Skip to content

Commit 39ebb1f

Browse files
asgerfasgerf
committed
JS: Port InterProceduralFlow test
All the new results are benign
1 parent 87cc339 commit 39ebb1f

File tree

5 files changed

+49
-41
lines changed

5 files changed

+49
-41
lines changed

‎javascript/ql/test/library-tests/InterProceduralFlow/DataFlowConfig.qll‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,21 @@
11
import javascript
22

3-
class TestDataFlowConfiguration extends DataFlow::Configuration {
4-
TestDataFlowConfiguration() { this = "TestDataFlowConfiguration" }
5-
6-
override predicate isSource(DataFlow::Node src) {
3+
module TestConfig implements DataFlow::ConfigSig {
4+
predicate isSource(DataFlow::Node src) {
75
exists(VariableDeclarator vd |
86
vd.getBindingPattern().(VarDecl).getName().matches("%source%") and
97
src.asExpr() = vd.getInit()
108
)
119
}
1210

13-
override predicate isSink(DataFlow::Node snk) {
11+
predicate isSink(DataFlow::Node snk) {
1412
exists(VariableDeclarator vd |
1513
vd.getBindingPattern().(VarDecl).getName().matches("%sink%") and
1614
snk.asExpr() = vd.getInit()
1715
)
1816
}
1917

20-
override predicate isBarrier(DataFlow::Node node) {
18+
predicate isBarrier(DataFlow::Node node) {
2119
exists(Function f |
2220
f.getName().matches("%noReturnTracking%") and
2321
node = f.getAReturnedExpr().flow()
@@ -26,3 +24,5 @@ class TestDataFlowConfiguration extends DataFlow::Configuration {
2624
node.asExpr().(PropAccess).getPropertyName() = "notTracked"
2725
}
2826
}
27+
28+
module TestFlow = DataFlow::Global<TestConfig>;

‎javascript/ql/test/library-tests/InterProceduralFlow/async.js‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
return source;
1212
}
1313
let sink3 = sync(); // NOT OK
14-
let sink4 = await sync(); // OK
14+
let sink4 = await sync(); // NOT OK
1515

1616
async function throwsAsync() {
1717
throw source;
@@ -64,7 +64,7 @@
6464
return x.x;
6565
}
6666

67-
var sink8 = unpack(pack(source)); // OK
67+
var sink8 = unpack(pack(source)); // OK
6868
let sink9 = unpack(await (pack(source))); // NOT OK - but not found
6969
}
7070
})();
@@ -75,19 +75,19 @@ async function props() {
7575
p: x
7676
};
7777
}
78-
78+
7979
let source = "source";
8080
let sink = (await (foo(source))).p; // NOT OK - this requires the immidiatly awaited storeStep.
8181
let sink2 = foo("not a source").p;
82-
82+
8383
async function getP(base) {
8484
return base.p;
8585
}
86-
86+
8787
async function getQ(base) {
8888
return base.q;
8989
}
90-
90+
9191
let o3 = { p: source };
9292
let sink6 = await (getP(o3)); // NOT OK - this requires the immidiatly awaited loadStep
9393
let sink7 = await (getQ(o3));

‎javascript/ql/test/library-tests/InterProceduralFlow/properties2.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ function setP(base, rhs) {
1414

1515
var o = {};
1616
setP(o, source);
17-
var sink3 = o.p; // flow from `source` not yet detected
17+
var sink3 = o.p;
1818
var sink4 = o.q;
1919

2020
var o2 = {};

