Skip to content

Commit 2c624c2

Browse files
tamasvajktamasvajk
committed
Add test cases for missing flow with interpolated strings and StringBuilder 
1 parent 9f24b02 commit 2c624c2

File tree

4 files changed

+46
-19
lines changed

4 files changed

+46
-19
lines changed

‎csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -166,10 +166,18 @@
166166
| GlobalDataFlow.cs:545:17:545:33 | object creation of type SimpleClass | normal | GlobalDataFlow.cs:545:17:545:33 | object creation of type SimpleClass |
167167
| GlobalDataFlow.cs:558:44:558:47 | delegate call | normal | GlobalDataFlow.cs:558:44:558:47 | delegate call |
168168
| GlobalDataFlowStringBuilder.cs:19:9:19:20 | call to method Append | normal | GlobalDataFlowStringBuilder.cs:19:9:19:20 | call to method Append |
169-
| GlobalDataFlowStringBuilder.cs:24:18:24:36 | object creation of type StringBuilder | normal | GlobalDataFlowStringBuilder.cs:24:18:24:36 | object creation of type StringBuilder |
170-
| GlobalDataFlowStringBuilder.cs:26:22:26:34 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:26:22:26:34 | call to method ToString |
171-
| GlobalDataFlowStringBuilder.cs:29:9:29:18 | call to method Clear | normal | GlobalDataFlowStringBuilder.cs:29:9:29:18 | call to method Clear |
172-
| GlobalDataFlowStringBuilder.cs:30:23:30:35 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:30:23:30:35 | call to method ToString |
169+
| GlobalDataFlowStringBuilder.cs:24:9:24:27 | call to method Append | normal | GlobalDataFlowStringBuilder.cs:24:9:24:27 | call to method Append |
170+
| GlobalDataFlowStringBuilder.cs:29:18:29:36 | object creation of type StringBuilder | normal | GlobalDataFlowStringBuilder.cs:29:18:29:36 | object creation of type StringBuilder |
171+
| GlobalDataFlowStringBuilder.cs:31:21:31:33 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:31:21:31:33 | call to method ToString |
172+
| GlobalDataFlowStringBuilder.cs:34:19:34:37 | object creation of type StringBuilder | normal | GlobalDataFlowStringBuilder.cs:34:19:34:37 | object creation of type StringBuilder |
173+
| GlobalDataFlowStringBuilder.cs:35:9:35:22 | call to method Append | normal | GlobalDataFlowStringBuilder.cs:35:9:35:22 | call to method Append |
174+
| GlobalDataFlowStringBuilder.cs:36:21:36:34 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:36:21:36:34 | call to method ToString |
175+
| GlobalDataFlowStringBuilder.cs:39:19:39:37 | object creation of type StringBuilder | normal | GlobalDataFlowStringBuilder.cs:39:19:39:37 | object creation of type StringBuilder |
176+
| GlobalDataFlowStringBuilder.cs:40:9:40:27 | call to method Append | normal | GlobalDataFlowStringBuilder.cs:40:9:40:27 | call to method Append |
177+
| GlobalDataFlowStringBuilder.cs:41:21:41:34 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:41:21:41:34 | call to method ToString |
178+
| GlobalDataFlowStringBuilder.cs:44:9:44:18 | call to method Clear | normal | GlobalDataFlowStringBuilder.cs:44:9:44:18 | call to method Clear |
179+
| GlobalDataFlowStringBuilder.cs:45:23:45:35 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:45:23:45:35 | call to method ToString |
180+
| GlobalDataFlowStringBuilder.cs:49:21:49:33 | call to method ToString | normal | GlobalDataFlowStringBuilder.cs:49:21:49:33 | call to method ToString |
173181
| Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return<String> | normal | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return<String> |
174182
| Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return<String> | normal | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return<String> |
175183
| Splitting.cs:20:22:20:30 | call to method Return<String> | normal | Splitting.cs:20:22:20:30 | call to method Return<String> |

