Skip to content

Commit 6e734a8

Browse files
geoffw0geoffw0
committed
C++: Additional test cases for std::string.
1 parent 58f5189 commit 6e734a8

File tree

5 files changed

+225
-28
lines changed

5 files changed

+225
-28
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 133 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -461,12 +461,12 @@
461461
| standalone_iterators.cpp:51:37:51:43 | source1 | standalone_iterators.cpp:53:12:53:18 | source1 | |
462462
| standalone_iterators.cpp:51:37:51:43 | source1 | standalone_iterators.cpp:54:14:54:20 | source1 | |
463463
| standalone_iterators.cpp:53:12:53:18 | ref arg source1 | standalone_iterators.cpp:54:14:54:20 | source1 | |
464-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
465-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
466-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
467-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
468-
| stl.h:172:30:172:40 | call to allocator | stl.h:172:21:172:41 | noexcept(...) | TAINT |
469-
| stl.h:172:53:172:63 | 0 | stl.h:172:46:172:64 | (no string representation) | TAINT |
464+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
465+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
466+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
467+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
468+
| stl.h:179:30:179:40 | call to allocator | stl.h:179:21:179:41 | noexcept(...) | TAINT |
469+
| stl.h:179:53:179:63 | 0 | stl.h:179:46:179:64 | (no string representation) | TAINT |
470470
| string.cpp:24:12:24:17 | call to source | string.cpp:28:7:28:7 | a | |
471471
| string.cpp:25:16:25:20 | 123 | string.cpp:25:16:25:21 | call to basic_string | TAINT |
472472
| string.cpp:25:16:25:21 | call to basic_string | string.cpp:29:7:29:7 | b | |
@@ -624,32 +624,32 @@
624624
| string.cpp:153:18:153:23 | call to basic_string | string.cpp:173:8:173:9 | s3 | |
625625
| string.cpp:154:18:154:23 | call to source | string.cpp:154:18:154:26 | call to basic_string | TAINT |
626626
| string.cpp:154:18:154:26 | call to basic_string | string.cpp:157:13:157:14 | s4 | |
627-
| string.cpp:154:18:154:26 | call to basic_string | string.cpp:161:9:161:10 | s4 | |
627+
| string.cpp:154:18:154:26 | call to basic_string | string.cpp:161:14:161:15 | s4 | |
628628
| string.cpp:154:18:154:26 | call to basic_string | string.cpp:170:13:170:14 | s4 | |
629629
| string.cpp:157:8:157:9 | s3 | string.cpp:157:11:157:11 | call to operator+ | TAINT |
630630
| string.cpp:157:11:157:11 | call to operator+ | string.cpp:157:3:157:14 | ... = ... | |
631631
| string.cpp:157:11:157:11 | call to operator+ | string.cpp:158:8:158:9 | s5 | |
632632
| string.cpp:157:13:157:14 | s4 | string.cpp:157:11:157:11 | call to operator+ | TAINT |
633633
| string.cpp:160:8:160:9 | s3 | string.cpp:160:3:160:9 | ... = ... | |
