Skip to content

Commit 02e1edd

Browse files
geoffw0geoffw0
committed
CPP: Test taint through lambdas.
1 parent b6cf341 commit 02e1edd

File tree

4 files changed

+103
-0
lines changed

4 files changed

+103
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,20 @@
1+
| file://:0:0:0:0 | t | taint.cpp:235:11:239:2 | {...} | TAINT |
2+
| file://:0:0:0:0 | t | taint.cpp:243:11:246:2 | {...} | TAINT |
3+
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
4+
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
5+
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
6+
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
17
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
8+
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
9+
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
10+
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
11+
| file://:0:0:0:0 | this | file://:0:0:0:0 | v | TAINT |
212
| file://:0:0:0:0 | this | taint.cpp:72:3:72:3 | c | TAINT |
313
| file://:0:0:0:0 | this | taint.cpp:73:3:73:3 | d | TAINT |
414
| file://:0:0:0:0 | this | taint.cpp:77:3:77:3 | d | TAINT |
15+
| file://:0:0:0:0 | u | taint.cpp:235:11:239:2 | {...} | TAINT |
16+
| file://:0:0:0:0 | u | taint.cpp:243:11:246:2 | {...} | TAINT |
17+
| file://:0:0:0:0 | v | taint.cpp:235:11:239:2 | {...} | TAINT |
518
| taint.cpp:4:27:4:33 | source1 | taint.cpp:6:13:6:19 | source1 | |
619
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:5:8:5:13 | clean1 | |
720
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:6:3:6:8 | clean1 | |
@@ -178,3 +191,44 @@
178191
| taint.cpp:213:12:213:12 | x | taint.cpp:213:15:213:15 | ref arg y | |
179192
| taint.cpp:213:15:213:15 | ref arg y | taint.cpp:216:7:216:7 | y | |
180193
| taint.cpp:213:15:213:15 | y | taint.cpp:213:12:213:12 | ref arg x | |
194+
| taint.cpp:223:10:223:15 | call to source | file://:0:0:0:0 | t | |
195+
| taint.cpp:223:10:223:15 | call to source | file://:0:0:0:0 | t | |
196+
| taint.cpp:223:10:223:15 | call to source | taint.cpp:228:12:228:12 | t | |
197+
| taint.cpp:223:10:223:15 | call to source | taint.cpp:253:4:253:4 | t | |
198+
| taint.cpp:223:10:223:15 | call to source | taint.cpp:260:4:260:4 | t | |
199+
| taint.cpp:224:9:224:10 | 0 | file://:0:0:0:0 | u | |
200+
| taint.cpp:224:9:224:10 | 0 | file://:0:0:0:0 | u | |
201+
| taint.cpp:224:9:224:10 | 0 | taint.cpp:228:15:228:15 | u | |
202+
| taint.cpp:224:9:224:10 | 0 | taint.cpp:253:7:253:7 | u | |
203+
| taint.cpp:224:9:224:10 | 0 | taint.cpp:260:7:260:7 | u | |
204+
| taint.cpp:225:9:225:10 | 0 | file://:0:0:0:0 | v | |
205+
| taint.cpp:225:9:225:10 | 0 | taint.cpp:241:7:241:7 | v | |
206+
| taint.cpp:226:9:226:10 | 0 | taint.cpp:260:10:260:10 | w | |
207+
| taint.cpp:226:9:226:10 | 0 | taint.cpp:261:7:261:7 | w | |
208+
| taint.cpp:228:11:228:11 | Unknown literal | taint.cpp:228:11:228:11 | constructor init of field t | TAINT |
209+
| taint.cpp:228:11:228:11 | Unknown literal | taint.cpp:228:11:228:11 | constructor init of field u | TAINT |
210+
| taint.cpp:228:11:232:2 | [...](...){...} | taint.cpp:233:7:233:7 | a | |
211+
| taint.cpp:228:11:232:2 | {...} | taint.cpp:228:11:232:2 | [...](...){...} | TAINT |
212+
| taint.cpp:228:12:228:12 | t | taint.cpp:228:11:232:2 | {...} | TAINT |
213+
| taint.cpp:228:15:228:15 | u | taint.cpp:228:11:232:2 | {...} | TAINT |
214+
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field t | TAINT |
215+
