Skip to content

Commit 141d6b8

Browse files
smowtonsmowton
committed
Accept paths test changes
1 parent 8a06ca5 commit 141d6b8

File tree

9 files changed

+113
-162
lines changed

9 files changed

+113
-162
lines changed

‎go/ql/test/example-tests/snippets/typeinfo.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
| file://:0:0:0:0 | parameter 1 of ReadResponse |
2+
| file://:0:0:0:0 | parameter -1 of AddCookie |
3+
| file://:0:0:0:0 | parameter -1 of Clone |
4+
| file://:0:0:0:0 | parameter -1 of Write |
5+
| file://:0:0:0:0 | parameter -1 of WriteProxy |
16
| main.go:18:12:18:14 | argument corresponding to req |
27
| main.go:18:12:18:14 | definition of req |
38
| main.go:20:5:20:7 | req |

‎go/ql/test/experimental/CWE-918/SSRF.expected

Lines changed: 6 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,21 @@ edges
77
| file://:0:0:0:0 | parameter 0 of ReadAll | file://:0:0:0:0 | [summary] to write: return (return[0]) in ReadAll |
88
| file://:0:0:0:0 | parameter 0 of TrimPrefix | file://:0:0:0:0 | [summary] to write: return (return[0]) in TrimPrefix |
99
| file://:0:0:0:0 | parameter 0 of Unmarshal | file://:0:0:0:0 | [summary] to write: argument 1 in Unmarshal |
10-
| file://:0:0:0:0 | parameter 1 of Sprintf | file://:0:0:0:0 | [summary] to write: return (return[0]) in Sprintf |
1110
| file://:0:0:0:0 | parameter -1 of Get | file://:0:0:0:0 | [summary] to write: return (return[0]) in Get |
1211
| file://:0:0:0:0 | parameter -1 of Query | file://:0:0:0:0 | [summary] to write: return (return[0]) in Query |
13-
| new-tests.go:26:26:26:30 | &... | new-tests.go:31:48:31:56 | selection of word |
14-
| new-tests.go:26:26:26:30 | &... | new-tests.go:32:48:32:56 | selection of safe |
15-
| new-tests.go:26:26:26:30 | &... | new-tests.go:35:49:35:57 | selection of word |
16-
| new-tests.go:31:48:31:56 | selection of word | file://:0:0:0:0 | parameter 1 of Sprintf |
17-
| new-tests.go:31:48:31:56 | selection of word | new-tests.go:31:11:31:57 | call to Sprintf |
18-
| new-tests.go:32:48:32:56 | selection of safe | file://:0:0:0:0 | parameter 1 of Sprintf |
19-
| new-tests.go:32:48:32:56 | selection of safe | new-tests.go:32:11:32:57 | call to Sprintf |
20-
| new-tests.go:35:49:35:57 | selection of word | file://:0:0:0:0 | parameter 1 of Sprintf |
21-
| new-tests.go:35:49:35:57 | selection of word | new-tests.go:35:12:35:58 | call to Sprintf |
12+
| new-tests.go:26:26:26:30 | &... | new-tests.go:31:11:31:57 | call to Sprintf |
13+
| new-tests.go:26:26:26:30 | &... | new-tests.go:32:11:32:57 | call to Sprintf |
14+
| new-tests.go:26:26:26:30 | &... | new-tests.go:35:12:35:58 | call to Sprintf |
2215
| new-tests.go:39:18:39:30 | call to Param | new-tests.go:47:11:47:46 | ...+... |
2316
| new-tests.go:49:18:49:30 | call to Query | new-tests.go:50:11:50:46 | ...+... |
2417
| new-tests.go:62:2:62:39 | ... := ...[0] | new-tests.go:63:17:63:23 | reqBody |
2518
| new-tests.go:62:31:62:38 | selection of Body | file://:0:0:0:0 | parameter 0 of ReadAll |
2619
| new-tests.go:62:31:62:38 | selection of Body | new-tests.go:62:2:62:39 | ... := ...[0] |
2720
| new-tests.go:63:17:63:23 | reqBody | file://:0:0:0:0 | parameter 0 of Unmarshal |
2821
| new-tests.go:63:17:63:23 | reqBody | new-tests.go:63:26:63:30 | &... |
29-
| new-tests.go:63:26:63:30 | &... | new-tests.go:68:48:68:56 | selection of word |
30-
