Skip to content

Commit e082ae8

Browse files
geoffw0geoffw0
committed
Rust: Expand the test cases.
1 parent 61ff9d0 commit e082ae8

4 files changed

Lines changed: 70 additions & 33 deletions

File tree

‎rust/ql/test/library-tests/format-macros-legacy/FormatArgs.expected‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,11 @@
22
| main.rs:16:10:16:23 | FormatArgsExpr | 0 |
33
| main.rs:19:13:19:36 | FormatArgsExpr | 1 |
44
| main.rs:33:25:33:33 | FormatArgsExpr | 1 |
5-
| main.rs:38:13:38:32 | FormatArgsExpr | 1 |
6-
| main.rs:39:13:39:32 | FormatArgsExpr | 0 |
7-
| main.rs:49:5:49:27 | FormatArgsExpr | 1 |
8-
| main.rs:50:5:50:26 | FormatArgsExpr | 0 |
9-
| main.rs:51:5:51:25 | FormatArgsExpr | 1 |
10-
| main.rs:52:5:52:24 | FormatArgsExpr | 0 |
5+
| main.rs:44:40:44:46 | FormatArgsExpr | 0 |
6+
| main.rs:49:52:49:58 | FormatArgsExpr | 0 |
7+
| main.rs:55:13:55:33 | FormatArgsExpr | 1 |
8+
| main.rs:60:13:60:33 | FormatArgsExpr | 0 |
9+
| main.rs:70:5:70:27 | FormatArgsExpr | 1 |
10+
| main.rs:71:5:71:26 | FormatArgsExpr | 0 |
11+
| main.rs:72:5:72:25 | FormatArgsExpr | 1 |
12+
| main.rs:73:5:73:24 | FormatArgsExpr | 0 |

