Improved tests

Note that a FN test case was added

Author: atorralba

java/ql/test/query-tests/security/CWE-807/semmle/tests/ConditionalBypassTest.java

@@ -57,7 +57,6 @@ public static void test(String user, String password) {
 		if (adminCookie.getValue() == "false")
 			login(user, password);
 		else {
-			// do something else
 			login(user, password);
 		}
 	}
@@ -69,17 +68,19 @@ public static void test2(String user, String password) {
 			login(user, password);
 		else {
 			// do something else
+			doIt();
 		}
 		login(user, password);
 	}
 
 	public static void test3(String user, String password) {
 		Cookie adminCookie = getCookies()[0];
+		// BAD: login may not happen
 		if (adminCookie.getValue() == "false") // $ hasConditionalBypassTest
 			login(user, password);
 		else {
 			// do something else
-			// BAD: login may not happen
+			doIt();
 		}
 		return;
 	}
@@ -97,6 +98,37 @@ public static void test4(String user, String password) {
 		return;
 	}
 
+	public static void test5(String user, String password) throws Exception {
+		Cookie adminCookie = getCookies()[0];
+		// GOOD: exit with Exception if condition is not met
+		if (adminCookie.getValue() == "false") {
+			throw new Exception();
+		}
+
+		login(user, password);
+	}
+
+	public static void test6(String user, String password) {
+		Cookie adminCookie = getCookies()[0];
+		// GOOD: exit with return if condition is not met
+		if (adminCookie.getValue() == "false") {
+			return;
+		}
+
+		login(user, password);
+	}
+
+	public static void test7(String user, String password) {
+		Cookie adminCookie = getCookies()[0];
+		// FALSE NEGATIVE: login is bypasseable
+		if (adminCookie.getValue() == "false") { // $ MISSING: $ hasConditionalBypassTest
+			login(user, password);
+			return;
+		} else {
+			doIt();
+		}
+	}
+
 	public static void login(String user, String password) {
 		// login
 	}

java/ql/test/query-tests/security/CWE-807/semmle/tests/TaintedPermissionsCheck.expected

@@ -3,5 +3,6 @@ edges
 nodes
 | TaintedPermissionsCheckTest.java:12:19:12:48 | getParameter(...) : String | semmle.label | getParameter(...) : String |
 | TaintedPermissionsCheckTest.java:15:27:15:53 | ... + ... | semmle.label | ... + ... |
+subpaths
 #select
 | TaintedPermissionsCheckTest.java:15:7:15:54 | isPermitted(...) | TaintedPermissionsCheckTest.java:12:19:12:48 | getParameter(...) : String | TaintedPermissionsCheckTest.java:15:27:15:53 | ... + ... | Permissions check uses user-controlled $@. | TaintedPermissionsCheckTest.java:12:19:12:48 | getParameter(...) | data |