Skip to content

Commit fae5320

Browse files
hmachmac
committed
Ruby: Add filter flow tests
1 parent 04e80fa commit fae5320

File tree

4 files changed

+191
-6
lines changed

4 files changed

+191
-6
lines changed

‎ruby/ql/test/library-tests/frameworks/action_controller/ActionController.expected

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ actionControllerControllerClasses
66
| controllers/posts_controller.rb:1:1:32:3 | PostsController |
77
| controllers/tags_controller.rb:1:1:2:3 | TagsController |
88
| controllers/users/notifications_controller.rb:2:3:5:5 | Users::NotificationsController |
9+
| filter_flow.rb:9:1:23:3 | OneController |
10+
| filter_flow.rb:25:1:40:3 | TwoController |
11+
| filter_flow.rb:42:1:57:3 | ThreeController |
12+
| filter_flow.rb:59:1:73:3 | FourController |
13+
| filter_flow.rb:75:1:93:3 | FiveController |
914
| input_access.rb:1:1:50:3 | UsersController |
1015
| params_flow.rb:1:1:162:3 | MyController |
1116
| params_flow.rb:170:1:178:3 | Subclass |
@@ -27,6 +32,22 @@ actionControllerActionMethods
2732
| controllers/posts_controller.rb:17:3:18:5 | show |
2833
| controllers/posts_controller.rb:20:3:21:5 | upvote |
2934
| controllers/users/notifications_controller.rb:3:5:4:7 | mark_as_read |
35+
| filter_flow.rb:13:3:15:5 | a |
36+
| filter_flow.rb:17:3:18:5 | b |
37+
| filter_flow.rb:20:3:22:5 | c |
38+
| filter_flow.rb:29:3:31:5 | a |
39+
| filter_flow.rb:33:3:35:5 | b |
40+
| filter_flow.rb:37:3:39:5 | c |
41+
| filter_flow.rb:46:3:49:5 | a |
42+
| filter_flow.rb:51:3:52:5 | b |
43+
| filter_flow.rb:54:3:56:5 | c |
44+
| filter_flow.rb:63:3:65:5 | a |
45+
| filter_flow.rb:67:3:68:5 | b |
46+
| filter_flow.rb:70:3:72:5 | c |
47+
| filter_flow.rb:79:3:81:5 | a |
48+
| filter_flow.rb:83:3:84:5 | b |
49+
| filter_flow.rb:86:3:88:5 | c |
50+
| filter_flow.rb:90:3:92:5 | taint_foo |
3051
| input_access.rb:2:3:49:5 | index |
3152
| logging.rb:2:5:8:7 | index |
3253
| params_flow.rb:2:3:4:5 | m1 |
@@ -72,6 +93,11 @@ paramsCalls
7293
| controllers/foo/bars_controller.rb:21:21:21:26 | call to params |
7394
| controllers/foo/bars_controller.rb:22:10:22:15 | call to params |
7495
| controllers/posts_controller.rb:26:23:26:28 | call to params |
96+
| filter_flow.rb:14:12:14:17 | call to params |
97+
| filter_flow.rb:30:12:30:17 | call to params |
98+
| filter_flow.rb:47:12:47:17 | call to params |
99+
| filter_flow.rb:64:16:64:21 | call to params |
100+
| filter_flow.rb:91:12:91:17 | call to params |
75101
| params_flow.rb:3:10:3:15 | call to params |
76102
| params_flow.rb:7:10:7:15 | call to params |
77103
| params_flow.rb:11:10:11:15 | call to params |
@@ -127,6 +153,11 @@ paramsSources
127153
| controllers/foo/bars_controller.rb:21:21:21:26 | call to params |
128154
| controllers/foo/bars_controller.rb:22:10:22:15 | call to params |
129155
| controllers/posts_controller.rb:26:23:26:28 | call to params |
156+
| filter_flow.rb:14:12:14:17 | call to params |
157+
| filter_flow.rb:30:12:30:17 | call to params |
158+
| filter_flow.rb:47:12:47:17 | call to params |
159+
| filter_flow.rb:64:16:64:21 | call to params |
160+
| filter_flow.rb:91:12:91:17 | call to params |
130161
| params_flow.rb:3:10:3:15 | call to params |
131162
| params_flow.rb:7:10:7:15 | call to params |
132163
| params_flow.rb:11:10:11:15 | call to params |
@@ -192,6 +223,11 @@ httpInputAccesses
192223
| controllers/foo/bars_controller.rb:21:21:21:26 | call to params | ActionController::Metal#params |
193224
| controllers/foo/bars_controller.rb:22:10:22:15 | call to params | ActionController::Metal#params |
194225
| controllers/posts_controller.rb:26:23:26:28 | call to params | ActionController::Metal#params |
226+
| filter_flow.rb:14:12:14:17 | call to params | ActionController::Metal#params |
227+
| filter_flow.rb:30:12:30:17 | call to params | ActionController::Metal#params |
228+
| filter_flow.rb:47:12:47:17 | call to params | ActionController::Metal#params |
229+
| filter_flow.rb:64:16:64:21 | call to params | ActionController::Metal#params |
230+
| filter_flow.rb:91:12:91:17 | call to params | ActionController::Metal#params |
195231
| input_access.rb:3:5:3:18 | call to params | ActionDispatch::Request#params |
196232
| input_access.rb:4:5:4:22 | call to parameters | ActionDispatch::Request#parameters |
197233
| input_access.rb:5:5:5:15 | call to GET | ActionDispatch::Request#GET |