‎csharp/ql/test/library-tests/dataflow/global/GlobalDataFlowStringBuilder.cs

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,34 @@ static void AppendToStringBuilder(StringBuilder sb, string s)
1919
sb.Append(s);
2020
}
2121

22+
static void AppendToStringBuilderInterpolated(StringBuilder sb, string s)
23+
{
24+
sb.Append($"a{s}b");
25+
}
26+
2227
void TestStringBuilderFlow()
2328
{
2429
var sb = new StringBuilder();
2530
AppendToStringBuilder(sb, "taint source");
26-
var sink43 = sb.ToString();
27-
Check(sink43);
31+
var sink0 = sb.ToString();
32+
Check(sink0);
33+
34+
var sb1 = new StringBuilder();
35+
sb1.Append(sb);
36+
var sink1 = sb1.ToString();
37+
Check(sink1);
38+
39+
var sb2 = new StringBuilder();
40+
sb2.Append($"{sb}");
41+
var sink2 = sb2.ToString();
42+
Check(sink2);
2843

2944
sb.Clear();
3045
var nonSink = sb.ToString();
3146
Check(nonSink);
47+
48+
AppendToStringBuilderInterpolated(sb, "taint source");
49+
var sink3 = sb.ToString();
50+
Check(sink3);
3251
}
3352
}

‎csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@
7272
| GlobalDataFlow.cs:533:15:533:21 | access to field field |
7373
| GlobalDataFlow.cs:539:15:539:22 | access to field field |
7474
| GlobalDataFlow.cs:547:15:547:21 | access to field field |
75-
| GlobalDataFlowStringBuilder.cs:27:15:27:20 | access to local variable sink43 |
75+
| GlobalDataFlowStringBuilder.cs:32:15:32:19 | access to local variable sink0 |
7676
| Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
7777
| Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x |
7878
| Splitting.cs:11:19:11:19 | access to local variable x |

