources/test.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ fn test_io_stdin() -> std::io::Result<()> {
214214
{
215215
let mut buffer = Vec::<u8>::new();
216216
let _bytes = std::io::stdin().read_to_end(&mut buffer)?; // $ Alert[rust/summary/taint-sources]
217-
sink(&buffer); // $ MISSING: hasTaintFlow
217+
sink(&buffer); // $ hasTaintFlow
218218
}
219219

220220
{

‎rust/ql/test/library-tests/frameworks/postgres/main.rs

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
1616
)",
1717
&[],
1818
)?;
19-
19+
2020
let query = format!("INSERT INTO person (name, age) VALUES ('{}', '{}')", name, age);
2121

2222
conn.execute(query.as_str(), &[])?; // $ sql-sink
@@ -33,11 +33,11 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
3333
// conn.query_typed_raw(query.as_str(), &[])?;
3434

3535
for row in &conn.query("SELECT id, name, age FROM person", &[])? { // $ sql-sink
36-
let id: i32 = row.get("id"); // $ database-read
37-
let name: &str = row.try_get("name")?; // $ database-read
38-
let age: i32 = row.try_get("age").unwrap(); // $ database-read
36+
let id: i32 = row.get("id"); // $ MISSING: database-read
37+
let name: &str = row.try_get("name")?; // $ MISSING: database-read
38+
let age: i32 = row.try_get("age").unwrap(); // $ MISSING: database-read
3939
println!("found person: {} {} {}", id, name, age);
4040
}
4141

