From 460ed30d05d0c20199c10d04fcf816dab1bfdc75 Mon Sep 17 00:00:00 2001 From: Kevin Stubbings Date: Tue, 12 Nov 2024 16:08:14 -0800 Subject: [PATCH] Fixed tests --- .../GorillaMuxSkipClean/TaintedPath.expected | 11 +++++--- .../Security/CWE-022/TaintedPath.expected | 25 +++++++++++++++++++ 2 files changed, 32 insertions(+), 4 deletions(-) create mode 100644 go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected diff --git a/go/ql/test/query-tests/Security/CWE-022/GorillaMuxSkipClean/TaintedPath.expected b/go/ql/test/query-tests/Security/CWE-022/GorillaMuxSkipClean/TaintedPath.expected index f07dfaec8ccd..887b9858ef36 100644 --- a/go/ql/test/query-tests/Security/CWE-022/GorillaMuxSkipClean/TaintedPath.expected +++ b/go/ql/test/query-tests/Security/CWE-022/GorillaMuxSkipClean/TaintedPath.expected @@ -1,10 +1,13 @@ +#select +| MuxClean.go:14:29:14:74 | call to Join | MuxClean.go:13:22:13:32 | call to Vars | MuxClean.go:14:29:14:74 | call to Join | This path depends on a $@. | MuxClean.go:13:22:13:32 | call to Vars | user-provided value | edges -| MuxClean.go:13:22:13:32 | call to Vars | MuxClean.go:14:58:14:73 | not_tainted_path | provenance | Src:MaD:524 | -| MuxClean.go:14:58:14:73 | not_tainted_path | MuxClean.go:14:29:14:74 | call to Join | provenance | FunctionModel Sink:MaD:854 | +| MuxClean.go:13:22:13:32 | call to Vars | MuxClean.go:14:58:14:73 | not_tainted_path | provenance | Src:MaD:2 | +| MuxClean.go:14:58:14:73 | not_tainted_path | MuxClean.go:14:29:14:74 | call to Join | provenance | FunctionModel Sink:MaD:1 | +models +| 1 | Sink: io/ioutil; ; false; ReadFile; ; ; Argument[0]; path-injection; manual | +| 2 | Source: github.com/gorilla/mux; ; true; Vars; ; ; ReturnValue; remote; manual | nodes | MuxClean.go:13:22:13:32 | call to Vars | semmle.label | call to Vars | | MuxClean.go:14:29:14:74 | call to Join | semmle.label | call to Join | | MuxClean.go:14:58:14:73 | not_tainted_path | semmle.label | not_tainted_path | subpaths -#select -| MuxClean.go:14:29:14:74 | call to Join | MuxClean.go:13:22:13:32 | call to Vars | MuxClean.go:14:29:14:74 | call to Join | This path depends on a $@. | MuxClean.go:13:22:13:32 | call to Vars | user-provided value | diff --git a/go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected b/go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected new file mode 100644 index 000000000000..839d35f663ce --- /dev/null +++ b/go/ql/test/query-tests/Security/CWE-022/TaintedPath.expected @@ -0,0 +1,25 @@ +#select +| TaintedPath.go:17:29:17:40 | tainted_path | TaintedPath.go:14:18:14:22 | selection of URL | TaintedPath.go:17:29:17:40 | tainted_path | This path depends on a $@. | TaintedPath.go:14:18:14:22 | selection of URL | user-provided value | +| TaintedPath.go:21:28:21:69 | call to Join | TaintedPath.go:14:18:14:22 | selection of URL | TaintedPath.go:21:28:21:69 | call to Join | This path depends on a $@. | TaintedPath.go:14:18:14:22 | selection of URL | user-provided value | +| TaintedPath.go:68:28:68:57 | call to Clean | TaintedPath.go:14:18:14:22 | selection of URL | TaintedPath.go:68:28:68:57 | call to Clean | This path depends on a $@. | TaintedPath.go:14:18:14:22 | selection of URL | user-provided value | +edges +| TaintedPath.go:14:18:14:22 | selection of URL | TaintedPath.go:14:18:14:30 | call to Query | provenance | Src:MaD:2 MaD:3 | +| TaintedPath.go:14:18:14:30 | call to Query | TaintedPath.go:17:29:17:40 | tainted_path | provenance | Sink:MaD:1 | +| TaintedPath.go:14:18:14:30 | call to Query | TaintedPath.go:21:57:21:68 | tainted_path | provenance | | +| TaintedPath.go:14:18:14:30 | call to Query | TaintedPath.go:68:39:68:56 | ...+... | provenance | | +| TaintedPath.go:21:57:21:68 | tainted_path | TaintedPath.go:21:28:21:69 | call to Join | provenance | FunctionModel Sink:MaD:1 | +| TaintedPath.go:68:39:68:56 | ...+... | TaintedPath.go:68:28:68:57 | call to Clean | provenance | MaD:4 Sink:MaD:1 | +models +| 1 | Sink: io/ioutil; ; false; ReadFile; ; ; Argument[0]; path-injection; manual | +| 2 | Source: net/http; Request; true; URL; ; ; ; remote; manual | +| 3 | Summary: net/url; URL; true; Query; ; ; Argument[receiver]; ReturnValue; taint; manual | +| 4 | Summary: path; ; false; Clean; ; ; Argument[0]; ReturnValue; taint; manual | +nodes +| TaintedPath.go:14:18:14:22 | selection of URL | semmle.label | selection of URL | +| TaintedPath.go:14:18:14:30 | call to Query | semmle.label | call to Query | +| TaintedPath.go:17:29:17:40 | tainted_path | semmle.label | tainted_path | +| TaintedPath.go:21:28:21:69 | call to Join | semmle.label | call to Join | +| TaintedPath.go:21:57:21:68 | tainted_path | semmle.label | tainted_path | +| TaintedPath.go:68:28:68:57 | call to Clean | semmle.label | call to Clean | +| TaintedPath.go:68:39:68:56 | ...+... | semmle.label | ...+... | +subpaths