Skip to content

Commit e6c19b0

Browse files
owen-mcowen-mc
committed
Modernize tests
1 parent cba0bec commit e6c19b0

File tree

7 files changed

+18
-20
lines changed

7 files changed

+18
-20
lines changed

‎go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,10 @@ edges
3030
| contenttype.go:73:10:73:28 | call to FormValue | contenttype.go:79:11:79:14 | data | provenance | Src:MaD:8 |
3131
| contenttype.go:88:10:88:28 | call to FormValue | contenttype.go:91:4:91:7 | data | provenance | Src:MaD:8 |
3232
| contenttype.go:113:10:113:28 | call to FormValue | contenttype.go:114:50:114:53 | data | provenance | Src:MaD:8 |
33-
| reflectedxsstest.go:31:2:31:44 | ... := ...[0] | reflectedxsstest.go:32:34:32:37 | file | provenance | Src:MaD:7 |
33+
| reflectedxsstest.go:31:2:31:44 | ... := ...[0] | reflectedxsstest.go:32:30:32:33 | file | provenance | Src:MaD:7 |
3434
| reflectedxsstest.go:31:2:31:44 | ... := ...[1] | reflectedxsstest.go:34:46:34:60 | selection of Filename | provenance | Src:MaD:7 |
35-
| reflectedxsstest.go:32:2:32:38 | ... := ...[0] | reflectedxsstest.go:33:49:33:55 | content | provenance | |
36-
| reflectedxsstest.go:32:34:32:37 | file | reflectedxsstest.go:32:2:32:38 | ... := ...[0] | provenance | MaD:13 |
35+
| reflectedxsstest.go:32:2:32:34 | ... := ...[0] | reflectedxsstest.go:33:49:33:55 | content | provenance | |
36+
| reflectedxsstest.go:32:30:32:33 | file | reflectedxsstest.go:32:2:32:34 | ... := ...[0] | provenance | MaD:13 |
3737
| reflectedxsstest.go:33:17:33:56 | []type{args} [array] | reflectedxsstest.go:33:17:33:56 | call to Sprintf | provenance | MaD:12 |
3838
| reflectedxsstest.go:33:17:33:56 | call to Sprintf | reflectedxsstest.go:33:10:33:57 | type conversion | provenance | |
3939
| reflectedxsstest.go:33:49:33:55 | content | reflectedxsstest.go:33:17:33:56 | []type{args} [array] | provenance | |
@@ -81,7 +81,7 @@ models
8181
| 10 | Source: net/http; Request; true; URL; ; ; ; remote; manual |
8282
| 11 | Source: nhooyr.io/websocket; Conn; true; Read; ; ; ReturnValue[1]; remote; manual |
8383
| 12 | Summary: fmt; ; false; Sprintf; ; ; Argument[1].ArrayElement; ReturnValue; taint; manual |
84-
| 13 | Summary: io/ioutil; ; false; ReadAll; ; ; Argument[0]; ReturnValue[0]; taint; manual |
84+
| 13 | Summary: io; ; false; ReadAll; ; ; Argument[0]; ReturnValue[0]; taint; manual |
8585
| 14 | Summary: io; Reader; true; Read; ; ; Argument[receiver]; Argument[0]; taint; manual |
8686
| 15 | Summary: mime/multipart; Part; true; FileName; ; ; Argument[receiver]; ReturnValue; taint; manual |
8787
| 16 | Summary: mime/multipart; Reader; true; NextPart; ; ; Argument[receiver]; ReturnValue[0]; taint; manual |
@@ -108,8 +108,8 @@ nodes
108108
| contenttype.go:114:50:114:53 | data | semmle.label | data |
109109
| reflectedxsstest.go:31:2:31:44 | ... := ...[0] | semmle.label | ... := ...[0] |
110110
| reflectedxsstest.go:31:2:31:44 | ... := ...[1] | semmle.label | ... := ...[1] |
111-
| reflectedxsstest.go:32:2:32:38 | ... := ...[0] | semmle.label | ... := ...[0] |
112-
| reflectedxsstest.go:32:34:32:37 | file | semmle.label | file |
111+
| reflectedxsstest.go:32:2:32:34 | ... := ...[0] | semmle.label | ... := ...[0] |
112+
| reflectedxsstest.go:32:30:32:33 | file | semmle.label | file |
113113
| reflectedxsstest.go:33:10:33:57 | type conversion | semmle.label | type conversion |
114114
| reflectedxsstest.go:33:17:33:56 | []type{args} [array] | semmle.label | []type{args} [array] |
115115
| reflectedxsstest.go:33:17:33:56 | call to Sprintf | semmle.label | call to Sprintf |