‎ruby/ql/test/library-tests/frameworks/action_controller/Filters.expected

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@ additionalFlowSteps
22
| controllers/application_controller.rb:7:5:7:9 | [post] self | controllers/comments_controller.rb:74:3:77:5 | self in ensure_user_can_edit_comments |
33
| controllers/application_controller.rb:7:5:7:9 | [post] self | controllers/comments_controller.rb:79:3:81:5 | self in set_comment |
44
| controllers/application_controller.rb:7:5:7:9 | [post] self | controllers/comments_controller.rb:99:3:100:5 | self in foo |
5-
| controllers/application_controller.rb:7:5:7:9 | [post] self | controllers/posts_controller.rb:12:3:13:5 | self in index |
6-
| controllers/application_controller.rb:7:5:7:9 | [post] self | controllers/posts_controller.rb:15:3:16:5 | self in show |
7-
| controllers/application_controller.rb:7:5:7:9 | [post] self | controllers/posts_controller.rb:18:3:19:5 | self in upvote |
5+
| controllers/application_controller.rb:7:5:7:9 | [post] self | controllers/posts_controller.rb:12:3:15:5 | self in index |
6+
| controllers/application_controller.rb:7:5:7:9 | [post] self | controllers/posts_controller.rb:17:3:18:5 | self in show |
7+
| controllers/application_controller.rb:7:5:7:9 | [post] self | controllers/posts_controller.rb:20:3:21:5 | self in upvote |
88
| controllers/application_controller.rb:11:53:11:59 | self | controllers/application_controller.rb:6:3:8:5 | self in set_user |
99
| controllers/application_controller.rb:11:53:11:59 | self | controllers/photos_controller.rb:3:3:6:5 | self in show |
10-
| controllers/application_controller.rb:11:53:11:59 | self | controllers/posts_controller.rb:23:3:25:5 | self in set_post |
10+
| controllers/application_controller.rb:11:53:11:59 | self | controllers/posts_controller.rb:25:3:27:5 | self in set_post |
1111
| controllers/comments_controller.rb:50:5:50:12 | self | controllers/comments_controller.rb:87:3:89:5 | self in check_feature_flags |
1212
| controllers/comments_controller.rb:53:3:54:5 | self in create | controllers/comments_controller.rb:83:3:85:5 | self in log_comment_change |
1313
| controllers/comments_controller.rb:57:5:61:7 | self | controllers/comments_controller.rb:87:3:89:5 | self in check_feature_flags |
@@ -28,8 +28,18 @@ additionalFlowSteps
2828
| controllers/comments_controller.rb:102:3:103:5 | self in bar | controllers/comments_controller.rb:64:3:66:5 | self in photo |
2929
| controllers/comments_controller.rb:102:3:103:5 | self in bar | controllers/comments_controller.rb:68:3:70:5 | self in destroy |
3030
| controllers/photos_controller.rb:5:5:5:6 | [post] self | controllers/photos_controller.rb:8:3:9:5 | self in foo |
31-
| controllers/posts_controller.rb:18:3:19:5 | self in upvote | controllers/posts_controller.rb:27:3:29:5 | self in log_upvote |
32-
| controllers/posts_controller.rb:24:5:24:9 | [post] self | controllers/application_controller.rb:6:3:8:5 | self in set_user |
31+
