Skip to content

Commit f3f89ff

Browse files
jbjjbj
authored
Merge pull request #1742 from geoffw0/lambdataint
CPP: Tests for taint through lambdas
2 parents f1bbc9b + a6902bd commit f3f89ff

File tree

7 files changed

+170
-0
lines changed

7 files changed

+170
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/lambdas.cpp‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
int source();
2+
void sink(...) {};
3+
4+
// --- lambdas ---
5+
6+
void test_lambdas()
7+
{
8+
int t = source();
9+
int u = 0;
10+
int v = 0;
11+
int w = 0;
12+
13+
auto a = [t, u]() -> int {
14+
sink(t); // flow from source() [NOT DETECTED]
15+
sink(u);
16+
return t;
17+
};
18+
sink(a()); // flow from source() [NOT DETECTED]
19+
20+
auto b = [&] {
21+
sink(t); // flow from source() [NOT DETECTED]
22+
sink(u);
23+
v = source(); // (v is reference captured)
24+
};
25+
b();
26+
sink(v); // flow from source() [NOT DETECTED]
27+
28+
auto c = [=] {
29+
sink(t); // flow from source() [NOT DETECTED]
30+
sink(u);
31+
};
32+
c();
33+
34+
auto d = [](int a, int b) {
35+
sink(a); // flow from source()
36+
sink(b);
37+
};
38+
d(t, u);
39+
40+
auto e = [](int &a, int &b, int &c) {
41+
sink(a); // flow from source()
42+
sink(b);
43+
c = source();
44+
};
45+
e(t, u, w);
46+
sink(w); // flow from source() [NOT DETECTED]
47+
}

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
| acrossLinkTargets.cpp:12:8:12:8 | x | acrossLinkTargets.cpp:19:27:19:32 | call to source |
2+
| lambdas.cpp:35:8:35:8 | a | lambdas.cpp:8:10:8:15 | call to source |
3+
| lambdas.cpp:41:8:41:8 | a | lambdas.cpp:8:10:8:15 | call to source |
24
| test.cpp:7:8:7:9 | t1 | test.cpp:6:12:6:17 | call to source |
35
| test.cpp:9:8:9:9 | t1 | test.cpp:6:12:6:17 | call to source |
46
| test.cpp:10:8:10:9 | t2 | test.cpp:6:12:6:17 | call to source |