| new-tests.go:63:26:63:30 | &... | new-tests.go:69:48:69:56 | selection of safe |
31-
| new-tests.go:63:26:63:30 | &... | new-tests.go:74:49:74:57 | selection of word |
32-
| new-tests.go:68:48:68:56 | selection of word | file://:0:0:0:0 | parameter 1 of Sprintf |
33-
| new-tests.go:68:48:68:56 | selection of word | new-tests.go:68:11:68:57 | call to Sprintf |
34-
| new-tests.go:69:48:69:56 | selection of safe | file://:0:0:0:0 | parameter 1 of Sprintf |
35-
| new-tests.go:69:48:69:56 | selection of safe | new-tests.go:69:11:69:57 | call to Sprintf |
36-
| new-tests.go:74:49:74:57 | selection of word | file://:0:0:0:0 | parameter 1 of Sprintf |
37-
| new-tests.go:74:49:74:57 | selection of word | new-tests.go:74:12:74:58 | call to Sprintf |
22+
| new-tests.go:63:26:63:30 | &... | new-tests.go:68:11:68:57 | call to Sprintf |
23+
| new-tests.go:63:26:63:30 | &... | new-tests.go:69:11:69:57 | call to Sprintf |
24+
| new-tests.go:63:26:63:30 | &... | new-tests.go:74:12:74:58 | call to Sprintf |
3825
| new-tests.go:78:18:78:24 | selection of URL | file://:0:0:0:0 | parameter -1 of Query |
3926
| new-tests.go:78:18:78:24 | selection of URL | new-tests.go:78:18:78:32 | call to Query |
4027
| new-tests.go:78:18:78:32 | call to Query | file://:0:0:0:0 | parameter -1 of Get |
@@ -61,21 +48,16 @@ nodes
6148
| file://:0:0:0:0 | [summary] to write: return (return[0]) in Get | semmle.label | [summary] to write: return (return[0]) in Get |
6249
| file://:0:0:0:0 | [summary] to write: return (return[0]) in Query | semmle.label | [summary] to write: return (return[0]) in Query |
6350
| file://:0:0:0:0 | [summary] to write: return (return[0]) in ReadAll | semmle.label | [summary] to write: return (return[0]) in ReadAll |
64-
| file://:0:0:0:0 | [summary] to write: return (return[0]) in Sprintf | semmle.label | [summary] to write: return (return[0]) in Sprintf |
6551
| file://:0:0:0:0 | [summary] to write: return (return[0]) in TrimPrefix | semmle.label | [summary] to write: return (return[0]) in TrimPrefix |
6652
| file://:0:0:0:0 | parameter 0 of ReadAll | semmle.label | parameter 0 of ReadAll |
6753
| file://:0:0:0:0 | parameter 0 of TrimPrefix | semmle.label | parameter 0 of TrimPrefix |
6854
| file://:0:0:0:0 | parameter 0 of Unmarshal | semmle.label | parameter 0 of Unmarshal |
69-
| file://:0:0:0:0 | parameter 1 of Sprintf | semmle.label | parameter 1 of Sprintf |
7055
| file://:0:0:0:0 | parameter -1 of Get | semmle.label | parameter -1 of Get |
7156
| file://:0:0:0:0 | parameter -1 of Query | semmle.label | parameter -1 of Query |
7257
| new-tests.go:26:26:26:30 | &... | semmle.label | &... |
7358
| new-tests.go:31:11:31:57 | call to Sprintf | semmle.label | call to Sprintf |
74-
| new-tests.go:31:48:31:56 | selection of word | semmle.label | selection of word |
7559
| new-tests.go:32:11:32:57 | call to Sprintf | semmle.label | call to Sprintf |
76-
| new-tests.go:32:48:32:56 | selection of safe | semmle.label | selection of safe |
7760
| new-tests.go:35:12:35:58 | call to Sprintf | semmle.label | call to Sprintf |
78-
| new-tests.go:35:49:35:57 | selection of word | semmle.label | selection of word |
7961
| new-tests.go:39:18:39:30 | call to Param | semmle.label | call to Param |
8062
| new-tests.go:47:11:47:46 | ...+... | semmle.label | ...+... |
8163
| new-tests.go:49:18:49:30 | call to Query | semmle.label | call to Query |
@@ -85,11 +67,8 @@ nodes
8567
