Skip to content

Commit 646d28f

Browse files
owen-mcowen-mc
committed
Make cleartext logging tests more realistic
1 parent 94c812c commit 646d28f

File tree

2 files changed

+86
-85
lines changed

2 files changed

+86
-85
lines changed

‎go/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected

Lines changed: 58 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,35 @@
11
#select
22
| klog.go:23:15:23:20 | header | klog.go:21:30:21:37 | selection of Header | klog.go:23:15:23:20 | header | $@ flows to a logging call. | klog.go:21:30:21:37 | selection of Header | Sensitive data returned by HTTP request headers |
33
| klog.go:29:13:29:41 | call to Get | klog.go:29:13:29:20 | selection of Header | klog.go:29:13:29:41 | call to Get | $@ flows to a logging call. | klog.go:29:13:29:20 | selection of Header | Sensitive data returned by HTTP request headers |
4-
| main.go:15:12:15:19 | password | main.go:15:12:15:19 | password | main.go:15:12:15:19 | password | $@ flows to a logging call. | main.go:15:12:15:19 | password | Sensitive data returned by an access to password |
5-
| main.go:16:17:16:24 | password | main.go:16:17:16:24 | password | main.go:16:17:16:24 | password | $@ flows to a logging call. | main.go:16:17:16:24 | password | Sensitive data returned by an access to password |
6-
| main.go:17:13:17:20 | password | main.go:17:13:17:20 | password | main.go:17:13:17:20 | password | $@ flows to a logging call. | main.go:17:13:17:20 | password | Sensitive data returned by an access to password |
7-
| main.go:18:14:18:21 | password | main.go:18:14:18:21 | password | main.go:18:14:18:21 | password | $@ flows to a logging call. | main.go:18:14:18:21 | password | Sensitive data returned by an access to password |
8-
| main.go:19:12:19:19 | password | main.go:19:12:19:19 | password | main.go:19:12:19:19 | password | $@ flows to a logging call. | main.go:19:12:19:19 | password | Sensitive data returned by an access to password |
9-
| main.go:20:17:20:24 | password | main.go:20:17:20:24 | password | main.go:20:17:20:24 | password | $@ flows to a logging call. | main.go:20:17:20:24 | password | Sensitive data returned by an access to password |
10-
| main.go:21:13:21:20 | password | main.go:21:13:21:20 | password | main.go:21:13:21:20 | password | $@ flows to a logging call. | main.go:21:13:21:20 | password | Sensitive data returned by an access to password |
11-
| main.go:22:14:22:21 | password | main.go:22:14:22:21 | password | main.go:22:14:22:21 | password | $@ flows to a logging call. | main.go:22:14:22:21 | password | Sensitive data returned by an access to password |
12-
| main.go:23:12:23:19 | password | main.go:23:12:23:19 | password | main.go:23:12:23:19 | password | $@ flows to a logging call. | main.go:23:12:23:19 | password | Sensitive data returned by an access to password |
13-
| main.go:24:17:24:24 | password | main.go:24:17:24:24 | password | main.go:24:17:24:24 | password | $@ flows to a logging call. | main.go:24:17:24:24 | password | Sensitive data returned by an access to password |
14-
| main.go:25:13:25:20 | password | main.go:25:13:25:20 | password | main.go:25:13:25:20 | password | $@ flows to a logging call. | main.go:25:13:25:20 | password | Sensitive data returned by an access to password |
15-
| main.go:26:14:26:21 | password | main.go:26:14:26:21 | password | main.go:26:14:26:21 | password | $@ flows to a logging call. | main.go:26:14:26:21 | password | Sensitive data returned by an access to password |
16-
| main.go:27:16:27:23 | password | main.go:27:16:27:23 | password | main.go:27:16:27:23 | password | $@ flows to a logging call. | main.go:27:16:27:23 | password | Sensitive data returned by an access to password |
17-
| main.go:30:10:30:17 | password | main.go:30:10:30:17 | password | main.go:30:10:30:17 | password | $@ flows to a logging call. | main.go:30:10:30:17 | password | Sensitive data returned by an access to password |
18-
| main.go:31:15:31:22 | password | main.go:31:15:31:22 | password | main.go:31:15:31:22 | password | $@ flows to a logging call. | main.go:31:15:31:22 | password | Sensitive data returned by an access to password |
19-
| main.go:32:11:32:18 | password | main.go:32:11:32:18 | password | main.go:32:11:32:18 | password | $@ flows to a logging call. | main.go:32:11:32:18 | password | Sensitive data returned by an access to password |
20-
| main.go:33:12:33:19 | password | main.go:33:12:33:19 | password | main.go:33:12:33:19 | password | $@ flows to a logging call. | main.go:33:12:33:19 | password | Sensitive data returned by an access to password |
21-
