Skip to content

Commit 9c7fc58

Browse files
geoffw0geoffw0
committed
Rust: Add tests for a few more edge cases.
1 parent 0924dec commit 9c7fc58

File tree

2 files changed

+79
-63
lines changed

2 files changed

+79
-63
lines changed

‎rust/ql/test/query-tests/security/CWE-319/UseOfHttp.expected‎

Lines changed: 64 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,76 @@
11
#select
22
| main.rs:12:22:12:43 | ...::get | main.rs:12:45:12:68 | "http://example.com/api" | main.rs:12:22:12:43 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:12:45:12:68 | "http://example.com/api" | this HTTP URL |
3-
| main.rs:13:22:13:43 | ...::get | main.rs:13:45:13:73 | "http://api.example.com/data" | main.rs:13:22:13:43 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:13:45:13:73 | "http://api.example.com/data" | this HTTP URL |
4-
| main.rs:25:21:25:42 | ...::get | main.rs:22:20:22:39 | "http://example.com" | main.rs:25:21:25:42 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:22:20:22:39 | "http://example.com" | this HTTP URL |
5-
| main.rs:36:30:36:51 | ...::get | main.rs:33:20:33:28 | "http://" | main.rs:36:30:36:51 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:33:20:33:28 | "http://" | this HTTP URL |
6-
| main.rs:63:24:63:45 | ...::get | main.rs:60:19:60:53 | "http://example.com/sensitive-... | main.rs:63:24:63:45 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:60:19:60:53 | "http://example.com/sensitive-... | this HTTP URL |
3+
| main.rs:14:22:14:43 | ...::get | main.rs:14:45:14:73 | "http://api.example.com/data" | main.rs:14:22:14:43 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:14:45:14:73 | "http://api.example.com/data" | this HTTP URL |
4+
| main.rs:26:21:26:42 | ...::get | main.rs:23:20:23:39 | "http://example.com" | main.rs:26:21:26:42 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:23:20:23:39 | "http://example.com" | this HTTP URL |
5+
| main.rs:37:30:37:51 | ...::get | main.rs:34:20:34:28 | "http://" | main.rs:37:30:37:51 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:34:20:34:28 | "http://" | this HTTP URL |
6+
| main.rs:53:19:53:40 | ...::get | main.rs:53:42:53:68 | "http://172.31.255.255/bar" | main.rs:53:19:53:40 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:53:42:53:68 | "http://172.31.255.255/bar" | this HTTP URL |
7+
| main.rs:60:20:60:41 | ...::get | main.rs:60:43:60:65 | "http://172.32.0.0/baz" | main.rs:60:20:60:41 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:60:43:60:65 | "http://172.32.0.0/baz" | this HTTP URL |
8+
| main.rs:71:24:71:45 | ...::get | main.rs:68:19:68:53 | "http://example.com/sensitive-... | main.rs:71:24:71:45 | ...::get | This URL may be constructed with the HTTP protocol, from $@. | main.rs:68:19:68:53 | "http://example.com/sensitive-... | this HTTP URL |
79
edges
810
| main.rs:12:45:12:68 | "http://example.com/api" | main.rs:12:22:12:43 | ...::get | provenance | MaD:1 Sink:MaD:1 |
9-
| main.rs:13:45:13:73 | "http://api.example.com/data" | main.rs:13:22:13:43 | ...::get | provenance | MaD:1 Sink:MaD:1 |
10-
| main.rs:22:9:22:16 | base_url | main.rs:24:28:24:53 | MacroExpr | provenance | |
11-
