From 880011ce1317f6329520c318290c9dc1895e244c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 18 Jun 2026 10:24:33 +0000 Subject: [PATCH 01/44] Bump the pip group across 2 directories with 2 updates Bumps the pip group with 1 update in the /misc/codegen directory: [pytest](https://github.com/pytest-dev/pytest). Bumps the pip group with 1 update in the /python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC directory: [pymongo](https://github.com/mongodb/mongo-python-driver). Updates `pytest` from 8.3.5 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest/compare/8.3.5...9.0.3) Updates `pymongo` from 3.9 to 4.6.3 - [Release notes](https://github.com/mongodb/mongo-python-driver/releases) - [Changelog](https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst) - [Commits](https://github.com/mongodb/mongo-python-driver/compare/3.9.0...4.6.3) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: pymongo dependency-version: 4.6.3 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] --- misc/codegen/requirements_lock.txt | 2 +- .../Security/CWE-943-NoSqlInjection/PoC/requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/misc/codegen/requirements_lock.txt b/misc/codegen/requirements_lock.txt index d29fbd560769..7a2021a364a9 100644 --- a/misc/codegen/requirements_lock.txt +++ b/misc/codegen/requirements_lock.txt @@ -14,7 +14,7 @@ pluggy==1.5.0 # via pytest pystache==0.6.8 # via -r misc/codegen/requirements_in.txt -pytest==8.3.5 +pytest==9.0.3 # via -r misc/codegen/requirements_in.txt pyyaml==6.0.2 # via -r misc/codegen/requirements_in.txt diff --git a/python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC/requirements.txt b/python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC/requirements.txt index 36b236179535..eb25fa908ce2 100644 --- a/python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC/requirements.txt +++ b/python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/PoC/requirements.txt @@ -1,2 +1,2 @@ flask -pymongo==3.9 +pymongo==4.6.3 From 4328031ff7f91e354d4e6a80f6211d99905279cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jack=20N=C3=B8rskov=20J=C3=B8rgensen?= Date: Wed, 1 Jul 2026 13:17:56 +0200 Subject: [PATCH 02/44] Add MaDs for Apache POI --- .../org.apache.poi.common.model.yml | 8 + ...pache.poi.common.usermodel.fonts.model.yml | 15 + .../org.apache.poi.common.usermodel.model.yml | 8 + .../llmgenerator/org.apache.poi.ddf.model.yml | 96 ++++++ .../org.apache.poi.extractor.model.yml | 39 +++ .../org.apache.poi.hpsf.extractor.model.yml | 12 + .../org.apache.poi.hpsf.model.yml | 146 ++++++++ .../org.apache.poi.hssf.eventmodel.model.yml | 13 + ...g.apache.poi.hssf.eventusermodel.model.yml | 40 +++ .../org.apache.poi.hssf.extractor.model.yml | 34 ++ .../org.apache.poi.hssf.model.model.yml | 80 +++++ .../org.apache.poi.hssf.model.yml | 11 + ...pache.poi.hssf.record.aggregates.model.yml | 65 ++++ .../org.apache.poi.hssf.record.cf.model.yml | 34 ++ ...org.apache.poi.hssf.record.chart.model.yml | 24 ++ ...rg.apache.poi.hssf.record.common.model.yml | 40 +++ .../org.apache.poi.hssf.record.cont.model.yml | 9 + .../org.apache.poi.hssf.record.model.yml | 312 ++++++++++++++++++ ...pache.poi.hssf.record.pivottable.model.yml | 12 + ...pache.poi.hssf.usermodel.helpers.model.yml | 9 + .../org.apache.poi.hssf.usermodel.model.yml | 268 +++++++++++++++ .../org.apache.poi.hssf.util.model.yml | 11 + .../llmgenerator/org.apache.poi.model.yml | 25 ++ ...org.apache.poi.poifs.crypt.agile.model.yml | 53 +++ ...apache.poi.poifs.crypt.binaryrc4.model.yml | 10 + ...apache.poi.poifs.crypt.cryptoapi.model.yml | 10 + .../org.apache.poi.poifs.crypt.model.yml | 80 +++++ ....apache.poi.poifs.crypt.standard.model.yml | 11 + .../org.apache.poi.poifs.crypt.xor.model.yml | 9 + .../org.apache.poi.poifs.dev.model.yml | 28 ++ ...apache.poi.poifs.eventfilesystem.model.yml | 22 ++ .../org.apache.poi.poifs.filesystem.model.yml | 131 ++++++++ .../org.apache.poi.poifs.macros.model.yml | 25 ++ .../org.apache.poi.poifs.nio.model.yml | 30 ++ .../org.apache.poi.poifs.property.model.yml | 29 ++ .../org.apache.poi.poifs.storage.model.yml | 17 + .../org.apache.poi.sl.draw.geom.model.yml | 86 +++++ .../org.apache.poi.sl.draw.model.yml | 102 ++++++ .../org.apache.poi.sl.extractor.model.yml | 10 + .../org.apache.poi.sl.image.model.yml | 13 + .../org.apache.poi.sl.usermodel.model.yml | 23 ++ .../org.apache.poi.ss.extractor.model.yml | 20 ++ .../org.apache.poi.ss.format.model.yml | 52 +++ ...g.apache.poi.ss.formula.constant.model.yml | 9 + ...pache.poi.ss.formula.eval.forked.model.yml | 9 + .../org.apache.poi.ss.formula.eval.model.yml | 41 +++ ...g.apache.poi.ss.formula.function.model.yml | 9 + ....apache.poi.ss.formula.functions.model.yml | 55 +++ .../org.apache.poi.ss.formula.model.yml | 121 +++++++ .../org.apache.poi.ss.formula.ptg.model.yml | 68 ++++ .../org.apache.poi.ss.formula.udf.model.yml | 16 + ....apache.poi.ss.usermodel.helpers.model.yml | 10 + .../org.apache.poi.ss.usermodel.model.yml | 137 ++++++++ .../org.apache.poi.ss.util.cellwalk.model.yml | 9 + .../org.apache.poi.ss.util.model.yml | 51 +++ .../org.apache.poi.util.model.yml | 195 +++++++++++ 56 files changed, 2802 insertions(+) create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.fonts.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ddf.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.extractor.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hpsf.extractor.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hpsf.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.eventmodel.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.eventusermodel.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.extractor.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.model.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.aggregates.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.cf.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.chart.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.common.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.cont.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.pivottable.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.usermodel.helpers.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.usermodel.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.util.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.agile.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.binaryrc4.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.cryptoapi.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.standard.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.xor.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.dev.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.eventfilesystem.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.filesystem.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.macros.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.nio.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.property.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.storage.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.draw.geom.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.draw.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.extractor.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.image.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.usermodel.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.extractor.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.format.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.constant.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.eval.forked.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.eval.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.function.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.functions.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.ptg.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.udf.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.usermodel.helpers.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.usermodel.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.util.cellwalk.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.util.model.yml create mode 100644 java/ql/lib/ext/generated/llmgenerator/org.apache.poi.util.model.yml diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.model.yml new file mode 100644 index 000000000000..90e75c34a850 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.model.yml @@ -0,0 +1,8 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.common", "Duplicatable", True, "copy", "()", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.fonts.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.fonts.model.yml new file mode 100644 index 000000000000..5cc0fc0a5b70 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.fonts.model.yml @@ -0,0 +1,15 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "getFamilyName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "getFullName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "getStyleName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "getVersionName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "init", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.common.usermodel.fonts", "FontHeader", True, "init", "(byte[],int,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.common.usermodel.fonts", "FontInfo", True, "getPanose", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.common.usermodel.fonts", "FontInfo", True, "getTypeface", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.model.yml new file mode 100644 index 000000000000..774b9e50aad7 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.common.usermodel.model.yml @@ -0,0 +1,8 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.common.usermodel", "GenericRecord", True, "getGenericChildren", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ddf.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ddf.model.yml new file mode 100644 index 000000000000..37745dd68287 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ddf.model.yml @@ -0,0 +1,96 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ddf", "AbstractEscherOptRecord", True, "addEscherProperty", "(EscherProperty)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.AbstractEscherOptRecord.properties].Element", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "AbstractEscherOptRecord", True, "getEscherProperties", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.AbstractEscherOptRecord.properties]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "AbstractEscherOptRecord", True, "getEscherProperty", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.AbstractEscherOptRecord.properties].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "AbstractEscherOptRecord", True, "lookup", "(EscherPropertyTypes)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.AbstractEscherOptRecord.properties].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "AbstractEscherOptRecord", True, "lookup", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.AbstractEscherOptRecord.properties].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "AbstractEscherOptRecord", True, "setEscherProperty", "(EscherProperty)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.AbstractEscherOptRecord.properties].Element", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherArrayProperty", False, "getElement", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherComplexProperty.complexData].ArrayElement", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherArrayProperty", False, "setArrayData", "(byte[],int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherComplexProperty.complexData]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherArrayProperty", False, "setElement", "(int,byte[])", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherComplexProperty.complexData]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBSERecord", False, "EscherBSERecord", "(EscherBSERecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherBSERecord", False, "getBlipRecord", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBSERecord.field_12_blipRecord]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBSERecord", False, "getRemainingData", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBSERecord._remainingData]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBSERecord", False, "getUid", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBSERecord.field_3_uid]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBSERecord", False, "setBlipRecord", "(EscherBlipRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBSERecord.field_12_blipRecord]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBSERecord", False, "setRemainingData", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBSERecord._remainingData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBSERecord", False, "setUid", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBSERecord.field_3_uid]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "EscherBitmapBlip", "(EscherBitmapBlip)", "", "Argument[0].SyntheticField[org.apache.poi.ddf.EscherBitmapBlip.field_1_UID]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBitmapBlip.field_1_UID]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "EscherBitmapBlip", "(EscherBitmapBlip)", "", "Argument[0].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBitmapBlip.field_1_UID]", "ReturnValue.SyntheticField[org.apache.poi.ddf.EscherBitmapBlip.field_1_UID]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "ReturnValue.SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "fillFields", "(byte[],int,EscherRecordFactory)", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "fillFields", "(byte[],int,EscherRecordFactory)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBitmapBlip.field_1_UID]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "getUID", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBitmapBlip.field_1_UID]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "serialize", "(int,byte[],EscherSerializationListener)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBitmapBlip.field_1_UID]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "serialize", "(int,byte[],EscherSerializationListener)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBitmapBlip", True, "setUID", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBitmapBlip.field_1_UID]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBlipRecord", True, "EscherBlipRecord", "(EscherBlipRecord)", "", "Argument[0].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBlipRecord", True, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "ReturnValue.SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBlipRecord", True, "fillFields", "(byte[],int,EscherRecordFactory)", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBlipRecord", True, "getPicturedata", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBlipRecord", True, "serialize", "(int,byte[],EscherSerializationListener)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBlipRecord", True, "setPictureData", "(byte[])", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherBlipRecord", True, "setPictureData", "(byte[],int,int)", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientAnchorRecord", True, "EscherClientAnchorRecord", "(EscherClientAnchorRecord)", "", "Argument[0].SyntheticField[org.apache.poi.ddf.EscherClientAnchorRecord.remainingData]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientAnchorRecord.remainingData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientAnchorRecord", True, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientAnchorRecord.remainingData]", "ReturnValue.SyntheticField[org.apache.poi.ddf.EscherClientAnchorRecord.remainingData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientAnchorRecord", True, "fillFields", "(byte[],int,EscherRecordFactory)", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientAnchorRecord.remainingData].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientAnchorRecord", True, "getRemainingData", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientAnchorRecord.remainingData]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientAnchorRecord", True, "serialize", "(int,byte[],EscherSerializationListener)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientAnchorRecord.remainingData]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientAnchorRecord", True, "setRemainingData", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientAnchorRecord.remainingData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientDataRecord", True, "EscherClientDataRecord", "(EscherClientDataRecord)", "", "Argument[0].SyntheticField[org.apache.poi.ddf.EscherClientDataRecord.remainingData]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientDataRecord.remainingData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientDataRecord", True, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientDataRecord.remainingData]", "ReturnValue.SyntheticField[org.apache.poi.ddf.EscherClientDataRecord.remainingData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientDataRecord", True, "fillFields", "(byte[],int,EscherRecordFactory)", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientDataRecord.remainingData].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientDataRecord", True, "getRemainingData", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientDataRecord.remainingData]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientDataRecord", True, "serialize", "(int,byte[],EscherSerializationListener)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientDataRecord.remainingData]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherClientDataRecord", True, "setRemainingData", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherClientDataRecord.remainingData]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherComplexProperty", True, "getComplexData", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherComplexProperty.complexData]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherComplexProperty", True, "serializeComplexPart", "(byte[],int)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherComplexProperty.complexData]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherComplexProperty", True, "setComplexData", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherComplexProperty.complexData]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherComplexProperty", True, "setComplexData", "(byte[],int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherComplexProperty.complexData]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherContainerRecord", False, "addChildBefore", "(EscherRecord,int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherContainerRecord._childRecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherContainerRecord", False, "addChildRecord", "(EscherRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherContainerRecord._childRecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherContainerRecord", False, "getChild", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherContainerRecord._childRecords].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherContainerRecord", False, "getChildById", "(short)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherContainerRecord._childRecords].Element", "ReturnValue", "value", "manual"] + - ["org.apache.poi.ddf", "EscherContainerRecord", False, "getChildContainers", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherContainerRecord._childRecords].Element", "ReturnValue", "value", "manual"] + - ["org.apache.poi.ddf", "EscherContainerRecord", False, "getRecordsById", "(short,List)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherContainerRecord._childRecords].Element", "ReturnValue.Element", "value", "manual"] + - ["org.apache.poi.ddf", "EscherContainerRecord", False, "getChildRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherContainerRecord._childRecords].Element", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherContainerRecord", False, "setChildRecords", "(List)", "", "Argument[0].Element", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherContainerRecord._childRecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherDggRecord", False, "getFileIdClusters", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherDggRecord.field_5_fileIdClusters].Element", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherDggRecord", False, "setFileIdClusters", "(EscherDggRecord$FileIdCluster[])", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherDggRecord.field_5_fileIdClusters].Element", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherMetafileBlip", False, "EscherMetafileBlip", "(EscherMetafileBlip)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherMetafileBlip", False, "getPrimaryUID", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherMetafileBlip.field_2_UID]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherMetafileBlip", False, "getRemainingData", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherMetafileBlip", False, "getUID", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherMetafileBlip.field_1_UID]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherMetafileBlip", False, "setPictureData", "(byte[])", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherBlipRecord.field_pictureData].