| main.go:34:10:34:17 | password | main.go:34:10:34:17 | password | main.go:34:10:34:17 | password | $@ flows to a logging call. | main.go:34:10:34:17 | password | Sensitive data returned by an access to password |
22-
| main.go:35:15:35:22 | password | main.go:35:15:35:22 | password | main.go:35:15:35:22 | password | $@ flows to a logging call. | main.go:35:15:35:22 | password | Sensitive data returned by an access to password |
23-
| main.go:36:11:36:18 | password | main.go:36:11:36:18 | password | main.go:36:11:36:18 | password | $@ flows to a logging call. | main.go:36:11:36:18 | password | Sensitive data returned by an access to password |
24-
| main.go:37:12:37:19 | password | main.go:37:12:37:19 | password | main.go:37:12:37:19 | password | $@ flows to a logging call. | main.go:37:12:37:19 | password | Sensitive data returned by an access to password |
25-
| main.go:38:10:38:17 | password | main.go:38:10:38:17 | password | main.go:38:10:38:17 | password | $@ flows to a logging call. | main.go:38:10:38:17 | password | Sensitive data returned by an access to password |
26-
| main.go:39:15:39:22 | password | main.go:39:15:39:22 | password | main.go:39:15:39:22 | password | $@ flows to a logging call. | main.go:39:15:39:22 | password | Sensitive data returned by an access to password |
27-
| main.go:40:11:40:18 | password | main.go:40:11:40:18 | password | main.go:40:11:40:18 | password | $@ flows to a logging call. | main.go:40:11:40:18 | password | Sensitive data returned by an access to password |
28-
| main.go:41:12:41:19 | password | main.go:41:12:41:19 | password | main.go:41:12:41:19 | password | $@ flows to a logging call. | main.go:41:12:41:19 | password | Sensitive data returned by an access to password |
29-
| main.go:42:14:42:21 | password | main.go:42:14:42:21 | password | main.go:42:14:42:21 | password | $@ flows to a logging call. | main.go:42:14:42:21 | password | Sensitive data returned by an access to password |
30-
| main.go:44:12:44:19 | password | main.go:44:12:44:19 | password | main.go:44:12:44:19 | password | $@ flows to a logging call. | main.go:44:12:44:19 | password | Sensitive data returned by an access to password |
31-
| main.go:45:17:45:24 | password | main.go:45:17:45:24 | password | main.go:45:17:45:24 | password | $@ flows to a logging call. | main.go:45:17:45:24 | password | Sensitive data returned by an access to password |
32-
| main.go:52:35:52:42 | password | main.go:52:35:52:42 | password | main.go:52:35:52:42 | password | $@ flows to a logging call. | main.go:52:35:52:42 | password | Sensitive data returned by an access to password |
4+
| main.go:16:12:16:19 | password | main.go:16:12:16:19 | password | main.go:16:12:16:19 | password | $@ flows to a logging call. | main.go:16:12:16:19 | password | Sensitive data returned by an access to password |
5+
| main.go:17:19:17:26 | password | main.go:17:19:17:26 | password | main.go:17:19:17:26 | password | $@ flows to a logging call. | main.go:17:19:17:26 | password | Sensitive data returned by an access to password |
6+
| main.go:18:13:18:20 | password | main.go:18:13:18:20 | password | main.go:18:13:18:20 | password | $@ flows to a logging call. | main.go:18:13:18:20 | password | Sensitive data returned by an access to password |
7+
| main.go:19:14:19:21 | password | main.go:19:14:19:21 | password | main.go:19:14:19:21 | password | $@ flows to a logging call. | main.go:19:14:19:21 | password | Sensitive data returned by an access to password |
8+
| main.go:20:12:20:19 | password | main.go:20:12:20:19 | password | main.go:20:12:20:19 | password | $@ flows to a logging call. | main.go:20:12:20:19 | password | Sensitive data returned by an access to password |
9+
| main.go:21:19:21:26 | password | main.go:21:19:21:26 | password | main.go:21:19:21:26 | password | $@ flows to a logging call. | main.go:21:19:21:26 | password | Sensitive data returned by an access to password |
10+
| main.go:22:13:22:20 | password | main.go:22:13:22:20 | password | main.go:22:13:22:20 | password | $@ flows to a logging call. | main.go:22:13:22:20 | password | Sensitive data returned by an access to password |
11+
| main.go:23:14:23:21 | password | main.go:23:14:23:21 | password | main.go:23:14:23:21 | password | $@ flows to a logging call. | main.go:23:14:23:21 | password | Sensitive data returned by an access to password |
12+
| main.go:24:12:24:19 | password | main.go:24:12:24:19 | password | main.go:24:12:24:19 | password | $@ flows to a logging call. | main.go:24:12:24:19 | password | Sensitive data returned by an access to password |
13+
| main.go:25:19:25:26 | password | main.go:25:19:25:26 | password | main.go:25:19:25:26 | password | $@ flows to a logging call. | main.go:25:19:25:26 | password | Sensitive data returned by an access to password |