| main.rs:22:20:22:39 | "http://example.com" | main.rs:22:9:22:16 | base_url | provenance | |
12-
| main.rs:24:9:24:16 | full_url | main.rs:25:45:25:52 | full_url | provenance | |
13-
| main.rs:24:20:24:26 | res | main.rs:24:28:24:53 | { ... } | provenance | |
14-
| main.rs:24:28:24:53 | ...::format(...) | main.rs:24:20:24:26 | res | provenance | |
15-
| main.rs:24:28:24:53 | ...::must_use(...) | main.rs:24:9:24:16 | full_url | provenance | |
16-
| main.rs:24:28:24:53 | MacroExpr | main.rs:24:28:24:53 | ...::format(...) | provenance | MaD:2 |
17-
| main.rs:24:28:24:53 | { ... } | main.rs:24:28:24:53 | ...::must_use(...) | provenance | MaD:3 |
18-
| main.rs:25:44:25:52 | &full_url [&ref] | main.rs:25:21:25:42 | ...::get | provenance | MaD:1 Sink:MaD:1 |
19-
| main.rs:25:45:25:52 | full_url | main.rs:25:44:25:52 | &full_url [&ref] | provenance | |
20-
| main.rs:33:9:33:16 | protocol | main.rs:35:32:35:53 | MacroExpr | provenance | |
21-
| main.rs:33:20:33:28 | "http://" | main.rs:33:9:33:16 | protocol | provenance | |
22-
| main.rs:35:9:35:20 | insecure_url | main.rs:36:54:36:65 | insecure_url | provenance | |
23-
| main.rs:35:24:35:30 | res | main.rs:35:32:35:53 | { ... } | provenance | |
24-
| main.rs:35:32:35:53 | ...::format(...) | main.rs:35:24:35:30 | res | provenance | |
25-
| main.rs:35:32:35:53 | ...::must_use(...) | main.rs:35:9:35:20 | insecure_url | provenance | |
26-
| main.rs:35:32:35:53 | MacroExpr | main.rs:35:32:35:53 | ...::format(...) | provenance | MaD:2 |
27-
| main.rs:35:32:35:53 | { ... } | main.rs:35:32:35:53 | ...::must_use(...) | provenance | MaD:3 |
28-
| main.rs:36:53:36:65 | &insecure_url [&ref] | main.rs:36:30:36:51 | ...::get | provenance | MaD:1 Sink:MaD:1 |
29-
| main.rs:36:54:36:65 | insecure_url | main.rs:36:53:36:65 | &insecure_url [&ref] | provenance | |
30-
| main.rs:60:13:60:15 | url | main.rs:63:47:63:49 | url | provenance | |
31-
| main.rs:60:19:60:53 | "http://example.com/sensitive-... | main.rs:60:13:60:15 | url | provenance | |
32-
| main.rs:63:47:63:49 | url | main.rs:63:24:63:45 | ...::get | provenance | MaD:1 Sink:MaD:1 |
11+
| main.rs:14:45:14:73 | "http://api.example.com/data" | main.rs:14:22:14:43 | ...::get | provenance | MaD:1 Sink:MaD:1 |
12+
| main.rs:23:9:23:16 | base_url | main.rs:25:28:25:53 | MacroExpr | provenance | |
13+
| main.rs:23:20:23:39 | "http://example.com" | main.rs:23:9:23:16 | base_url | provenance | |
14+
| main.rs:25:9:25:16 | full_url | main.rs:26:45:26:52 | full_url | provenance | |
15+
| main.rs:25:20:25:26 | res | main.rs:25:28:25:53 | { ... } | provenance | |
16+
| main.rs:25:28:25:53 | ...::format(...) | main.rs:25:20:25:26 | res | provenance | |
17+
| main.rs:25:28:25:53 | ...::must_use(...) | main.rs:25:9:25:16 | full_url | provenance | |
18+
| main.rs:25:28:25:53 | MacroExpr | main.rs:25:28:25:53 | ...::format(...) | provenance | MaD:2 |
19+
| main.rs:25:28:25:53 | { ... } | main.rs:25:28:25:53 | ...::must_use(...) | provenance | MaD:3 |
20+
| main.rs:26:44:26:52 | &full_url [&ref] | main.rs:26:21:26:42 | ...::get | provenance | MaD:1 Sink:MaD:1 |
21+
| main.rs:26:45:26:52 | full_url | main.rs:26:44:26:52 | &full_url [&ref] | provenance | |