| new-tests.go:63:17:63:23 | reqBody | semmle.label | reqBody |
8668
| new-tests.go:63:26:63:30 | &... | semmle.label | &... |
8769
| new-tests.go:68:11:68:57 | call to Sprintf | semmle.label | call to Sprintf |
88-
| new-tests.go:68:48:68:56 | selection of word | semmle.label | selection of word |
8970
| new-tests.go:69:11:69:57 | call to Sprintf | semmle.label | call to Sprintf |
90-
| new-tests.go:69:48:69:56 | selection of safe | semmle.label | selection of safe |
9171
| new-tests.go:74:12:74:58 | call to Sprintf | semmle.label | call to Sprintf |
92-
| new-tests.go:74:49:74:57 | selection of word | semmle.label | selection of word |
9372
| new-tests.go:78:18:78:24 | selection of URL | semmle.label | selection of URL |
9473
| new-tests.go:78:18:78:32 | call to Query | semmle.label | call to Query |
9574
| new-tests.go:78:18:78:46 | call to Get | semmle.label | call to Get |
@@ -103,14 +82,8 @@ nodes
10382
| new-tests.go:95:18:95:45 | call to URLParam | semmle.label | call to URLParam |
10483
| new-tests.go:96:11:96:46 | ...+... | semmle.label | ...+... |
10584
subpaths
106-
| new-tests.go:31:48:31:56 | selection of word | file://:0:0:0:0 | parameter 1 of Sprintf | file://:0:0:0:0 | [summary] to write: return (return[0]) in Sprintf | new-tests.go:31:11:31:57 | call to Sprintf |
107-
| new-tests.go:32:48:32:56 | selection of safe | file://:0:0:0:0 | parameter 1 of Sprintf | file://:0:0:0:0 | [summary] to write: return (return[0]) in Sprintf | new-tests.go:32:11:32:57 | call to Sprintf |
108-
| new-tests.go:35:49:35:57 | selection of word | file://:0:0:0:0 | parameter 1 of Sprintf | file://:0:0:0:0 | [summary] to write: return (return[0]) in Sprintf | new-tests.go:35:12:35:58 | call to Sprintf |
10985
| new-tests.go:62:31:62:38 | selection of Body | file://:0:0:0:0 | parameter 0 of ReadAll | file://:0:0:0:0 | [summary] to write: return (return[0]) in ReadAll | new-tests.go:62:2:62:39 | ... := ...[0] |
11086
| new-tests.go:63:17:63:23 | reqBody | file://:0:0:0:0 | parameter 0 of Unmarshal | file://:0:0:0:0 | [summary] to write: argument 1 in Unmarshal | new-tests.go:63:26:63:30 | &... |
111-
| new-tests.go:68:48:68:56 | selection of word | file://:0:0:0:0 | parameter 1 of Sprintf | file://:0:0:0:0 | [summary] to write: return (return[0]) in Sprintf | new-tests.go:68:11:68:57 | call to Sprintf |
112-
| new-tests.go:69:48:69:56 | selection of safe | file://:0:0:0:0 | parameter 1 of Sprintf | file://:0:0:0:0 | [summary] to write: return (return[0]) in Sprintf | new-tests.go:69:11:69:57 | call to Sprintf |
113-
| new-tests.go:74:49:74:57 | selection of word | file://:0:0:0:0 | parameter 1 of Sprintf | file://:0:0:0:0 | [summary] to write: return (return[0]) in Sprintf | new-tests.go:74:12:74:58 | call to Sprintf |
11487
| new-tests.go:78:18:78:24 | selection of URL | file://:0:0:0:0 | parameter -1 of Query | file://:0:0:0:0 | [summary] to write: return (return[0]) in Query | new-tests.go:78:18:78:32 | call to Query |
11588
| new-tests.go:78:18:78:32 | call to Query | file://:0:0:0:0 | parameter -1 of Get | file://:0:0:0:0 | [summary] to write: return (return[0]) in Get | new-tests.go:78:18:78:46 | call to Get |
11689
| new-tests.go:81:37:81:48 | selection of Path | file://:0:0:0:0 | parameter 0 of TrimPrefix | file://:0:0:0:0 | [summary] to write: return (return[0]) in TrimPrefix | new-tests.go:81:18:81:67 | call to TrimPrefix |