14+
| main.go:26:13:26:20 | password | main.go:26:13:26:20 | password | main.go:26:13:26:20 | password | $@ flows to a logging call. | main.go:26:13:26:20 | password | Sensitive data returned by an access to password |
15+
| main.go:27:14:27:21 | password | main.go:27:14:27:21 | password | main.go:27:14:27:21 | password | $@ flows to a logging call. | main.go:27:14:27:21 | password | Sensitive data returned by an access to password |
16+
| main.go:28:16:28:23 | password | main.go:28:16:28:23 | password | main.go:28:16:28:23 | password | $@ flows to a logging call. | main.go:28:16:28:23 | password | Sensitive data returned by an access to password |
17+
| main.go:31:10:31:17 | password | main.go:31:10:31:17 | password | main.go:31:10:31:17 | password | $@ flows to a logging call. | main.go:31:10:31:17 | password | Sensitive data returned by an access to password |
18+
| main.go:32:17:32:24 | password | main.go:32:17:32:24 | password | main.go:32:17:32:24 | password | $@ flows to a logging call. | main.go:32:17:32:24 | password | Sensitive data returned by an access to password |
19+
| main.go:33:11:33:18 | password | main.go:33:11:33:18 | password | main.go:33:11:33:18 | password | $@ flows to a logging call. | main.go:33:11:33:18 | password | Sensitive data returned by an access to password |
20+
| main.go:34:12:34:19 | password | main.go:34:12:34:19 | password | main.go:34:12:34:19 | password | $@ flows to a logging call. | main.go:34:12:34:19 | password | Sensitive data returned by an access to password |
21+
| main.go:35:10:35:17 | password | main.go:35:10:35:17 | password | main.go:35:10:35:17 | password | $@ flows to a logging call. | main.go:35:10:35:17 | password | Sensitive data returned by an access to password |
22+
| main.go:36:17:36:24 | password | main.go:36:17:36:24 | password | main.go:36:17:36:24 | password | $@ flows to a logging call. | main.go:36:17:36:24 | password | Sensitive data returned by an access to password |
23+
| main.go:37:11:37:18 | password | main.go:37:11:37:18 | password | main.go:37:11:37:18 | password | $@ flows to a logging call. | main.go:37:11:37:18 | password | Sensitive data returned by an access to password |
24+
| main.go:38:12:38:19 | password | main.go:38:12:38:19 | password | main.go:38:12:38:19 | password | $@ flows to a logging call. | main.go:38:12:38:19 | password | Sensitive data returned by an access to password |
25+
| main.go:39:10:39:17 | password | main.go:39:10:39:17 | password | main.go:39:10:39:17 | password | $@ flows to a logging call. | main.go:39:10:39:17 | password | Sensitive data returned by an access to password |
26+
| main.go:40:17:40:24 | password | main.go:40:17:40:24 | password | main.go:40:17:40:24 | password | $@ flows to a logging call. | main.go:40:17:40:24 | password | Sensitive data returned by an access to password |
27+
| main.go:41:11:41:18 | password | main.go:41:11:41:18 | password | main.go:41:11:41:18 | password | $@ flows to a logging call. | main.go:41:11:41:18 | password | Sensitive data returned by an access to password |
28+
| main.go:42:12:42:19 | password | main.go:42:12:42:19 | password | main.go:42:12:42:19 | password | $@ flows to a logging call. | main.go:42:12:42:19 | password | Sensitive data returned by an access to password |
29+
| main.go:43:14:43:21 | password | main.go:43:14:43:21 | password | main.go:43:14:43:21 | password | $@ flows to a logging call. | main.go:43:14:43:21 | password | Sensitive data returned by an access to password |
30+
| main.go:45:12:45:19 | password | main.go:45:12:45:19 | password | main.go:45:12:45:19 | password | $@ flows to a logging call. | main.go:45:12:45:19 | password | Sensitive data returned by an access to password |
31+
| main.go:46:17:46:24 | password | main.go:46:17:46:24 | password | main.go:46:17:46:24 | password | $@ flows to a logging call. | main.go:46:17:46:24 | password | Sensitive data returned by an access to password |
32+
| main.go:53:35:53:42 | password | main.go:53:35:53:42 | password | main.go:53:35:53:42 | password | $@ flows to a logging call. | main.go:53:35:53:42 | password | Sensitive data returned by an access to password |
3333
| overrides.go:13:14:13:23 | call to String | overrides.go:9:9:9:16 | password | overrides.go:13:14:13:23 | call to String | $@ flows to a logging call. | overrides.go:9:9:9:16 | password | Sensitive data returned by an access to password |
3434
| passwords.go:9:14:9:14 | x | passwords.go:30:8:30:15 | password | passwords.go:9:14:9:14 | x | $@ flows to a logging call. | passwords.go:30:8:30:15 | password | Sensitive data returned by an access to password |