22+
| main.rs:34:9:34:16 | protocol | main.rs:36:32:36:53 | MacroExpr | provenance | |
23+
| main.rs:34:20:34:28 | "http://" | main.rs:34:9:34:16 | protocol | provenance | |
24+
| main.rs:36:9:36:20 | insecure_url | main.rs:37:54:37:65 | insecure_url | provenance | |
25+
| main.rs:36:24:36:30 | res | main.rs:36:32:36:53 | { ... } | provenance | |
26+
| main.rs:36:32:36:53 | ...::format(...) | main.rs:36:24:36:30 | res | provenance | |
27+
| main.rs:36:32:36:53 | ...::must_use(...) | main.rs:36:9:36:20 | insecure_url | provenance | |
28+
| main.rs:36:32:36:53 | MacroExpr | main.rs:36:32:36:53 | ...::format(...) | provenance | MaD:2 |
29+
| main.rs:36:32:36:53 | { ... } | main.rs:36:32:36:53 | ...::must_use(...) | provenance | MaD:3 |
30+
| main.rs:37:53:37:65 | &insecure_url [&ref] | main.rs:37:30:37:51 | ...::get | provenance | MaD:1 Sink:MaD:1 |
31+
| main.rs:37:54:37:65 | insecure_url | main.rs:37:53:37:65 | &insecure_url [&ref] | provenance | |
32+
| main.rs:53:42:53:68 | "http://172.31.255.255/bar" | main.rs:53:19:53:40 | ...::get | provenance | MaD:1 Sink:MaD:1 |
33+
| main.rs:60:43:60:65 | "http://172.32.0.0/baz" | main.rs:60:20:60:41 | ...::get | provenance | MaD:1 Sink:MaD:1 |
34+
| main.rs:68:13:68:15 | url | main.rs:71:47:71:49 | url | provenance | |
35+
| main.rs:68:19:68:53 | "http://example.com/sensitive-... | main.rs:68:13:68:15 | url | provenance | |
36+
| main.rs:71:47:71:49 | url | main.rs:71:24:71:45 | ...::get | provenance | MaD:1 Sink:MaD:1 |
3337
models
3438
| 1 | Sink: reqwest::blocking::get; Argument[0]; request-url |
3539
| 2 | Summary: alloc::fmt::format; Argument[0]; ReturnValue; taint |
3640
| 3 | Summary: core::hint::must_use; Argument[0]; ReturnValue; value |
3741
nodes
3842
| main.rs:12:22:12:43 | ...::get | semmle.label | ...::get |
3943
| main.rs:12:45:12:68 | "http://example.com/api" | semmle.label | "http://example.com/api" |
40-
| main.rs:13:22:13:43 | ...::get | semmle.label | ...::get |
41-
| main.rs:13:45:13:73 | "http://api.example.com/data" | semmle.label | "http://api.example.com/data" |
42-
| main.rs:22:9:22:16 | base_url | semmle.label | base_url |
43-
| main.rs:22:20:22:39 | "http://example.com" | semmle.label | "http://example.com" |
44-
| main.rs:24:9:24:16 | full_url | semmle.label | full_url |
45-
| main.rs:24:20:24:26 | res | semmle.label | res |
46-
| main.rs:24:28:24:53 | ...::format(...) | semmle.label | ...::format(...) |
47-
| main.rs:24:28:24:53 | ...::must_use(...) | semmle.label | ...::must_use(...) |
48-
| main.rs:24:28:24:53 | MacroExpr | semmle.label | MacroExpr |
49-
| main.rs:24:28:24:53 | { ... } | semmle.label | { ... } |
50-
| main.rs:25:21:25:42 | ...::get | semmle.label | ...::get |
51-
| main.rs:25:44:25:52 | &full_url [&ref] | semmle.label | &full_url [&ref] |
52-
| main.rs:25:45:25:52 | full_url | semmle.label | full_url |
53-
| main.rs:33:9:33:16 | protocol | semmle.label | protocol |
54-
| main.rs:33:20:33:28 | "http://" | semmle.label | "http://" |
55-
| main.rs:35:9:35:20 | insecure_url | semmle.label | insecure_url |
56-
| main.rs:35:24:35:30 | res | semmle.label | res |
57-