634-
| string.cpp:160:8:160:9 | s3 | string.cpp:161:3:161:4 | s6 | |
634+
| string.cpp:160:8:160:9 | s3 | string.cpp:161:8:161:9 | s6 | |
635635
| string.cpp:160:8:160:9 | s3 | string.cpp:162:8:162:9 | s6 | |
636-
| string.cpp:161:3:161:4 | ref arg s6 | string.cpp:162:8:162:9 | s6 | |
637-
| string.cpp:161:3:161:4 | s6 | string.cpp:161:6:161:6 | call to operator+= | TAINT |
638-
| string.cpp:161:9:161:10 | s4 | string.cpp:161:3:161:4 | ref arg s6 | TAINT |
639-
| string.cpp:161:9:161:10 | s4 | string.cpp:161:6:161:6 | call to operator+= | TAINT |
636+
| string.cpp:161:8:161:9 | ref arg s6 | string.cpp:162:8:162:9 | s6 | |
637+
| string.cpp:161:8:161:9 | s6 | string.cpp:161:11:161:11 | call to operator+= | TAINT |
638+
| string.cpp:161:14:161:15 | s4 | string.cpp:161:8:161:9 | ref arg s6 | TAINT |
639+
| string.cpp:161:14:161:15 | s4 | string.cpp:161:11:161:11 | call to operator+= | TAINT |
640640
| string.cpp:164:8:164:9 | s3 | string.cpp:164:3:164:9 | ... = ... | |
641-
| string.cpp:164:8:164:9 | s3 | string.cpp:165:3:165:4 | s7 | |
642-
| string.cpp:164:8:164:9 | s3 | string.cpp:166:3:166:4 | s7 | |
641+
| string.cpp:164:8:164:9 | s3 | string.cpp:165:8:165:9 | s7 | |
642+
| string.cpp:164:8:164:9 | s3 | string.cpp:166:8:166:9 | s7 | |
643643
| string.cpp:164:8:164:9 | s3 | string.cpp:167:8:167:9 | s7 | |
644-
| string.cpp:165:3:165:4 | ref arg s7 | string.cpp:166:3:166:4 | s7 | |
645-
| string.cpp:165:3:165:4 | ref arg s7 | string.cpp:167:8:167:9 | s7 | |
646-
| string.cpp:165:3:165:4 | s7 | string.cpp:165:6:165:6 | call to operator+= | TAINT |
647-
| string.cpp:165:9:165:14 | call to source | string.cpp:165:3:165:4 | ref arg s7 | TAINT |
648-
| string.cpp:165:9:165:14 | call to source | string.cpp:165:6:165:6 | call to operator+= | TAINT |
649-
| string.cpp:166:3:166:4 | ref arg s7 | string.cpp:167:8:167:9 | s7 | |
650-
| string.cpp:166:3:166:4 | s7 | string.cpp:166:6:166:6 | call to operator+= | TAINT |
651-
| string.cpp:166:9:166:11 | | string.cpp:166:3:166:4 | ref arg s7 | TAINT |
652-
| string.cpp:166:9:166:11 | | string.cpp:166:6:166:6 | call to operator+= | TAINT |
644+
| string.cpp:165:8:165:9 | ref arg s7 | string.cpp:166:8:166:9 | s7 | |
645+
| string.cpp:165:8:165:9 | ref arg s7 | string.cpp:167:8:167:9 | s7 | |
646+
| string.cpp:165:8:165:9 | s7 | string.cpp:165:11:165:11 | call to operator+= | TAINT |
647+
| string.cpp:165:14:165:19 | call to source | string.cpp:165:8:165:9 | ref arg s7 | TAINT |
648+
| string.cpp:165:14:165:19 | call to source | string.cpp:165:11:165:11 | call to operator+= | TAINT |
649+
| string.cpp:166:8:166:9 | ref arg s7 | string.cpp:167:8:167:9 | s7 | |
650+
| string.cpp:166:8:166:9 | s7 | string.cpp:166:11:166:11 | call to operator+= | TAINT |
651+
| string.cpp:166:14:166:16 | | string.cpp:166:8:166:9 | ref arg s7 | TAINT |