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherMetafileBlip", False, "setPrimaryUID", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherMetafileBlip.field_2_UID]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherMetafileBlip", False, "setUID", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherMetafileBlip.field_1_UID]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherOptRecord", True, "EscherOptRecord", "(EscherOptRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherPropertyMetaData", True, "EscherPropertyMetaData", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherPropertyMetaData.description]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherPropertyMetaData", True, "EscherPropertyMetaData", "(String,byte)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherPropertyMetaData.description]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherPropertyMetaData", True, "getDescription", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherPropertyMetaData.description]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherRecord", True, "fillFields", "(byte[],int,EscherRecordFactory)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherRecord", True, "getChild", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherRecord", True, "serialize", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherRecord", True, "serialize", "(int,byte[])", "", "Argument[this]", "Argument[1]", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherRecord", True, "serialize", "(int,byte[],EscherSerializationListener)", "", "Argument[this]", "Argument[1]", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherTertiaryOptRecord", True, "EscherTertiaryOptRecord", "(EscherTertiaryOptRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ddf", "EscherTextboxRecord", False, "EscherTextboxRecord", "(EscherTextboxRecord)", "", "Argument[0].SyntheticField[org.apache.poi.ddf.EscherTextboxRecord.thedata]", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherTextboxRecord.thedata]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherTextboxRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherTextboxRecord.thedata]", "ReturnValue.SyntheticField[org.apache.poi.ddf.EscherTextboxRecord.thedata]", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherTextboxRecord", False, "fillFields", "(byte[],int,EscherRecordFactory)", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherTextboxRecord.thedata].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherTextboxRecord", False, "getData", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherTextboxRecord.thedata]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherTextboxRecord", False, "serialize", "(int,byte[],EscherSerializationListener)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherTextboxRecord.thedata]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherTextboxRecord", False, "setData", "(byte[])", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherTextboxRecord.thedata].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "EscherTextboxRecord", False, "setData", "(byte[],int,int)", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.EscherTextboxRecord.thedata].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "UnknownEscherRecord", False, "addChildRecord", "(EscherRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ddf.UnknownEscherRecord._childRecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "UnknownEscherRecord", False, "fillFields", "(byte[],int,EscherRecordFactory)", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ddf.UnknownEscherRecord.thedata].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "UnknownEscherRecord", False, "getChildRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.UnknownEscherRecord._childRecords]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "UnknownEscherRecord", False, "getData", "()", "", "Argument[this].SyntheticField[org.apache.poi.ddf.UnknownEscherRecord.thedata]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ddf", "UnknownEscherRecord", False, "serialize", "(int,byte[],EscherSerializationListener)", "", "Argument[this].SyntheticField[org.apache.poi.ddf.UnknownEscherRecord.thedata]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.ddf", "UnknownEscherRecord", False, "setChildRecords", "(List)", "", "Argument[0].Element", "Argument[this].SyntheticField[org.apache.poi.ddf.UnknownEscherRecord._childRecords].Element", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.extractor.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.extractor.model.yml new file mode 100644 index 000000000000..642de58bad2d --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.extractor.model.yml @@ -0,0 +1,39 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.extractor", "ExtractorFactory", True, "createExtractor", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.extractor", "ExtractorFactory", True, "createExtractor", "(File,String)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.extractor", "ExtractorProvider", True, "create", "(File,String)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.extractor", "MainExtractorFactory", True, "create", "(File,String)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.extractor", "ExtractorFactory", True, "createExtractor", "(File)", "", "ReturnValue", "file", "ai-generated"] + - ["org.apache.poi.extractor", "ExtractorFactory", True, "createExtractor", "(File,String)", "", "ReturnValue", "file", "ai-generated"] + - ["org.apache.poi.extractor", "MainExtractorFactory", True, "create", "(File,String)", "", "ReturnValue", "file", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(DirectoryNode)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(DirectoryNode,String)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(DirectoryNode,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(File,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(InputStream,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(POIFSFileSystem)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(POIFSFileSystem,String)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "ExtractorFactory", False, "createExtractor", "(POIFSFileSystem,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "ExtractorProvider", True, "create", "(File,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "ExtractorProvider", True, "create", "(InputStream,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "MainExtractorFactory", True, "create", "(DirectoryNode,String)", "", "Argument[0].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._filesystem]", "ReturnValue.SyntheticField[org.apache.poi.hssf.extractor.OldExcelExtractor.toClose]", "value", "dfc-generated"] + - ["org.apache.poi.extractor", "POIOLE2TextExtractor", True, "getDocSummaryInformation", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "POIOLE2TextExtractor", True, "getRoot", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "POIOLE2TextExtractor", True, "getSummaryInformation", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "POITextExtractor", True, "getDocument", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "POITextExtractor", True, "getMetadataTextExtractor", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.extractor", "POITextExtractor", True, "getText", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hpsf.extractor.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hpsf.extractor.model.yml new file mode 100644 index 000000000000..f3edc6d77bbd --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hpsf.extractor.model.yml @@ -0,0 +1,12 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "HPSFPropertiesExtractor", "(POIDocument)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.extractor.HPSFPropertiesExtractor.document]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "HPSFPropertiesExtractor", "(POIFSFileSystem)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "HPSFPropertiesExtractor", "(POIOLE2TextExtractor)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "getDocument", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.extractor.HPSFPropertiesExtractor.document]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf.extractor", "HPSFPropertiesExtractor", True, "getFilesystem", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.extractor.HPSFPropertiesExtractor.document]", "ReturnValue", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hpsf.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hpsf.model.yml new file mode 100644 index 000000000000..dc39fc5d76da --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hpsf.model.yml @@ -0,0 +1,146 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.hpsf", "HPSFPropertiesOnlyDocument", True, "write", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hpsf", "Array", True, "getValues", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "Blob", True, "read", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "ClassID", "(ClassID)", "", "Argument[0].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "ClassID", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "ClassID", "(byte[],int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "ReturnValue.SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "getBytes", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "read", "(byte[],int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "read", "(byte[],int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "read", "(byte[],int)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "setBytes", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "write", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClassID", True, "write", "(byte[],int)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClipboardData", True, "getValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClipboardData._value]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClipboardData", True, "read", "(LittleEndianByteArrayInputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClipboardData._value]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClipboardData", True, "setValue", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClipboardData._value]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "ClipboardData", True, "toByteArray", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.ClipboardData._value]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "CodePageString", True, "getJavaValue", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.CodePageString._value]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "CodePageString", True, "read", "(LittleEndianByteArrayInputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.CodePageString._value]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "CodePageString", True, "setJavaValue", "(String,int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.CodePageString._value]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "CodePageString", True, "write", "(OutputStream)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.CodePageString._value]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "Currency", True, "read", "(LittleEndianByteArrayInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "CustomProperties", True, "nameSet", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.CustomProperties.dictionary].MapValue", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "CustomProperties", True, "properties", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.CustomProperties.props].MapValue", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "CustomProperties", True, "put", "(String,CustomProperty)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.CustomProperties.dictionary].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "CustomProperties", True, "put", "(String,CustomProperty)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hpsf.CustomProperties.props].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "CustomProperties", True, "put", "(String,CustomProperty)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.CustomProperties.props].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "CustomProperty", True, "CustomProperty", "(Property)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "CustomProperty", True, "CustomProperty", "(Property,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hpsf.CustomProperty.name]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "CustomProperty", True, "getName", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.CustomProperty.name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "CustomProperty", True, "setName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.CustomProperty.name]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Date", True, "read", "(LittleEndianByteArrayInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "DocumentSummaryInformation", True, "DocumentSummaryInformation", "(InputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "DocumentSummaryInformation", True, "DocumentSummaryInformation", "(PropertySet)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "DocumentSummaryInformation", True, "getCustomProperties", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "HPSFException", True, "HPSFException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "HPSFException", True, "HPSFException", "(String,Throwable)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hpsf.HPSFException.reason]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "HPSFException", True, "HPSFException", "(Throwable)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.HPSFException.reason]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "HPSFException", True, "getReason", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.HPSFException.reason]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "HPSFPropertiesOnlyDocument", True, "HPSFPropertiesOnlyDocument", "(POIFSFileSystem)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "HPSFRuntimeException", True, "HPSFRuntimeException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "HPSFRuntimeException", True, "HPSFRuntimeException", "(String,Throwable)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hpsf.HPSFRuntimeException.reason]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "HPSFRuntimeException", True, "HPSFRuntimeException", "(Throwable)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.HPSFRuntimeException.reason]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "HPSFRuntimeException", True, "getReason", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.HPSFRuntimeException.reason]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "IllegalPropertySetDataException", True, "IllegalPropertySetDataException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "IllegalPropertySetDataException", True, "IllegalPropertySetDataException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "IllegalPropertySetDataException", True, "IllegalPropertySetDataException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "IllegalPropertySetDataException", True, "IllegalPropertySetDataException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "IllegalVariantTypeException", True, "IllegalVariantTypeException", "(long,Object)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "IllegalVariantTypeException", True, "IllegalVariantTypeException", "(long,Object,String)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "IllegalVariantTypeException", True, "IllegalVariantTypeException", "(long,Object,String)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "MissingSectionException", True, "MissingSectionException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "MissingSectionException", True, "MissingSectionException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "MissingSectionException", True, "MissingSectionException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "MissingSectionException", True, "MissingSectionException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoFormatIDException", True, "NoFormatIDException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoFormatIDException", True, "NoFormatIDException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoFormatIDException", True, "NoFormatIDException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoFormatIDException", True, "NoFormatIDException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoPropertySetStreamException", True, "NoPropertySetStreamException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoPropertySetStreamException", True, "NoPropertySetStreamException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoPropertySetStreamException", True, "NoPropertySetStreamException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoPropertySetStreamException", True, "NoPropertySetStreamException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoSingleSectionException", True, "NoSingleSectionException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoSingleSectionException", True, "NoSingleSectionException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoSingleSectionException", True, "NoSingleSectionException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "NoSingleSectionException", True, "NoSingleSectionException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "Property", True, "Property", "(Property)", "", "Argument[0].SyntheticField[org.apache.poi.hpsf.Property.value]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Property.value]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Property", True, "Property", "(long,long,Object)", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Property.value]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Property", True, "getValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Property.value]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Property", True, "setValue", "(Object)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Property.value]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Property", True, "toString", "(int,PropertyIDMap)", "", "Argument[1].MapValue", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "Property", True, "toString", "(int,PropertyIDMap)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Property.value]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "Property", True, "write", "(OutputStream,int)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Property.value]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "PropertySet", "(InputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.classID].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "PropertySet", "(PropertySet)", "", "Argument[0].SyntheticField[org.apache.poi.hpsf.PropertySet.classID]", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.classID]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "PropertySet", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.classID].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "PropertySet", "(byte[],int,int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.classID].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "addSection", "(Section)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.sections].Element", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "getClassID", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.classID]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "getFirstSection", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.sections].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "getProperties", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "getPropertyStringValue", "(Object)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "getSections", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.sections].Element", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "setClassID", "(ClassID)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.classID]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "write", "(DirectoryEntry,String)", "", "Argument[1]", "Argument[0].Element", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "PropertySet", True, "write", "(OutputStream)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.PropertySet.classID].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "PropertySetFactory", True, "create", "(InputStream)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hpsf.PropertySet.classID].