Skip to content

Commit 7601bd4

Browse files
RasmusWLRasmusWL
committed
Python: Add tests for re.escape FP
1 parent 0d1fb0f commit 7601bd4

File tree

6 files changed

+94
-0
lines changed

6 files changed

+94
-0
lines changed

‎python/ql/test/library-tests/regex/Characters.expected‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,47 @@
118118
| ax{,3} | 3 | 4 |
119119
| ax{,3} | 4 | 5 |
120120
| ax{,3} | 5 | 6 |
121+
| https://www.humblebundle.com/home/library | 0 | 1 |
122+
| https://www.humblebundle.com/home/library | 1 | 2 |
123+
| https://www.humblebundle.com/home/library | 2 | 3 |
124+
| https://www.humblebundle.com/home/library | 3 | 4 |
125+
| https://www.humblebundle.com/home/library | 4 | 5 |
126+
| https://www.humblebundle.com/home/library | 5 | 6 |
127+
| https://www.humblebundle.com/home/library | 6 | 7 |
128+
| https://www.humblebundle.com/home/library | 7 | 8 |
129+
| https://www.humblebundle.com/home/library | 8 | 9 |
130+
| https://www.humblebundle.com/home/library | 9 | 10 |
131+
| https://www.humblebundle.com/home/library | 10 | 11 |
132+
| https://www.humblebundle.com/home/library | 11 | 12 |
133+
| https://www.humblebundle.com/home/library | 12 | 13 |
134+
| https://www.humblebundle.com/home/library | 13 | 14 |
135+
| https://www.humblebundle.com/home/library | 14 | 15 |
136+
| https://www.humblebundle.com/home/library | 15 | 16 |
137+
| https://www.humblebundle.com/home/library | 16 | 17 |
138+
| https://www.humblebundle.com/home/library | 17 | 18 |
139+
| https://www.humblebundle.com/home/library | 18 | 19 |
140+
| https://www.humblebundle.com/home/library | 19 | 20 |
141+
| https://www.humblebundle.com/home/library | 20 | 21 |
142+
| https://www.humblebundle.com/home/library | 21 | 22 |
143+
| https://www.humblebundle.com/home/library | 22 | 23 |
144+
| https://www.humblebundle.com/home/library | 23 | 24 |
145+
| https://www.humblebundle.com/home/library | 24 | 25 |
146+
| https://www.humblebundle.com/home/library | 25 | 26 |
147+
| https://www.humblebundle.com/home/library | 26 | 27 |
148+
| https://www.humblebundle.com/home/library | 27 | 28 |
149+
| https://www.humblebundle.com/home/library | 28 | 29 |
150+
| https://www.humblebundle.com/home/library | 29 | 30 |
151+
| https://www.humblebundle.com/home/library | 30 | 31 |
152+
| https://www.humblebundle.com/home/library | 31 | 32 |
153+
| https://www.humblebundle.com/home/library | 32 | 33 |
154+
| https://www.humblebundle.com/home/library | 33 | 34 |
155+
| https://www.humblebundle.com/home/library | 34 | 35 |
156+
| https://www.humblebundle.com/home/library | 35 | 36 |
157+
| https://www.humblebundle.com/home/library | 36 | 37 |
158+
| https://www.humblebundle.com/home/library | 37 | 38 |
159+
| https://www.humblebundle.com/home/library | 38 | 39 |
160+
| https://www.humblebundle.com/home/library | 39 | 40 |
161+
| https://www.humblebundle.com/home/library | 40 | 41 |
121162
| x\| | 0 | 1 |
122163
| x\|(?<!\\w)l | 0 | 1 |
123164
| x\|(?<!\\w)l | 6 | 8 |

‎python/ql/test/library-tests/regex/FirstLast.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,8 @@
9090
| ax{,3} | last | 1 | 2 |
9191
| ax{,3} | last | 1 | 6 |
9292
| ax{,3} | last | 5 | 6 |
93+
| https://www.humblebundle.com/home/library | first | 0 | 1 |
94+
| https://www.humblebundle.com/home/library | last | 40 | 41 |
9395
| x\| | first | 0 | 1 |
9496
| x\| | last | 0 | 1 |
9597
| x\|(?<!\\w)l | first | 0 | 1 |