652+
| string.cpp:166:14:166:16 | | string.cpp:166:11:166:11 | call to operator+= | TAINT |
653653
| string.cpp:169:8:169:9 | s3 | string.cpp:169:3:169:9 | ... = ... | |
654654
| string.cpp:169:8:169:9 | s3 | string.cpp:170:3:170:4 | s8 | |
655655
| string.cpp:169:8:169:9 | s3 | string.cpp:171:8:171:9 | s8 | |
@@ -1237,6 +1237,116 @@
12371237
| string.cpp:501:29:501:30 | ref arg s2 | string.cpp:504:7:504:8 | s2 | |
12381238
| string.cpp:501:29:501:30 | s2 | string.cpp:501:32:501:34 | call to end | TAINT |
12391239
| string.cpp:501:32:501:34 | call to end | string.cpp:501:17:501:37 | call to basic_string | TAINT |
1240+
| string.cpp:510:16:510:19 | aa | string.cpp:510:16:510:20 | call to basic_string | TAINT |
1241+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:512:7:512:7 | a | |
1242+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:513:7:513:7 | a | |
1243+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:514:2:514:2 | a | |
1244+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:515:7:515:7 | a | |
1245+
| string.cpp:510:16:510:20 | call to basic_string | string.cpp:516:7:516:7 | a | |
1246+
| string.cpp:512:7:512:7 | ref arg a | string.cpp:513:7:513:7 | a | |
1247+
| string.cpp:512:7:512:7 | ref arg a | string.cpp:514:2:514:2 | a | |
1248+
| string.cpp:512:7:512:7 | ref arg a | string.cpp:515:7:515:7 | a | |
1249+
| string.cpp:512:7:512:7 | ref arg a | string.cpp:516:7:516:7 | a | |
1250+
| string.cpp:513:7:513:7 | ref arg a | string.cpp:514:2:514:2 | a | |
1251+
| string.cpp:513:7:513:7 | ref arg a | string.cpp:515:7:515:7 | a | |
1252+
| string.cpp:513:7:513:7 | ref arg a | string.cpp:516:7:516:7 | a | |
1253+
| string.cpp:514:2:514:2 | ref arg a | string.cpp:515:7:515:7 | a | |
1254+
| string.cpp:514:2:514:2 | ref arg a | string.cpp:516:7:516:7 | a | |
1255+
| string.cpp:515:7:515:7 | ref arg a | string.cpp:516:7:516:7 | a | |
1256+
| string.cpp:521:17:521:20 | aa | string.cpp:521:17:521:21 | call to basic_string | TAINT |
1257+
| string.cpp:521:17:521:21 | call to basic_string | string.cpp:528:9:528:9 | a | |
1258+
| string.cpp:521:17:521:21 | call to basic_string | string.cpp:532:8:532:8 | a | |
1259+
| string.cpp:522:17:522:20 | bb | string.cpp:522:17:522:21 | call to basic_string | TAINT |
1260+
| string.cpp:522:17:522:21 | call to basic_string | string.cpp:528:15:528:15 | b | |
1261+
| string.cpp:522:17:522:21 | call to basic_string | string.cpp:533:8:533:8 | b | |
1262+
| string.cpp:523:17:523:20 | cc | string.cpp:523:17:523:21 | call to basic_string | TAINT |
1263+
| string.cpp:523:17:523:21 | call to basic_string | string.cpp:529:9:529:9 | c | |
1264+
| string.cpp:523:17:523:21 | call to basic_string | string.cpp:534:8:534:8 | c | |
1265+
| string.cpp:524:17:524:20 | dd | string.cpp:524:17:524:21 | call to basic_string | TAINT |
1266+