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "ReadingNotSupportedException", True, "ReadingNotSupportedException", "(long,Object)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "Section", True, "Section", "(Section)", "", "Argument[0].SyntheticField[org.apache.poi.hpsf.Section.dictionary].MapKey", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.dictionary].MapKey", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "Section", "(Section)", "", "Argument[0].SyntheticField[org.apache.poi.hpsf.Section.dictionary].MapValue", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.dictionary].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "Section", "(Section)", "", "Argument[0].SyntheticField[org.apache.poi.hpsf.Section.formatID]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.formatID]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "Section", "(byte[],int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.dictionary].MapValue", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "Section", "(byte[],int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.sectionBytes]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "getDictionary", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.dictionary]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "getFormatID", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.formatID]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "getPIDString", "(long)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.dictionary].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "getProperties", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.properties].MapValue", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "getProperty", "(long)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "Section", True, "setDictionary", "(Map)", "", "Argument[0].MapKey", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.dictionary].MapKey", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "setDictionary", "(Map)", "", "Argument[0].MapValue", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.dictionary].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "setFormatID", "(ClassID)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.formatID]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "setProperties", "(Property[])", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.properties].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "setProperty", "(Property)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.properties].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "toString", "(PropertyIDMap)", "", "Argument[0].MapValue", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "toString", "(PropertyIDMap)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.formatID]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "write", "(OutputStream)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.dictionary].MapValue", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "Section", True, "write", "(OutputStream)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Section.sectionBytes]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "SummaryInformation", False, "SummaryInformation", "(InputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "SummaryInformation", False, "SummaryInformation", "(PropertySet)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "Thumbnail", False, "Thumbnail", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Thumbnail._thumbnailData]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Thumbnail", False, "getThumbnail", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Thumbnail._thumbnailData]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Thumbnail", False, "getThumbnailAsWMF", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.Thumbnail._thumbnailData].ArrayElement", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Thumbnail", False, "setThumbnail", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.Thumbnail._thumbnailData]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "TypedPropertyValue", True, "TypedPropertyValue", "(int,Object)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hpsf.TypedPropertyValue._value]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "TypedPropertyValue", True, "getValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.TypedPropertyValue._value]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "TypedPropertyValue", True, "read", "(LittleEndianByteArrayInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "TypedPropertyValue", True, "readValue", "(LittleEndianByteArrayInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "UnexpectedPropertySetTypeException", True, "UnexpectedPropertySetTypeException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "UnexpectedPropertySetTypeException", True, "UnexpectedPropertySetTypeException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "UnexpectedPropertySetTypeException", True, "UnexpectedPropertySetTypeException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "UnexpectedPropertySetTypeException", True, "UnexpectedPropertySetTypeException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "UnicodeString", True, "getValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.UnicodeString._value]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "UnicodeString", True, "read", "(LittleEndianByteArrayInputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.UnicodeString._value]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "UnicodeString", True, "setJavaValue", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hpsf.UnicodeString._value]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "UnicodeString", True, "toJavaString", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.UnicodeString._value]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "UnicodeString", True, "write", "(OutputStream)", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.UnicodeString._value]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "UnsupportedVariantTypeException", True, "UnsupportedVariantTypeException", "(long,Object)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "VariantSupport", True, "write", "(OutputStream,long,Object,int)", "", "Argument[2]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hpsf", "VariantTypeException", True, "VariantTypeException", "(long,Object,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hpsf.VariantTypeException.value]", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "VariantTypeException", True, "getValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.hpsf.VariantTypeException.value]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hpsf", "Vector", True, "getValues", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "VersionedStream", True, "read", "(LittleEndianByteArrayInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hpsf", "WritingNotSupportedException", True, "WritingNotSupportedException", "(long,Object)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.eventmodel.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.eventmodel.model.yml new file mode 100644 index 000000000000..0c987768086b --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.eventmodel.model.yml @@ -0,0 +1,13 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.hssf.eventmodel", "ERFListener", True, "processRecord", "(Record)", "", "Parameter[0]", "file", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.eventmodel", "EventRecordFactory", False, "EventRecordFactory", "(ERFListener,short[])", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.eventusermodel.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.eventusermodel.model.yml new file mode 100644 index 000000000000..f00b8564c2f7 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.eventusermodel.model.yml @@ -0,0 +1,40 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.hssf.eventusermodel", "AbortableHSSFListener", True, "abortableProcessRecord", "(Record)", "", "Parameter[0]", "file", "ai-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "processRecord", "(Record)", "", "Parameter[0]", "file", "ai-generated"] + - ["org.apache.poi.hssf.eventusermodel", "FormatTrackingHSSFListener", True, "processRecord", "(Record)", "", "Parameter[0]", "file", "ai-generated"] + - ["org.apache.poi.hssf.eventusermodel", "HSSFListener", True, "processRecord", "(Record)", "", "Parameter[0]", "file", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder", True, "createStubWorkbook", "(ExternSheetRecord[],BoundSheetRecord[])", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder", True, "createStubWorkbook", "(ExternSheetRecord[],BoundSheetRecord[])", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder", True, "createStubWorkbook", "(ExternSheetRecord[],BoundSheetRecord[],SSTRecord)", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder", True, "createStubWorkbook", "(ExternSheetRecord[],BoundSheetRecord[],SSTRecord)", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder", True, "createStubWorkbook", "(ExternSheetRecord[],BoundSheetRecord[],SSTRecord)", "", "Argument[2]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "SheetRecordCollectingListener", "(HSSFListener)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "getBoundSheetRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.eventusermodel.EventWorkbookBuilder$SheetRecordCollectingListener.boundSheetRecords].Element", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "getExternSheetRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.eventusermodel.EventWorkbookBuilder$SheetRecordCollectingListener.externSheetRecords].Element", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "getSSTRecord", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.eventusermodel.EventWorkbookBuilder$SheetRecordCollectingListener.sstRecord]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "getStubHSSFWorkbook", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "getStubWorkbook", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "processRecordInternally", "(Record)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.eventusermodel.EventWorkbookBuilder$SheetRecordCollectingListener.boundSheetRecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "processRecordInternally", "(Record)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.eventusermodel.EventWorkbookBuilder$SheetRecordCollectingListener.externSheetRecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.eventusermodel", "EventWorkbookBuilder$SheetRecordCollectingListener", True, "processRecordInternally", "(Record)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.eventusermodel.EventWorkbookBuilder$SheetRecordCollectingListener.sstRecord]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.eventusermodel", "FormatTrackingHSSFListener", True, "FormatTrackingHSSFListener", "(HSSFListener)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "FormatTrackingHSSFListener", True, "FormatTrackingHSSFListener", "(HSSFListener,Locale)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "FormatTrackingHSSFListener", True, "FormatTrackingHSSFListener", "(HSSFListener,Locale)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "FormatTrackingHSSFListener", True, "getFormatString", "(CellValueRecordInterface)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "FormatTrackingHSSFListener", True, "getFormatString", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "FormatTrackingHSSFListener", True, "processRecordInternally", "(Record)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "HSSFUserException", True, "HSSFUserException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.eventusermodel", "HSSFUserException", True, "HSSFUserException", "(String,Throwable)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.eventusermodel.HSSFUserException.reason]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.eventusermodel", "HSSFUserException", True, "HSSFUserException", "(Throwable)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.eventusermodel.HSSFUserException.reason]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.eventusermodel", "HSSFUserException", True, "getReason", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.eventusermodel.HSSFUserException.reason]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.eventusermodel", "MissingRecordAwareHSSFListener", False, "MissingRecordAwareHSSFListener", "(HSSFListener)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.extractor.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.extractor.model.yml new file mode 100644 index 000000000000..c36edfab9608 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.extractor.model.yml @@ -0,0 +1,34 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.hssf.extractor", "OldExcelExtractor", True, "OldExcelExtractor", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.hssf.extractor", "OldExcelExtractor", True, "OldExcelExtractor", "(File)", "", "Argument[this]", "file", "ai-generated"] + - ["org.apache.poi.hssf.extractor", "OldExcelExtractor", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.extractor", "EventBasedExcelExtractor", True, "EventBasedExcelExtractor", "(DirectoryNode)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.EventBasedExcelExtractor._dir]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "EventBasedExcelExtractor", True, "EventBasedExcelExtractor", "(DirectoryNode,char[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.EventBasedExcelExtractor._dir]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "EventBasedExcelExtractor", True, "EventBasedExcelExtractor", "(POIFSFileSystem)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.EventBasedExcelExtractor.poifs]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "EventBasedExcelExtractor", True, "EventBasedExcelExtractor", "(POIFSFileSystem,char[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.EventBasedExcelExtractor.poifs]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "EventBasedExcelExtractor", True, "getFilesystem", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.EventBasedExcelExtractor.poifs]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "EventBasedExcelExtractor", True, "getRoot", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.EventBasedExcelExtractor._dir]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "ExcelExtractor", True, "ExcelExtractor", "(DirectoryNode)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.extractor", "ExcelExtractor", True, "ExcelExtractor", "(DirectoryNode,char[])", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.extractor", "ExcelExtractor", True, "ExcelExtractor", "(HSSFWorkbook)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.ExcelExtractor._wb]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "ExcelExtractor", True, "ExcelExtractor", "(POIFSFileSystem)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.extractor", "ExcelExtractor", True, "ExcelExtractor", "(POIFSFileSystem,char[])", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.extractor", "ExcelExtractor", True, "getDocument", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.ExcelExtractor._wb]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "ExcelExtractor", True, "getFilesystem", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.ExcelExtractor._wb]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "OldExcelExtractor", True, "OldExcelExtractor", "(InputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.OldExcelExtractor.toClose]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "OldExcelExtractor", True, "OldExcelExtractor", "(POIFSFileSystem)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.OldExcelExtractor.toClose]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.extractor", "OldExcelExtractor", True, "getFilesystem", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.extractor.OldExcelExtractor.toClose]", "ReturnValue", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.model.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.model.model.yml new file mode 100644 index 000000000000..a4c9faf55a1c --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.model.model.yml @@ -0,0 +1,80 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.model", "DrawingManager2", True, "DrawingManager2", "(EscherDggRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.DrawingManager2.dgg]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "DrawingManager2", True, "getDgg", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.DrawingManager2.dgg]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "HSSFFormulaParser", False, "toFormulaString", "(HSSFWorkbook,Ptg[])", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "cloneSheet", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "createSheet", "(RecordStream)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "findFirstRecordBySid", "(short)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet._records].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getCellValueIterator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getConditionalFormattingTable", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getGridsetRecord", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getMergedRegionAt", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getNextRow", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getNoteRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet._records].Element", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getOrCreateDataValidityTable", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getPageSettings", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getPrintGridlines", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet.printGridlines]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getPrintHeaders", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet.printHeaders]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getProtectionBlock", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet._records]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getRow", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getRowsAggregate", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getSelection", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet._selection]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "getWindowTwo", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "setPrintGridlines", "(PrintGridlinesRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet.printGridlines]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "setPrintHeaders", "(PrintHeadersRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet.printHeaders]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "setSCLRecord", "(SCLRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet._records].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalSheet", False, "setSelection", "(SelectionRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalSheet._selection]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "addBSERecord", "(EscherBSERecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalWorkbook.escherBSERecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "addName", "(NameRecord)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "createWorkbook", "(List)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "findDrawingGroup", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "findFirstRecordBySid", "(short)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "findNextRecordBySid", "(short,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "findSheetFirstNameFromExternSheet", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "findSheetLastNameFromExternSheet", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getBSERecord", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalWorkbook.escherBSERecords].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getBackupRecord", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getCustomPalette", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getDrawingManager", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getExFormatAt", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getFileSharing", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getFontRecordAt", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getFormats", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getHyperlinks", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getNameCommentRecord", "(NameRecord)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalWorkbook.commentRecords].