| main.rs:35:32:35:53 | ...::format(...) | semmle.label | ...::format(...) |
58-
| main.rs:35:32:35:53 | ...::must_use(...) | semmle.label | ...::must_use(...) |
59-
| main.rs:35:32:35:53 | MacroExpr | semmle.label | MacroExpr |
60-
| main.rs:35:32:35:53 | { ... } | semmle.label | { ... } |
61-
| main.rs:36:30:36:51 | ...::get | semmle.label | ...::get |
62-
| main.rs:36:53:36:65 | &insecure_url [&ref] | semmle.label | &insecure_url [&ref] |
63-
| main.rs:36:54:36:65 | insecure_url | semmle.label | insecure_url |
64-
| main.rs:60:13:60:15 | url | semmle.label | url |
65-
| main.rs:60:19:60:53 | "http://example.com/sensitive-... | semmle.label | "http://example.com/sensitive-... |
66-
| main.rs:63:24:63:45 | ...::get | semmle.label | ...::get |
67-
| main.rs:63:47:63:49 | url | semmle.label | url |
44+
| main.rs:14:22:14:43 | ...::get | semmle.label | ...::get |
45+
| main.rs:14:45:14:73 | "http://api.example.com/data" | semmle.label | "http://api.example.com/data" |
46+
| main.rs:23:9:23:16 | base_url | semmle.label | base_url |
47+
| main.rs:23:20:23:39 | "http://example.com" | semmle.label | "http://example.com" |
48+
| main.rs:25:9:25:16 | full_url | semmle.label | full_url |
49+
| main.rs:25:20:25:26 | res | semmle.label | res |
50+
| main.rs:25:28:25:53 | ...::format(...) | semmle.label | ...::format(...) |
51+
| main.rs:25:28:25:53 | ...::must_use(...) | semmle.label | ...::must_use(...) |
52+
| main.rs:25:28:25:53 | MacroExpr | semmle.label | MacroExpr |
53+
| main.rs:25:28:25:53 | { ... } | semmle.label | { ... } |
54+
| main.rs:26:21:26:42 | ...::get | semmle.label | ...::get |
55+
| main.rs:26:44:26:52 | &full_url [&ref] | semmle.label | &full_url [&ref] |
56+
| main.rs:26:45:26:52 | full_url | semmle.label | full_url |
57+
| main.rs:34:9:34:16 | protocol | semmle.label | protocol |
58+
| main.rs:34:20:34:28 | "http://" | semmle.label | "http://" |
59+
| main.rs:36:9:36:20 | insecure_url | semmle.label | insecure_url |
60+
| main.rs:36:24:36:30 | res | semmle.label | res |
61+
| main.rs:36:32:36:53 | ...::format(...) | semmle.label | ...::format(...) |
62+
| main.rs:36:32:36:53 | ...::must_use(...) | semmle.label | ...::must_use(...) |
63+
| main.rs:36:32:36:53 | MacroExpr | semmle.label | MacroExpr |
64+
| main.rs:36:32:36:53 | { ... } | semmle.label | { ... } |
65+
| main.rs:37:30:37:51 | ...::get | semmle.label | ...::get |
66+
| main.rs:37:53:37:65 | &insecure_url [&ref] | semmle.label | &insecure_url [&ref] |
67+
| main.rs:37:54:37:65 | insecure_url | semmle.label | insecure_url |
68+
| main.rs:53:19:53:40 | ...::get | semmle.label | ...::get |
69+
| main.rs:53:42:53:68 | "http://172.31.255.255/bar" | semmle.label | "http://172.31.255.255/bar" |
70+
| main.rs:60:20:60:41 | ...::get | semmle.label | ...::get |
71+
| main.rs:60:43:60:65 | "http://172.32.0.0/baz" | semmle.label | "http://172.32.0.0/baz" |
72+
| main.rs:68:13:68:15 | url | semmle.label | url |
73+
| main.rs:68:19:68:53 | "http://example.com/sensitive-... | semmle.label | "http://example.com/sensitive-... |
74+
| main.rs:71:24:71:45 | ...::get | semmle.label | ...::get |
75+
| main.rs:71:47:71:49 | url | semmle.label | url |
6876
subpaths

