Skip to content

Commit f824a89

Browse files
geoffw0geoffw0
committed
C++: Add test cases for appending strings.
1 parent 030ab4f commit f824a89

File tree

2 files changed

+88
-0
lines changed

2 files changed

+88
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -507,6 +507,52 @@
507507
| stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | (__range) | |
508508
| stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | (__range) | |
509509
| stl.cpp:315:21:315:27 | const_v | stl.cpp:315:21:315:21 | call to operator* | TAINT |
510+
| stl.cpp:322:18:322:24 | hello | stl.cpp:322:18:322:25 | call to basic_string | TAINT |
511+
| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:325:8:325:9 | s1 | |
512+
| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:325:13:325:14 | s1 | |
513+
| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:326:8:326:9 | s1 | |
514+
| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:327:13:327:14 | s1 | |
515+
| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:330:8:330:9 | s1 | |
516+
| stl.cpp:322:18:322:25 | call to basic_string | stl.cpp:331:8:331:9 | s1 | |
517+
| stl.cpp:323:18:323:23 | call to source | stl.cpp:323:18:323:26 | call to basic_string | TAINT |
518+
| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:326:13:326:14 | s2 | |
519+
| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:327:8:327:9 | s2 | |
520+
| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:8:328:9 | s2 | |
521+
| stl.cpp:323:18:323:26 | call to basic_string | stl.cpp:328:13:328:14 | s2 | |
522+
| stl.cpp:335:18:335:22 | abc | stl.cpp:335:18:335:23 | call to basic_string | TAINT |
523+
| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:339:8:339:9 | s3 | |
524+
| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:342:8:342:9 | s3 | |
525+
| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:346:8:346:9 | s3 | |
526+
| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:351:8:351:9 | s3 | |
527+
| stl.cpp:335:18:335:23 | call to basic_string | stl.cpp:355:8:355:9 | s3 | |
528+
| stl.cpp:336:18:336:23 | call to source | stl.cpp:336:18:336:26 | call to basic_string | TAINT |
529+
| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:339:13:339:14 | s4 | |
530+
| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:343:9:343:10 | s4 | |
531+
| stl.cpp:336:18:336:26 | call to basic_string | stl.cpp:352:13:352:14 | s4 | |
532+
| stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:339:3:339:14 | ... = ... | |
533+
| stl.cpp:339:11:339:11 | call to operator+ | stl.cpp:340:8:340:9 | s5 | |
534+
| stl.cpp:342:8:342:9 | s3 | stl.cpp:342:3:342:9 | ... = ... | |
535+
| stl.cpp:342:8:342:9 | s3 | stl.cpp:343:3:343:4 | s6 | |
536+
| stl.cpp:342:8:342:9 | s3 | stl.cpp:344:8:344:9 | s6 | |
537+
| stl.cpp:343:3:343:4 | ref arg s6 | stl.cpp:344:8:344:9 | s6 | |
538+
| stl.cpp:346:8:346:9 | s3 | stl.cpp:346:3:346:9 | ... = ... | |
539+
| stl.cpp:346:8:346:9 | s3 | stl.cpp:347:3:347:4 | s7 | |
540+
| stl.cpp:346:8:346:9 | s3 | stl.cpp:348:3:348:4 | s7 | |
541+
| stl.cpp:346:8:346:9 | s3 | stl.cpp:349:8:349:9 | s7 | |
542+
| stl.cpp:347:3:347:4 | ref arg s7 | stl.cpp:348:3:348:4 | s7 | |
543+
| stl.cpp:347:3:347:4 | ref arg s7 | stl.cpp:349:8:349:9 | s7 | |
544+
| stl.cpp:348:3:348:4 | ref arg s7 | stl.cpp:349:8:349:9 | s7 | |
545+
| stl.cpp:351:8:351:9 | s3 | stl.cpp:351:3:351:9 | ... = ... | |
546+
| stl.cpp:351:8:351:9 | s3 | stl.cpp:352:3:352:4 | s8 | |
547+
| stl.cpp:351:8:351:9 | s3 | stl.cpp:353:8:353:9 | s8 | |
548+
| stl.cpp:352:3:352:4 | ref arg s8 | stl.cpp:353:8:353:9 | s8 | |
549+
| stl.cpp:355:8:355:9 | s3 | stl.cpp:355:3:355:9 | ... = ... | |
550+
| stl.cpp:355:8:355:9 | s3 | stl.cpp:356:3:356:4 | s9 | |
551+
| stl.cpp:355:8:355:9 | s3 | stl.cpp:357:3:357:4 | s9 | |
552+
| stl.cpp:355:8:355:9 | s3 | stl.cpp:358:8:358:9 | s9 | |
553+
| stl.cpp:356:3:356:4 | ref arg s9 | stl.cpp:357:3:357:4 | s9 | |
554+
| stl.cpp:356:3:356:4 | ref arg s9 | stl.cpp:358:8:358:9 | s9 | |
555+
| stl.cpp:357:3:357:4 | ref arg s9 | stl.cpp:358:8:358:9 | s9 | |
510556
| structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
511557
| structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
512558
| structlikeclass.cpp:5:7:5:7 | this | structlikeclass.cpp:5:7:5:7 | constructor init of field v [pre-this] | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,3 +316,45 @@ void test_range_based_for_loop_vector(int source1) {
316316
sink(x); // tainted [NOT DETECTED by IR]
317317
}
318318
}
319+
320+
void test_string_append() {
321+
{
322+
std::string s1("hello");
323+
std::string s2(source());
324+
325+
sink(s1 + s1);
326+
sink(s1 + s2); // tainted [NOT DETECTED]
327+
sink(s2 + s1); // tainted [NOT DETECTED]
328+
sink(s2 + s2); // tainted [NOT DETECTED]
329+
330+
sink(s1 + " world");
331+
sink(s1 + source()); // tainted [NOT DETECTED]
332+
}
333+
334+
{
335+
std::string s3("abc");
336+
std::string s4(source());
337+
std::string s5, s6, s7, s8, s9;
338+
339+
s5 = s3 + s4;
340+
sink(s5); // tainted [NOT DETECTED]
341+
342+
s6 = s3;
343+
s6 += s4;
344+
sink(s6); // tainted [NOT DETECTED]
345+
346+
s7 = s3;
347+
s7 += source();
348+
s7 += " ";
349+
sink(s7); // tainted [NOT DETECTED]
350+
351+
s8 = s3;
352+
s8.append(s4);
353+
sink(s8); // tainted [NOT DETECTED]
354+
355+
s9 = s3;
356+
s9.append(source());
357+
s9.append(" ");
358+
sink(s9); // tainted [NOT DETECTED]
359+
}
360+
}

0 commit comments

Comments
 (0)