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getNameRecord", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getRecalcId", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getRecords", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getSheetName", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getSpecificBuiltinRecord", "(byte,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getStyleRecord", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getWindowOne", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getWorkbookRecordList", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getWriteAccess", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "getWriteProtect", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "updateNameCommentRecordCache", "(NameCommentRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_6_name_text]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalWorkbook.commentRecords].MapKey", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", False, "updateNameCommentRecordCache", "(NameCommentRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.InternalWorkbook.commentRecords].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "RecordStream", False, "RecordStream", "(List,int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.RecordStream._list]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "RecordStream", False, "RecordStream", "(List,int,int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.RecordStream._list]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "RecordStream", False, "getNext", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.RecordStream._list].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "RecordStream", False, "peekNextRecord", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.RecordStream._list].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "RowBlocksReader", False, "getLooseMergedCells", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "RowBlocksReader", False, "getPlainRecordStream", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "RowBlocksReader", False, "getSharedFormulaManager", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.model", "WorkbookRecordList", False, "add", "(int,Record)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.WorkbookRecordList.records].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "WorkbookRecordList", False, "get", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.WorkbookRecordList.records].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "WorkbookRecordList", False, "getRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.model.WorkbookRecordList.records]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.model", "WorkbookRecordList", False, "setRecords", "(List)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.model.WorkbookRecordList.records]", "value", "dfc-generated"] + - addsTo: + pack: codeql/java-all + extensible: neutralModel + data: + - ["org.apache.poi.hssf.model", "InternalWorkbook", "getNameXPtg", "(String,UDFFinder)", "summary", "ai-generated"] + - ["org.apache.poi.hssf.model", "InternalWorkbook", "getNameXPtg", "(String,int,UDFFinder)", "summary", "ai-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.model.yml new file mode 100644 index 000000000000..db040eb00f3a --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.model.yml @@ -0,0 +1,11 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf", "HSSFReadException", True, "HSSFReadException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf", "HSSFReadException", True, "HSSFReadException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf", "HSSFReadException", True, "HSSFReadException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf", "OldExcelFormatException", True, "OldExcelFormatException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.aggregates.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.aggregates.model.yml new file mode 100644 index 000000000000..657f6d06183d --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.aggregates.model.yml @@ -0,0 +1,65 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.record.aggregates", "CFRecordsAggregate", False, "CFRecordsAggregate", "(CellRangeAddress[],CFRuleBase[])", "", "Argument[1].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.CFRecordsAggregate.rules].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "CFRecordsAggregate", False, "addRule", "(CFRuleBase)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.CFRecordsAggregate.rules].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "CFRecordsAggregate", False, "createCFAggregate", "(RecordStream)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.model.RecordStream._list].Element", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.aggregates.CFRecordsAggregate.header]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "CFRecordsAggregate", False, "createCFAggregate", "(RecordStream)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.model.RecordStream._list].Element", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.aggregates.CFRecordsAggregate.rules].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "CFRecordsAggregate", False, "getHeader", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.CFRecordsAggregate.header]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "CFRecordsAggregate", False, "getRule", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.CFRecordsAggregate.rules].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "CFRecordsAggregate", False, "setRule", "(int,CFRuleBase)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.CFRecordsAggregate.rules].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "ChartSubstreamRecordAggregate", False, "ChartSubstreamRecordAggregate", "(RecordStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "ColumnInfoRecordsAggregate", False, "ColumnInfoRecordsAggregate", "(RecordStream)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.model.RecordStream._list].Element", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.ColumnInfoRecordsAggregate.records].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "ColumnInfoRecordsAggregate", False, "findColumnInfo", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.ColumnInfoRecordsAggregate.records].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "ColumnInfoRecordsAggregate", False, "insertColumn", "(ColumnInfoRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.ColumnInfoRecordsAggregate.records].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "ConditionalFormattingTable", False, "add", "(CFRecordsAggregate)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.ConditionalFormattingTable._cfHeaders].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "ConditionalFormattingTable", False, "get", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.ConditionalFormattingTable._cfHeaders].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "CustomViewSettingsRecordAggregate", False, "CustomViewSettingsRecordAggregate", "(RecordStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "CustomViewSettingsRecordAggregate", False, "append", "(RecordBase)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "DataValidityTable", False, "DataValidityTable", "(RecordStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "DataValidityTable", False, "addDataValidation", "(DVRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "FormulaRecordAggregate", False, "FormulaRecordAggregate", "(FormulaRecord,StringRecord,SharedValueManager)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.FormulaRecordAggregate._formulaRecord]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "FormulaRecordAggregate", False, "FormulaRecordAggregate", "(FormulaRecord,StringRecord,SharedValueManager)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.FormulaRecordAggregate._stringRecord]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "FormulaRecordAggregate", False, "getFormulaRecord", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.FormulaRecordAggregate._formulaRecord]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "FormulaRecordAggregate", False, "getStringRecord", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.FormulaRecordAggregate._stringRecord]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "FormulaRecordAggregate", False, "getStringValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.FormulaRecordAggregate._stringRecord].SyntheticField[org.apache.poi.hssf.record.StringRecord._text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "FormulaRecordAggregate", False, "setCachedStringResult", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.FormulaRecordAggregate._stringRecord].SyntheticField[org.apache.poi.hssf.record.StringRecord._text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "MergedCellsTable", False, "addRecords", "(MergeCellsRecord[])", "", "Argument[0].ArrayElement", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "MergedCellsTable", False, "get", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "MergedCellsTable", False, "read", "(RecordStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "PageSettingsBlock", "(RecordStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "addLateHeaderFooter", "(HeaderFooterRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "addLateRecords", "(RecordStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "getFooter", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.PageSettingsBlock._footer]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "getHCenter", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "getHeader", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.PageSettingsBlock._header]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "getPrintSetup", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.PageSettingsBlock._printSetup]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "getVCenter", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "setFooter", "(FooterRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.PageSettingsBlock._footer]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "setHeader", "(HeaderRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.PageSettingsBlock._header]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "PageSettingsBlock", False, "setPrintSetup", "(PrintSetupRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.PageSettingsBlock._printSetup]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RecordAggregate$PositionTrackingVisitor", False, "PositionTrackingVisitor", "(RecordAggregate$RecordVisitor,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RecordAggregate$RecordVisitor", True, "visitRecord", "(Record)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RecordAggregate", True, "visitContainedRecords", "(RecordAggregate$RecordVisitor)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RowRecordsAggregate", False, "RowRecordsAggregate", "(RecordStream,SharedValueManager)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.model.RecordStream._list].Element", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.RowRecordsAggregate._rowRecords].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RowRecordsAggregate", False, "createFormula", "(int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RowRecordsAggregate", False, "getCellValueIterator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RowRecordsAggregate", False, "getCellValueSpliterator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RowRecordsAggregate", False, "getIterator", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.RowRecordsAggregate._rowRecords].MapValue", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RowRecordsAggregate", False, "getRow", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.RowRecordsAggregate._rowRecords].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RowRecordsAggregate", False, "getSpliterator", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.RowRecordsAggregate._rowRecords].MapValue", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "RowRecordsAggregate", False, "insertRow", "(RowRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.RowRecordsAggregate._rowRecords].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "SharedValueManager", False, "addArrayRecord", "(ArrayRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.SharedValueManager._arrayRecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "SharedValueManager", False, "create", "(SharedFormulaRecord[],CellReference[],ArrayRecord[],TableRecord[])", "", "Argument[3]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.aggregates.SharedValueManager._tableRecords]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "SharedValueManager", False, "getArrayRecord", "(int,int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.SharedValueManager._arrayRecords].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "SharedValueManager", False, "getRecordForFirstCell", "(FormulaRecordAggregate)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.SharedValueManager._arrayRecords].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "SharedValueManager", False, "getRecordForFirstCell", "(FormulaRecordAggregate)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.aggregates.SharedValueManager._tableRecords].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.aggregates", "SharedValueManager", False, "linkSharedFormulaRecord", "(CellReference,FormulaRecordAggregate)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "SharedValueManager", False, "removeArrayFormula", "(int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "WorksheetProtectionBlock", False, "addRecords", "(RecordStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "WorksheetProtectionBlock", False, "getPasswordRecord", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.aggregates", "WorksheetProtectionBlock", False, "getHCenter", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.cf.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.cf.model.yml new file mode 100644 index 000000000000..0d33353aee77 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.cf.model.yml @@ -0,0 +1,34 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.record.cf", "ColorGradientFormatting", False, "getColors", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.ColorGradientFormatting.colors]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "ColorGradientFormatting", False, "getThresholds", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.ColorGradientFormatting.thresholds]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "ColorGradientFormatting", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "ColorGradientFormatting", False, "setColors", "(ExtendedColor[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.ColorGradientFormatting.colors]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "ColorGradientFormatting", False, "setThresholds", "(ColorGradientThreshold[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.ColorGradientFormatting.thresholds]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "ColorGradientThreshold", False, "ColorGradientThreshold", "(ColorGradientThreshold)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "ColorGradientThreshold", False, "ColorGradientThreshold", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarFormatting", False, "DataBarFormatting", "(DataBarFormatting)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarFormatting", False, "DataBarFormatting", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarFormatting", False, "getColor", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.DataBarFormatting.color]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarFormatting", False, "getThresholdMax", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.DataBarFormatting.thresholdMax]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarFormatting", False, "getThresholdMin", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.DataBarFormatting.thresholdMin]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarFormatting", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarFormatting", False, "setColor", "(ExtendedColor)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.DataBarFormatting.color]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarFormatting", False, "setThresholdMax", "(DataBarThreshold)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.DataBarFormatting.thresholdMax]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarFormatting", False, "setThresholdMin", "(DataBarThreshold)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.DataBarFormatting.thresholdMin]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarThreshold", False, "DataBarThreshold", "(DataBarThreshold)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "DataBarThreshold", False, "DataBarThreshold", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "FontFormatting", False, "FontFormatting", "(FontFormatting)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "FontFormatting", False, "FontFormatting", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "FontFormatting", False, "getRawRecord", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "IconMultiStateFormatting", False, "getThresholds", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.IconMultiStateFormatting.thresholds]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "IconMultiStateFormatting", False, "setThresholds", "(Threshold[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.cf.IconMultiStateFormatting.thresholds]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.cf", "IconMultiStateThreshold", False, "IconMultiStateThreshold", "(IconMultiStateThreshold)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "IconMultiStateThreshold", False, "IconMultiStateThreshold", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "Threshold", True, "getParsedExpression", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cf", "Threshold", True, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.chart.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.chart.model.yml new file mode 100644 index 000000000000..093014fbc025 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.chart.model.yml @@ -0,0 +1,24 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.record.chart", "ChartEndBlockRecord", False, "ChartEndBlockRecord", "(ChartEndBlockRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "ChartEndBlockRecord", False, "ChartEndBlockRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "ChartEndBlockRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "ChartEndObjectRecord", False, "ChartEndObjectRecord", "(ChartEndObjectRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "ChartEndObjectRecord", False, "ChartEndObjectRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "ChartEndObjectRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "DataLabelExtensionRecord", False, "DataLabelExtensionRecord", "(DataLabelExtensionRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "DataLabelExtensionRecord", False, "DataLabelExtensionRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "LinkedDataRecord", False, "LinkedDataRecord", "(LinkedDataRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "LinkedDataRecord", False, "LinkedDataRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "LinkedDataRecord", False, "getFormulaOfLink", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "LinkedDataRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.chart", "SeriesTextRecord", False, "SeriesTextRecord", "(SeriesTextRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.chart", "SeriesTextRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.chart", "SeriesTextRecord", False, "getText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.chart", "SeriesTextRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record.chart", "SeriesTextRecord", False, "setText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.common.