‎rust/ql/test/query-tests/security/CWE-319/main.rs‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ fn main() {
1010
fn test_direct_literals() {
1111
// BAD: Direct HTTP URLs that should be flagged
1212
let _response1 = reqwest::blocking::get("http://example.com/api").unwrap(); // $ Alert[rust/non-https-url]
13-
let _response2 = reqwest::blocking::get("http://api.example.com/data").unwrap(); // $ Alert[rust/non-https-url]
13+
let _response2 = reqwest::blocking::get("HTTP://EXAMPLE.COM/API").unwrap(); // $ MISSING: Alert[rust/non-https-url]
14+
let _response3 = reqwest::blocking::get("http://api.example.com/data").unwrap(); // $ Alert[rust/non-https-url]
1415

1516
// GOOD: HTTPS URLs that should not be flagged
1617
let _response3 = reqwest::blocking::get("https://example.com/api").unwrap();
@@ -44,13 +45,20 @@ fn test_dynamic_urls() {
4445
fn test_localhost_exemptions() {
4546
// GOOD: localhost URLs should not be flagged (local development)
4647
let _local1 = reqwest::blocking::get("http://localhost:8080/api").unwrap();
47-
let _local2 = reqwest::blocking::get("http://127.0.0.1:3000/test").unwrap();
48-
let _local3 = reqwest::blocking::get("http://192.168.1.100/internal").unwrap();
49-
let _local4 = reqwest::blocking::get("http://10.0.0.1/admin").unwrap();
48+
let _local2 = reqwest::blocking::get("HTTP://LOCALHOST:8080/api").unwrap();
49+
let _local3 = reqwest::blocking::get("http://127.0.0.1:3000/test").unwrap();
50+
let _local4 = reqwest::blocking::get("http://192.168.1.100/internal").unwrap();
51+
let _local5 = reqwest::blocking::get("http://10.0.0.1/admin").unwrap();
52+
let _local6 = reqwest::blocking::get("http://172.16.0.0/foo").unwrap();
53+
let _local7 = reqwest::blocking::get("http://172.31.255.255/bar").unwrap(); // $ SPURIOUS: Alert[rust/non-https-url]
54+
55+
// GOOD: test IPv6 localhost variants
56+
let _local8 = reqwest::blocking::get("http://[::1]:8080/api").unwrap();
57+
let _local9 = reqwest::blocking::get("http://[0:0:0:0:0:0:0:1]/test").unwrap();
58+
59+
// BAD: non-private IP address
60+
let _local10 = reqwest::blocking::get("http://172.32.0.0/baz").unwrap(); // $ Alert[rust/non-https-url]
5061

51-
// Test IPv6 localhost variants
52-
let _local5 = reqwest::blocking::get("http://[::1]:8080/api").unwrap();
53-
let _local6 = reqwest::blocking::get("http://[0:0:0:0:0:0:0:1]/test").unwrap();
5462
}
5563

5664
// Additional test cases that mirror the Bad/Good examples

0 commit comments

Comments
 (0)