| controllers/posts_controller.rb:20:3:21:5 | self in upvote | controllers/posts_controller.rb:29:3:31:5 | self in log_upvote |
32+
| controllers/posts_controller.rb:26:5:26:9 | [post] self | controllers/application_controller.rb:6:3:8:5 | self in set_user |
33+
| filter_flow.rb:14:5:14:8 | [post] self | filter_flow.rb:17:3:18:5 | self in b |
34+
| filter_flow.rb:17:3:18:5 | self in b | filter_flow.rb:20:3:22:5 | self in c |
35+
| filter_flow.rb:30:5:30:8 | [post] self | filter_flow.rb:33:3:35:5 | self in b |
36+
| filter_flow.rb:34:5:34:8 | [post] self | filter_flow.rb:37:3:39:5 | self in c |
37+
| filter_flow.rb:48:5:48:8 | [post] self | filter_flow.rb:51:3:52:5 | self in b |
38+
| filter_flow.rb:51:3:52:5 | self in b | filter_flow.rb:54:3:56:5 | self in c |
39+
| filter_flow.rb:64:16:64:21 | self | filter_flow.rb:67:3:68:5 | self in b |
40+
| filter_flow.rb:67:3:68:5 | self in b | filter_flow.rb:70:3:72:5 | self in c |
41+
| filter_flow.rb:80:5:80:8 | self | filter_flow.rb:83:3:84:5 | self in b |
42+
| filter_flow.rb:83:3:84:5 | self in b | filter_flow.rb:86:3:88:5 | self in c |
3343
filterChain
3444
| controllers/comments_controller.rb:17:3:51:5 | index | controllers/application_controller.rb:6:3:8:5 | set_user | controllers/comments_controller.rb:99:3:100:5 | foo |
3545
| controllers/comments_controller.rb:17:3:51:5 | index | controllers/application_controller.rb:10:3:12:5 | log_request | controllers/application_controller.rb:6:3:8:5 | set_user |
@@ -84,3 +94,13 @@ filterChain
8494
| controllers/posts_controller.rb:20:3:21:5 | upvote | controllers/application_controller.rb:10:3:12:5 | log_request | controllers/posts_controller.rb:25:3:27:5 | set_post |
8595
| controllers/posts_controller.rb:20:3:21:5 | upvote | controllers/posts_controller.rb:20:3:21:5 | upvote | controllers/posts_controller.rb:29:3:31:5 | log_upvote |
8696
| controllers/posts_controller.rb:20:3:21:5 | upvote | controllers/posts_controller.rb:25:3:27:5 | set_post | controllers/application_controller.rb:6:3:8:5 | set_user |
97+
| filter_flow.rb:17:3:18:5 | b | filter_flow.rb:13:3:15:5 | a | filter_flow.rb:17:3:18:5 | b |
98+
| filter_flow.rb:17:3:18:5 | b | filter_flow.rb:17:3:18:5 | b | filter_flow.rb:20:3:22:5 | c |
99+
| filter_flow.rb:33:3:35:5 | b | filter_flow.rb:29:3:31:5 | a | filter_flow.rb:33:3:35:5 | b |
100+
| filter_flow.rb:33:3:35:5 | b | filter_flow.rb:33:3:35:5 | b | filter_flow.rb:37:3:39:5 | c |
101+
| filter_flow.rb:51:3:52:5 | b | filter_flow.rb:46:3:49:5 | a | filter_flow.rb:51:3:52:5 | b |
102+
| filter_flow.rb:51:3:52:5 | b | filter_flow.rb:51:3:52:5 | b | filter_flow.rb:54:3:56:5 | c |
103+
| filter_flow.rb:67:3:68:5 | b | filter_flow.rb:63:3:65:5 | a | filter_flow.rb:67:3:68:5 | b |
104+
| filter_flow.rb:67:3:68:5 | b | filter_flow.rb:67:3:68:5 | b | filter_flow.rb:70:3:72:5 | c |
105+
| filter_flow.rb:83:3:84:5 | b | filter_flow.rb:79:3:81:5 | a | filter_flow.rb:83:3:84:5 | b |
106+
| filter_flow.rb:83:3:84:5 | b | filter_flow.rb:83:3:84:5 | b | filter_flow.rb:86:3:88:5 | c |

