Skip to content

Commit 1a6f7fe

Browse files
geoffw0geoffw0
committed
CPP: Add tests of taint through qualifiers.
1 parent 79811fc commit 1a6f7fe

File tree

6 files changed

+155
-0
lines changed

6 files changed

+155
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/TaintTestCommon.qll‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import cpp
22
import semmle.code.cpp.dataflow.TaintTracking
3+
import semmle.code.cpp.models.interfaces.Taint
34

45
/** Common data flow configuration to be used by tests. */
56
class TestAllocationConfig extends TaintTracking::Configuration {
@@ -25,3 +26,39 @@ class TestAllocationConfig extends TaintTracking::Configuration {
2526
barrier.asExpr().(VariableAccess).getTarget().hasName("sanitizer")
2627
}
2728
}
29+
30+
class SetMemberFunction extends TaintFunction {
31+
SetMemberFunction() { this.hasName("setMember") }
32+
33+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
34+
input.isParameter(0) and
35+
output.isQualifierObject()
36+
}
37+
}
38+
39+
class GetMemberFunction extends TaintFunction {
40+
GetMemberFunction() { this.hasName("getMember") }
41+
42+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
43+
input.isQualifierObject() and
44+
output.isReturnValue()
45+
}
46+
}
47+
48+
class SetStringFunction extends TaintFunction {
49+
SetStringFunction() { this.hasName("setString") }
50+
51+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
52+
input.isParameterDeref(0) and
53+
output.isQualifierObject()
54+
}
55+
}
56+
57+
class GetStringFunction extends TaintFunction {
58+
GetStringFunction() { this.hasName("getString") }
59+
60+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
61+
input.isQualifierObject() and
62+
output.isReturnValueDeref()
63+
}
64+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -347,3 +347,62 @@
347347
| taint.cpp:390:6:390:11 | call to wcsdup | taint.cpp:390:2:390:28 | ... = ... | |
348348
| taint.cpp:390:6:390:11 | call to wcsdup | taint.cpp:392:7:392:7 | b | |
349349
| taint.cpp:390:13:390:27 | hello, world | taint.cpp:390:6:390:11 | call to wcsdup | TAINT |
350+
| taint.cpp:417:13:417:14 | call to MyClass2 | taint.cpp:420:7:420:7 | a | |
351+
| taint.cpp:417:13:417:14 | call to MyClass2 | taint.cpp:421:7:421:7 | a | |
352+
| taint.cpp:417:13:417:14 | call to MyClass2 | taint.cpp:422:2:422:2 | a | |
353+
| taint.cpp:417:13:417:14 | call to MyClass2 | taint.cpp:423:7:423:7 | a | |
354+
| taint.cpp:417:13:417:14 | call to MyClass2 | taint.cpp:424:7:424:7 | a | |
355+
| taint.cpp:417:19:417:20 | call to MyClass2 | taint.cpp:426:7:426:7 | b | |
356+
| taint.cpp:417:19:417:20 | call to MyClass2 | taint.cpp:427:7:427:7 | b | |
357+
| taint.cpp:417:19:417:20 | call to MyClass2 | taint.cpp:428:2:428:2 | b | |
358+
| taint.cpp:417:19:417:20 | call to MyClass2 | taint.cpp:429:7:429:7 | b | |
359+
| taint.cpp:417:19:417:20 | call to MyClass2 | taint.cpp:430:7:430:7 | b | |
360+
| taint.cpp:417:19:417:20 | call to MyClass2 | taint.cpp:431:7:431:7 | b | |
361+
| taint.cpp:418:13:418:15 | call to MyClass3 | taint.cpp:443:7:443:7 | d | |