‎go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,21 @@
11
edges
2-
| TaintedPath.go:13:18:13:22 | selection of URL | TaintedPath.go:16:29:16:40 | tainted_path |
3-
| TaintedPath.go:13:18:13:22 | selection of URL | TaintedPath.go:20:28:20:69 | call to Join |
2+
| TaintedPath.go:13:18:13:22 | selection of URL | TaintedPath.go:13:18:13:30 | call to Query |
3+
| TaintedPath.go:13:18:13:22 | selection of URL | file://:0:0:0:0 | parameter -1 of Query |
4+
| TaintedPath.go:13:18:13:30 | call to Query | TaintedPath.go:16:29:16:40 | tainted_path |
5+
| TaintedPath.go:13:18:13:30 | call to Query | TaintedPath.go:20:28:20:69 | call to Join |
6+
| file://:0:0:0:0 | parameter -1 of Query | file://:0:0:0:0 | [summary] to write: return (return[0]) in Query |
47
| tst.go:14:2:14:39 | ... := ...[1] | tst.go:17:41:17:56 | selection of Filename |
58
nodes
69
| TaintedPath.go:13:18:13:22 | selection of URL | semmle.label | selection of URL |
10+
| TaintedPath.go:13:18:13:30 | call to Query | semmle.label | call to Query |
711
| TaintedPath.go:16:29:16:40 | tainted_path | semmle.label | tainted_path |
812
| TaintedPath.go:20:28:20:69 | call to Join | semmle.label | call to Join |
13+
| file://:0:0:0:0 | [summary] to write: return (return[0]) in Query | semmle.label | [summary] to write: return (return[0]) in Query |
14+
| file://:0:0:0:0 | parameter -1 of Query | semmle.label | parameter -1 of Query |
915
| tst.go:14:2:14:39 | ... := ...[1] | semmle.label | ... := ...[1] |
1016
| tst.go:17:41:17:56 | selection of Filename | semmle.label | selection of Filename |
1117
subpaths
18+
| TaintedPath.go:13:18:13:22 | selection of URL | file://:0:0:0:0 | parameter -1 of Query | file://:0:0:0:0 | [summary] to write: return (return[0]) in Query | TaintedPath.go:13:18:13:30 | call to Query |
1219
#select
1320
| TaintedPath.go:16:29:16:40 | tainted_path | TaintedPath.go:13:18:13:22 | selection of URL | TaintedPath.go:16:29:16:40 | tainted_path | This path depends on a $@. | TaintedPath.go:13:18:13:22 | selection of URL | user-provided value |
1421
| TaintedPath.go:20:28:20:69 | call to Join | TaintedPath.go:13:18:13:22 | selection of URL | TaintedPath.go:20:28:20:69 | call to Join | This path depends on a $@. | TaintedPath.go:13:18:13:22 | selection of URL | user-provided value |