‎ruby/ql/test/library-tests/frameworks/action_controller/filter_flow.rb

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
Rails.application.routes.draw do
2+
get 'one/b', to: "one#b"
3+
get 'two/b', to: "two#b"
4+
get 'three/b', to: "three#b"
5+
get 'four/b', to: "four#b"
6+
get 'five/b', to: "five#b"
7+
end
8+
9+
class OneController < ActionController::Base
10+
before_action :a
11+
after_action :c
12+
13+
def a
14+
@foo = params[:foo]
15+
end
16+
17+
def b
18+
end
19+
20+
def c
21+
sink @foo
22+
end
23+
end
24+
25+
class TwoController < ActionController::Base
26+
before_action :a
27+
after_action :c
28+
29+
def a
30+
@foo = params[:foo]
31+
end
32+
33+
def b
34+
@foo = "safe"
35+
end
36+
37+
def c
38+
sink @foo
39+
end
40+
end
41+
42+
class ThreeController < ActionController::Base
43+
before_action :a
44+
after_action :c
45+
46+
def a
47+
@foo = params[:foo]
48+
@foo = "safe"
49+
end
50+
51+
def b
52+
end
53+
54+
def c
55+
sink @foo
56+
end
57+
end
58+
59+
class FourController < ActionController::Base
60+
before_action :a
61+
after_action :c
62+
63+
def a
64+
@foo.bar = params[:foo]
65+
end
66+
67+
def b
68+
end
69+
70+
def c
71+
sink(@foo.bar)
72+
end
73+
end
74+
75+
class FiveController < ActionController::Base
76+
before_action :a
77+
after_action :c
78+
79+
def a
80+
self.taint_foo
81+
end
82+
83+
def b
84+
end
85+
86+
def c
87+
sink @foo
88+
end
89+
90+
def taint_foo
91+
@foo = params[:foo]
92+
end
93+
end