‎csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -328,11 +328,11 @@ edges
328328
| GlobalDataFlow.cs:558:46:558:46 | access to local variable x : String | GlobalDataFlow.cs:558:44:558:47 | delegate call : String |
329329
| GlobalDataFlowStringBuilder.cs:17:64:17:64 | s : String | GlobalDataFlowStringBuilder.cs:19:19:19:19 | access to parameter s : String |
330330
| GlobalDataFlowStringBuilder.cs:19:19:19:19 | access to parameter s : String | GlobalDataFlowStringBuilder.cs:19:9:19:10 | [post] access to parameter sb : StringBuilder |
331-
| GlobalDataFlowStringBuilder.cs:25:31:25:32 | [post] access to local variable sb : StringBuilder | GlobalDataFlowStringBuilder.cs:26:22:26:23 | access to local variable sb : StringBuilder |
332-
| GlobalDataFlowStringBuilder.cs:25:35:25:48 | "taint source" : String | GlobalDataFlowStringBuilder.cs:17:64:17:64 | s : String |
333-
| GlobalDataFlowStringBuilder.cs:25:35:25:48 | "taint source" : String | GlobalDataFlowStringBuilder.cs:25:31:25:32 | [post] access to local variable sb : StringBuilder |
334-
| GlobalDataFlowStringBuilder.cs:26:22:26:23 | access to local variable sb : StringBuilder | GlobalDataFlowStringBuilder.cs:26:22:26:34 | call to method ToString : String |
335-
| GlobalDataFlowStringBuilder.cs:26:22:26:34 | call to method ToString : String | GlobalDataFlowStringBuilder.cs:27:15:27:20 | access to local variable sink43 |
331+
| GlobalDataFlowStringBuilder.cs:30:31:30:32 | [post] access to local variable sb : StringBuilder | GlobalDataFlowStringBuilder.cs:31:21:31:22 | access to local variable sb : StringBuilder |
332+
| GlobalDataFlowStringBuilder.cs:30:35:30:48 | "taint source" : String | GlobalDataFlowStringBuilder.cs:17:64:17:64 | s : String |
333+
| GlobalDataFlowStringBuilder.cs:30:35:30:48 | "taint source" : String | GlobalDataFlowStringBuilder.cs:30:31:30:32 | [post] access to local variable sb : StringBuilder |
334+
| GlobalDataFlowStringBuilder.cs:31:21:31:22 | access to local variable sb : StringBuilder | GlobalDataFlowStringBuilder.cs:31:21:31:33 | call to method ToString : String |
335+
| GlobalDataFlowStringBuilder.cs:31:21:31:33 | call to method ToString : String | GlobalDataFlowStringBuilder.cs:32:15:32:19 | access to local variable sink0 |
336336
| Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:8:24:8:30 | [b (line 3): false] access to parameter tainted : String |
337337
| Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:8:24:8:30 | [b (line 3): true] access to parameter tainted : String |
338338
| Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return<String> : String | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
@@ -657,11 +657,11 @@ nodes
657657
| GlobalDataFlowStringBuilder.cs:17:64:17:64 | s : String | semmle.label | s : String |
658658
| GlobalDataFlowStringBuilder.cs:19:9:19:10 | [post] access to parameter sb : StringBuilder | semmle.label | [post] access to parameter sb : StringBuilder |
659659
| GlobalDataFlowStringBuilder.cs:19:19:19:19 | access to parameter s : String | semmle.label | access to parameter s : String |
660-
| GlobalDataFlowStringBuilder.cs:25:31:25:32 | [post] access to local variable sb : StringBuilder | semmle.label | [post] access to local variable sb : StringBuilder |
661-
| GlobalDataFlowStringBuilder.cs:25:35:25:48 | "taint source" : String | semmle.label | "taint source" : String |
662-
| GlobalDataFlowStringBuilder.cs:26:22:26:23 | access to local variable sb : StringBuilder | semmle.label | access to local variable sb : StringBuilder |
663-
| GlobalDataFlowStringBuilder.cs:26:22:26:34 | call to method ToString : String | semmle.label | call to method ToString : String |
664-
| GlobalDataFlowStringBuilder.cs:27:15:27:20 | access to local variable sink43 | semmle.label | access to local variable sink43 |
660+
| GlobalDataFlowStringBuilder.cs:30:31:30:32 | [post] access to local variable sb : StringBuilder | semmle.label | [post] access to local variable sb : StringBuilder |
661+
| GlobalDataFlowStringBuilder.cs:30:35:30:48 | "taint source" : String | semmle.label | "taint source" : String |
662+
| GlobalDataFlowStringBuilder.cs:31:21:31:22 | access to local variable sb : StringBuilder | semmle.label | access to local variable sb : StringBuilder |
663+
| GlobalDataFlowStringBuilder.cs:31:21:31:33 | call to method ToString : String | semmle.label | call to method ToString : String |
664+