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.common.model.yml new file mode 100644 index 000000000000..ed13a2b0b1f9 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.common.model.yml @@ -0,0 +1,40 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.record.common", "ExtRst", True, "copy", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "ExtRst", True, "getPhRuns", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "ExtRst", True, "getPhoneticText", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "ExtendedColor", False, "ExtendedColor", "(ExtendedColor)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "ExtendedColor", False, "ExtendedColor", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "ExtendedColor", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "ExtendedColor", False, "getRGBA", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "ExtendedColor", False, "serialize", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "ExtendedColor", False, "setRGBA", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "FeatProtection", False, "FeatProtection", "(FeatProtection)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.common.FeatProtection.title]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.FeatProtection.title]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "FeatProtection", False, "FeatProtection", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "FeatProtection", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.FeatProtection.title]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.common.FeatProtection.title]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "FeatProtection", False, "getTitle", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.FeatProtection.title]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "FeatProtection", False, "setTitle", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.FeatProtection.title]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "FeatSmartTag", False, "FeatSmartTag", "(FeatSmartTag)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "FeatSmartTag", False, "FeatSmartTag", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "FtrHeader", False, "getAssociatedRange", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.FtrHeader.associatedRange]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "FtrHeader", False, "setAssociatedRange", "(CellRangeAddress)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.FtrHeader.associatedRange]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "FutureRecord", True, "getAssociatedRange", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "FutureRecord", True, "getFutureHeader", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "SharedFeature", True, "copy", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "SharedFeature", True, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "UnicodeString", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "addFormatRun", "(FormatRun)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_4_format_runs].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "formatIterator", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_4_format_runs].Element", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "formatSpliterator", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_4_format_runs].Element", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "getDebugInfo", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "getDebugInfo", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_4_format_runs].Element", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "getExtendedRst", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "getFormatRun", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_4_format_runs].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "getString", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record.common", "UnicodeString", True, "setString", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.cont.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.cont.model.yml new file mode 100644 index 000000000000..d0c9ec7fd228 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.cont.model.yml @@ -0,0 +1,9 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.record.cont", "ContinuableRecordInput", True, "ContinuableRecordInput", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.cont", "ContinuableRecordOutput", False, "ContinuableRecordOutput", "(LittleEndianOutput,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.model.yml new file mode 100644 index 000000000000..86c2d3d0eac8 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.model.yml @@ -0,0 +1,312 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.record", "AbstractEscherHolderRecord", True, "addEscherRecord", "(EscherRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.AbstractEscherHolderRecord.escherRecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "AbstractEscherHolderRecord", True, "addEscherRecord", "(int,EscherRecord)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.AbstractEscherHolderRecord.escherRecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "AbstractEscherHolderRecord", True, "findFirstWithId", "(short)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.AbstractEscherHolderRecord.escherRecords].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "AbstractEscherHolderRecord", True, "getEscherContainer", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.AbstractEscherHolderRecord.escherRecords].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "AbstractEscherHolderRecord", True, "getEscherRecord", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.AbstractEscherHolderRecord.escherRecords].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "AbstractEscherHolderRecord", True, "getEscherRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.AbstractEscherHolderRecord.escherRecords]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "AbstractEscherHolderRecord", True, "getGenericChildren", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.AbstractEscherHolderRecord.escherRecords]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "AbstractEscherHolderRecord", True, "getRawData", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ArrayRecord", False, "ArrayRecord", "(ArrayRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ArrayRecord", False, "ArrayRecord", "(Formula,CellRangeAddress8Bit)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ArrayRecord", False, "ArrayRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ArrayRecord", False, "getFormulaTokens", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ArrayRecord", False, "ArrayRecord", "(Formula,CellRangeAddress8Bit)", "", "Argument[1]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.hssf.record", "BoundSheetRecord", False, "BoundSheetRecord", "(BoundSheetRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.BoundSheetRecord.field_5_sheetname]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.BoundSheetRecord.field_5_sheetname]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "BoundSheetRecord", False, "BoundSheetRecord", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.BoundSheetRecord.field_5_sheetname]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "BoundSheetRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.BoundSheetRecord.field_5_sheetname]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.BoundSheetRecord.field_5_sheetname]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "BoundSheetRecord", False, "getSheetname", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.BoundSheetRecord.field_5_sheetname]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "BoundSheetRecord", False, "orderByBofPosition", "(List)", "", "Argument[0].Element", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "BoundSheetRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.BoundSheetRecord.field_5_sheetname]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "BoundSheetRecord", False, "setSheetname", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.BoundSheetRecord.field_5_sheetname]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "CFHeaderBase", True, "getCellRanges", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFHeaderBase", True, "getEnclosingCellRange", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.CFHeaderBase.field_3_enclosing_cell_range]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "CFHeaderBase", True, "setEnclosingCellRange", "(CellRangeAddress)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.CFHeaderBase.field_3_enclosing_cell_range]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "CFRule12Record", "(CFRule12Record)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "CFRule12Record", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "getColorGradientFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "getDataBarFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "getMultiStateFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "getParsedExpressionScale", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "createColorGradientFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "createDataBarFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.hssf.record", "CFRule12Record", False, "createMultiStateFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.hssf.record", "CFRuleBase", True, "getBorderFormatting", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.CFRuleBase._borderFormatting]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "CFRuleBase", True, "getFontFormatting", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.CFRuleBase._fontFormatting]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "CFRuleBase", True, "getParsedExpression1", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRuleBase", True, "getParsedExpression2", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRuleBase", True, "getPatternFormatting", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.CFRuleBase._patternFormatting]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "CFRuleBase", True, "setBorderFormatting", "(BorderFormatting)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.CFRuleBase._borderFormatting]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "CFRuleBase", True, "setFontFormatting", "(FontFormatting)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.CFRuleBase._fontFormatting]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "CFRuleBase", True, "setPatternFormatting", "(PatternFormatting)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.CFRuleBase._patternFormatting]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "CFRuleRecord", False, "CFRuleRecord", "(CFRuleRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRuleRecord", False, "CFRuleRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CFRuleRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CRNRecord", False, "CRNRecord", "(CRNRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CRNRecord", False, "CRNRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CRNRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "CellRecord", True, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ContinueRecord", False, "ContinueRecord", "(ContinueRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.ContinueRecord._data]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ContinueRecord._data]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ContinueRecord", False, "ContinueRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ContinueRecord", False, "ContinueRecord", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ContinueRecord._data]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ContinueRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ContinueRecord._data]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.ContinueRecord._data]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ContinueRecord", False, "getData", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ContinueRecord._data]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ContinueRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DConRefRecord", True, "DConRefRecord", "(DConRefRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DConRefRecord", True, "DConRefRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DConRefRecord", True, "getPath", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DConRefRecord", True, "getReadablePath", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "DVRecord", "(DVRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "DVRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "DVRecord", "(int,int,int,boolean,boolean,boolean,boolean,String,String,boolean,String,String,Ptg[],Ptg[],CellRangeAddressList)", "", "Argument[10]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._errorTitle].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "DVRecord", "(int,int,int,boolean,boolean,boolean,boolean,String,String,boolean,String,String,Ptg[],Ptg[],CellRangeAddressList)", "", "Argument[11]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._errorText].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "DVRecord", "(int,int,int,boolean,boolean,boolean,boolean,String,String,boolean,String,String,Ptg[],Ptg[],CellRangeAddressList)", "", "Argument[14]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._regions]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "DVRecord", "(int,int,int,boolean,boolean,boolean,boolean,String,String,boolean,String,String,Ptg[],Ptg[],CellRangeAddressList)", "", "Argument[7]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._promptTitle].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "DVRecord", "(int,int,int,boolean,boolean,boolean,boolean,String,String,boolean,String,String,Ptg[],Ptg[],CellRangeAddressList)", "", "Argument[8]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._promptText].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "getCellRangeAddress", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._regions]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "getErrorText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._errorText].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "getErrorTitle", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._errorTitle].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "getFormula1", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "getFormula2", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "getPromptText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._promptText].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "getPromptTitle", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DVRecord._promptTitle].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DVRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DrawingRecord", False, "DrawingRecord", "(DrawingRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.DrawingRecord.recordData]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DrawingRecord.recordData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DrawingRecord", False, "DrawingRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DrawingRecord", False, "DrawingRecord", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DrawingRecord.recordData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DrawingRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DrawingRecord.recordData]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.DrawingRecord.recordData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DrawingRecord", False, "getRecordData", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DrawingRecord.recordData]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "DrawingRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "DrawingRecord", False, "setData", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.DrawingRecord.recordData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EmbeddedObjectRefSubRecord", False, "EmbeddedObjectRefSubRecord", "(EmbeddedObjectRefSubRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "EmbeddedObjectRefSubRecord", False, "EmbeddedObjectRefSubRecord", "(LittleEndianInput,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "EmbeddedObjectRefSubRecord", False, "getOLEClassName", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EmbeddedObjectRefSubRecord.field_4_ole_classname]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EmbeddedObjectRefSubRecord", False, "getObjectData", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "EmbeddedObjectRefSubRecord", False, "setOleClassname", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EmbeddedObjectRefSubRecord.field_4_ole_classname]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EmbeddedObjectRefSubRecord", False, "setUnknownFormulaData", "(byte[])", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "EscherAggregate", "(EscherAggregate)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "addTailRecord", "(NoteRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EscherAggregate.tailRec].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "associateShapeToObjRecord", "(EscherRecord,Record)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EscherAggregate.shapeToObj].MapKey", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "associateShapeToObjRecord", "(EscherRecord,Record)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EscherAggregate.shapeToObj].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "createAggregate", "(List,int)", "", "Argument[0].Element", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.EscherAggregate.shapeToObj].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "createAggregate", "(List,int)", "", "Argument[0].Element", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.EscherAggregate.tailRec].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "getNoteRecordByObj", "(ObjRecord)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EscherAggregate.tailRec].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "getShapeToObjMapping", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EscherAggregate.shapeToObj].MapKey", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "getShapeToObjMapping", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EscherAggregate.shapeToObj].MapValue", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "getTailRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EscherAggregate.tailRec].MapKey", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "EscherAggregate", False, "getTailRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.EscherAggregate.tailRec].MapValue", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ExternSheetRecord", True, "addREFRecord", "(ExternSheetRecord$RefSubRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ExternSheetRecord", True, "combine", "(ExternSheetRecord[])", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ExternalNameRecord", False, "ExternalNameRecord", "(ExternalNameRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.ExternalNameRecord.field_4_name]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ExternalNameRecord.field_4_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ExternalNameRecord", False, "ExternalNameRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ExternalNameRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ExternalNameRecord.field_4_name]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.ExternalNameRecord.field_4_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ExternalNameRecord", False, "getParsedExpression", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ExternalNameRecord", False, "getText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ExternalNameRecord.field_4_name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ExternalNameRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ExternalNameRecord", False, "setText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ExternalNameRecord.field_4_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FeatHdrRecord", False, "FeatHdrRecord", "(FeatHdrRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FeatHdrRecord", False, "FeatHdrRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FeatHdrRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FeatRecord", False, "FeatRecord", "(FeatRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FeatRecord", False, "FeatRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FeatRecord", False, "getCellRefs", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FeatRecord.cellRefs]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FeatRecord", False, "getSharedFeature", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FeatRecord.sharedFeature]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FeatRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FeatRecord", False, "setCellRefs", "(CellRangeAddress[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FeatRecord.cellRefs]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FeatRecord", False, "setSharedFeature", "(SharedFeature)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FeatRecord.sharedFeature]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FilePassRecord", False, "getEncryptionInfo", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FileSharingRecord", False, "FileSharingRecord", "(FileSharingRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.FileSharingRecord.field_3_username_value]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FileSharingRecord.field_3_username_value]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FileSharingRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FileSharingRecord.field_3_username_value]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.FileSharingRecord.field_3_username_value]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FileSharingRecord", False, "getUsername", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FileSharingRecord.field_3_username_value]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FileSharingRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FileSharingRecord.field_3_username_value]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FileSharingRecord", False, "setUsername", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FileSharingRecord.field_3_username_value]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FontRecord", False