‎rust/ql/test/library-tests/format-macros-legacy/LogInjection.expected‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,28 @@
11
#select
2-
| main.rs:49:5:49:27 | FormatArgsExpr | main.rs:47:19:47:45 | ...::var(...) | main.rs:49:5:49:27 | FormatArgsExpr | Log entry depends on a $@. | main.rs:47:19:47:45 | ...::var(...) | user-provided value |
3-
| main.rs:50:5:50:26 | FormatArgsExpr | main.rs:47:19:47:45 | ...::var(...) | main.rs:50:5:50:26 | FormatArgsExpr | Log entry depends on a $@. | main.rs:47:19:47:45 | ...::var(...) | user-provided value |
4-
| main.rs:51:5:51:25 | FormatArgsExpr | main.rs:47:19:47:45 | ...::var(...) | main.rs:51:5:51:25 | FormatArgsExpr | Log entry depends on a $@. | main.rs:47:19:47:45 | ...::var(...) | user-provided value |
5-
| main.rs:52:5:52:24 | FormatArgsExpr | main.rs:47:19:47:45 | ...::var(...) | main.rs:52:5:52:24 | FormatArgsExpr | Log entry depends on a $@. | main.rs:47:19:47:45 | ...::var(...) | user-provided value |
2+
| main.rs:70:5:70:27 | FormatArgsExpr | main.rs:68:19:68:45 | ...::var(...) | main.rs:70:5:70:27 | FormatArgsExpr | Log entry depends on a $@. | main.rs:68:19:68:45 | ...::var(...) | user-provided value |
3+
| main.rs:71:5:71:26 | FormatArgsExpr | main.rs:68:19:68:45 | ...::var(...) | main.rs:71:5:71:26 | FormatArgsExpr | Log entry depends on a $@. | main.rs:68:19:68:45 | ...::var(...) | user-provided value |
4+
| main.rs:72:5:72:25 | FormatArgsExpr | main.rs:68:19:68:45 | ...::var(...) | main.rs:72:5:72:25 | FormatArgsExpr | Log entry depends on a $@. | main.rs:68:19:68:45 | ...::var(...) | user-provided value |
5+
| main.rs:73:5:73:24 | FormatArgsExpr | main.rs:68:19:68:45 | ...::var(...) | main.rs:73:5:73:24 | FormatArgsExpr | Log entry depends on a $@. | main.rs:68:19:68:45 | ...::var(...) | user-provided value |
66
edges
7-
| main.rs:47:9:47:15 | tainted | main.rs:49:5:49:27 | FormatArgsExpr | provenance | Sink:MaD:2 |
8-
| main.rs:47:9:47:15 | tainted | main.rs:50:5:50:26 | FormatArgsExpr | provenance | Sink:MaD:1 |
9-
| main.rs:47:9:47:15 | tainted | main.rs:51:5:51:25 | FormatArgsExpr | provenance | Sink:MaD:2 |
10-
| main.rs:47:9:47:15 | tainted | main.rs:52:5:52:24 | FormatArgsExpr | provenance | Sink:MaD:1 |
11-
| main.rs:47:19:47:45 | ...::var(...) | main.rs:47:19:47:45 | ...::var(...) [Ok] | provenance | Src:MaD:3 |
12-
| main.rs:47:19:47:45 | ...::var(...) [Ok] | main.rs:47:19:47:65 | ... .unwrap_or_default() | provenance | MaD:4 |
13-
| main.rs:47:19:47:65 | ... .unwrap_or_default() | main.rs:47:9:47:15 | tainted | provenance | |
7+
| main.rs:68:9:68:15 | tainted | main.rs:70:5:70:27 | FormatArgsExpr | provenance | Sink:MaD:2 |
8+
| main.rs:68:9:68:15 | tainted | main.rs:71:5:71:26 | FormatArgsExpr | provenance | Sink:MaD:1 |
9+
| main.rs:68:9:68:15 | tainted | main.rs:72:5:72:25 | FormatArgsExpr | provenance | Sink:MaD:2 |
10+
| main.rs:68:9:68:15 | tainted | main.rs:73:5:73:24 | FormatArgsExpr | provenance | Sink:MaD:1 |
11+
| main.rs:68:19:68:45 | ...::var(...) | main.rs:68:19:68:45 | ...::var(...) [Ok] | provenance | Src:MaD:3 |
12+
| main.rs:68:19:68:45 | ...::var(...) [Ok] | main.rs:68:19:68:65 | ... .unwrap_or_default() | provenance | MaD:4 |
13+
| main.rs:68:19:68:65 | ... .unwrap_or_default() | main.rs:68:9:68:15 | tainted | provenance | |
1414
models
1515
| 1 | Sink: std::io::stdio::_eprint; Argument[0]; log-injection |
1616
| 2 | Sink: std::io::stdio::_print; Argument[0]; log-injection |
1717
| 3 | Source: std::env::var; ReturnValue.Field[core::result::Result::Ok(0)]; environment |
1818
| 4 | Summary: <core::result::Result>::unwrap_or_default; Argument[self].Field[core::result::Result::Ok(0)]; ReturnValue; value |
1919
nodes
20-
| main.rs:47:9:47:15 | tainted | semmle.label | tainted |
21-
| main.rs:47:19:47:45 | ...::var(...) | semmle.label | ...::var(...) |
22-
| main.rs:47:19:47:45 | ...::var(...) [Ok] | semmle.label | ...::var(...) [Ok] |
23-
| main.rs:47:19:47:65 | ... .unwrap_or_default() | semmle.label | ... .unwrap_or_default() |
24-
| main.rs:49:5:49:27 | FormatArgsExpr | semmle.label | FormatArgsExpr |
25-
| main.rs:50:5:50:26 | FormatArgsExpr | semmle.label | FormatArgsExpr |
26-
| main.rs:51:5:51:25 | FormatArgsExpr | semmle.label | FormatArgsExpr |
27-
| main.rs:52:5:52:24 | FormatArgsExpr | semmle.label | FormatArgsExpr |
20+
| main.rs:68:9:68:15 | tainted | semmle.label | tainted |
21+
| main.rs:68:19:68:45 | ...::var(...) | semmle.label | ...::var(...) |
22+
| main.rs:68:19:68:45 | ...::var(...) [Ok] | semmle.label | ...::var(...) [Ok] |
23+
| main.rs:68:19:68:65 | ... .unwrap_or_default() | semmle.label | ... .unwrap_or_default() |
24+
| main.rs:70:5:70:27 | FormatArgsExpr | semmle.label | FormatArgsExpr |
25+
| main.rs:71:5:71:26 | FormatArgsExpr | semmle.label | FormatArgsExpr |
26+
| main.rs:72:5:72:25 | FormatArgsExpr | semmle.label | FormatArgsExpr |
27+
| main.rs:73:5:73:24 | FormatArgsExpr | semmle.label | FormatArgsExpr |
2828
subpaths