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field u | TAINT |
216+
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field v | TAINT |
217+
| taint.cpp:235:11:239:2 | [...](...){...} | taint.cpp:240:2:240:2 | b | |
218+
| taint.cpp:235:11:239:2 | {...} | taint.cpp:235:11:239:2 | [...](...){...} | TAINT |
219+
| taint.cpp:238:7:238:12 | call to source | taint.cpp:238:3:238:14 | ... = ... | |
220+
| taint.cpp:243:11:243:11 | Unknown literal | taint.cpp:243:11:243:11 | constructor init of field t | TAINT |
221+
| taint.cpp:243:11:243:11 | Unknown literal | taint.cpp:243:11:243:11 | constructor init of field u | TAINT |
222+
| taint.cpp:243:11:246:2 | [...](...){...} | taint.cpp:247:2:247:2 | c | |
223+
| taint.cpp:243:11:246:2 | {...} | taint.cpp:243:11:246:2 | [...](...){...} | TAINT |
224+
| taint.cpp:249:11:252:2 | [...](...){...} | taint.cpp:253:2:253:2 | d | |
225+
| taint.cpp:249:18:249:18 | a | taint.cpp:250:8:250:8 | a | |
226+
| taint.cpp:249:25:249:25 | b | taint.cpp:251:8:251:8 | b | |
227+
| taint.cpp:255:11:259:2 | [...](...){...} | taint.cpp:260:2:260:2 | e | |
228+
| taint.cpp:255:19:255:19 | a | taint.cpp:256:8:256:8 | a | |
229+
| taint.cpp:255:27:255:27 | b | taint.cpp:257:8:257:8 | b | |
230+
| taint.cpp:258:7:258:12 | call to source | taint.cpp:258:3:258:14 | ... = ... | |
231+
| taint.cpp:260:4:260:4 | ref arg t | taint.cpp:260:4:260:4 | t | |
232+
| taint.cpp:260:7:260:7 | ref arg u | taint.cpp:260:7:260:7 | u | |
233+
| taint.cpp:260:10:260:10 | ref arg w | taint.cpp:260:10:260:10 | w | |
234+
| taint.cpp:260:10:260:10 | ref arg w | taint.cpp:261:7:261:7 | w | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -215,3 +215,48 @@ void test_swap() {
215215
sink(x); // [FALSE POSITIVE]
216216
sink(y); // tainted
217217
}
218+
219+
// --- lambdas ---
220+
221+
void test_lambdas()
222+
{
223+
int t = source();
224+
int u = 0;
225+
int v = 0;
226+
int w = 0;
227+
228+
auto a = [t, u]() -> int {
229+
sink(t); // tainted [NOT DETECTED]
230+
sink(u);
231+
return t;
232+
};
233+
sink(a()); // tainted [NOT DETECTED]
234+
235+
auto b = [&] {
236+
sink(t); // tainted [NOT DETECTED]
237+
sink(u);
238+
v = source(); // (v is reference captured)
239+
};
240+
b();
241+
sink(v); // tainted [NOT DETECTED]
242+
243+
auto c = [=] {
244+
sink(t); // tainted [NOT DETECTED]
245+
sink(u);
246+
};
247+
c();
248+
249+
auto d = [](int a, int b) {
250+
sink(a); // tainted
251+
sink(b);
252+
};
253+
d(t, u);
254+
255+
auto e = [](int &a, int &b, int &c) {
256+
sink(a); // tainted
257+
sink(b);
258+
c = source();
259+
};
260+
e(t, u, w);
261+
sink(w); // tainted [NOT DETECTED]
262+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,3 +20,5 @@
2020
| taint.cpp:210:7:210:7 | x | taint.cpp:207:6:207:11 | call to source |
2121
| taint.cpp:215:7:215:7 | x | taint.cpp:207:6:207:11 | call to source |
2222
| taint.cpp:216:7:216:7 | y | taint.cpp:207:6:207:11 | call to source |
23+
| taint.cpp:250:8:250:8 | a | taint.cpp:223:10:223:15 | call to source |
24+
| taint.cpp:256:8:256:8 | a | taint.cpp:223:10:223:15 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,5 @@
1212
| taint.cpp:195:7:195:7 | taint.cpp:193:6:193:6 | AST only |
1313
| taint.cpp:215:7:215:7 | taint.cpp:207:6:207:11 | AST only |
1414
| taint.cpp:216:7:216:7 | taint.cpp:207:6:207:11 | AST only |
15+
| taint.cpp:250:8:250:8 | taint.cpp:223:10:223:15 | AST only |
16+
| taint.cpp:256:8:256:8 | taint.cpp:223:10:223:15 | AST only |

0 commit comments

Comments
 (0)