, "FontRecord", "(FontRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FontRecord", False, "cloneStyleFrom", "(FontRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FontRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FontRecord", False, "getFontName", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FontRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FontRecord", False, "setFontName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FooterRecord", False, "FooterRecord", "(FooterRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FooterRecord", False, "FooterRecord", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FormatRecord", False, "FormatRecord", "(int,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FormatRecord.field_4_formatstring]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FormatRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FormatRecord.field_4_formatstring]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.FormatRecord.field_4_formatstring]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FormatRecord", False, "getFormatString", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FormatRecord.field_4_formatstring]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FormatRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.FormatRecord.field_4_formatstring]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "FormulaRecord", False, "FormulaRecord", "(FormulaRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FormulaRecord", False, "FormulaRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FormulaRecord", False, "getFormula", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FormulaRecord", False, "getParsedExpression", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FormulaSpecialCachedValue", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FtCblsSubRecord", False, "FtCblsSubRecord", "(FtCblsSubRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "FtCblsSubRecord", False, "FtCblsSubRecord", "(LittleEndianInput,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "GroupMarkerSubRecord", False, "GroupMarkerSubRecord", "(GroupMarkerSubRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "GroupMarkerSubRecord", False, "GroupMarkerSubRecord", "(LittleEndianInput,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HeaderFooterBase", True, "getText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HeaderFooterBase.field_3_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HeaderFooterBase", True, "serialize", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HeaderFooterBase.field_3_text]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HeaderFooterBase", True, "setText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HeaderFooterBase.field_3_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HeaderFooterRecord", False, "HeaderFooterRecord", "(HeaderFooterRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.HeaderFooterRecord._rawData]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HeaderFooterRecord._rawData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HeaderFooterRecord", False, "HeaderFooterRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HeaderFooterRecord", False, "HeaderFooterRecord", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HeaderFooterRecord._rawData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HeaderFooterRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HeaderFooterRecord._rawData]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.HeaderFooterRecord._rawData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HeaderFooterRecord", False, "getGuid", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HeaderFooterRecord._rawData].ArrayElement", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HeaderFooterRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HeaderRecord", False, "HeaderRecord", "(HeaderRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HeaderRecord", False, "HeaderRecord", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HorizontalPageBreakRecord", False, "HorizontalPageBreakRecord", "(HorizontalPageBreakRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "HyperlinkRecord", "(HyperlinkRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "HyperlinkRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "getAddress", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._address]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "getAddress", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._shortFilename]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "getAddress", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._textMark]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "getLabel", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._label]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "getShortFilename", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._shortFilename]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "getTargetFrame", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "getTextMark", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._textMark]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "setAddress", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._address]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "setAddress", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._shortFilename]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "setAddress", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._textMark]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "setLabel", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._label]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "setShortFilename", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._shortFilename]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "HyperlinkRecord", False, "setTextMark", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._textMark]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "LabelRecord", False, "LabelRecord", "(LabelRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "LabelRecord", False, "getValue", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "LbsDataSubRecord$LbsDropData", True, "LbsDropData", "(LbsDataSubRecord$LbsDropData)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "LbsDataSubRecord$LbsDropData", True, "LbsDropData", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "LbsDataSubRecord$LbsDropData", True, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "LbsDataSubRecord", True, "LbsDataSubRecord", "(LbsDataSubRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "LbsDataSubRecord", True, "LbsDataSubRecord", "(LittleEndianInput,int,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "LbsDataSubRecord", True, "getFormula", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "MergeCellsRecord", False, "MergeCellsRecord", "(CellRangeAddress[],int,int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.MergeCellsRecord._regions]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "MergeCellsRecord", False, "getAreaAt", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.MergeCellsRecord._regions].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "NameCommentRecord", "(NameCommentRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_6_name_text]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_6_name_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "NameCommentRecord", "(NameCommentRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_7_comment_text]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_7_comment_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "NameCommentRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "NameCommentRecord", "(String,String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_6_name_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "NameCommentRecord", "(String,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_7_comment_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_6_name_text]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_6_name_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_7_comment_text]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_7_comment_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "getCommentText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_7_comment_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "getNameText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_6_name_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "setCommentText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_7_comment_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameCommentRecord", False, "setNameText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_6_name_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "NameRecord", "(NameRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "NameRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "getCustomMenuText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_14_custom_menu_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "getDescriptionText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_15_description_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "getHelpTopicText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_16_help_topic_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "getNameDefinition", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "getNameText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_12_name_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "getStatusBarText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_17_status_bar_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "setCustomMenuText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_14_custom_menu_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "setDescriptionText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_15_description_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "setHelpTopicText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_16_help_topic_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "setNameText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_12_name_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NameRecord", False, "setStatusBarText", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_17_status_bar_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NoteRecord", False, "NoteRecord", "(NoteRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.NoteRecord.field_6_author]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NoteRecord.field_6_author]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NoteRecord", False, "NoteRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "NoteRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NoteRecord.field_6_author]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.NoteRecord.field_6_author]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NoteRecord", False, "getAuthor", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NoteRecord.field_6_author]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NoteRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NoteRecord.field_6_author]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NoteRecord", False, "setAuthor", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.NoteRecord.field_6_author]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "NoteStructureSubRecord", False, "NoteStructureSubRecord", "(LittleEndianInput,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "NoteStructureSubRecord", False, "NoteStructureSubRecord", "(LittleEndianInput,int,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "NoteStructureSubRecord", False, "NoteStructureSubRecord", "(NoteStructureSubRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ObjRecord", False, "ObjRecord", "(ObjRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ObjRecord", False, "ObjRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "ObjRecord", False, "addSubRecord", "(SubRecord)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ObjRecord.subrecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ObjRecord", False, "addSubRecord", "(int,SubRecord)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ObjRecord.subrecords].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ObjRecord", False, "getGenericChildren", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ObjRecord.subrecords]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "ObjRecord", False, "getSubRecords", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.ObjRecord.subrecords]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "OldFormulaRecord", False, "OldFormulaRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldFormulaRecord", False, "getFormula", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldFormulaRecord", False, "getParsedExpression", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldLabelRecord", False, "OldLabelRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldLabelRecord", False, "getValue", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldLabelRecord", False, "setCodePage", "(CodepageRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldSheetRecord", False, "OldSheetRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldSheetRecord", False, "getSheetname", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldSheetRecord", False, "setCodePage", "(CodepageRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldStringRecord", False, "OldStringRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldStringRecord", False, "getString", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "OldStringRecord", False, "setCodePage", "(CodepageRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "PageBreakRecord", True, "getBreak", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "PageBreakRecord", True, "getBreaksIterator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "PageBreakRecord", True, "getBreaksSpliterator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "Record", True, "serialize", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordBase", True, "serialize", "(int,byte[])", "", "Argument[this]", "Argument[1]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordFactory", False, "createRecord", "(RecordInputStream)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordFactory", False, "createSingleRecord", "(RecordInputStream)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordFactoryInputStream", False, "RecordFactoryInputStream", "(InputStream,boolean)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordFactoryInputStream", False, "RecordFactoryInputStream", "(InputStream,boolean,char[])", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordFactoryInputStream", False, "nextRecord", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordInputStream", False, "RecordInputStream", "(InputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordInputStream", False, "RecordInputStream", "(InputStream,EncryptionInfo,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordInputStream", False, "read", "(byte[],int,int)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordInputStream", False, "readAllContinuedRemainder", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "RecordInputStream", False, "readRemainder", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "SSTRecord", False, "getString", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "SharedFormulaRecord", False, "SharedFormulaRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "SharedFormulaRecord", False, "SharedFormulaRecord", "(SharedFormulaRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "SharedFormulaRecord", False, "getFormulaTokens", "(FormulaRecord)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "SharedValueRecordBase", True, "getRange", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "SharedValueRecordBase", True, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "StringRecord", False, "StringRecord", "(StringRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.StringRecord._text]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.StringRecord._text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "StringRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.StringRecord._text]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.StringRecord._text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "StringRecord", False, "getString", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.StringRecord._text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "StringRecord", False, "setString", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.StringRecord._text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "StyleRecord", False, "StyleRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "StyleRecord", False, "StyleRecord", "(StyleRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.StyleRecord.field_4_name]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.StyleRecord.field_4_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "StyleRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.StyleRecord.field_4_name]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.StyleRecord.field_4_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "StyleRecord", False, "getName", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.StyleRecord.field_4_name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "StyleRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.StyleRecord.field_4_name]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "StyleRecord", False, "setName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.StyleRecord.field_4_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SubRecord", True, "createSubRecord", "(LittleEndianInput,int)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "SubRecord", True, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "SupBookRecord", "(String,String[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_2_encoded_url]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "SupBookRecord", "(String,String[])", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_3_sheet_names]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "SupBookRecord", "(SupBookRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_2_encoded_url]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_2_encoded_url]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "SupBookRecord", "(SupBookRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_3_sheet_names]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_3_sheet_names]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_2_encoded_url]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_2_encoded_url]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_3_sheet_names]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_3_sheet_names]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "createExternalReferences", "(String,String[])", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_2_encoded_url]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "createExternalReferences", "(String,String[])", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_3_sheet_names]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "getSheetNames", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_3_sheet_names]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "getURL", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_2_encoded_url]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "SupBookRecord", False, "setURL", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.SupBookRecord.field_2_encoded_url]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.record", "TableRecord", False, "TableRecord", "(CellRangeAddress8Bit)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "TableStylesRecord", False, "TableStylesRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "TableStylesRecord", False, "TableStylesRecord", "(TableStylesRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "TextObjectRecord", False, "TextObjectRecord", "(TextObjectRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "TextObjectRecord", False, "getLinkRefPtg", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "TextObjectRecord", False, "getStr", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.TextObjectRecord._text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "TextObjectRecord", False, "setStr", "(HSSFRichTextString)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.TextObjectRecord._text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "UnknownRecord", False, "UnknownRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "UnknownRecord", False, "UnknownRecord", "(int,byte[])", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "UnknownRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "UserSViewBegin", False, "UserSViewBegin", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "UserSViewBegin", False, "UserSViewBegin", "(UserSViewBegin)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.UserSViewBegin._rawData]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.UserSViewBegin._rawData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "UserSViewBegin", False, "UserSViewBegin", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.UserSViewBegin._rawData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "UserSViewBegin", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.UserSViewBegin._rawData]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.UserSViewBegin._rawData]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "UserSViewBegin", False, "getGuid", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.UserSViewBegin._rawData].ArrayElement", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "UserSViewBegin", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "UserSViewEnd", False, "UserSViewEnd", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "UserSViewEnd", False, "UserSViewEnd", "(UserSViewEnd)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "UserSViewEnd", False, "UserSViewEnd", "(byte[])", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "UserSViewEnd", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "VerticalPageBreakRecord", False, "VerticalPageBreakRecord", "(VerticalPageBreakRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "WriteAccessRecord", False, "WriteAccessRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "WriteAccessRecord", False, "WriteAccessRecord", "(WriteAccessRecord)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.record.WriteAccessRecord.field_1_username]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.WriteAccessRecord.field_1_username]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "WriteAccessRecord", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.WriteAccessRecord.field_1_username]", "ReturnValue.SyntheticField[org.apache.poi.hssf.record.WriteAccessRecord.field_1_username]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "WriteAccessRecord", False, "getUsername", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.record.WriteAccessRecord.field_1_username]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.record", "WriteAccessRecord", False, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record", "WriteAccessRecord", False, "setUsername", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.record.WriteAccessRecord.field_1_username]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.pivottable.