@@ -481,3 +481,37 @@ func testPathInjection2(s1: UnsafeMutablePointer<String>, s2: UnsafeMutablePoint
481
481
_ = fm. fileAttributes ( atPath: remoteString, traverseLink: true ) // $ MISSING: hasPathInjection=445
482
482
_ = try fm. attributesOfItem ( atPath: remoteString) // $ MISSING: hasPathInjection=445
483
483
}
484
+
485
+ // ---
486
+
487
+ func myOpenFile1( atPath path: String ) { }
488
+ func myOpenFile2( _ filePath: String ) { }
489
+ func myFindFiles( ofType type: Int , inDirectory dir: String ) { }
490
+
491
+ class MyClass {
492
+ init ( contentsOfFile: String ) { }
493
+ func doSomething( keyPath: String ) { }
494
+ func write( toFile: String ) { }
495
+ }
496
+
497
+ class MyFile {
498
+ init ( path: String ) { }
499
+ }
500
+
501
+ func testPathInjectionHeuristics( ) {
502
+ let remoteString = String ( contentsOf: URL ( string: " http://example.com/ " ) !)
503
+
504
+ myOpenFile1 ( atPath: remoteString) // $ MISSING: hasPathInjection=
505
+ myOpenFile2 ( remoteString) // $ MISSING: hasPathInjection=
506
+ myFindFiles ( ofType: 0 , inDirectory: remoteString) // $ MISSING: hasPathInjection=
507
+
508
+ let mc = MyClass ( contentsOfFile: remoteString) // $ MISSING: hasPathInjection=
509
+ mc. doSomething ( keyPath: remoteString) // good - not a path
510
+ mc. write ( toFile: remoteString) // $ MISSING: hasPathInjection=
511
+
512
+ let mf1 = MyFile ( path: " " )
513
+ let mf2 = MyFile ( path: remoteString) // $ MISSING: hasPathInjection=
514
+
515
+ _ = NSSortDescriptor ( key: remoteString, ascending: true ) // good - not a path
516
+ _ = NSSortDescriptor ( keyPath: remoteString as! KeyPath < Int , Int > , ascending: true ) // good - not a path
517
+ }
0 commit comments