3535
| passwords.go:25:14:25:21 | password | passwords.go:25:14:25:21 | password | passwords.go:25:14:25:21 | password | $@ flows to a logging call. | passwords.go:25:14:25:21 | password | Sensitive data returned by an access to password |
@@ -108,35 +108,35 @@ nodes
108108
| klog.go:23:15:23:20 | header | semmle.label | header |
109109
| klog.go:29:13:29:20 | selection of Header | semmle.label | selection of Header |
110110
| klog.go:29:13:29:41 | call to Get | semmle.label | call to Get |
111-
| main.go:15:12:15:19 | password | semmle.label | password |
112-
| main.go:16:17:16:24 | password | semmle.label | password |
113-
| main.go:17:13:17:20 | password | semmle.label | password |
114-
| main.go:18:14:18:21 | password | semmle.label | password |
115-
| main.go:19:12:19:19 | password | semmle.label | password |
116-
| main.go:20:17:20:24 | password | semmle.label | password |
117-
| main.go:21:13:21:20 | password | semmle.label | password |
118-
| main.go:22:14:22:21 | password | semmle.label | password |
119-
| main.go:23:12:23:19 | password | semmle.label | password |
120-
| main.go:24:17:24:24 | password | semmle.label | password |
121-
| main.go:25:13:25:20 | password | semmle.label | password |
122-
| main.go:26:14:26:21 | password | semmle.label | password |
123-
| main.go:27:16:27:23 | password | semmle.label | password |
124-
| main.go:30:10:30:17 | password | semmle.label | password |
125-
| main.go:31:15:31:22 | password | semmle.label | password |
126-
| main.go:32:11:32:18 | password | semmle.label | password |
127-
| main.go:33:12:33:19 | password | semmle.label | password |
128-
| main.go:34:10:34:17 | password | semmle.label | password |
129-
| main.go:35:15:35:22 | password | semmle.label | password |
130-
| main.go:36:11:36:18 | password | semmle.label | password |
131-
| main.go:37:12:37:19 | password | semmle.label | password |
132-
| main.go:38:10:38:17 | password | semmle.label | password |
133-
| main.go:39:15:39:22 | password | semmle.label | password |
134-
| main.go:40:11:40:18 | password | semmle.label | password |
135-
| main.go:41:12:41:19 | password | semmle.label | password |
136-
| main.go:42:14:42:21 | password | semmle.label | password |
137-
| main.go:44:12:44:19 | password | semmle.label | password |
138-
| main.go:45:17:45:24 | password | semmle.label | password |
139-
| main.go:52:35:52:42 | password | semmle.label | password |
111+
| main.go:16:12:16:19 | password | semmle.label | password |
112+
| main.go:17:19:17:26 | password | semmle.label | password |
113+
| main.go:18:13:18:20 | password | semmle.label | password |
114+
| main.go:19:14:19:21 | password | semmle.label | password |
115+
| main.go:20:12:20:19 | password | semmle.label | password |
116+
| main.go:21:19:21:26 | password | semmle.label | password |
117+
| main.go:22:13:22:20 | password | semmle.label | password |
118+
| main.go:23:14:23:21 | password | semmle.label | password |
119+
| main.go:24:12:24:19 | password | semmle.label | password |
120+
| main.go:25:19:25:26 | password | semmle.label | password |
121+
| main.go:26:13:26:20 | password | semmle.label | password |
122+
| main.go:27:14:27:21 | password | semmle.label | password |
123+
| main.go:28:16:28:23 | password | semmle.label | password |
124+
| main.go:31:10:31:17 | password | semmle.label | password |
125+
| main.go:32:17:32:24 | password | semmle.label | password |
126+
| main.go:33:11:33:18 | password | semmle.label | password |
127+
| main.go:34:12:34:19 | password | semmle.label | password |
128+
| main.go:35:10:35:17 | password | semmle.label | password |
129+
| main.go:36:17:36:24 | password | semmle.label | password |
130+
| main.go:37:11:37:18 | password | semmle.label | password |
131+
| main.go:38:12:38:19 | password | semmle.label | password |
132+
| main.go:39:10:39:17 | password | semmle.label | password |
133+
| main.go:40:17:40:24 | password | semmle.label | password |
134+
| main.go:41:11:41:18 | password | semmle.label | password |
135+
| main.go:42:12:42:19 | password | semmle.label | password |
136+
| main.go:43:14:43:21 | password | semmle.label | password |
137+
| main.go:45:12:45:19 | password | semmle.label | password |
138+
| main.go:46:17:46:24 | password | semmle.label | password |
139+
| main.go:53:35:53:42 | password | semmle.label | password |
140140
| overrides.go:9:9:9:16 | password | semmle.label | password |
141141
| overrides.go:13:14:13:23 | call to String | semmle.label | call to String |
142142
| passwords.go:8:12:8:12 | definition of x | semmle.label | definition of x |