| string.cpp:524:17:524:21 | call to basic_string | string.cpp:529:15:529:15 | d | |
1267+
| string.cpp:524:17:524:21 | call to basic_string | string.cpp:535:8:535:8 | d | |
1268+
| string.cpp:525:17:525:20 | ee | string.cpp:525:17:525:21 | call to basic_string | TAINT |
1269+
| string.cpp:525:17:525:21 | call to basic_string | string.cpp:530:10:530:10 | e | |
1270+
| string.cpp:525:17:525:21 | call to basic_string | string.cpp:536:8:536:8 | e | |
1271+
| string.cpp:526:17:526:20 | ff | string.cpp:526:17:526:21 | call to basic_string | TAINT |
1272+
| string.cpp:526:17:526:21 | call to basic_string | string.cpp:531:10:531:10 | f | |
1273+
| string.cpp:526:17:526:21 | call to basic_string | string.cpp:537:8:537:8 | f | |
1274+
| string.cpp:528:9:528:9 | a | string.cpp:528:11:528:11 | call to operator+= | TAINT |
1275+
| string.cpp:528:9:528:9 | ref arg a | string.cpp:532:8:532:8 | a | |
1276+
| string.cpp:528:15:528:15 | b | string.cpp:528:17:528:17 | call to operator+= | TAINT |
1277+
| string.cpp:528:15:528:15 | ref arg b | string.cpp:533:8:533:8 | b | |
1278+
| string.cpp:528:17:528:17 | call to operator+= | string.cpp:528:9:528:9 | ref arg a | TAINT |
1279+
| string.cpp:528:17:528:17 | call to operator+= | string.cpp:528:11:528:11 | call to operator+= | TAINT |
1280+
| string.cpp:528:20:528:23 | bb | string.cpp:528:15:528:15 | ref arg b | TAINT |
1281+
| string.cpp:528:20:528:23 | bb | string.cpp:528:17:528:17 | call to operator+= | TAINT |
1282+
| string.cpp:529:9:529:9 | c | string.cpp:529:11:529:11 | call to operator+= | TAINT |
1283+
| string.cpp:529:9:529:9 | ref arg c | string.cpp:534:8:534:8 | c | |
1284+
| string.cpp:529:15:529:15 | d | string.cpp:529:17:529:17 | call to operator+= | TAINT |
1285+
| string.cpp:529:15:529:15 | ref arg d | string.cpp:535:8:535:8 | d | |
1286+
| string.cpp:529:17:529:17 | call to operator+= | string.cpp:529:9:529:9 | ref arg c | TAINT |
1287+
| string.cpp:529:17:529:17 | call to operator+= | string.cpp:529:11:529:11 | call to operator+= | TAINT |
1288+
| string.cpp:529:20:529:25 | call to source | string.cpp:529:15:529:15 | ref arg d | TAINT |
1289+
| string.cpp:529:20:529:25 | call to source | string.cpp:529:17:529:17 | call to operator+= | TAINT |
1290+
| string.cpp:530:10:530:10 | e | string.cpp:530:12:530:12 | call to operator+= | TAINT |
1291+
| string.cpp:530:10:530:10 | ref arg e | string.cpp:536:8:536:8 | e | |
1292+
| string.cpp:530:12:530:12 | call to operator+= | string.cpp:530:21:530:21 | call to operator+= | TAINT |
1293+
| string.cpp:530:15:530:18 | ee | string.cpp:530:10:530:10 | ref arg e | TAINT |
1294+
| string.cpp:530:15:530:18 | ee | string.cpp:530:12:530:12 | call to operator+= | TAINT |
1295+
| string.cpp:530:24:530:29 | call to source | string.cpp:530:12:530:12 | ref arg call to operator+= | TAINT |
1296+