‎javascript/ql/test/library-tests/InterProceduralFlow/tests.expected‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ dataFlow
44
| a.js:2:15:2:28 | "also tainted" | b.js:5:13:5:29 | notTaintedTrustMe |
55
| async.js:2:16:2:23 | "source" | async.js:8:15:8:27 | await async() |
66
| async.js:2:16:2:23 | "source" | async.js:13:15:13:20 | sync() |
7+
| async.js:2:16:2:23 | "source" | async.js:14:15:14:26 | await sync() |
78
| async.js:2:16:2:23 | "source" | async.js:27:17:27:17 | e |
89
| async.js:2:16:2:23 | "source" | async.js:36:17:36:17 | e |
910
| async.js:2:16:2:23 | "source" | async.js:41:17:41:17 | e |
@@ -24,6 +25,7 @@ dataFlow
2425
| esLib.js:3:21:3:29 | "tainted" | nodeJsClient.js:5:13:5:21 | es.source |
2526
| global.js:1:15:1:24 | "tainted1" | global.js:9:13:9:22 | g(source1) |
2627
| global.js:1:15:1:24 | "tainted1" | global.js:17:13:17:27 | window.location |
28+
| global.js:1:15:1:24 | "tainted1" | global.js:18:13:18:24 | win.location |
2729
| global.js:2:15:2:24 | "tainted2" | global.js:10:13:10:22 | g(source2) |
2830
| global.js:5:22:5:35 | "also tainted" | global.js:9:13:9:22 | g(source1) |
2931
| global.js:5:22:5:35 | "also tainted" | global.js:10:13:10:22 | g(source2) |
@@ -55,7 +57,9 @@ dataFlow
5557
| promises.js:12:22:12:31 | "rejected" | promises.js:24:20:24:20 | v |
5658
| promises.js:32:24:32:37 | "also tainted" | promises.js:38:32:38:32 | v |
5759
| properties2.js:7:14:7:21 | "source" | properties2.js:8:12:8:24 | foo(source).p |
60+
| properties2.js:7:14:7:21 | "source" | properties2.js:17:13:17:15 | o.p |
5861
| properties2.js:7:14:7:21 | "source" | properties2.js:33:13:33:20 | getP(o3) |
62+
| properties2.js:7:14:7:21 | "source" | properties2.js:38:13:38:20 | getP(o4) |
5963
| properties.js:2:16:2:24 | "tainted" | properties.js:5:14:5:23 | a.someProp |
6064
| properties.js:2:16:2:24 | "tainted" | properties.js:12:15:12:24 | x.someProp |
6165
| properties.js:2:16:2:24 | "tainted" | properties.js:14:15:14:27 | tmp1.someProp |
@@ -106,6 +110,7 @@ taintTracking
106110
| esLib.js:3:21:3:29 | "tainted" | nodeJsClient.js:5:13:5:21 | es.source |
107111
| global.js:1:15:1:24 | "tainted1" | global.js:9:13:9:22 | g(source1) |
108112
| global.js:1:15:1:24 | "tainted1" | global.js:17:13:17:27 | window.location |
113+
| global.js:1:15:1:24 | "tainted1" | global.js:18:13:18:24 | win.location |
109114
| global.js:2:15:2:24 | "tainted2" | global.js:10:13:10:22 | g(source2) |
110115
| global.js:5:22:5:35 | "also tainted" | global.js:9:13:9:22 | g(source1) |
111116
| global.js:5:22:5:35 | "also tainted" | global.js:10:13:10:22 | g(source2) |
@@ -140,7 +145,9 @@ taintTracking
140145
| promises.js:12:22:12:31 | "rejected" | promises.js:24:20:24:20 | v |
141146
| promises.js:32:24:32:37 | "also tainted" | promises.js:38:32:38:32 | v |
142147
| properties2.js:7:14:7:21 | "source" | properties2.js:8:12:8:24 | foo(source).p |
148+
| properties2.js:7:14:7:21 | "source" | properties2.js:17:13:17:15 | o.p |
143149
| properties2.js:7:14:7:21 | "source" | properties2.js:33:13:33:20 | getP(o3) |
150+
| properties2.js:7:14:7:21 | "source" | properties2.js:38:13:38:20 | getP(o4) |
144151
| properties.js:2:16:2:24 | "tainted" | properties.js:5:14:5:23 | a.someProp |
145152
| properties.js:2:16:2:24 | "tainted" | properties.js:12:15:12:24 | x.someProp |
146153
| properties.js:2:16:2:24 | "tainted" | properties.js:14:15:14:27 | tmp1.someProp |
@@ -191,6 +198,7 @@ germanFlow
191198
| a.js:2:15:2:28 | "also tainted" | b.js:5:13:5:29 | notTaintedTrustMe |
192199
| async.js:2:16:2:23 | "source" | async.js:8:15:8:27 | await async() |
193200
| async.js:2:16:2:23 | "source" | async.js:13:15:13:20 | sync() |
201+
| async.js:2:16:2:23 | "source" | async.js:14:15:14:26 | await sync() |
194202
| async.js:2:16:2:23 | "source" | async.js:27:17:27:17 | e |
195203
| async.js:2:16:2:23 | "source" | async.js:36:17:36:17 | e |
196204
| async.js:2:16:2:23 | "source" | async.js:41:17:41:17 | e |
@@ -212,6 +220,7 @@ germanFlow
212220
| esLib.js:3:21:3:29 | "tainted" | nodeJsClient.js:5:13:5:21 | es.source |
213221
| global.js:1:15:1:24 | "tainted1" | global.js:9:13:9:22 | g(source1) |
214222
| global.js:1:15:1:24 | "tainted1" | global.js:17:13:17:27 | window.location |
223+
| global.js:1:15:1:24 | "tainted1" | global.js:18:13:18:24 | win.location |
215224
| global.js:2:15:2:24 | "tainted2" | global.js:10:13:10:22 | g(source2) |
216225
| global.js:5:22:5:35 | "also tainted" | global.js:9:13:9:22 | g(source1) |
217226
| global.js:5:22:5:35 | "also tainted" | global.js:10:13:10:22 | g(source2) |
@@ -243,7 +252,9 @@ germanFlow
243252
| promises.js:12:22:12:31 | "rejected" | promises.js:24:20:24:20 | v |
244253
| promises.js:32:24:32:37 | "also tainted" | promises.js:38:32:38:32 | v |
245254
| properties2.js:7:14:7:21 | "source" | properties2.js:8:12:8:24 | foo(source).p |
255+
| properties2.js:7:14:7:21 | "source" | properties2.js:17:13:17:15 | o.p |
246256
| properties2.js:7:14:7:21 | "source" | properties2.js:33:13:33:20 | getP(o3) |
257+
| properties2.js:7:14:7:21 | "source" | properties2.js:38:13:38:20 | getP(o4) |
247258
| properties.js:2:16:2:24 | "tainted" | properties.js:5:14:5:23 | a.someProp |
248259
| properties.js:2:16:2:24 | "tainted" | properties.js:12:15:12:24 | x.someProp |
249260
| properties.js:2:16:2:24 | "tainted" | properties.js:14:15:14:27 | tmp1.someProp |