‎go/ql/test/query-tests/Security/CWE-079/StoredXss.expected

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,20 @@
11
#select
2-
| StoredXss.go:13:21:13:36 | ...+... | StoredXss.go:13:21:13:31 | call to Name | StoredXss.go:13:21:13:36 | ...+... | Stored cross-site scripting vulnerability due to $@. | StoredXss.go:13:21:13:31 | call to Name | stored value |
32
| stored.go:30:22:30:25 | name | stored.go:18:3:18:28 | ... := ...[0] | stored.go:30:22:30:25 | name | Stored cross-site scripting vulnerability due to $@. | stored.go:18:3:18:28 | ... := ...[0] | stored value |
43
| stored.go:61:22:61:25 | path | stored.go:59:30:59:33 | definition of path | stored.go:61:22:61:25 | path | Stored cross-site scripting vulnerability due to $@. | stored.go:59:30:59:33 | definition of path | stored value |
54
edges
6-
| StoredXss.go:13:21:13:31 | call to Name | StoredXss.go:13:21:13:36 | ...+... | provenance | |
75
| stored.go:18:3:18:28 | ... := ...[0] | stored.go:25:14:25:17 | rows | provenance | Src:MaD:1 |
86
| stored.go:25:14:25:17 | rows | stored.go:25:29:25:33 | &... | provenance | FunctionModel |
97
| stored.go:25:29:25:33 | &... | stored.go:30:22:30:25 | name | provenance | |
108
| stored.go:59:30:59:33 | definition of path | stored.go:61:22:61:25 | path | provenance | |
119
models
1210
| 1 | Source: database/sql; DB; true; Query; ; ; ReturnValue[0]; database; manual |
1311
nodes
14-
| StoredXss.go:13:21:13:31 | call to Name | semmle.label | call to Name |
15-
| StoredXss.go:13:21:13:36 | ...+... | semmle.label | ...+... |
1612
| stored.go:18:3:18:28 | ... := ...[0] | semmle.label | ... := ...[0] |
1713
| stored.go:25:14:25:17 | rows | semmle.label | rows |
1814
| stored.go:25:29:25:33 | &... | semmle.label | &... |
1915
| stored.go:30:22:30:25 | name | semmle.label | name |
2016
| stored.go:59:30:59:33 | definition of path | semmle.label | definition of path |
2117
| stored.go:61:22:61:25 | path | semmle.label | path |
2218
subpaths
19+
testFailures
20+
| StoredXss.go:13:39:13:63 | comment | Missing result: Alert[go/stored-xss] |

‎go/ql/test/query-tests/Security/CWE-079/StoredXss.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@ package main
22

33
import (
44
"io"
5-
"io/ioutil"
65
"net/http"
6+
"os"
77
)
88

99
func ListFiles(w http.ResponseWriter, r *http.Request) {
10-
files, _ := ioutil.ReadDir(".")
10+
files, _ := os.ReadDir(".")
1111

1212
for _, file := range files {
1313
io.WriteString(w, file.Name()+"\n") // $ Alert[go/stored-xss]

‎go/ql/test/query-tests/Security/CWE-079/StoredXssGood.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ import (
44
"html"
55
"html/template"
66
"io"
7-
"io/ioutil"
87
"net/http"
8+
"os"
99
)
1010

1111
func ListFiles1(w http.ResponseWriter, r *http.Request) {
1212
var template template.Template
13-
files, _ := ioutil.ReadDir(".")
13+
files, _ := os.ReadDir(".")
1414

1515
for _, file := range files {
1616
io.WriteString(w, html.EscapeString(file.Name())+"\n")

‎go/ql/test/query-tests/Security/CWE-079/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module codeql-go-tests/CWE-079
22

3-
go 1.14
3+
go 1.24
44

55
require (
66
github.com/gobwas/ws v1.0.3

‎go/ql/test/query-tests/Security/CWE-079/reflectedxsstest.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package main
33
import (
44
"encoding/json"
55
"fmt"
6-
"io/ioutil"
6+
"io"
77
"net/http"
88
)
99

@@ -29,7 +29,7 @@ func ErrTest(w http.ResponseWriter, r http.Request) {
2929
w.Write([]byte(fmt.Sprintf("Cookie check error: %v", err))) // GOOD: Cookie's err return is harmless
3030
http.Error(w, fmt.Sprintf("Cookie result: %v", cookie), 500) // Good: only plain text is written.
3131
file, header, err := r.FormFile("someFile") // $ Source[go/reflected-xss]
32-
content, err2 := ioutil.ReadAll(file)
32+
content, err2 := io.ReadAll(file)
3333
w.Write([]byte(fmt.Sprintf("File content: %v", content))) // $ Alert[go/reflected-xss] // BAD: file content is user-controlled
3434
w.Write([]byte(fmt.Sprintf("File name: %v", header.Filename))) // $ Alert[go/reflected-xss] // BAD: file header is user-controlled
3535
w.Write([]byte(fmt.Sprintf("FormFile error: %v", err))) // GOOD: FormFile's err return is harmless

‎go/ql/test/query-tests/Security/CWE-079/websocketXss.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ import (
1515
nhooyr "nhooyr.io/websocket"
1616
)
1717

18-
func marshal(v interface{}) (data []byte, payloadType byte, err error) {
18+
func marshal(v any) (data []byte, payloadType byte, err error) {
1919
return nil, 0, nil
2020
}
21-
func unmarshal(data []byte, payloadType byte, v interface{}) (err error) {
21+
func unmarshal(data []byte, payloadType byte, v any) (err error) {
2222
return nil
2323
}
2424

@@ -30,7 +30,7 @@ func xss(w http.ResponseWriter, r *http.Request) {
3030
var xnet = make([]byte, 512) // $ Source[go/reflected-xss]
3131
ws.Read(xnet)
3232
fmt.Fprintf(w, "%v", xnet) // $ Alert[go/reflected-xss]
33-
codec := &websocket.Codec{marshal, unmarshal}
33+
codec := &websocket.Codec{Marshal: marshal, Unmarshal: unmarshal}
3434
xnet2 := make([]byte, 512) // $ Source[go/reflected-xss]
3535
codec.Receive(ws, xnet2)
3636
fmt.Fprintf(w, "%v", xnet2) // $ Alert[go/reflected-xss]

0 commit comments

Comments
 (0)