| string.cpp:530:24:530:29 | call to source | string.cpp:530:21:530:21 | call to operator+= | TAINT |
1297+
| string.cpp:531:10:531:10 | f | string.cpp:531:12:531:12 | call to operator+= | TAINT |
1298+
| string.cpp:531:10:531:10 | ref arg f | string.cpp:537:8:537:8 | f | |
1299+
| string.cpp:531:12:531:12 | call to operator+= | string.cpp:531:25:531:25 | call to operator+= | TAINT |
1300+
| string.cpp:531:15:531:20 | call to source | string.cpp:531:10:531:10 | ref arg f | TAINT |
1301+
| string.cpp:531:15:531:20 | call to source | string.cpp:531:12:531:12 | call to operator+= | TAINT |
1302+
| string.cpp:531:28:531:31 | ff | string.cpp:531:12:531:12 | ref arg call to operator+= | TAINT |
1303+
| string.cpp:531:28:531:31 | ff | string.cpp:531:25:531:25 | call to operator+= | TAINT |
1304+
| string.cpp:541:17:541:20 | aa | string.cpp:541:17:541:21 | call to basic_string | TAINT |
1305+
| string.cpp:541:17:541:21 | call to basic_string | string.cpp:548:9:548:9 | a | |
1306+
| string.cpp:541:17:541:21 | call to basic_string | string.cpp:552:8:552:8 | a | |
1307+
| string.cpp:542:17:542:20 | bb | string.cpp:542:17:542:21 | call to basic_string | TAINT |
1308+
| string.cpp:542:17:542:21 | call to basic_string | string.cpp:548:18:548:18 | b | |
1309+
| string.cpp:542:17:542:21 | call to basic_string | string.cpp:553:8:553:8 | b | |
1310+
| string.cpp:543:17:543:20 | cc | string.cpp:543:17:543:21 | call to basic_string | TAINT |
1311+
| string.cpp:543:17:543:21 | call to basic_string | string.cpp:549:9:549:9 | c | |
1312+
| string.cpp:543:17:543:21 | call to basic_string | string.cpp:554:8:554:8 | c | |
1313+
| string.cpp:544:17:544:20 | dd | string.cpp:544:17:544:21 | call to basic_string | TAINT |
1314+
| string.cpp:544:17:544:21 | call to basic_string | string.cpp:549:18:549:18 | d | |
1315+
| string.cpp:544:17:544:21 | call to basic_string | string.cpp:555:8:555:8 | d | |
1316+
| string.cpp:545:17:545:20 | ee | string.cpp:545:17:545:21 | call to basic_string | TAINT |
1317+
| string.cpp:545:17:545:21 | call to basic_string | string.cpp:550:9:550:9 | e | |
1318+
| string.cpp:545:17:545:21 | call to basic_string | string.cpp:556:8:556:8 | e | |
1319+
| string.cpp:546:17:546:20 | ff | string.cpp:546:17:546:21 | call to basic_string | TAINT |
1320+
| string.cpp:546:17:546:21 | call to basic_string | string.cpp:551:9:551:9 | f | |
1321+
| string.cpp:546:17:546:21 | call to basic_string | string.cpp:557:8:557:8 | f | |
1322+
| string.cpp:548:9:548:9 | ref arg a | string.cpp:552:8:552:8 | a | |
1323+
| string.cpp:548:18:548:18 | ref arg b | string.cpp:553:8:553:8 | b | |
1324+
| string.cpp:548:20:548:25 | call to assign | string.cpp:548:9:548:9 | ref arg a | TAINT |
1325+
| string.cpp:548:20:548:25 | call to assign | string.cpp:548:11:548:16 | call to assign | TAINT |
1326+