4242
Ok(())
43-
}
43+
}

‎rust/ql/test/query-tests/security/CWE-328/WeakSensitiveDataHashing.expected

Lines changed: 3 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -1,74 +1,14 @@
11
#select
2-
| test.rs:14:9:14:24 | ...::digest | test.rs:14:26:14:39 | credit_card_no | test.rs:14:9:14:24 | ...::digest | $@ is used in a hashing algorithm (MD5) that is insecure. | test.rs:14:26:14:39 | credit_card_no | Sensitive data (private) |
3-
| test.rs:15:9:15:24 | ...::digest | test.rs:15:26:15:33 | password | test.rs:15:9:15:24 | ...::digest | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:15:26:15:33 | password | Sensitive data (password) |
42
| test.rs:20:9:20:24 | ...::compute | test.rs:20:26:20:39 | credit_card_no | test.rs:20:9:20:24 | ...::compute | $@ is used in a hashing algorithm (MD5) that is insecure. | test.rs:20:26:20:39 | credit_card_no | Sensitive data (private) |
53
| test.rs:21:9:21:24 | ...::compute | test.rs:21:26:21:33 | password | test.rs:21:9:21:24 | ...::compute | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:21:26:21:33 | password | Sensitive data (password) |
6-
| test.rs:26:9:26:26 | ...::digest | test.rs:26:28:26:41 | credit_card_no | test.rs:26:9:26:26 | ...::digest | $@ is used in a hashing algorithm (SHA1) that is insecure. | test.rs:26:28:26:41 | credit_card_no | Sensitive data (private) |
7-
| test.rs:27:9:27:26 | ...::digest | test.rs:27:28:27:35 | password | test.rs:27:9:27:26 | ...::digest | $@ is used in a hashing algorithm (SHA1) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:27:28:27:35 | password | Sensitive data (password) |
8-
| test.rs:32:9:32:34 | ...::digest | test.rs:32:36:32:49 | credit_card_no | test.rs:32:9:32:34 | ...::digest | $@ is used in a hashing algorithm (SHA1) that is insecure. | test.rs:32:36:32:49 | credit_card_no | Sensitive data (private) |
9-
| test.rs:33:9:33:34 | ...::digest | test.rs:33:36:33:43 | password | test.rs:33:9:33:34 | ...::digest | $@ is used in a hashing algorithm (SHA1) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:33:36:33:43 | password | Sensitive data (password) |
10-
| test.rs:39:9:39:30 | ...::digest | test.rs:39:32:39:39 | password | test.rs:39:9:39:30 | ...::digest | $@ is used in a hashing algorithm (SHA3256) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:39:32:39:39 | password | Sensitive data (password) |
11-
| test.rs:60:9:60:24 | ...::digest | test.rs:60:26:60:37 | password_str | test.rs:60:9:60:24 | ...::digest | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:60:26:60:37 | password_str | Sensitive data (password) |
12-
| test.rs:62:9:62:24 | ...::digest | test.rs:62:26:62:37 | password_arr | test.rs:62:9:62:24 | ...::digest | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:62:26:62:37 | password_arr | Sensitive data (password) |
13-
| test.rs:64:9:64:24 | ...::digest | test.rs:64:26:64:37 | password_vec | test.rs:64:9:64:24 | ...::digest | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:64:26:64:37 | password_vec | Sensitive data (password) |
14-
| test.rs:77:9:77:33 | ...::new_with_prefix | test.rs:77:35:77:42 | password | test.rs:77:9:77:33 | ...::new_with_prefix | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:77:35:77:42 | password | Sensitive data (password) |
15-
| test.rs:81:9:81:24 | ...::digest | test.rs:81:26:81:33 | password | test.rs:81:9:81:24 | ...::digest | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:81:26:81:33 | password | Sensitive data (password) |
16-
| test.rs:83:9:83:24 | ...::digest | test.rs:83:26:83:33 | password | test.rs:83:9:83:24 | ...::digest | $@ is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function. | test.rs:83:26:83:33 | password | Sensitive data (password) |
174
edges
18-
| test.rs:14:26:14:39 | credit_card_no | test.rs:14:9:14:24 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
19-
| test.rs:15:26:15:33 | password | test.rs:15:9:15:24 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
20-
| test.rs:20:26:20:39 | credit_card_no | test.rs:20:9:20:24 | ...::compute | provenance | MaD:3 Sink:MaD:3 |
21-
| test.rs:21:26:21:33 | password | test.rs:21:9:21:24 | ...::compute | provenance | MaD:3 Sink:MaD:3 |
22-
| test.rs:26:28:26:41 | credit_card_no | test.rs:26:9:26:26 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
23-
| test.rs:27:28:27:35 | password | test.rs:27:9:27:26 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
24-