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
| lambdas.cpp:8:10:8:15 | lambdas.cpp:35:8:35:8 | AST only |
2+
| lambdas.cpp:8:10:8:15 | lambdas.cpp:41:8:41:8 | AST only |
13
| test.cpp:89:28:89:34 | test.cpp:92:8:92:14 | IR only |
24
| test.cpp:100:13:100:18 | test.cpp:103:10:103:12 | AST only |
35
| test.cpp:109:9:109:14 | test.cpp:110:10:110:12 | IR only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,25 @@
1+
| file://:0:0:0:0 | t | taint.cpp:235:11:239:2 | {...} | TAINT |
2+
| file://:0:0:0:0 | t | taint.cpp:243:11:246:2 | {...} | TAINT |
3+
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
4+
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
5+
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
6+
| file://:0:0:0:0 | this | file://:0:0:0:0 | t | TAINT |
17
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
8+
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
9+
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
10+
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
11+
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
12+
| file://:0:0:0:0 | this | file://:0:0:0:0 | this | |
13+
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
14+
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
15+
| file://:0:0:0:0 | this | file://:0:0:0:0 | u | TAINT |
16+
| file://:0:0:0:0 | this | file://:0:0:0:0 | v | TAINT |
217
| file://:0:0:0:0 | this | taint.cpp:72:3:72:3 | c | TAINT |
318
| file://:0:0:0:0 | this | taint.cpp:73:3:73:3 | d | TAINT |
419
| file://:0:0:0:0 | this | taint.cpp:77:3:77:3 | d | TAINT |
20+
| file://:0:0:0:0 | u | taint.cpp:235:11:239:2 | {...} | TAINT |
21+
| file://:0:0:0:0 | u | taint.cpp:243:11:246:2 | {...} | TAINT |
22+
| file://:0:0:0:0 | v | taint.cpp:235:11:239:2 | {...} | TAINT |
523
| taint.cpp:4:27:4:33 | source1 | taint.cpp:6:13:6:19 | source1 | |
624
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:5:8:5:13 | clean1 | |
725
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:6:3:6:8 | clean1 | |
@@ -178,3 +196,46 @@
178196
| taint.cpp:213:12:213:12 | x | taint.cpp:213:15:213:15 | ref arg y | |
179197
| taint.cpp:213:15:213:15 | ref arg y | taint.cpp:216:7:216:7 | y | |
180198
| taint.cpp:213:15:213:15 | y | taint.cpp:213:12:213:12 | ref arg x | |
199+
| taint.cpp:223:10:223:15 | call to source | file://:0:0:0:0 | t | |
200+
| taint.cpp:223:10:223:15 | call to source | file://:0:0:0:0 | t | |
201+
| taint.cpp:223:10:223:15 | call to source | taint.cpp:228:12:228:12 | t | |
202+
| taint.cpp:223:10:223:15 | call to source | taint.cpp:253:4:253:4 | t | |
203+
| taint.cpp:223:10:223:15 | call to source | taint.cpp:260:4:260:4 | t | |
204+
| taint.cpp:224:9:224:10 | 0 | file://:0:0:0:0 | u | |
205+
| taint.cpp:224:9:224:10 | 0 | file://:0:0:0:0 | u | |
206+
| taint.cpp:224:9:224:10 | 0 | taint.cpp:228:15:228:15 | u | |
207+
| taint.cpp:224:9:224:10 | 0 | taint.cpp:253:7:253:7 | u | |
208+
| taint.cpp:224:9:224:10 | 0 | taint.cpp:260:7:260:7 | u | |
209+
| taint.cpp:225:9:225:10 | 0 | file://:0:0:0:0 | v | |
210+
| taint.cpp:225:9:225:10 | 0 | taint.cpp:241:7:241:7 | v | |
211+
| taint.cpp:226:9:226:10 | 0 | taint.cpp:260:10:260:10 | w | |
212+
| taint.cpp:226:9:226:10 | 0 | taint.cpp:261:7:261:7 | w | |
213+
| taint.cpp:228:11:228:11 | Unknown literal | taint.cpp:228:11:228:11 | constructor init of field t | TAINT |
214+
| taint.cpp:228:11:228:11 | Unknown literal | taint.cpp:228:11:228:11 | constructor init of field u | TAINT |
215+
| taint.cpp:228:11:232:2 | [...](...){...} | taint.cpp:233:7:233:7 | a | |
216+
| taint.cpp:228:11:232:2 | {...} | taint.cpp:228:11:232:2 | [...](...){...} | TAINT |
217+
| taint.cpp:228:12:228:12 | t | taint.cpp:228:11:232:2 | {...} | TAINT |
218+
| taint.cpp:228:15:228:15 | u | taint.cpp:228:11:232:2 | {...} | TAINT |
219+
| taint.cpp:228:17:228:17 | `this` parameter in operator() | file://:0:0:0:0 | this | |
220+
| taint.cpp:228:17:228:17 | `this` parameter in operator() | file://:0:0:0:0 | this | |
221+
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field t | TAINT |
222+
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field u | TAINT |
223+
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field v | TAINT |
224+
| taint.cpp:235:11:239:2 | [...](...){...} | taint.cpp:240:2:240:2 | b | |
225+