| string.cpp:548:27:548:30 | bb | string.cpp:548:27:548:30 | call to basic_string | TAINT |
1327+
| string.cpp:548:27:548:30 | call to basic_string | string.cpp:548:18:548:18 | ref arg b | TAINT |
1328+
| string.cpp:548:27:548:30 | call to basic_string | string.cpp:548:20:548:25 | call to assign | TAINT |
1329+
| string.cpp:549:9:549:9 | ref arg c | string.cpp:554:8:554:8 | c | |
1330+
| string.cpp:549:18:549:18 | ref arg d | string.cpp:555:8:555:8 | d | |
1331+
| string.cpp:549:20:549:25 | call to assign | string.cpp:549:9:549:9 | ref arg c | TAINT |
1332+
| string.cpp:549:20:549:25 | call to assign | string.cpp:549:11:549:16 | call to assign | TAINT |
1333+
| string.cpp:549:27:549:32 | call to source | string.cpp:549:27:549:34 | call to basic_string | TAINT |
1334+
| string.cpp:549:27:549:34 | call to basic_string | string.cpp:549:18:549:18 | ref arg d | TAINT |
1335+
| string.cpp:549:27:549:34 | call to basic_string | string.cpp:549:20:549:25 | call to assign | TAINT |
1336+
| string.cpp:550:9:550:9 | ref arg e | string.cpp:556:8:556:8 | e | |
1337+
| string.cpp:550:18:550:21 | call to basic_string | string.cpp:550:9:550:9 | ref arg e | TAINT |
1338+
| string.cpp:550:18:550:21 | call to basic_string | string.cpp:550:11:550:16 | call to assign | TAINT |
1339+
| string.cpp:550:18:550:21 | ee | string.cpp:550:18:550:21 | call to basic_string | TAINT |
1340+
| string.cpp:550:31:550:36 | call to source | string.cpp:550:31:550:38 | call to basic_string | TAINT |
1341+
| string.cpp:550:31:550:38 | call to basic_string | string.cpp:550:11:550:16 | ref arg call to assign | TAINT |
1342+
| string.cpp:550:31:550:38 | call to basic_string | string.cpp:550:24:550:29 | call to assign | TAINT |
1343+
| string.cpp:551:9:551:9 | ref arg f | string.cpp:557:8:557:8 | f | |
1344+
| string.cpp:551:18:551:23 | call to source | string.cpp:551:18:551:25 | call to basic_string | TAINT |
1345+
| string.cpp:551:18:551:25 | call to basic_string | string.cpp:551:9:551:9 | ref arg f | TAINT |
1346+
| string.cpp:551:18:551:25 | call to basic_string | string.cpp:551:11:551:16 | call to assign | TAINT |
1347+
| string.cpp:551:35:551:38 | call to basic_string | string.cpp:551:11:551:16 | ref arg call to assign | TAINT |
1348+
| string.cpp:551:35:551:38 | call to basic_string | string.cpp:551:28:551:33 | call to assign | TAINT |
1349+
| string.cpp:551:35:551:38 | ff | string.cpp:551:35:551:38 | call to basic_string | TAINT |
12401350
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:16:2:16:4 | ss1 | |
12411351
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:22:7:22:9 | ss1 | |
12421352
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:27:7:27:9 | ss1 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,13 @@ namespace std
9191
const_iterator cbegin() const;
9292
const_iterator cend() const;
9393