‎ruby/ql/test/library-tests/frameworks/action_controller/params-flow.expected

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,22 @@
11
failures
2+
| filter_flow.rb:21:10:21:13 | @foo | Unexpected result: hasTaintFlow= |
3+
| filter_flow.rb:71:10:71:17 | call to bar | Unexpected result: hasTaintFlow= |
24
edges
5+
| filter_flow.rb:14:5:14:8 | [post] self [@foo] : | filter_flow.rb:17:3:18:5 | self in b [@foo] : |
6+
| filter_flow.rb:14:12:14:17 | call to params : | filter_flow.rb:14:12:14:23 | ...[...] : |
7+
| filter_flow.rb:14:12:14:23 | ...[...] : | filter_flow.rb:14:5:14:8 | [post] self [@foo] : |
8+
| filter_flow.rb:17:3:18:5 | self in b [@foo] : | filter_flow.rb:20:3:22:5 | self in c [@foo] : |
9+
| filter_flow.rb:20:3:22:5 | self in c [@foo] : | filter_flow.rb:21:10:21:13 | self [@foo] : |
10+
| filter_flow.rb:21:10:21:13 | self [@foo] : | filter_flow.rb:21:10:21:13 | @foo |
11+
| filter_flow.rb:64:5:64:8 | [post] @foo [@bar] : | filter_flow.rb:64:5:64:8 | [post] self [@foo, @bar] : |
12+
| filter_flow.rb:64:5:64:8 | [post] self [@foo, @bar] : | filter_flow.rb:64:16:64:21 | self [@foo, @bar] : |
13+
| filter_flow.rb:64:16:64:21 | call to params : | filter_flow.rb:64:16:64:27 | ...[...] : |
14+
| filter_flow.rb:64:16:64:21 | self [@foo, @bar] : | filter_flow.rb:67:3:68:5 | self in b [@foo, @bar] : |
15+
| filter_flow.rb:64:16:64:27 | ...[...] : | filter_flow.rb:64:5:64:8 | [post] @foo [@bar] : |
16+
| filter_flow.rb:67:3:68:5 | self in b [@foo, @bar] : | filter_flow.rb:70:3:72:5 | self in c [@foo, @bar] : |
17+
| filter_flow.rb:70:3:72:5 | self in c [@foo, @bar] : | filter_flow.rb:71:10:71:13 | self [@foo, @bar] : |
18+
| filter_flow.rb:71:10:71:13 | @foo [@bar] : | filter_flow.rb:71:10:71:17 | call to bar |
19+
| filter_flow.rb:71:10:71:13 | self [@foo, @bar] : | filter_flow.rb:71:10:71:13 | @foo [@bar] : |
320
| params_flow.rb:3:10:3:15 | call to params : | params_flow.rb:3:10:3:19 | ...[...] |
421
| params_flow.rb:7:10:7:15 | call to params : | params_flow.rb:7:10:7:23 | call to as_json |
522
| params_flow.rb:15:10:15:15 | call to params : | params_flow.rb:15:10:15:33 | call to permit |
@@ -52,6 +69,23 @@ edges
5269
| params_flow.rb:172:10:172:15 | call to params : | params_flow.rb:172:10:172:19 | ...[...] |
5370
| params_flow.rb:176:10:176:15 | call to params : | params_flow.rb:176:10:176:19 | ...[...] |
5471
nodes
72+
| filter_flow.rb:14:5:14:8 | [post] self [@foo] : | semmle.label | [post] self [@foo] : |
73+
| filter_flow.rb:14:12:14:17 | call to params : | semmle.label | call to params : |
74+
| filter_flow.rb:14:12:14:23 | ...[...] : | semmle.label | ...[...] : |
75+
| filter_flow.rb:17:3:18:5 | self in b [@foo] : | semmle.label | self in b [@foo] : |
76+
| filter_flow.rb:20:3:22:5 | self in c [@foo] : | semmle.label | self in c [@foo] : |
77+
| filter_flow.rb:21:10:21:13 | @foo | semmle.label | @foo |
78+
| filter_flow.rb:21:10:21:13 | self [@foo] : | semmle.label | self [@foo] : |
79+
| filter_flow.rb:64:5:64:8 | [post] @foo [@bar] : | semmle.label | [post] @foo [@bar] : |
80+
| filter_flow.rb:64:5:64:8 | [post] self [@foo, @bar] : | semmle.label | [post] self [@foo, @bar] : |
81+
| filter_flow.rb:64:16:64:21 | call to params : | semmle.label | call to params : |
82+
| filter_flow.rb:64:16:64:21 | self [@foo, @bar] : | semmle.label | self [@foo, @bar] : |
83+
| filter_flow.rb:64:16:64:27 | ...[...] : | semmle.label | ...[...] : |
84+
| filter_flow.rb:67:3:68:5 | self in b [@foo, @bar] : | semmle.label | self in b [@foo, @bar] : |
85+
| filter_flow.rb:70:3:72:5 | self in c [@foo, @bar] : | semmle.label | self in c [@foo, @bar] : |
86+
| filter_flow.rb:71:10:71:13 | @foo [@bar] : | semmle.label | @foo [@bar] : |
87+
| filter_flow.rb:71:10:71:13 | self [@foo, @bar] : | semmle.label | self [@foo, @bar] : |
88+
| filter_flow.rb:71:10:71:17 | call to bar | semmle.label | call to bar |
5589
| params_flow.rb:3:10:3:15 | call to params : | semmle.label | call to params : |
5690
| params_flow.rb:3:10:3:19 | ...[...] | semmle.label | ...[...] |
5791
| params_flow.rb:7:10:7:15 | call to params : | semmle.label | call to params : |
@@ -152,6 +186,8 @@ nodes
152186
| params_flow.rb:176:10:176:19 | ...[...] | semmle.label | ...[...] |
153187
subpaths
154188
#select
189+
| filter_flow.rb:21:10:21:13 | @foo | filter_flow.rb:14:12:14:17 | call to params : | filter_flow.rb:21:10:21:13 | @foo | $@ | filter_flow.rb:14:12:14:17 | call to params : | call to params : |
190+
| filter_flow.rb:71:10:71:17 | call to bar | filter_flow.rb:64:16:64:21 | call to params : | filter_flow.rb:71:10:71:17 | call to bar | $@ | filter_flow.rb:64:16:64:21 | call to params : | call to params : |
155191
| params_flow.rb:3:10:3:19 | ...[...] | params_flow.rb:3:10:3:15 | call to params : | params_flow.rb:3:10:3:19 | ...[...] | $@ | params_flow.rb:3:10:3:15 | call to params : | call to params : |
156192
| params_flow.rb:7:10:7:23 | call to as_json | params_flow.rb:7:10:7:15 | call to params : | params_flow.rb:7:10:7:23 | call to as_json | $@ | params_flow.rb:7:10:7:15 | call to params : | call to params : |
157193
| params_flow.rb:15:10:15:33 | call to permit | params_flow.rb:15:10:15:15 | call to params : | params_flow.rb:15:10:15:33 | call to permit | $@ | params_flow.rb:15:10:15:15 | call to params : | call to params : |

0 commit comments

Comments
 (0)