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.pivottable.model.yml new file mode 100644 index 000000000000..1be19872078c --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.record.pivottable.model.yml @@ -0,0 +1,12 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.record.pivottable", "DataItemRecord", False, "DataItemRecord", "(DataItemRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.pivottable", "ExtendedPivotTableViewFieldsRecord", False, "ExtendedPivotTableViewFieldsRecord", "(ExtendedPivotTableViewFieldsRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.pivottable", "ViewDefinitionRecord", False, "ViewDefinitionRecord", "(RecordInputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.pivottable", "ViewDefinitionRecord", False, "ViewDefinitionRecord", "(ViewDefinitionRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.record.pivottable", "ViewFieldsRecord", False, "ViewFieldsRecord", "(ViewFieldsRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.usermodel.helpers.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.usermodel.helpers.model.yml new file mode 100644 index 000000000000..01f7ae1516a4 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.usermodel.helpers.model.yml @@ -0,0 +1,9 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.usermodel.helpers", "HSSFColumnShifter", False, "HSSFColumnShifter", "(HSSFSheet)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.hssf.usermodel.helpers", "HSSFRowShifter", False, "HSSFRowShifter", "(HSSFSheet)", "", "Argument[0]", "Argument[this]", "taint", "manual"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.usermodel.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.usermodel.model.yml new file mode 100644 index 000000000000..705c0d9c43fb --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.usermodel.model.yml @@ -0,0 +1,268 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", True, "write", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "createCustomFormulaConstraint", "(String)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "createDateConstraint", "(int,String,String,String)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "createDateConstraint", "(int,String,String,String)", "", "Argument[2]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "createExplicitListConstraint", "(String[])", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._explicitListValues]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "createFormulaListConstraint", "(String)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "createNumericConstraint", "(int,int,String,String)", "", "Argument[2]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "createNumericConstraint", "(int,int,String,String)", "", "Argument[3]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "createTimeConstraint", "(int,String,String)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "createTimeConstraint", "(int,String,String)", "", "Argument[2]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "getExplicitListValues", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._explicitListValues]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "getFormula1", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "getFormula2", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "setExplicitListValues", "(String[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._explicitListValues]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "setFormula1", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "DVConstraint", True, "setFormula2", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics", True, "EscherGraphics", "(HSSFShapeGroup,HSSFWorkbook,Color,float)", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.foreground]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics", True, "create", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics", True, "getBackground", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.background]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics", True, "getColor", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.foreground]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics", True, "getFont", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.font]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics", True, "setBackground", "(Color)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.background]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics", True, "setColor", "(Color)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.foreground]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics", True, "setFont", "(Font)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.font]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "EscherGraphics2d", "(EscherGraphics)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "create", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "drawString", "(AttributedCharacterIterator,float,float)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._paint]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._escherGraphics].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.foreground]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "getBackground", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._escherGraphics].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.background]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "getColor", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._escherGraphics].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.foreground]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "getFont", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._escherGraphics].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.font]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "getPaint", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._paint]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "getStroke", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._stroke]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "getTransform", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._trans]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "setBackground", "(Color)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._escherGraphics].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.background]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "setColor", "(Color)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._escherGraphics].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.foreground]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "setFont", "(Font)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._escherGraphics].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.font]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "setPaint", "(Paint)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._escherGraphics].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics.foreground]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "setPaint", "(Paint)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._paint]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "setStroke", "(Stroke)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._stroke]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", False, "setTransform", "(AffineTransform)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.EscherGraphics2d._trans]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "FontDetails", True, "FontDetails", "(String,int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.FontDetails._fontName]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "FontDetails", True, "create", "(String,Properties)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.FontDetails._fontName]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "FontDetails", True, "getFontName", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.FontDetails._fontName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFAnchor", True, "createAnchorFromEscher", "(EscherContainerRecord)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCell", True, "getCellComment", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFCell._comment]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCell", True, "getSheet", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFCell._sheet]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCell", True, "setCellComment", "(Comment)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFCell._comment]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCellStyle", False, "getFont", "(Workbook)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.hssf.usermodel", "HSSFCellStyle", False, "getParentStyle", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart", False, "getChartTitle", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFChart.chartTitleText].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart", False, "getSeries", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart", False, "getSheetCharts", "(HSSFSheet)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart", False, "setChartTitle", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFChart.chartTitleText].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart$HSSFSeries", True, "getDataCategoryLabels", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart$HSSFSeries", True, "getDataName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart$HSSFSeries", True, "getDataSecondaryCategoryLabels", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart$HSSFSeries", True, "getDataValues", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart$HSSFSeries", True, "getSeries", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart$HSSFSeries", True, "getSeriesTitle", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFChart$HSSFSeries.seriesTitleText].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChart$HSSFSeries", True, "setSeriesTitle", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFChart$HSSFSeries.seriesTitleText].SyntheticField[org.apache.poi.hssf.record.chart.SeriesTextRecord.field_4_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFChildAnchor", False, "HSSFChildAnchor", "(EscherChildAnchorRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFClientAnchor", False, "HSSFClientAnchor", "(EscherClientAnchorRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCombobox", True, "HSSFCombobox", "(EscherContainerRecord,ObjRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCombobox", True, "HSSFCombobox", "(EscherContainerRecord,ObjRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCombobox", True, "HSSFCombobox", "(HSSFShape,HSSFAnchor)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCombobox", True, "HSSFCombobox", "(HSSFShape,HSSFAnchor)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFComment", True, "HSSFComment", "(EscherContainerRecord,ObjRecord,TextObjectRecord,NoteRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFComment", True, "HSSFComment", "(EscherContainerRecord,ObjRecord,TextObjectRecord,NoteRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFComment", True, "HSSFComment", "(EscherContainerRecord,ObjRecord,TextObjectRecord,NoteRecord)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFComment", True, "HSSFComment", "(EscherContainerRecord,ObjRecord,TextObjectRecord,NoteRecord)", "", "Argument[3]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFComment", True, "HSSFComment", "(HSSFShape,HSSFAnchor)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFComment", True, "getAuthor", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFComment._note].SyntheticField[org.apache.poi.hssf.record.NoteRecord.field_6_author]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFComment", True, "getClientAnchor", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFComment", True, "setAuthor", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFComment._note].SyntheticField[org.apache.poi.hssf.record.NoteRecord.field_6_author]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFConditionalFormattingRule", False, "createColorScaleFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFConditionalFormattingRule", False, "createDataBarFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFConditionalFormattingRule", False, "createMultiStateFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCreationHelper", True, "createAreaReference", "(CellReference,CellReference)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.ss.util.AreaReference._firstCell]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCreationHelper", True, "createAreaReference", "(CellReference,CellReference)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.ss.util.AreaReference._lastCell]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFCreationHelper", True, "createRichTextString", "(String)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFRichTextString._string].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataBarFormatting", False, "createThreshold", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataFormat", False, "getFormat", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataFormat._formats].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataFormat", False, "getFormat", "(short)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataFormat._formats].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataFormatter", False, "HSSFDataFormatter", "(Locale)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "HSSFDataValidation", "(CellRangeAddressList,DataValidationConstraint)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._regions]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "HSSFDataValidation", "(CellRangeAddressList,DataValidationConstraint)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._constraint]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "createDVRecord", "(HSSFSheet)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "createErrorBox", "(String,String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._error_title]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "createErrorBox", "(String,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._error_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "createPromptBox", "(String,String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._prompt_title]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "createPromptBox", "(String,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._prompt_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "getConstraint", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._constraint]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "getErrorBoxText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._error_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "getErrorBoxTitle", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._error_title]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "getPromptBoxText", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._prompt_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "getPromptBoxTitle", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._prompt_title]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "getRegions", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._regions]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidation", False, "getValidationConstraint", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._constraint]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createCustomConstraint", "(String)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createDateConstraint", "(int,String,String,String)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createDateConstraint", "(int,String,String,String)", "", "Argument[2]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createDecimalConstraint", "(int,String,String)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createDecimalConstraint", "(int,String,String)", "", "Argument[2]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createExplicitListConstraint", "(String[])", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._explicitListValues]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createFormulaListConstraint", "(String)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createIntegerConstraint", "(int,String,String)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createIntegerConstraint", "(int,String,String)", "", "Argument[2]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createNumericConstraint", "(int,int,String,String)", "", "Argument[2]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createNumericConstraint", "(int,int,String,String)", "", "Argument[3]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createTextLengthConstraint", "(int,String,String)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createTextLengthConstraint", "(int,String,String)", "", "Argument[2]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createTimeConstraint", "(int,String,String)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula1]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createTimeConstraint", "(int,String,String)", "", "Argument[2]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.DVConstraint._formula2]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createValidation", "(DataValidationConstraint,CellRangeAddressList)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._constraint]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFDataValidationHelper", True, "createValidation", "(DataValidationConstraint,CellRangeAddressList)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFDataValidation._regions]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFExtendedColor", True, "HSSFExtendedColor", "(ExtendedColor)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFExtendedColor", True, "getARGB", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFExtendedColor.color].SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFExtendedColor", True, "getRGB", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFExtendedColor.color].SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFExtendedColor", True, "setRGB", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFExtendedColor.color].SyntheticField[org.apache.poi.hssf.record.common.ExtendedColor.rgba]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFFont", False, "getFontName", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFFont.font].