94+
void push_back(charT c);
95+
96+
const charT& front() const;
97+
charT& front();
98+
const charT& back() const;
99+
charT& back();
100+
94101
const_reference operator[](size_type pos) const;
95102
reference operator[](size_type pos);
96103
const_reference at(size_type n) const;

‎cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp‎

Lines changed: 55 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -158,12 +158,12 @@ void test_string_append() {
158158
sink(s5); // tainted
159159

160160
s6 = s3;
161-
s6 += s4;
161+
sink(s6 += s4); // tainted
162162
sink(s6); // tainted
163163

164164
s7 = s3;
165-
s7 += source();
166-
s7 += " ";
165+
sink(s7 += source()); // tainted
166+
sink(s7 += " "); // tainted
167167
sink(s7); // tainted
168168

169169
s8 = s3;
@@ -505,3 +505,55 @@ void test_constructors_more() {
505505
sink(s3);
506506
sink(s4); // tainted
507507
}
508+
509+
void test_string_front_back() {
510+
std::string a("aa");
511+
512+
sink(a.front());
513+
sink(a.back());
514+
a.push_back(ns_char::source());
515+
sink(a.front());
516+
sink(a.back()); // tainted [NOT DETECTED]
517+
}
518+
519+
void test_string_return_assign() {
520+
{
521+
std::string a("aa");
522+
std::string b("bb");
523+
std::string c("cc");
524+
std::string d("dd");
525+
std::string e("ee");
526+
std::string f("ff");
527+
528+
sink( a += (b += "bb") );
529+
sink( c += (d += source()) ); // tainted
530+
sink( (e += "ee") += source() ); // tainted
531+
sink( (f += source()) += "ff" ); // tainted
532+
sink(a);
533+
sink(b);
534+
sink(c); // tainted
535+
sink(d); // tainted
536+
sink(e); // tainted [NOT DETECTED]
537+
sink(f); // tainted
538+
}
539+
540+
{
541+
std::string a("aa");
542+
std::string b("bb");
543+
std::string c("cc");
544+
std::string d("dd");
545+
std::string e("ee");
546+
std::string f("ff");
547+
548+
sink( a.assign(b.assign("bb")) );
549+
sink( c.assign(d.assign(source())) ); // tainted
550+
sink( e.assign("ee").assign(source()) ); // tainted
551+
sink( f.assign(source()).assign("ff") );
552+
sink(a);
553+
sink(b);
554+
sink(c); // tainted
555+
sink(d); // tainted
556+
sink(e); // tainted [NOT DETECTED]
557+
sink(f); // [FALSE POSITIVE]
558+
}
559+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,11 @@
6767
| string.cpp:146:11:146:11 | call to operator+ | string.cpp:141:18:141:23 | call to source |
6868
| string.cpp:149:11:149:11 | call to operator+ | string.cpp:149:13:149:18 | call to source |
6969
| string.cpp:158:8:158:9 | s5 | string.cpp:154:18:154:23 | call to source |
70+
| string.cpp:161:11:161:11 | call to operator+= | string.cpp:154:18:154:23 | call to source |
7071
| string.cpp:162:8:162:9 | s6 | string.cpp:154:18:154:23 | call to source |
71-
| string.cpp:167:8:167:9 | s7 | string.cpp:165:9:165:14 | call to source |
72+
| string.cpp:165:11:165:11 | call to operator+= | string.cpp:165:14:165:19 | call to source |
73+
| string.cpp:166:11:166:11 | call to operator+= | string.cpp:165:14:165:19 | call to source |
74+
| string.cpp:167:8:167:9 | s7 | string.cpp:165:14:165:19 | call to source |
7275
| string.cpp:171:8:171:9 | s8 | string.cpp:154:18:154:23 | call to source |
7376
| string.cpp:176:8:176:9 | s9 | string.cpp:174:13:174:18 | call to source |
7477
| string.cpp:184:8:184:10 | s10 | string.cpp:181:12:181:26 | call to source |
@@ -138,6 +141,17 @@
138141
| string.cpp:491:8:491:9 | s6 | string.cpp:482:18:482:23 | call to source |
139142
| string.cpp:504:7:504:8 | s2 | string.cpp:497:14:497:19 | call to source |
140143
| string.cpp:506:7:506:8 | s4 | string.cpp:497:14:497:19 | call to source |
144+
| string.cpp:529:11:529:11 | call to operator+= | string.cpp:529:20:529:25 | call to source |
145+
| string.cpp:530:21:530:21 | call to operator+= | string.cpp:530:24:530:29 | call to source |
146+
| string.cpp:531:25:531:25 | call to operator+= | string.cpp:531:15:531:20 | call to source |
147+
| string.cpp:534:8:534:8 | c | string.cpp:529:20:529:25 | call to source |
148+
| string.cpp:535:8:535:8 | d | string.cpp:529:20:529:25 | call to source |
149+
| string.cpp:537:8:537:8 | f | string.cpp:531:15:531:20 | call to source |
150+
| string.cpp:549:11:549:16 | call to assign | string.cpp:549:27:549:32 | call to source |
151+
| string.cpp:550:24:550:29 | call to assign | string.cpp:550:31:550:36 | call to source |
152+
| string.cpp:554:8:554:8 | c | string.cpp:549:27:549:32 | call to source |
153+
| string.cpp:555:8:555:8 | d | string.cpp:549:27:549:32 | call to source |
154+
| string.cpp:557:8:557:8 | f | string.cpp:551:18:551:23 | call to source |
141155
| structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
142156
| structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |
143157
| structlikeclass.cpp:37:8:37:9 | s3 | structlikeclass.cpp:29:22:29:27 | call to source |

0 commit comments

Comments
 (0)