‎python/ql/test/library-tests/regex/Regex.expected‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,48 @@
218218
| ax{,3} | char | 5 | 6 |
219219
| ax{,3} | qualified | 1 | 6 |
220220
| ax{,3} | sequence | 0 | 6 |
221+
| https://www.humblebundle.com/home/library | . | 11 | 12 |
222+
| https://www.humblebundle.com/home/library | . | 24 | 25 |
223+
| https://www.humblebundle.com/home/library | char | 0 | 1 |
224+
| https://www.humblebundle.com/home/library | char | 1 | 2 |
225+
| https://www.humblebundle.com/home/library | char | 2 | 3 |
226+
| https://www.humblebundle.com/home/library | char | 3 | 4 |
227+
| https://www.humblebundle.com/home/library | char | 4 | 5 |
228+
| https://www.humblebundle.com/home/library | char | 5 | 6 |
229+
| https://www.humblebundle.com/home/library | char | 6 | 7 |
230+
| https://www.humblebundle.com/home/library | char | 7 | 8 |
231+
| https://www.humblebundle.com/home/library | char | 8 | 9 |
232+
| https://www.humblebundle.com/home/library | char | 9 | 10 |
233+
| https://www.humblebundle.com/home/library | char | 10 | 11 |
234+
| https://www.humblebundle.com/home/library | char | 12 | 13 |
235+
| https://www.humblebundle.com/home/library | char | 13 | 14 |
236+
| https://www.humblebundle.com/home/library | char | 14 | 15 |
237+
| https://www.humblebundle.com/home/library | char | 15 | 16 |
238+
| https://www.humblebundle.com/home/library | char | 16 | 17 |
239+
| https://www.humblebundle.com/home/library | char | 17 | 18 |
240+
| https://www.humblebundle.com/home/library | char | 18 | 19 |
241+
| https://www.humblebundle.com/home/library | char | 19 | 20 |
242+
| https://www.humblebundle.com/home/library | char | 20 | 21 |
243+
| https://www.humblebundle.com/home/library | char | 21 | 22 |
244+
| https://www.humblebundle.com/home/library | char | 22 | 23 |
245+
| https://www.humblebundle.com/home/library | char | 23 | 24 |
246+
| https://www.humblebundle.com/home/library | char | 25 | 26 |
247+
| https://www.humblebundle.com/home/library | char | 26 | 27 |
248+
| https://www.humblebundle.com/home/library | char | 27 | 28 |
249+
| https://www.humblebundle.com/home/library | char | 28 | 29 |
250+
| https://www.humblebundle.com/home/library | char | 29 | 30 |
251+
| https://www.humblebundle.com/home/library | char | 30 | 31 |
252+
| https://www.humblebundle.com/home/library | char | 31 | 32 |
253+
| https://www.humblebundle.com/home/library | char | 32 | 33 |
254+
| https://www.humblebundle.com/home/library | char | 33 | 34 |
255+
| https://www.humblebundle.com/home/library | char | 34 | 35 |
256+
| https://www.humblebundle.com/home/library | char | 35 | 36 |
257+
| https://www.humblebundle.com/home/library | char | 36 | 37 |
258+
| https://www.humblebundle.com/home/library | char | 37 | 38 |
259+
| https://www.humblebundle.com/home/library | char | 38 | 39 |
260+
| https://www.humblebundle.com/home/library | char | 39 | 40 |
261+
| https://www.humblebundle.com/home/library | char | 40 | 41 |
262+
| https://www.humblebundle.com/home/library | sequence | 0 | 41 |
221263
| x\| | char | 0 | 1 |
222264
| x\| | choice | 0 | 2 |
223265
| x\| | sequence | 0 | 1 |

‎python/ql/test/library-tests/regex/test.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,3 +62,7 @@
6262
re.compile(r"\[(?P<txt>[^[]*)\]\((?P<uri>[^)]*)")
6363

6464
re.compile("", re.M) # ODASA-8056
65+
66+
# FP reported in https://github.com/github/codeql/issues/3712
67+
# This does not define a regex (but could be used by other code to do so)
68+
escaped = re.escape("https://www.humblebundle.com/home/library")

‎python/ql/test/query-tests/Security/CWE-020/IncompleteHostnameRegExp.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
| hosttest.py:6:27:6:51 | Str | This regular expression has an unescaped '.' before 'example.com', so it might match more hosts than expected. |
2+
| hosttest.py:23:21:23:63 | Str | This regular expression has an unescaped '.' before 'humblebundle.com', so it might match more hosts than expected. |

‎python/ql/test/query-tests/Security/CWE-020/hosttest.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,7 @@ def safe(request):
1717
target = request.args.get('target', '')
1818
if SAFE_REGEX.match(target):
1919
return redirect(target)
20+
21+
# FP reported in https://github.com/github/codeql/issues/3712
22+
# This does not define a regex (but could be used by other code to do so)
23+
escaped = re.escape("https://www.humblebundle.com/home/library")

0 commit comments

Comments
 (0)