| test.rs:32:36:32:49 | credit_card_no | test.rs:32:9:32:34 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
25-
| test.rs:33:36:33:43 | password | test.rs:33:9:33:34 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
26-
| test.rs:39:32:39:39 | password | test.rs:39:9:39:30 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
27-
| test.rs:60:26:60:37 | password_str | test.rs:60:9:60:24 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
28-
| test.rs:62:26:62:37 | password_arr | test.rs:62:9:62:24 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
29-
| test.rs:64:26:64:37 | password_vec | test.rs:64:9:64:24 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
30-
| test.rs:77:35:77:42 | password | test.rs:77:9:77:33 | ...::new_with_prefix | provenance | MaD:2 Sink:MaD:2 |
31-
| test.rs:81:26:81:33 | password | test.rs:81:26:81:40 | password.trim() [&ref] | provenance | MaD:5 |
32-
| test.rs:81:26:81:40 | password.trim() [&ref] | test.rs:81:9:81:24 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
33-
| test.rs:83:26:83:33 | password | test.rs:83:26:83:44 | password.as_bytes() | provenance | MaD:4 |
34-
| test.rs:83:26:83:44 | password.as_bytes() | test.rs:83:9:83:24 | ...::digest | provenance | MaD:1 Sink:MaD:1 |
5+
| test.rs:20:26:20:39 | credit_card_no | test.rs:20:9:20:24 | ...::compute | provenance | MaD:1 Sink:MaD:1 |
6+
| test.rs:21:26:21:33 | password | test.rs:21:9:21:24 | ...::compute | provenance | MaD:1 Sink:MaD:1 |
357
models
36-
| 1 | Sink: repo:https://github.com/RustCrypto/traits:digest; <_ as crate::digest::Digest>::digest; Argument[0]; hasher-input |
37-
| 2 | Sink: repo:https://github.com/RustCrypto/traits:digest; <_ as crate::digest::Digest>::new_with_prefix; Argument[0]; hasher-input |
38-
| 3 | Sink: repo:https://github.com/stainless-steel/md5:md5; crate::compute; Argument[0]; hasher-input |
39-
| 4 | Summary: lang:core; <str>::as_bytes; Argument[self]; ReturnValue; taint |
40-
| 5 | Summary: lang:core; <str>::trim; Argument[self]; ReturnValue.Reference; taint |
8+
| 1 | Sink: md5::compute; Argument[0]; hasher-input |
419
nodes
42-
| test.rs:14:9:14:24 | ...::digest | semmle.label | ...::digest |
43-
| test.rs:14:26:14:39 | credit_card_no | semmle.label | credit_card_no |
44-
| test.rs:15:9:15:24 | ...::digest | semmle.label | ...::digest |
45-
| test.rs:15:26:15:33 | password | semmle.label | password |
4610
| test.rs:20:9:20:24 | ...::compute | semmle.label | ...::compute |
4711
| test.rs:20:26:20:39 | credit_card_no | semmle.label | credit_card_no |
4812
| test.rs:21:9:21:24 | ...::compute | semmle.label | ...::compute |
4913
| test.rs:21:26:21:33 | password | semmle.label | password |
50-
| test.rs:26:9:26:26 | ...::digest | semmle.label | ...::digest |
51-
| test.rs:26:28:26:41 | credit_card_no | semmle.label | credit_card_no |
52-
| test.rs:27:9:27:26 | ...::digest | semmle.label | ...::digest |
53-
| test.rs:27:28:27:35 | password | semmle.label | password |
54-
| test.rs:32:9:32:34 | ...::digest | semmle.label | ...::digest |
55-
| test.rs:32:36:32:49 | credit_card_no | semmle.label | credit_card_no |
56-
| test.rs:33:9:33:34 | ...::digest | semmle.label | ...::digest |
57-
| test.rs:33:36:33:43 | password | semmle.label | password |
58-
| test.rs:39:9:39:30 | ...::digest | semmle.label | ...::digest |
59-
| test.rs:39:32:39:39 | password | semmle.label | password |
60-
| test.rs:60:9:60:24 | ...::digest | semmle.label | ...::digest |
61-
| test.rs:60:26:60:37 | password_str | semmle.label | password_str |
62-
| test.rs:62:9:62:24 | ...::digest | semmle.label | ...::digest |
63-
| test.rs:62:26:62:37 | password_arr | semmle.label | password_arr |
64-
| test.rs:64:9:64:24 | ...::digest | semmle.label | ...::digest |
65-
| test.rs:64:26:64:37 | password_vec | semmle.label | password_vec |
66-
| test.rs:77:9:77:33 | ...::new_with_prefix | semmle.label | ...::new_with_prefix |
67-
| test.rs:77:35:77:42 | password | semmle.label | password |
68-
| test.rs:81:9:81:24 | ...::digest | semmle.label | ...::digest |
69-
| test.rs:81:26:81:33 | password | semmle.label | password |
70-
| test.rs:81:26:81:40 | password.trim() [&ref] | semmle.label | password.trim() [&ref] |
71-
| test.rs:83:9:83:24 | ...::digest | semmle.label | ...::digest |
72-
| test.rs:83:26:83:33 | password | semmle.label | password |
73-
| test.rs:83:26:83:44 | password.as_bytes() | semmle.label | password.as_bytes() |
7414
subpaths