362+
| taint.cpp:418:13:418:15 | call to MyClass3 | taint.cpp:444:7:444:7 | d | |
363+
| taint.cpp:418:13:418:15 | call to MyClass3 | taint.cpp:445:2:445:2 | d | |
364+
| taint.cpp:418:13:418:15 | call to MyClass3 | taint.cpp:446:7:446:7 | d | |
365+
| taint.cpp:418:13:418:15 | call to MyClass3 | taint.cpp:447:7:447:7 | d | |
366+
| taint.cpp:421:7:421:7 | a [post update] | taint.cpp:422:2:422:2 | a | |
367+
| taint.cpp:421:7:421:7 | a [post update] | taint.cpp:423:7:423:7 | a | |
368+
| taint.cpp:421:7:421:7 | a [post update] | taint.cpp:424:7:424:7 | a | |
369+
| taint.cpp:422:2:422:2 | a [post update] | taint.cpp:423:7:423:7 | a | |
370+
| taint.cpp:422:2:422:2 | a [post update] | taint.cpp:424:7:424:7 | a | |
371+
| taint.cpp:427:7:427:7 | b [post update] | taint.cpp:428:2:428:2 | b | |
372+
| taint.cpp:427:7:427:7 | b [post update] | taint.cpp:429:7:429:7 | b | |
373+
| taint.cpp:427:7:427:7 | b [post update] | taint.cpp:430:7:430:7 | b | |
374+
| taint.cpp:427:7:427:7 | b [post update] | taint.cpp:431:7:431:7 | b | |
375+
| taint.cpp:428:2:428:2 | b [post update] | taint.cpp:429:7:429:7 | b | |
376+
| taint.cpp:428:2:428:2 | b [post update] | taint.cpp:430:7:430:7 | b | |
377+
| taint.cpp:428:2:428:2 | b [post update] | taint.cpp:431:7:431:7 | b | |
378+
| taint.cpp:428:2:428:20 | ... = ... | taint.cpp:430:9:430:14 | member | |
379+
| taint.cpp:428:13:428:18 | call to source | taint.cpp:428:2:428:20 | ... = ... | |
380+
| taint.cpp:433:6:433:20 | call to MyClass2 | taint.cpp:433:6:433:20 | new | |
381+
| taint.cpp:433:6:433:20 | new | taint.cpp:433:2:433:20 | ... = ... | |
382+
| taint.cpp:433:6:433:20 | new | taint.cpp:435:7:435:7 | c | |
383+
| taint.cpp:433:6:433:20 | new | taint.cpp:436:7:436:7 | c | |
384+
| taint.cpp:433:6:433:20 | new | taint.cpp:437:2:437:2 | c | |
385+
| taint.cpp:433:6:433:20 | new | taint.cpp:438:7:438:7 | c | |
386+
| taint.cpp:433:6:433:20 | new | taint.cpp:439:7:439:7 | c | |
387+
| taint.cpp:433:6:433:20 | new | taint.cpp:441:9:441:9 | c | |
388+
| taint.cpp:435:7:435:7 | ref arg c | taint.cpp:436:7:436:7 | c | |
389+
| taint.cpp:435:7:435:7 | ref arg c | taint.cpp:437:2:437:2 | c | |
390+
| taint.cpp:435:7:435:7 | ref arg c | taint.cpp:438:7:438:7 | c | |
391+
| taint.cpp:435:7:435:7 | ref arg c | taint.cpp:439:7:439:7 | c | |
392+
| taint.cpp:435:7:435:7 | ref arg c | taint.cpp:441:9:441:9 | c | |
393+
| taint.cpp:436:7:436:7 | c [post update] | taint.cpp:437:2:437:2 | c | |
394+
| taint.cpp:436:7:436:7 | c [post update] | taint.cpp:438:7:438:7 | c | |
395+
| taint.cpp:436:7:436:7 | c [post update] | taint.cpp:439:7:439:7 | c | |
396+
| taint.cpp:436:7:436:7 | c [post update] | taint.cpp:441:9:441:9 | c | |
397+
| taint.cpp:437:2:437:2 | c [post update] | taint.cpp:438:7:438:7 | c | |
398+
| taint.cpp:437:2:437:2 | c [post update] | taint.cpp:439:7:439:7 | c | |
399+
| taint.cpp:437:2:437:2 | c [post update] | taint.cpp:441:9:441:9 | c | |
400+
| taint.cpp:438:7:438:7 | ref arg c | taint.cpp:439:7:439:7 | c | |
401+
