Skip to content

Commit 93bc8aa

Browse files
author
Benjamin Muskalla
committed
Fix tests to take trim into account
1 parent 7be179c commit 93bc8aa

File tree

9 files changed

+83
-22
lines changed

9 files changed

+83
-22
lines changed

‎java/ql/test/experimental/query-tests/security/CWE-094/JakartaExpressionInjection.expected

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
edges
22
| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] |
3-
| JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] | JakartaExpressionInjection.java:25:31:25:40 | expression : String |
3+
| JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] | JakartaExpressionInjection.java:24:48:24:52 | bytes : byte[] |
4+
| JakartaExpressionInjection.java:24:37:24:59 | new String(...) : String | JakartaExpressionInjection.java:25:31:25:40 | expression : String |
5+
| JakartaExpressionInjection.java:24:48:24:52 | bytes : byte[] | JakartaExpressionInjection.java:24:37:24:59 | new String(...) : String |
46
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:32:24:32:33 | expression : String |
57
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:40:24:40:33 | expression : String |
68
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | JakartaExpressionInjection.java:48:24:48:33 | expression : String |
@@ -20,6 +22,8 @@ edges
2022
nodes
2123
| JakartaExpressionInjection.java:23:25:23:47 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
2224
| JakartaExpressionInjection.java:23:54:23:58 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
25+
| JakartaExpressionInjection.java:24:37:24:59 | new String(...) : String | semmle.label | new String(...) : String |
26+
| JakartaExpressionInjection.java:24:48:24:52 | bytes : byte[] | semmle.label | bytes : byte[] |
2327
| JakartaExpressionInjection.java:25:31:25:40 | expression : String | semmle.label | expression : String |
2428
| JakartaExpressionInjection.java:32:24:32:33 | expression : String | semmle.label | expression : String |
2529
| JakartaExpressionInjection.java:34:28:34:37 | expression | semmle.label | expression |

‎java/ql/test/experimental/query-tests/security/CWE-094/JythonInjection.expected

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@ edges
22
| JythonInjection.java:28:23:28:50 | getParameter(...) : String | JythonInjection.java:36:30:36:33 | code |
33
| JythonInjection.java:53:23:53:50 | getParameter(...) : String | JythonInjection.java:58:44:58:47 | code |
44
| JythonInjection.java:73:23:73:50 | getParameter(...) : String | JythonInjection.java:81:35:81:38 | code |
5-
| JythonInjection.java:97:23:97:50 | getParameter(...) : String | JythonInjection.java:106:61:106:75 | getBytes(...) |
5+
| JythonInjection.java:97:23:97:50 | getParameter(...) : String | JythonInjection.java:106:61:106:64 | code : String |
6+
| JythonInjection.java:106:61:106:64 | code : String | JythonInjection.java:106:61:106:75 | getBytes(...) |
67
nodes
78
| JythonInjection.java:28:23:28:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
89
| JythonInjection.java:36:30:36:33 | code | semmle.label | code |
@@ -11,6 +12,7 @@ nodes
1112
| JythonInjection.java:73:23:73:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
1213
| JythonInjection.java:81:35:81:38 | code | semmle.label | code |
1314
| JythonInjection.java:97:23:97:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
15+
| JythonInjection.java:106:61:106:64 | code : String | semmle.label | code : String |
1416
| JythonInjection.java:106:61:106:75 | getBytes(...) | semmle.label | getBytes(...) |
1517
| JythonInjection.java:131:40:131:63 | getInputStream(...) | semmle.label | getInputStream(...) |
1618
#select

‎java/ql/test/experimental/query-tests/security/CWE-094/ScriptInjection.expected

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
edges
22
| RhinoServlet.java:28:23:28:50 | getParameter(...) : String | RhinoServlet.java:32:55:32:58 | code |
33
| RhinoServlet.java:81:23:81:50 | getParameter(...) : String | RhinoServlet.java:83:54:83:57 | code |
4-
| RhinoServlet.java:88:23:88:50 | getParameter(...) : String | RhinoServlet.java:89:74:89:88 | getBytes(...) |
4+
| RhinoServlet.java:88:23:88:50 | getParameter(...) : String | RhinoServlet.java:89:74:89:77 | code : String |
5+
| RhinoServlet.java:89:74:89:77 | code : String | RhinoServlet.java:89:74:89:88 | getBytes(...) |
56
| ScriptEngineTest.java:20:44:20:55 | input : String | ScriptEngineTest.java:24:37:24:41 | input |
67
| ScriptEngineTest.java:27:51:27:62 | input : String | ScriptEngineTest.java:31:31:31:35 | input |
78
| ScriptEngineTest.java:35:58:35:69 | input : String | ScriptEngineTest.java:39:31:39:35 | input |
@@ -26,6 +27,7 @@ nodes
2627
| RhinoServlet.java:81:23:81:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
2728
| RhinoServlet.java:83:54:83:57 | code | semmle.label | code |
2829
| RhinoServlet.java:88:23:88:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
30+
| RhinoServlet.java:89:74:89:77 | code : String | semmle.label | code : String |
2931
| RhinoServlet.java:89:74:89:88 | getBytes(...) | semmle.label | getBytes(...) |
3032
| ScriptEngineTest.java:20:44:20:55 | input : String | semmle.label | input : String |
3133
| ScriptEngineTest.java:24:37:24:41 | input | semmle.label | input |