‎go/ql/test/query-tests/Security/CWE-312/main.go

Lines changed: 28 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -4,42 +4,43 @@ package main
44
//go:generate depstubber -vendor github.com/golang/glog "" Info
55

66
import (
7+
"log"
8+
79
"github.com/golang/glog"
810
"github.com/sirupsen/logrus"
9-
"log"
1011
)
1112

1213
func main() {
1314
password := "P4ssw0rd"
1415

15-
log.Print(password) // $ Alert
16-
log.Printf("", password) // $ Alert
17-
log.Printf(password, "") // $ Alert
18-
log.Println(password) // $ Alert
19-
log.Fatal(password) // $ Alert
20-
log.Fatalf("", password) // $ Alert
21-
log.Fatalf(password, "") // $ Alert
22-
log.Fatalln(password) // $ Alert
23-
log.Panic(password) // $ Alert
24-
log.Panicf("", password) // $ Alert
25-
log.Panicf(password, "") // $ Alert
26-
log.Panicln(password) // $ Alert
27-
log.Output(0, password) // $ Alert
16+
log.Print(password) // $ Alert
17+
log.Printf("%s", password) // $ Alert
18+
log.Printf(password, "") // $ Alert
19+
log.Println(password) // $ Alert
20+
log.Fatal(password) // $ Alert
21+
log.Fatalf("%s", password) // $ Alert
22+
log.Fatalf(password, "") // $ Alert
23+
log.Fatalln(password) // $ Alert
24+
log.Panic(password) // $ Alert
25+
log.Panicf("%s", password) // $ Alert
26+
log.Panicf(password, "") // $ Alert
27+
log.Panicln(password) // $ Alert
28+
log.Output(0, password) // $ Alert
2829

2930
l := log.Default()
30-
l.Print(password) // $ Alert
31-
l.Printf("", password) // $ Alert
32-
l.Printf(password, "") // $ Alert
33-
l.Println(password) // $ Alert
34-
l.Fatal(password) // $ Alert
35-
l.Fatalf("", password) // $ Alert
36-
l.Fatalf(password, "") // $ Alert
37-
l.Fatalln(password) // $ Alert
38-
l.Panic(password) // $ Alert
39-
l.Panicf("", password) // $ Alert
40-
l.Panicf(password, "") // $ Alert
41-
l.Panicln(password) // $ Alert
42-
l.Output(0, password) // $ Alert
31+
l.Print(password) // $ Alert
32+
l.Printf("%s", password) // $ Alert
33+
l.Printf(password, "") // $ Alert
34+
l.Println(password) // $ Alert
35+
l.Fatal(password) // $ Alert
36+
l.Fatalf("%s", password) // $ Alert
37+
l.Fatalf(password, "") // $ Alert
38+
l.Fatalln(password) // $ Alert
39+
l.Panic(password) // $ Alert
40+
l.Panicf("%s", password) // $ Alert
41+
l.Panicf(password, "") // $ Alert
42+
l.Panicln(password) // $ Alert
43+
l.Output(0, password) // $ Alert
4344

4445
glog.Info(password) // $ Alert
4546
logrus.Warning(password) // $ Alert

0 commit comments

Comments
 (0)