| taint.cpp:438:7:438:7 | ref arg c | taint.cpp:441:9:441:9 | c | |
402+
| taint.cpp:439:7:439:7 | c [post update] | taint.cpp:441:9:441:9 | c | |
403+
| taint.cpp:441:9:441:9 | c | taint.cpp:441:2:441:9 | delete | TAINT |
404+
| taint.cpp:444:7:444:7 | d [post update] | taint.cpp:445:2:445:2 | d | |
405+
| taint.cpp:444:7:444:7 | d [post update] | taint.cpp:446:7:446:7 | d | |
406+
| taint.cpp:444:7:444:7 | d [post update] | taint.cpp:447:7:447:7 | d | |
407+
| taint.cpp:445:2:445:2 | d [post update] | taint.cpp:446:7:446:7 | d | |
408+
| taint.cpp:445:2:445:2 | d [post update] | taint.cpp:447:7:447:7 | d | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -391,3 +391,58 @@ void test_wcsdup(wchar_t *source)
391391
sink(a); // tainted
392392
sink(b);
393393
}
394+
395+
// --- qualifiers ---
396+
397+
class MyClass2 {
398+
public:
399+
MyClass2(int value);
400+
void setMember(int value);
401+
int getMember();
402+
403+
int member;
404+
};
405+
406+
class MyClass3 {
407+
public:
408+
MyClass3(const char *string);
409+
void setString(const char *string);
410+
const char *getString();
411+
412+
const char *buffer;
413+
};
414+
415+
void test_qualifiers()
416+
{
417+
MyClass2 a(0), b(0), *c;
418+
MyClass3 d("");
419+
420+
sink(a);
421+
sink(a.getMember());
422+
a.setMember(source());
423+
sink(a); // tainted [NOT DETECTED]
424+
sink(a.getMember()); // tainted [NOT DETECTED]
425+
426+
sink(b);
427+
sink(b.getMember());
428+
b.member = source();
429+
sink(b); // tainted
430+
sink(b.member); // tainted
431+
sink(b.getMember());
432+
433+
c = new MyClass2(0);
434+
435+
sink(c);
436+
sink(c->getMember());
437+
c->setMember(source());
438+
sink(c); // tainted (deref) [NOT DETECTED]
439+
sink(c->getMember()); // tainted [NOT DETECTED]
440+
441+
delete c;
442+
443+
sink(d);
444+
sink(d.getString());
445+
d.setString(strings::source());
446+
sink(d); // tainted [NOT DETECTED]
447+
sink(d.getString()); // tainted [NOT DETECTED]
448+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,4 @@
3939
| taint.cpp:352:7:352:7 | b | taint.cpp:330:6:330:11 | call to source |
4040
| taint.cpp:372:7:372:7 | a | taint.cpp:365:24:365:29 | source |
4141
| taint.cpp:391:7:391:7 | a | taint.cpp:385:27:385:32 | source |
42+
| taint.cpp:430:9:430:14 | member | taint.cpp:428:13:428:18 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,5 @@
2626
| taint.cpp:352:7:352:7 | taint.cpp:330:6:330:11 | AST only |
2727
| taint.cpp:372:7:372:7 | taint.cpp:365:24:365:29 | AST only |
2828
| taint.cpp:391:7:391:7 | taint.cpp:385:27:385:32 | AST only |
29+
| taint.cpp:429:7:429:7 | taint.cpp:428:13:428:18 | IR only |
30+
| taint.cpp:430:9:430:14 | taint.cpp:428:13:428:18 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@
1515
| taint.cpp:291:7:291:7 | y | taint.cpp:275:6:275:11 | call to source |
1616
| taint.cpp:337:7:337:7 | t | taint.cpp:330:6:330:11 | call to source |
1717
| taint.cpp:350:7:350:7 | t | taint.cpp:330:6:330:11 | call to source |
18+
| taint.cpp:429:7:429:7 | b | taint.cpp:428:13:428:18 | call to source |

0 commit comments

Comments
 (0)