| taint.cpp:235:11:239:2 | {...} | taint.cpp:235:11:239:2 | [...](...){...} | TAINT |
226+
| taint.cpp:235:15:235:15 | `this` parameter in operator() | file://:0:0:0:0 | this | |
227+
| taint.cpp:238:7:238:12 | call to source | taint.cpp:238:3:238:14 | ... = ... | |
228+
| taint.cpp:243:11:243:11 | Unknown literal | taint.cpp:243:11:243:11 | constructor init of field t | TAINT |
229+
| taint.cpp:243:11:243:11 | Unknown literal | taint.cpp:243:11:243:11 | constructor init of field u | TAINT |
230+
| taint.cpp:243:11:246:2 | [...](...){...} | taint.cpp:247:2:247:2 | c | |
231+
| taint.cpp:243:11:246:2 | {...} | taint.cpp:243:11:246:2 | [...](...){...} | TAINT |
232+
| taint.cpp:243:15:243:15 | `this` parameter in operator() | file://:0:0:0:0 | this | |
233+
| taint.cpp:243:15:243:15 | `this` parameter in operator() | file://:0:0:0:0 | this | |
234+
| taint.cpp:249:11:252:2 | [...](...){...} | taint.cpp:253:2:253:2 | d | |
235+
| taint.cpp:249:18:249:18 | a | taint.cpp:250:8:250:8 | a | |
236+
| taint.cpp:249:25:249:25 | b | taint.cpp:251:8:251:8 | b | |
237+
| taint.cpp:255:11:259:2 | [...](...){...} | taint.cpp:260:2:260:2 | e | |
238+
| taint.cpp:255:19:255:19 | a | taint.cpp:256:8:256:8 | a | |
239+
| taint.cpp:255:27:255:27 | b | taint.cpp:257:8:257:8 | b | |
240+
| taint.cpp:258:7:258:12 | call to source | taint.cpp:258:3:258:14 | ... = ... | |
241+
| taint.cpp:260:10:260:10 | ref arg w | taint.cpp:261:7:261:7 | w | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -215,3 +215,48 @@ void test_swap() {
215215
sink(x); // [FALSE POSITIVE]
216216
sink(y); // tainted
217217
}
218+
219+
// --- lambdas ---
220+
221+
void test_lambdas()
222+
{
223+
int t = source();
224+
int u = 0;
225+
int v = 0;
226+
int w = 0;
227+
228+
auto a = [t, u]() -> int {
229+
sink(t); // tainted [NOT DETECTED]
230+
sink(u);
231+
return t;
232+
};
233+
sink(a()); // tainted
234+
235+
auto b = [&] {
236+
sink(t); // tainted [NOT DETECTED]
237+
sink(u);
238+
v = source(); // (v is reference captured)
239+
};
240+
b();
241+
sink(v); // tainted [NOT DETECTED]
242+
243+
auto c = [=] {
244+
sink(t); // tainted [NOT DETECTED]
245+
sink(u);
246+
};
247+
c();
248+
249+
auto d = [](int a, int b) {
250+
sink(a); // tainted
251+
sink(b);
252+
};
253+
d(t, u);
254+
255+
auto e = [](int &a, int &b, int &c) {
256+
sink(a); // tainted
257+
sink(b);
258+
c = source();
259+
};
260+
e(t, u, w);
261+
sink(w); // tainted [NOT DETECTED]
262+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
| file://:0:0:0:0 | t | taint.cpp:223:10:223:15 | call to source |
2+
| file://:0:0:0:0 | t | taint.cpp:223:10:223:15 | call to source |
3+
| file://:0:0:0:0 | t | taint.cpp:223:10:223:15 | call to source |
4+
| file://:0:0:0:0 | u | taint.cpp:223:10:223:15 | call to source |
5+
| file://:0:0:0:0 | u | taint.cpp:223:10:223:15 | call to source |
6+
| file://:0:0:0:0 | u | taint.cpp:223:10:223:15 | call to source |
17
| taint.cpp:8:8:8:13 | clean1 | taint.cpp:4:27:4:33 | source1 |
28
| taint.cpp:16:8:16:14 | source1 | taint.cpp:12:22:12:27 | call to source |
39
| taint.cpp:17:8:17:16 | ++ ... | taint.cpp:12:22:12:27 | call to source |
@@ -20,3 +26,6 @@
2026
| taint.cpp:210:7:210:7 | x | taint.cpp:207:6:207:11 | call to source |
2127
| taint.cpp:215:7:215:7 | x | taint.cpp:207:6:207:11 | call to source |
2228
| taint.cpp:216:7:216:7 | y | taint.cpp:207:6:207:11 | call to source |
29+
| taint.cpp:233:8:233:8 | call to operator() | taint.cpp:223:10:223:15 | call to source |
30+
| taint.cpp:250:8:250:8 | a | taint.cpp:223:10:223:15 | call to source |
31+
| taint.cpp:256:8:256:8 | a | taint.cpp:223:10:223:15 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
| file://:0:0:0:0 | taint.cpp:223:10:223:15 | AST only |
12
| taint.cpp:41:7:41:13 | taint.cpp:35:12:35:17 | AST only |
23
| taint.cpp:42:7:42:13 | taint.cpp:35:12:35:17 | AST only |
34
| taint.cpp:43:7:43:13 | taint.cpp:37:22:37:27 | AST only |
@@ -12,3 +13,6 @@
1213
| taint.cpp:195:7:195:7 | taint.cpp:193:6:193:6 | AST only |
1314
| taint.cpp:215:7:215:7 | taint.cpp:207:6:207:11 | AST only |
1415
| taint.cpp:216:7:216:7 | taint.cpp:207:6:207:11 | AST only |
16+
| taint.cpp:233:8:233:8 | taint.cpp:223:10:223:15 | AST only |
17+
| taint.cpp:250:8:250:8 | taint.cpp:223:10:223:15 | AST only |
18+
| taint.cpp:256:8:256:8 | taint.cpp:223:10:223:15 | AST only |

0 commit comments

Comments
 (0)