‎rust/ql/test/query-tests/security/CWE-328/test.rs

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ fn test_hash_algorithms(
1111

1212
// MD5
1313
_ = md5::Md5::digest(harmless);
14-
_ = md5::Md5::digest(credit_card_no); // $ Alert[rust/weak-sensitive-data-hashing]
15-
_ = md5::Md5::digest(password); // $ Alert[rust/weak-sensitive-data-hashing]
14+
_ = md5::Md5::digest(credit_card_no); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
15+
_ = md5::Md5::digest(password); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
1616
_ = md5::Md5::digest(encrypted_password);
1717

1818
// MD5 (alternative / older library)
@@ -23,20 +23,20 @@ fn test_hash_algorithms(
2323

2424
// SHA-1
2525
_ = sha1::Sha1::digest(harmless);
26-
_ = sha1::Sha1::digest(credit_card_no); // $ Alert[rust/weak-sensitive-data-hashing]
27-
_ = sha1::Sha1::digest(password); // $ Alert[rust/weak-sensitive-data-hashing]
26+
_ = sha1::Sha1::digest(credit_card_no); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
27+
_ = sha1::Sha1::digest(password); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
2828
_ = sha1::Sha1::digest(encrypted_password);
2929

3030
// SHA-1 checked
3131
_ = sha1_checked::Sha1::digest(harmless);
32-
_ = sha1_checked::Sha1::digest(credit_card_no); // $ Alert[rust/weak-sensitive-data-hashing]
33-
_ = sha1_checked::Sha1::digest(password); // $ Alert[rust/weak-sensitive-data-hashing]
32+
_ = sha1_checked::Sha1::digest(credit_card_no); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
33+
_ = sha1_checked::Sha1::digest(password); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
3434
_ = sha1_checked::Sha1::digest(encrypted_password);
3535

3636
// SHA-256 (appropriate for sensitive data hashing)
3737
_ = sha3::Sha3_256::digest(harmless);
3838
_ = sha3::Sha3_256::digest(credit_card_no);
39-
_ = sha3::Sha3_256::digest(password); // $ Alert[rust/weak-sensitive-data-hashing]
39+
_ = sha3::Sha3_256::digest(password); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
4040
_ = sha3::Sha3_256::digest(encrypted_password);
4141

4242
// Argon2 (appropriate for password hashing)
@@ -57,11 +57,11 @@ fn test_hash_code_patterns(
5757

5858
// hash different types of data
5959
_ = md5::Md5::digest(harmless_str);
60-
_ = md5::Md5::digest(password_str); // $ Alert[rust/weak-sensitive-data-hashing]
60+
_ = md5::Md5::digest(password_str); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
6161
_ = md5::Md5::digest(harmless_arr);
62-
_ = md5::Md5::digest(password_arr); // $ Alert[rust/weak-sensitive-data-hashing]
62+
_ = md5::Md5::digest(password_arr); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
6363
_ = md5::Md5::digest(harmless_vec);
64-
_ = md5::Md5::digest(password_vec); // $ Alert[rust/weak-sensitive-data-hashing]
64+
_ = md5::Md5::digest(password_vec); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
6565

6666
// hash through a hasher object
6767
let mut md5_hasher = md5::Md5::new();
@@ -74,13 +74,13 @@ fn test_hash_code_patterns(
7474
_ = md5::Md5::new().chain_update(harmless).chain_update(password).chain_update(harmless).finalize(); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
7575

7676
_ = md5::Md5::new_with_prefix(harmless).finalize();
77-
_ = md5::Md5::new_with_prefix(password).finalize(); // $ Alert[rust/weak-sensitive-data-hashing]
77+
_ = md5::Md5::new_with_prefix(password).finalize(); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
7878

7979
// hash transformed data
8080
_ = md5::Md5::digest(harmless.trim());
81-
_ = md5::Md5::digest(password.trim()); // $ Alert[rust/weak-sensitive-data-hashing]
81+
_ = md5::Md5::digest(password.trim()); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
8282
_ = md5::Md5::digest(harmless.as_bytes());
83-
_ = md5::Md5::digest(password.as_bytes()); // $ Alert[rust/weak-sensitive-data-hashing]
83+
_ = md5::Md5::digest(password.as_bytes()); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
8484
_ = md5::Md5::digest(std::str::from_utf8(harmless_arr).unwrap());
8585
_ = md5::Md5::digest(std::str::from_utf8(password_arr).unwrap()); // $ MISSING: Alert[rust/weak-sensitive-data-hashing]
8686
}

0 commit comments

Comments
 (0)