‎javascript/ql/test/library-tests/InterProceduralFlow/tests.ql‎

Lines changed: 25 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,29 @@
1+
import javascript
12
import DataFlowConfig
23

3-
query predicate dataFlow(DataFlow::Node src, DataFlow::Node snk) {
4-
exists(TestDataFlowConfiguration tttc | tttc.hasFlow(src, snk))
5-
}
4+
query predicate dataFlow(DataFlow::Node src, DataFlow::Node snk) { TestFlow::flow(src, snk) }
65

76
class Parity extends DataFlow::FlowLabel {
87
Parity() { this = "even" or this = "odd" }
98

109
Parity flip() { result != this }
1110
}
1211

13-
class FLowLabelConfig extends DataFlow::Configuration {
14-
FLowLabelConfig() { this = "FLowLabelConfig" }
12+
module FlowLabelConfig implements DataFlow::StateConfigSig {
13+
class FlowState = DataFlow::FlowLabel;
1514

16-
override predicate isSource(DataFlow::Node nd, DataFlow::FlowLabel lbl) {
15+
predicate isSource(DataFlow::Node nd, DataFlow::FlowLabel lbl) {
1716
nd.(DataFlow::CallNode).getCalleeName() = "source" and
1817
lbl = "even"
1918
}
2019

21-
override predicate isSink(DataFlow::Node nd, DataFlow::FlowLabel lbl) {
20+
predicate isSink(DataFlow::Node nd, DataFlow::FlowLabel lbl) {
2221
nd = any(DataFlow::CallNode c | c.getCalleeName() = "sink").getAnArgument() and
2322
lbl = "even"
2423
}
2524

26-
override predicate isAdditionalFlowStep(
27-
DataFlow::Node pred, DataFlow::Node succ, DataFlow::FlowLabel predLabel,
25+
predicate isAdditionalFlowStep(
26+
DataFlow::Node pred, DataFlow::FlowLabel predLabel, DataFlow::Node succ,
2827
DataFlow::FlowLabel succLabel
2928
) {
3029
exists(DataFlow::CallNode c | c = succ |
@@ -35,28 +34,28 @@ class FLowLabelConfig extends DataFlow::Configuration {
3534
}
3635
}
3736