‎java/ql/test/experimental/query-tests/security/CWE-094/SpelInjection.expected

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,70 @@
11
edges
22
| SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | SpelInjection.java:18:13:18:14 | in : InputStream |
33
| SpelInjection.java:18:13:18:14 | in : InputStream | SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] |
4-
| SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] | SpelInjection.java:23:5:23:14 | expression |
4+
| SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] | SpelInjection.java:19:31:19:35 | bytes : byte[] |
5+
| SpelInjection.java:19:20:19:42 | new String(...) : String | SpelInjection.java:23:5:23:14 | expression |
6+
| SpelInjection.java:19:31:19:35 | bytes : byte[] | SpelInjection.java:19:20:19:42 | new String(...) : String |
57
| SpelInjection.java:27:22:27:44 | getInputStream(...) : InputStream | SpelInjection.java:30:13:30:14 | in : InputStream |
68
| SpelInjection.java:30:13:30:14 | in : InputStream | SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] |
7-
| SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] | SpelInjection.java:34:5:34:14 | expression |
9+
| SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] | SpelInjection.java:31:31:31:35 | bytes : byte[] |
10+
| SpelInjection.java:31:20:31:42 | new String(...) : String | SpelInjection.java:34:5:34:14 | expression |
11+
| SpelInjection.java:31:31:31:35 | bytes : byte[] | SpelInjection.java:31:20:31:42 | new String(...) : String |
812
| SpelInjection.java:38:22:38:44 | getInputStream(...) : InputStream | SpelInjection.java:41:13:41:14 | in : InputStream |
913
| SpelInjection.java:41:13:41:14 | in : InputStream | SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] |
10-
| SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] | SpelInjection.java:48:5:48:14 | expression |
14+
| SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] | SpelInjection.java:42:31:42:35 | bytes : byte[] |
15+
| SpelInjection.java:42:20:42:42 | new String(...) : String | SpelInjection.java:48:5:48:14 | expression |
16+
| SpelInjection.java:42:31:42:35 | bytes : byte[] | SpelInjection.java:42:20:42:42 | new String(...) : String |
1117
| SpelInjection.java:52:22:52:44 | getInputStream(...) : InputStream | SpelInjection.java:55:13:55:14 | in : InputStream |
1218
| SpelInjection.java:55:13:55:14 | in : InputStream | SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] |
13-
| SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] | SpelInjection.java:59:5:59:14 | expression |
19+
| SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] | SpelInjection.java:56:31:56:35 | bytes : byte[] |
20+
| SpelInjection.java:56:20:56:42 | new String(...) : String | SpelInjection.java:59:5:59:14 | expression |
21+
| SpelInjection.java:56:31:56:35 | bytes : byte[] | SpelInjection.java:56:20:56:42 | new String(...) : String |
1422
| SpelInjection.java:63:22:63:44 | getInputStream(...) : InputStream | SpelInjection.java:66:13:66:14 | in : InputStream |
1523
| SpelInjection.java:66:13:66:14 | in : InputStream | SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] |
16-
| SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] | SpelInjection.java:70:5:70:14 | expression |
24+
| SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] | SpelInjection.java:67:31:67:35 | bytes : byte[] |
25+
| SpelInjection.java:67:20:67:42 | new String(...) : String | SpelInjection.java:70:5:70:14 | expression |
26+
| SpelInjection.java:67:31:67:35 | bytes : byte[] | SpelInjection.java:67:20:67:42 | new String(...) : String |
1727
| SpelInjection.java:74:22:74:44 | getInputStream(...) : InputStream | SpelInjection.java:77:13:77:14 | in : InputStream |
1828
| SpelInjection.java:77:13:77:14 | in : InputStream | SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] |
19-
| SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] | SpelInjection.java:83:5:83:14 | expression |
29+
| SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] | SpelInjection.java:78:31:78:35 | bytes : byte[] |
30+
| SpelInjection.java:78:20:78:42 | new String(...) : String | SpelInjection.java:83:5:83:14 | expression |
31+
| SpelInjection.java:78:31:78:35 | bytes : byte[] | SpelInjection.java:78:20:78:42 | new String(...) : String |
2032
nodes
2133
| SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
2234
| SpelInjection.java:18:13:18:14 | in : InputStream | semmle.label | in : InputStream |
2335
| SpelInjection.java:18:21:18:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
36+
| SpelInjection.java:19:20:19:42 | new String(...) : String | semmle.label | new String(...) : String |
37+
| SpelInjection.java:19:31:19:35 | bytes : byte[] | semmle.label | bytes : byte[] |
2438
| SpelInjection.java:23:5:23:14 | expression | semmle.label | expression |
2539
| SpelInjection.java:27:22:27:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
2640
| SpelInjection.java:30:13:30:14 | in : InputStream | semmle.label | in : InputStream |
2741
| SpelInjection.java:30:21:30:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
42+
| SpelInjection.java:31:20:31:42 | new String(...) : String | semmle.label | new String(...) : String |
43+
| SpelInjection.java:31:31:31:35 | bytes : byte[] | semmle.label | bytes : byte[] |
2844
| SpelInjection.java:34:5:34:14 | expression | semmle.label | expression |
2945
| SpelInjection.java:38:22:38:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
3046
| SpelInjection.java:41:13:41:14 | in : InputStream | semmle.label | in : InputStream |
3147
| SpelInjection.java:41:21:41:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
48+
| SpelInjection.java:42:20:42:42 | new String(...) : String | semmle.label | new String(...) : String |
49+
| SpelInjection.java:42:31:42:35 | bytes : byte[] | semmle.label | bytes : byte[] |
3250
| SpelInjection.java:48:5:48:14 | expression | semmle.label | expression |
3351
| SpelInjection.java:52:22:52:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
3452
| SpelInjection.java:55:13:55:14 | in : InputStream | semmle.label | in : InputStream |
3553
| SpelInjection.java:55:21:55:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
54+
| SpelInjection.java:56:20:56:42 | new String(...) : String | semmle.label | new String(...) : String |
55+
| SpelInjection.java:56:31:56:35 | bytes : byte[] | semmle.label | bytes : byte[] |
3656
| SpelInjection.java:59:5:59:14 | expression | semmle.label | expression |
3757
| SpelInjection.java:63:22:63:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
3858
| SpelInjection.java:66:13:66:14 | in : InputStream | semmle.label | in : InputStream |
3959
| SpelInjection.java:66:21:66:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
60+
| SpelInjection.java:67:20:67:42 | new String(...) : String | semmle.label | new String(...) : String |
61+
| SpelInjection.java:67:31:67:35 | bytes : byte[] | semmle.label | bytes : byte[] |
4062
| SpelInjection.java:70:5:70:14 | expression | semmle.label | expression |
4163
| SpelInjection.java:74:22:74:44 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream |
4264
| SpelInjection.java:77:13:77:14 | in : InputStream | semmle.label | in : InputStream |
4365
| SpelInjection.java:77:21:77:25 | bytes [post update] : byte[] | semmle.label | bytes [post update] : byte[] |
66+
| SpelInjection.java:78:20:78:42 | new String(...) : String | semmle.label | new String(...) : String |
67+
| SpelInjection.java:78:31:78:35 | bytes : byte[] | semmle.label | bytes : byte[] |
4468
| SpelInjection.java:83:5:83:14 | expression | semmle.label | expression |
4569
#select
4670
| SpelInjection.java:23:5:23:14 | expression | SpelInjection.java:15:22:15:44 | getInputStream(...) : InputStream | SpelInjection.java:23:5:23:14 | expression | SpEL injection from $@. | SpelInjection.java:15:22:15:44 | getInputStream(...) | this user input |

‎java/ql/test/query-tests/security/CWE-089/semmle/examples/SqlTaintedLocal.expected