‎rust/ql/test/library-tests/format-macros-legacy/inline-taint-flow.expected‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@ edges
1414
| main.rs:19:9:19:9 | s | main.rs:20:10:20:10 | s | provenance | |
1515
| main.rs:19:13:19:36 | ...::format(...) | main.rs:19:9:19:9 | s | provenance | |
1616
| main.rs:19:13:19:36 | FormatArgsExpr | main.rs:19:13:19:36 | ...::format(...) | provenance | MaD:1 |
17+
| main.rs:32:9:32:9 | a | main.rs:33:9:33:9 | b | provenance | |
18+
| main.rs:32:13:32:21 | source(...) | main.rs:32:9:32:9 | a | provenance | |
19+
| main.rs:33:9:33:9 | b | main.rs:34:30:34:30 | b | provenance | |
20+
| main.rs:34:9:34:9 | c | main.rs:35:10:35:10 | c | provenance | |
21+
| main.rs:34:13:34:31 | ...::format(...) | main.rs:34:9:34:9 | c | provenance | |
22+
| main.rs:34:30:34:30 | b | main.rs:34:13:34:31 | ...::format(...) | provenance | MaD:1 |
1723
nodes
1824
| main.rs:12:9:12:9 | a | semmle.label | a |
1925
| main.rs:12:13:12:21 | source(...) | semmle.label | source(...) |
@@ -31,9 +37,17 @@ nodes
3137
| main.rs:19:13:19:36 | ...::format(...) | semmle.label | ...::format(...) |
3238
| main.rs:19:13:19:36 | FormatArgsExpr | semmle.label | FormatArgsExpr |
3339
| main.rs:20:10:20:10 | s | semmle.label | s |
40+
| main.rs:32:9:32:9 | a | semmle.label | a |
41+
| main.rs:32:13:32:21 | source(...) | semmle.label | source(...) |
42+
| main.rs:33:9:33:9 | b | semmle.label | b |
43+
| main.rs:34:9:34:9 | c | semmle.label | c |
44+
| main.rs:34:13:34:31 | ...::format(...) | semmle.label | ...::format(...) |
45+
| main.rs:34:30:34:30 | b | semmle.label | b |
46+
| main.rs:35:10:35:10 | c | semmle.label | c |
3447
subpaths
3548
testFailures
3649
#select
3750
| main.rs:13:10:13:25 | MacroExpr | main.rs:12:13:12:21 | source(...) | main.rs:13:10:13:25 | MacroExpr | $@ | main.rs:12:13:12:21 | source(...) | source(...) |
3851
| main.rs:16:10:16:23 | MacroExpr | main.rs:15:13:15:21 | source(...) | main.rs:16:10:16:23 | MacroExpr | $@ | main.rs:15:13:15:21 | source(...) | source(...) |
3952
| main.rs:20:10:20:10 | s | main.rs:18:13:18:21 | source(...) | main.rs:20:10:20:10 | s | $@ | main.rs:18:13:18:21 | source(...) | source(...) |
53+
| main.rs:35:10:35:10 | c | main.rs:32:13:32:21 | source(...) | main.rs:35:10:35:10 | c | $@ | main.rs:32:13:32:21 | source(...) | source(...) |

‎rust/ql/test/library-tests/format-macros-legacy/main.rs‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ fn source(i: i64) -> String {
66
i.to_string()
77
}
88

9-
fn sink(s: String) {}
9+
fn sink(_s: String) {}
1010

1111
pub fn format_flow() {
1212
let a = source(1);
@@ -29,15 +29,36 @@ pub fn exercises_reconstruction() {
2929
// behavior on >=1.94, where the `Write::write_fmt` content-to-self taint
3030
// model is also missing. So it is a pre-existing model gap, not a
3131
// regression from the reconstruction.
32-
let d = source(4);
33-
let _ = format_args!("{}", d);
32+
let a = source(4);
33+
let b = format_args!("{}", a);
34+
let c = std::fmt::format(b);
35+
sink(c); // $ hasTaintFlow=4
36+
37+
let mut buf1 = String::new();
38+
let d = source(5);
39+
let _ = buf1.write_str(d.as_str());
40+
sink(buf1); // $ MISSING: hasTaintFlow=5
41+
42+
let mut buf2 = String::new();
43+
let e = source(6);
44+
let _ = buf2.write_fmt(format_args!("{e}"));
45+
sink(buf2); // $ MISSING: hasTaintFlow=6
46+
47+
let mut buf3 = String::new();
48+
let f = source(7);
49+
let _ = std::fmt::write(&mut buf3, format_args!("{f}"));
50+
sink(buf3); // $ MISSING: hasTaintFlow=7
3451

3552
use std::fmt::Write;
36-
let mut buf = String::new();
37-
let e = source(5);
38-
let _ = write!(buf, "{}", e);
39-
let _ = writeln!(buf, "{e}");
40-
sink(buf);
53+
let mut buf4 = String::new();
54+
let g = source(8);
55+
let _ = write!(buf4, "{}", g);
56+
sink(buf4); // $ MISSING: hasTaintFlow=8
57+
58+
let mut buf5 = String::new();
59+
let h = source(9);
60+
let _ = writeln!(buf5, "{h}");
61+
sink(buf5); // $ MISSING: hasTaintFlow=9
4162
}
4263

4364
// The log-injection sinks (`println!`/`eprintln!`/`panic!`) are reconstructed

0 commit comments

Comments
 (0)