38-
query predicate flowLabels(DataFlow::PathNode source, DataFlow::PathNode sink) {
39-
exists(FLowLabelConfig cfg | cfg.hasFlowPath(source, sink))
40-
}
37+
module FlowLabelFlow = DataFlow::GlobalWithState<FlowLabelConfig>;
4138

42-
class TestTaintTrackingConfiguration extends TaintTracking::Configuration {
43-
TestTaintTrackingConfiguration() { this = "TestTaintTrackingConfiguration" }
39+
query predicate flowLabels(FlowLabelFlow::PathNode source, FlowLabelFlow::PathNode sink) {
40+
FlowLabelFlow::flowPath(source, sink)
41+
}
4442

45-
override predicate isSource(DataFlow::Node src) {
43+
module TaintConfig implements DataFlow::ConfigSig {
44+
predicate isSource(DataFlow::Node src) {
4645
exists(VariableDeclarator vd |
4746
vd.getBindingPattern().(VarDecl).getName().matches("%source%") and
4847
src.asExpr() = vd.getInit()
4948
)
5049
}
5150

52-
override predicate isSink(DataFlow::Node snk) {
51+
predicate isSink(DataFlow::Node snk) {
5352
exists(VariableDeclarator vd |
5453
vd.getBindingPattern().(VarDecl).getName().matches("%sink%") and
5554
snk.asExpr() = vd.getInit()
5655
)
5756
}
5857

59-
override predicate isSanitizer(DataFlow::Node node) {
58+
predicate isBarrier(DataFlow::Node node) {
6059
exists(Function f |
6160
f.getName().matches("%noReturnTracking%") and
6261
node = f.getAReturnedExpr().flow()
@@ -66,14 +65,12 @@ class TestTaintTrackingConfiguration extends TaintTracking::Configuration {
6665
}
6766
}
6867

69-
query predicate taintTracking(DataFlow::Node src, DataFlow::Node snk) {
70-
exists(TestTaintTrackingConfiguration tttc | tttc.hasFlow(src, snk))
71-
}
68+
module TaintFlow = TaintTracking::Global<TaintConfig>;
7269

73-
class GermanFlowConfig extends DataFlow::Configuration {
74-
GermanFlowConfig() { this = "GermanFlowConfig" }
70+
query predicate taintTracking(DataFlow::Node src, DataFlow::Node snk) { TaintFlow::flow(src, snk) }
7571

76-
override predicate isSource(DataFlow::Node src) {
72+
module GermanConfig implements DataFlow::ConfigSig {
73+
predicate isSource(DataFlow::Node src) {
7774
exists(VariableDeclarator vd |
7875
vd.getBindingPattern().(VarDecl).getName().matches("%source%") and
7976
src.asExpr() = vd.getInit()
@@ -82,7 +79,7 @@ class GermanFlowConfig extends DataFlow::Configuration {
8279
src.asExpr() = any(Variable v | v.getName() = "quelle").getAnAssignedExpr()
8380
}
8481

85-
override predicate isSink(DataFlow::Node snk) {
82+
predicate isSink(DataFlow::Node snk) {
8683
exists(VariableDeclarator vd |
8784
vd.getBindingPattern().(VarDecl).getName().matches("%sink%") and
8885
snk.asExpr() = vd.getInit()
@@ -91,7 +88,7 @@ class GermanFlowConfig extends DataFlow::Configuration {
9188
snk.asExpr() = any(Variable v | v.getName() = "abfluss").getAnAssignedExpr()
9289
}
9390

94-
override predicate isBarrier(DataFlow::Node node) {
91+
predicate isBarrier(DataFlow::Node node) {
9592
exists(Function f |
9693
f.getName().matches("%noReturnTracking%") and
9794
node = f.getAReturnedExpr().flow()
@@ -101,6 +98,6 @@ class GermanFlowConfig extends DataFlow::Configuration {
10198
}
10299
}
103100

104-
query predicate germanFlow(DataFlow::Node src, DataFlow::Node snk) {
105-
exists(GermanFlowConfig tttc | tttc.hasFlow(src, snk))
106-
}
101+
module GermanFlow = DataFlow::Global<GermanConfig>;
102+
103+
query predicate germanFlow(DataFlow::Node src, DataFlow::Node snk) { GermanFlow::flow(src, snk) }

0 commit comments

Comments
 (0)