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,14 @@ edges
44
| Test.java:29:30:29:42 | args : String[] | Test.java:36:47:36:52 | query1 |
55
| Test.java:29:30:29:42 | args : String[] | Test.java:42:57:42:62 | query2 |
66
| Test.java:29:30:29:42 | args : String[] | Test.java:50:62:50:67 | query3 |
7+
| Test.java:29:30:29:42 | args : String[] | Test.java:58:19:58:26 | category : String |
78
| Test.java:29:30:29:42 | args : String[] | Test.java:62:47:62:61 | querySbToString |
89
| Test.java:29:30:29:42 | args : String[] | Test.java:70:40:70:44 | query |
910
| Test.java:29:30:29:42 | args : String[] | Test.java:78:46:78:50 | query |
11+
| Test.java:58:4:58:10 | querySb [post update] : StringBuilder | Test.java:60:29:60:35 | querySb : StringBuilder |
12+
| Test.java:58:19:58:26 | category : String | Test.java:58:4:58:10 | querySb [post update] : StringBuilder |
13+
| Test.java:60:29:60:35 | querySb : StringBuilder | Test.java:60:29:60:46 | toString(...) : String |
14+
| Test.java:60:29:60:46 | toString(...) : String | Test.java:62:47:62:61 | querySbToString |
1015
| Test.java:183:33:183:45 | args : String[] | Test.java:209:47:209:68 | queryWithUserTableName |
1116
| Test.java:213:26:213:38 | args : String[] | Test.java:214:11:214:14 | args : String[] |
1217
| Test.java:213:26:213:38 | args : String[] | Test.java:218:14:218:17 | args : String[] |
@@ -20,6 +25,10 @@ nodes
2025
| Test.java:36:47:36:52 | query1 | semmle.label | query1 |
2126
| Test.java:42:57:42:62 | query2 | semmle.label | query2 |
2227
| Test.java:50:62:50:67 | query3 | semmle.label | query3 |
28+
| Test.java:58:4:58:10 | querySb [post update] : StringBuilder | semmle.label | querySb [post update] : StringBuilder |
29+
| Test.java:58:19:58:26 | category : String | semmle.label | category : String |
30+
| Test.java:60:29:60:35 | querySb : StringBuilder | semmle.label | querySb : StringBuilder |
31+
| Test.java:60:29:60:46 | toString(...) : String | semmle.label | toString(...) : String |
2332
| Test.java:62:47:62:61 | querySbToString | semmle.label | querySbToString |
2433
| Test.java:70:40:70:44 | query | semmle.label | query |
2534
| Test.java:78:46:78:50 | query | semmle.label | query |

‎java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayConstructionLocal.expected

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
edges
2-
| Test.java:76:27:76:60 | getProperty(...) : String | Test.java:80:31:80:34 | size |
3-
| Test.java:76:27:76:60 | getProperty(...) : String | Test.java:86:34:86:37 | size |
2+
| Test.java:76:27:76:60 | getProperty(...) : String | Test.java:78:37:78:48 | userProperty : String |
3+
| Test.java:78:37:78:48 | userProperty : String | Test.java:78:37:78:55 | trim(...) : String |
4+
| Test.java:78:37:78:55 | trim(...) : String | Test.java:80:31:80:34 | size |
5+
| Test.java:78:37:78:55 | trim(...) : String | Test.java:86:34:86:37 | size |
46
nodes
57
| Test.java:76:27:76:60 | getProperty(...) : String | semmle.label | getProperty(...) : String |
8+
| Test.java:78:37:78:48 | userProperty : String | semmle.label | userProperty : String |
9+
| Test.java:78:37:78:55 | trim(...) : String | semmle.label | trim(...) : String |
610
| Test.java:80:31:80:34 | size | semmle.label | size |
711
| Test.java:86:34:86:37 | size | semmle.label | size |
812
#select

‎java/ql/test/query-tests/security/CWE-129/semmle/tests/ImproperValidationOfArrayIndexLocal.expected

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
edges
2-
| Test.java:14:27:14:60 | getProperty(...) : String | Test.java:19:34:19:38 | index |
2+
| Test.java:14:27:14:60 | getProperty(...) : String | Test.java:16:38:16:49 | userProperty : String |
3+
| Test.java:16:38:16:49 | userProperty : String | Test.java:16:38:16:56 | trim(...) : String |
4+
| Test.java:16:38:16:56 | trim(...) : String | Test.java:19:34:19:38 | index |
35
nodes
46
| Test.java:14:27:14:60 | getProperty(...) : String | semmle.label | getProperty(...) : String |
7+
| Test.java:16:38:16:49 | userProperty : String | semmle.label | userProperty : String |
8+
| Test.java:16:38:16:56 | trim(...) : String | semmle.label | trim(...) : String |
59
| Test.java:19:34:19:38 | index | semmle.label | index |
610
#select
711
| Test.java:19:34:19:38 | index | Test.java:14:27:14:60 | getProperty(...) : String | Test.java:19:34:19:38 | index | $@ flows to here and is used as an index causing an ArrayIndexOutOfBoundsException. | Test.java:14:27:14:60 | getProperty(...) | User-provided value |

0 commit comments

Comments
 (0)