Skip to content

Commit 4990d00

Browse files
MathiasVPMathiasVP
committed
C++: Add taint tests demonstrating lack of taint through range based for loops
1 parent b88ef56 commit 4990d00

File tree

2 files changed

+70
-0
lines changed

2 files changed

+70
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,55 @@
399399
| stl.cpp:228:8:228:28 | call to basic_string | stl.cpp:228:3:228:28 | ... = ... | |
400400
| stl.cpp:228:8:228:28 | call to basic_string | stl.cpp:231:8:231:9 | s2 | |
401401
| stl.cpp:228:20:228:25 | call to source | stl.cpp:228:8:228:28 | call to basic_string | TAINT |
402+
| stl.cpp:238:16:238:21 | call to source | stl.cpp:238:16:238:24 | call to basic_string | TAINT |
403+
| stl.cpp:238:16:238:24 | call to basic_string | stl.cpp:239:15:239:15 | s | |
404+
| stl.cpp:238:16:238:24 | call to basic_string | stl.cpp:243:33:243:33 | s | |
405+
| stl.cpp:238:16:238:24 | call to basic_string | stl.cpp:243:50:243:50 | s | |
406+
| stl.cpp:238:16:238:24 | call to basic_string | stl.cpp:247:16:247:16 | s | |
407+
| stl.cpp:239:15:239:15 | call to begin | stl.cpp:239:15:239:15 | (__begin) | |
408+
| stl.cpp:239:15:239:15 | call to begin | stl.cpp:239:15:239:15 | (__begin) | |
409+
| stl.cpp:239:15:239:15 | call to begin | stl.cpp:239:15:239:15 | (__begin) | |
410+
| stl.cpp:239:15:239:15 | call to end | stl.cpp:239:15:239:15 | (__end) | |
411+
| stl.cpp:239:15:239:15 | call to operator* | stl.cpp:240:8:240:8 | c | |
412+
| stl.cpp:239:15:239:15 | ref arg (__begin) | stl.cpp:239:15:239:15 | (__begin) | |
413+
| stl.cpp:239:15:239:15 | ref arg (__begin) | stl.cpp:239:15:239:15 | (__begin) | |
414+
| stl.cpp:239:15:239:15 | ref arg (__begin) | stl.cpp:239:15:239:15 | (__begin) | |
415+
| stl.cpp:239:15:239:15 | ref arg (__range) | stl.cpp:239:15:239:15 | (__range) | |
416+
| stl.cpp:239:15:239:15 | s | stl.cpp:239:15:239:15 | (__range) | |
417+
| stl.cpp:239:15:239:15 | s | stl.cpp:239:15:239:15 | (__range) | |
418+
| stl.cpp:243:33:243:33 | ref arg s | stl.cpp:243:50:243:50 | s | |
419+
| stl.cpp:243:33:243:33 | ref arg s | stl.cpp:247:16:247:16 | s | |
420+
| stl.cpp:243:35:243:39 | call to begin | stl.cpp:243:44:243:45 | it | |
421+
| stl.cpp:243:35:243:39 | call to begin | stl.cpp:243:61:243:62 | it | |
422+
| stl.cpp:243:35:243:39 | call to begin | stl.cpp:244:9:244:10 | it | |
423+
| stl.cpp:243:50:243:50 | ref arg s | stl.cpp:243:50:243:50 | s | |
424+
| stl.cpp:243:50:243:50 | ref arg s | stl.cpp:247:16:247:16 | s | |
425+
| stl.cpp:243:61:243:62 | ref arg it | stl.cpp:243:44:243:45 | it | |
426+
| stl.cpp:243:61:243:62 | ref arg it | stl.cpp:243:61:243:62 | it | |
427+
| stl.cpp:243:61:243:62 | ref arg it | stl.cpp:244:9:244:10 | it | |
428+
| stl.cpp:247:16:247:16 | call to begin | stl.cpp:247:16:247:16 | (__begin) | |
429+
| stl.cpp:247:16:247:16 | call to begin | stl.cpp:247:16:247:16 | (__begin) | |
430+
| stl.cpp:247:16:247:16 | call to begin | stl.cpp:247:16:247:16 | (__begin) | |
431+
| stl.cpp:247:16:247:16 | call to end | stl.cpp:247:16:247:16 | (__end) | |
432+
| stl.cpp:247:16:247:16 | call to operator* | stl.cpp:248:8:248:8 | c | |
433+
| stl.cpp:247:16:247:16 | ref arg (__begin) | stl.cpp:247:16:247:16 | (__begin) | |
434+
| stl.cpp:247:16:247:16 | ref arg (__begin) | stl.cpp:247:16:247:16 | (__begin) | |
435+
| stl.cpp:247:16:247:16 | ref arg (__begin) | stl.cpp:247:16:247:16 | (__begin) | |
436+
| stl.cpp:247:16:247:16 | ref arg (__range) | stl.cpp:247:16:247:16 | (__range) | |
437+
| stl.cpp:247:16:247:16 | s | stl.cpp:247:16:247:16 | (__range) | |
438+
| stl.cpp:247:16:247:16 | s | stl.cpp:247:16:247:16 | (__range) | |
439+
| stl.cpp:251:28:251:33 | call to source | stl.cpp:251:28:251:36 | call to basic_string | TAINT |
440+
| stl.cpp:251:28:251:36 | call to basic_string | stl.cpp:252:22:252:28 | const_s | |
441+
| stl.cpp:252:22:252:22 | call to begin | stl.cpp:252:22:252:22 | (__begin) | |
442+
| stl.cpp:252:22:252:22 | call to begin | stl.cpp:252:22:252:22 | (__begin) | |
443+
| stl.cpp:252:22:252:22 | call to begin | stl.cpp:252:22:252:22 | (__begin) | |
444+
| stl.cpp:252:22:252:22 | call to end | stl.cpp:252:22:252:22 | (__end) | |
445+
| stl.cpp:252:22:252:22 | call to operator* | stl.cpp:253:8:253:8 | c | |
446+
| stl.cpp:252:22:252:22 | ref arg (__begin) | stl.cpp:252:22:252:22 | (__begin) | |
447+
| stl.cpp:252:22:252:22 | ref arg (__begin) | stl.cpp:252:22:252:22 | (__begin) | |
448+
| stl.cpp:252:22:252:22 | ref arg (__begin) | stl.cpp:252:22:252:22 | (__begin) | |
449+
| stl.cpp:252:22:252:28 | const_s | stl.cpp:252:22:252:22 | (__range) | |
450+
| stl.cpp:252:22:252:28 | const_s | stl.cpp:252:22:252:22 | (__range) | |
402451
| structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
403452
| structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
404453
| structlikeclass.cpp:5:7:5:7 | this | structlikeclass.cpp:5:7:5:7 | constructor init of field v [pre-this] | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -232,3 +232,24 @@ void test_string_constructors_assignments()
232232
}
233233
}
234234

235+
void sink(char) {}
236+
237+
void test_range_based_for_loop() {
238+
std::string s(source());
239+
for(char c : s) {
240+
sink(c); // tainted [NOT DETECTED]
241+
}
242+
243+
for(std::string::iterator it = s.begin(); it != s.end(); ++it) {
244+
sink(*it); // tainted [NOT DETECTED]
245+
}
246+
247+
for(char& c : s) {
248+
sink(c); // tainted [NOT DETECTED]
249+
}
250+
251+
const std::string const_s(source());
252+
for(const char& c : const_s) {
253+
sink(c); // tainted [NOT DETECTED]
254+
}
255+
}

0 commit comments

Comments
 (0)