‎go/ql/test/query-tests/Security/CWE-022/ZipSlip.expected

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,15 @@ edges
44
| UnsafeUnzipSymlinkGood.go:72:3:72:25 | ... := ...[0] | UnsafeUnzipSymlinkGood.go:76:70:76:80 | selection of Name |
55
| UnsafeUnzipSymlinkGood.go:76:24:76:38 | selection of Linkname | UnsafeUnzipSymlinkGood.go:52:24:52:32 | definition of candidate |
66
| UnsafeUnzipSymlinkGood.go:76:70:76:80 | selection of Name | UnsafeUnzipSymlinkGood.go:52:24:52:32 | definition of candidate |
7-
| ZipSlip.go:11:2:15:2 | range statement[1] | ZipSlip.go:14:20:14:20 | p |
8-
| tarslip.go:15:2:15:30 | ... := ...[0] | tarslip.go:16:14:16:34 | call to Dir |
7+
| ZipSlip.go:11:2:15:2 | range statement[1] | ZipSlip.go:12:24:12:29 | selection of Name |
8+
| ZipSlip.go:12:3:12:30 | ... := ...[0] | ZipSlip.go:14:20:14:20 | p |
9+
| ZipSlip.go:12:24:12:29 | selection of Name | ZipSlip.go:12:3:12:30 | ... := ...[0] |
10+
| ZipSlip.go:12:24:12:29 | selection of Name | file://:0:0:0:0 | parameter 0 of Abs |
11+
| file://:0:0:0:0 | parameter 0 of Abs | file://:0:0:0:0 | [summary] to write: return (return[0]) in Abs |
12+
| file://:0:0:0:0 | parameter 0 of Dir | file://:0:0:0:0 | [summary] to write: return (return[0]) in Dir |
13+
| tarslip.go:15:2:15:30 | ... := ...[0] | tarslip.go:16:23:16:33 | selection of Name |
14+
| tarslip.go:16:23:16:33 | selection of Name | file://:0:0:0:0 | parameter 0 of Dir |
15+
| tarslip.go:16:23:16:33 | selection of Name | tarslip.go:16:14:16:34 | call to Dir |
916
| tst.go:23:2:43:2 | range statement[1] | tst.go:29:20:29:23 | path |
1017
nodes
1118
| UnsafeUnzipSymlinkGood.go:52:24:52:32 | definition of candidate | semmle.label | definition of candidate |
@@ -14,12 +21,21 @@ nodes
1421
| UnsafeUnzipSymlinkGood.go:76:24:76:38 | selection of Linkname | semmle.label | selection of Linkname |
1522
| UnsafeUnzipSymlinkGood.go:76:70:76:80 | selection of Name | semmle.label | selection of Name |
1623
| ZipSlip.go:11:2:15:2 | range statement[1] | semmle.label | range statement[1] |
24+
| ZipSlip.go:12:3:12:30 | ... := ...[0] | semmle.label | ... := ...[0] |
25+
| ZipSlip.go:12:24:12:29 | selection of Name | semmle.label | selection of Name |
1726
| ZipSlip.go:14:20:14:20 | p | semmle.label | p |
27+
| file://:0:0:0:0 | [summary] to write: return (return[0]) in Abs | semmle.label | [summary] to write: return (return[0]) in Abs |
28+
| file://:0:0:0:0 | [summary] to write: return (return[0]) in Dir | semmle.label | [summary] to write: return (return[0]) in Dir |
29+
| file://:0:0:0:0 | parameter 0 of Abs | semmle.label | parameter 0 of Abs |
30+
| file://:0:0:0:0 | parameter 0 of Dir | semmle.label | parameter 0 of Dir |
1831
| tarslip.go:15:2:15:30 | ... := ...[0] | semmle.label | ... := ...[0] |
1932
| tarslip.go:16:14:16:34 | call to Dir | semmle.label | call to Dir |
33+
| tarslip.go:16:23:16:33 | selection of Name | semmle.label | selection of Name |
2034
| tst.go:23:2:43:2 | range statement[1] | semmle.label | range statement[1] |
2135
| tst.go:29:20:29:23 | path | semmle.label | path |
2236
subpaths
37+
| ZipSlip.go:12:24:12:29 | selection of Name | file://:0:0:0:0 | parameter 0 of Abs | file://:0:0:0:0 | [summary] to write: return (return[0]) in Abs | ZipSlip.go:12:3:12:30 | ... := ...[0] |
38+
| tarslip.go:16:23:16:33 | selection of Name | file://:0:0:0:0 | parameter 0 of Dir | file://:0:0:0:0 | [summary] to write: return (return[0]) in Dir | tarslip.go:16:14:16:34 | call to Dir |
2339
#select
2440
| UnsafeUnzipSymlinkGood.go:72:3:72:25 | ... := ...[0] | UnsafeUnzipSymlinkGood.go:72:3:72:25 | ... := ...[0] | UnsafeUnzipSymlinkGood.go:61:31:61:62 | call to Join | Unsanitized archive entry, which may contain '..', is used in a $@. | UnsafeUnzipSymlinkGood.go:61:31:61:62 | call to Join | file system operation |
2541
| ZipSlip.go:11:2:15:2 | range statement[1] | ZipSlip.go:11:2:15:2 | range statement[1] | ZipSlip.go:14:20:14:20 | p | Unsanitized archive entry, which may contain '..', is used in a $@. | ZipSlip.go:14:20:14:20 | p | file system operation |

0 commit comments

Comments
 (0)