| GlobalDataFlowStringBuilder.cs:32:15:32:19 | access to local variable sink0 | semmle.label | access to local variable sink0 |
665665
| Splitting.cs:3:28:3:34 | tainted : String | semmle.label | tainted : String |
666666
| Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return<String> : String | semmle.label | [b (line 3): false] call to method Return<String> : String |
667667
| Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return<String> : String | semmle.label | [b (line 3): true] call to method Return<String> : String |
@@ -708,7 +708,7 @@ subpaths
708708
| GlobalDataFlow.cs:389:18:389:18 | access to parameter x : String | GlobalDataFlow.cs:298:26:298:26 | x : String | GlobalDataFlow.cs:301:16:301:41 | ... ? ... : ... : String | GlobalDataFlow.cs:389:16:389:19 | delegate call : String |
709709
| GlobalDataFlow.cs:389:18:389:18 | access to parameter x : String | GlobalDataFlow.cs:300:27:300:28 | x0 : String | GlobalDataFlow.cs:300:33:300:34 | access to parameter x0 : String | GlobalDataFlow.cs:389:16:389:19 | delegate call : String |
710710
| GlobalDataFlow.cs:558:46:558:46 | access to local variable x : String | GlobalDataFlow.cs:81:79:81:79 | x : String | GlobalDataFlow.cs:81:84:81:84 | access to parameter x : String | GlobalDataFlow.cs:558:44:558:47 | delegate call : String |
711-
| GlobalDataFlowStringBuilder.cs:25:35:25:48 | "taint source" : String | GlobalDataFlowStringBuilder.cs:17:64:17:64 | s : String | GlobalDataFlowStringBuilder.cs:19:9:19:10 | [post] access to parameter sb : StringBuilder | GlobalDataFlowStringBuilder.cs:25:31:25:32 | [post] access to local variable sb : StringBuilder |
711+
| GlobalDataFlowStringBuilder.cs:30:35:30:48 | "taint source" : String | GlobalDataFlowStringBuilder.cs:17:64:17:64 | s : String | GlobalDataFlowStringBuilder.cs:19:9:19:10 | [post] access to parameter sb : StringBuilder | GlobalDataFlowStringBuilder.cs:30:31:30:32 | [post] access to local variable sb : StringBuilder |
712712
| Splitting.cs:8:24:8:30 | [b (line 3): false] access to parameter tainted : String | Splitting.cs:16:26:16:26 | x : String | Splitting.cs:16:32:16:32 | access to parameter x : String | Splitting.cs:8:17:8:31 | [b (line 3): false] call to method Return<String> : String |
713713
| Splitting.cs:8:24:8:30 | [b (line 3): true] access to parameter tainted : String | Splitting.cs:16:26:16:26 | x : String | Splitting.cs:16:32:16:32 | access to parameter x : String | Splitting.cs:8:17:8:31 | [b (line 3): true] call to method Return<String> : String |
714714
| Splitting.cs:20:29:20:29 | access to parameter s : String | Splitting.cs:16:26:16:26 | x : String | Splitting.cs:16:32:16:32 | access to parameter x : String | Splitting.cs:20:22:20:30 | call to method Return<String> : String |
@@ -790,7 +790,7 @@ subpaths
790790
| GlobalDataFlow.cs:533:15:533:21 | access to field field | GlobalDataFlow.cs:483:20:483:33 | "taint source" : String | GlobalDataFlow.cs:533:15:533:21 | access to field field | access to field field |
791791
| GlobalDataFlow.cs:539:15:539:22 | access to field field | GlobalDataFlow.cs:483:20:483:33 | "taint source" : String | GlobalDataFlow.cs:539:15:539:22 | access to field field | access to field field |
792792
| GlobalDataFlow.cs:547:15:547:21 | access to field field | GlobalDataFlow.cs:483:20:483:33 | "taint source" : String | GlobalDataFlow.cs:547:15:547:21 | access to field field | access to field field |
793-
| GlobalDataFlowStringBuilder.cs:27:15:27:20 | access to local variable sink43 | GlobalDataFlowStringBuilder.cs:25:35:25:48 | "taint source" : String | GlobalDataFlowStringBuilder.cs:27:15:27:20 | access to local variable sink43 | access to local variable sink43 |
793+
| GlobalDataFlowStringBuilder.cs:32:15:32:19 | access to local variable sink0 | GlobalDataFlowStringBuilder.cs:30:35:30:48 | "taint source" : String | GlobalDataFlowStringBuilder.cs:32:15:32:19 | access to local variable sink0 | access to local variable sink0 |
794794
| Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x | [b (line 3): false] access to local variable x |
795795
| Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x | [b (line 3): true] access to local variable x |
796796
| Splitting.cs:11:19:11:19 | access to local variable x | Splitting.cs:3:28:3:34 | tainted : String | Splitting.cs:11:19:11:19 | access to local variable x | access to local variable x |

0 commit comments

Comments
 (0)