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFFont", False, "setFontName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFFont.font].SyntheticField[org.apache.poi.hssf.record.FontRecord.field_11_font_name]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFEvaluationWorkbook", False, "create", "(HSSFWorkbook)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.hssf.usermodel", "HSSFFormulaEvaluator", True, "HSSFFormulaEvaluator", "(HSSFWorkbook)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.hssf.usermodel", "HSSFFormulaEvaluator", True, "HSSFFormulaEvaluator", "(HSSFWorkbook,IStabilityClassifier)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.hssf.usermodel", "HSSFFormulaEvaluator", True, "HSSFFormulaEvaluator", "(HSSFWorkbook,IStabilityClassifier)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFFormulaEvaluator", True, "create", "(HSSFWorkbook,IStabilityClassifier,UDFFinder)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.hssf.usermodel", "HSSFFormulaEvaluator", True, "create", "(HSSFWorkbook,IStabilityClassifier,UDFFinder)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "getAddress", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._address]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "getAddress", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._shortFilename]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "getAddress", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._textMark]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "getLabel", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._label]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "getShortFilename", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._shortFilename]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "getTextMark", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._textMark]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "setAddress", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._address]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "setAddress", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._shortFilename]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "setAddress", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._textMark]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "setLabel", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._label]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "setShortFilename", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._shortFilename]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFHyperlink", True, "setTextMark", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFHyperlink.record].SyntheticField[org.apache.poi.hssf.record.HyperlinkRecord._textMark]", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFName", False, "getComment", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFName._commentRec].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_7_comment_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFName", False, "getComment", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFName._definedNameRec].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_15_description_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFName", False, "getNameName", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFName._definedNameRec].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_12_name_text]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFName", False, "setComment", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFName._commentRec].SyntheticField[org.apache.poi.hssf.record.NameCommentRecord.field_7_comment_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFName", False, "setComment", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFName._definedNameRec].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_15_description_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFName", False, "setNameName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFName._definedNameRec].SyntheticField[org.apache.poi.hssf.record.NameRecord.field_12_name_text]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFObjectData", False, "HSSFObjectData", "(EscherContainerRecord,ObjRecord,DirectoryEntry)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFObjectData", False, "HSSFObjectData", "(EscherContainerRecord,ObjRecord,DirectoryEntry)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFObjectData", False, "HSSFObjectData", "(EscherContainerRecord,ObjRecord,DirectoryEntry)", "", "Argument[2].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "addShape", "(HSSFShape)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFPatriarch._shapes].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "addShape", "(HSSFShape)", "", "Argument[this]", "Argument[0].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape._patriarch]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createCellComment", "(ClientAnchor)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createComment", "(HSSFAnchor)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createGroup", "(HSSFClientAnchor)", "", "Argument[this]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape._patriarch]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createObjectData", "(ClientAnchor,int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createPicture", "(ClientAnchor,int)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createPicture", "(HSSFClientAnchor,int)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createPolygon", "(HSSFClientAnchor)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createPolygon", "(HSSFClientAnchor)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createSimpleShape", "(HSSFClientAnchor)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createSimpleShape", "(HSSFClientAnchor)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createTextbox", "(HSSFClientAnchor)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "createTextbox", "(HSSFClientAnchor)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "getBoundAggregate", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPatriarch", False, "getChildren", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFPatriarch._shapes].Element", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPicture", True, "HSSFPicture", "(EscherContainerRecord,ObjRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPicture", True, "HSSFPicture", "(EscherContainerRecord,ObjRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPicture", True, "HSSFPicture", "(HSSFShape,HSSFAnchor)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPicture", True, "getClientAnchor", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPicture", True, "getPreferredSize", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPicture", True, "getPreferredSize", "(double)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPicture", True, "getPreferredSize", "(double,double)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPictureData", True, "HSSFPictureData", "(EscherBlipRecord)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPolygon", True, "HSSFPolygon", "(EscherContainerRecord,ObjRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPolygon", True, "HSSFPolygon", "(EscherContainerRecord,ObjRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPolygon", True, "HSSFPolygon", "(EscherContainerRecord,ObjRecord,TextObjectRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPolygon", True, "HSSFPolygon", "(EscherContainerRecord,ObjRecord,TextObjectRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFPolygon", True, "HSSFPolygon", "(EscherContainerRecord,ObjRecord,TextObjectRecord)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRangeCopier", True, "HSSFRangeCopier", "(Sheet)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.hssf.usermodel", "HSSFRangeCopier", True, "HSSFRangeCopier", "(Sheet,Sheet)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.hssf.usermodel", "HSSFRangeCopier", True, "HSSFRangeCopier", "(Sheet,Sheet)", "", "Argument[1]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.hssf.usermodel", "HSSFRichTextString", False, "HSSFRichTextString", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRichTextString._string].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRichTextString", False, "getString", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRichTextString._string].SyntheticField[org.apache.poi.hssf.record.common.UnicodeString.field_3_string]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRow", False, "createCell", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRow.sheet]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFCell._sheet]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRow", False, "createCell", "(int,CellType)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRow.sheet]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFCell._sheet]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRow", False, "getCell", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRow.cells].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRow", False, "getCell", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRow.sheet]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFCell._sheet]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRow", False, "getCell", "(int,Row$MissingCellPolicy)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRow.cells].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRow", False, "getCell", "(int,Row$MissingCellPolicy)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRow.sheet]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFCell._sheet]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRow", False, "getSheet", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRow.sheet]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFRow", False, "moveCell", "(HSSFCell,short)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFRow.cells].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShape", True, "HSSFShape", "(EscherContainerRecord,ObjRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShape", True, "HSSFShape", "(EscherContainerRecord,ObjRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShape", True, "HSSFShape", "(HSSFShape,HSSFAnchor)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.parent]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShape", True, "HSSFShape", "(HSSFShape,HSSFAnchor)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShape", True, "getAnchor", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShape", True, "getOptRecord", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShape", True, "getParent", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.parent]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShape", True, "getPatriarch", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape._patriarch]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShape", True, "setAnchor", "(HSSFAnchor)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "HSSFShapeGroup", "(EscherContainerRecord,ObjRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "HSSFShapeGroup", "(EscherContainerRecord,ObjRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "HSSFShapeGroup", "(HSSFShape,HSSFAnchor)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "HSSFShapeGroup", "(HSSFShape,HSSFAnchor)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "addShape", "(HSSFShape)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShapeGroup.shapes].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "addShape", "(HSSFShape)", "", "Argument[this]", "Argument[0].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.parent]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "addShape", "(HSSFShape)", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape._patriarch]", "Argument[0].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape._patriarch]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "createGroup", "(HSSFChildAnchor)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "createGroup", "(HSSFChildAnchor)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "createPicture", "(HSSFChildAnchor,int)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFShape.anchor]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "createPolygon", "(HSSFChildAnchor)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "createPolygon", "(HSSFChildAnchor)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "createShape", "(HSSFChildAnchor)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "createShape", "(HSSFChildAnchor)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "createTextbox", "(HSSFChildAnchor)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "createTextbox", "(HSSFChildAnchor)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFShapeGroup", True, "getChildren", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFShapeGroup.shapes].Element", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSheet", False, "createRow", "(int)", "", "Argument[this]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFRow.sheet]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSheet", False, "getDrawingEscherAggregate", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSheet", False, "getSheet", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSheet", False, "getWorkbook", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFSheet._workbook]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSheetConditionalFormatting", False, "createConditionalFormattingRule", "(HSSFExtendedColor)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSimpleShape", True, "HSSFSimpleShape", "(EscherContainerRecord,ObjRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSimpleShape", True, "HSSFSimpleShape", "(EscherContainerRecord,ObjRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSimpleShape", True, "HSSFSimpleShape", "(EscherContainerRecord,ObjRecord,TextObjectRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSimpleShape", True, "HSSFSimpleShape", "(EscherContainerRecord,ObjRecord,TextObjectRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSimpleShape", True, "HSSFSimpleShape", "(EscherContainerRecord,ObjRecord,TextObjectRecord)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSimpleShape", True, "HSSFSimpleShape", "(HSSFShape,HSSFAnchor)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSimpleShape", True, "HSSFSimpleShape", "(HSSFShape,HSSFAnchor)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFSimpleShape", True, "getString", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFTextbox", True, "HSSFTextbox", "(EscherContainerRecord,ObjRecord,TextObjectRecord)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFTextbox", True, "HSSFTextbox", "(EscherContainerRecord,ObjRecord,TextObjectRecord)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFTextbox", True, "HSSFTextbox", "(EscherContainerRecord,ObjRecord,TextObjectRecord)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFTextbox", True, "HSSFTextbox", "(HSSFShape,HSSFAnchor)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFTextbox", True, "HSSFTextbox", "(HSSFShape,HSSFAnchor)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "HSSFWorkbook", "(DirectoryNode,POIFSFileSystem,boolean)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "HSSFWorkbook", "(DirectoryNode,boolean)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "HSSFWorkbook", "(DirectoryNode,boolean,char[])", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "HSSFWorkbook", "(POIFSFileSystem)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "HSSFWorkbook", "(POIFSFileSystem,boolean)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "HSSFWorkbook", "(POIFSFileSystem,boolean,char[])", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "cloneSheet", "(int)", "", "Argument[this]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFSheet._workbook]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "create", "(InternalWorkbook)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFWorkbook.workbook]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "createSheet", "()", "", "Argument[this]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFSheet._workbook]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "createSheet", "(String)", "", "Argument[this]", "ReturnValue.SyntheticField[org.apache.poi.hssf.usermodel.HSSFSheet._workbook]", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "getInternalWorkbook", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFWorkbook.workbook]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "getWorkbook", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.usermodel.HSSFWorkbook.workbook]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbook", False, "setOutputPassword", "(char[])", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HSSFWorkbookFactory", True, "createWorkbook", "(POIFSFileSystem)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.hssf.usermodel", "HeaderFooter", True, "font", "(String,String)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HeaderFooter", True, "font", "(String,String)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.hssf.usermodel", "HeaderFooter", True, "stripFields", "(String)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - addsTo: + pack: codeql/java-all + extensible: neutralModel + data: + - ["org.apache.poi.hssf.usermodel", "EscherGraphics", "clearRect", "(int,int,int,int)", "summary", "ai-generated"] + - ["org.apache.poi.hssf.usermodel", "EscherGraphics2d", "clearRect", "(int,int,int,int)", "summary", "ai-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.util.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.util.model.yml new file mode 100644 index 000000000000..e2fa44c08ddd --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.util.model.yml @@ -0,0 +1,11 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.hssf.util", "HSSFColor", True, "toHSSFColor", "(Color)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.hssf.util", "LazilyConcatenatedByteArray", True, "concatenate", "(LazilyConcatenatedByteArray)", "", "Argument[0].SyntheticField[org.apache.poi.hssf.util.LazilyConcatenatedByteArray.arrays].Element", "Argument[this].SyntheticField[org.apache.poi.hssf.util.LazilyConcatenatedByteArray.arrays].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.util", "LazilyConcatenatedByteArray", True, "concatenate", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.hssf.util.LazilyConcatenatedByteArray.arrays].Element", "value", "dfc-generated"] + - ["org.apache.poi.hssf.util", "LazilyConcatenatedByteArray", True, "toArray", "()", "", "Argument[this].SyntheticField[org.apache.poi.hssf.util.LazilyConcatenatedByteArray.arrays].Element", "ReturnValue", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.model.yml new file mode 100644 index 000000000000..4eaa86daaddd --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.model.yml @@ -0,0 +1,25 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi", "POIDocument", True, "write", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi", "EmptyFileException", True, "EmptyFileException", "(File)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi", "EncryptedDocumentException", True, "EncryptedDocumentException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi", "EncryptedDocumentException", True, "EncryptedDocumentException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi", "EncryptedDocumentException", True, "EncryptedDocumentException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi", "EncryptedDocumentException", True, "EncryptedDocumentException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi", "OldFileFormatException", True, "OldFileFormatException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi", "POIDocument", True, "getDirectory", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi", "POIDocument", True, "getDocumentSummaryInformation", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi", "POIDocument", True, "getSummaryInformation", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi", "POIException", True, "POIException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi", "POIException", True, "POIException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi", "POIException", True, "POIException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi", "POIException", True, "POIException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.agile.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.agile.model.yml new file mode 100644 index 000000000000..3353cfc2e8a6 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.agile.model.yml @@ -0,0 +1,53 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionInfoBuilder", True, "parseDescriptor", "(InputStream)", "", "Argument[0]", "xxe", "ai-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionInfoBuilder", True, "parseDescriptor", "(String)", "", "Argument[0]", "xxe", "ai-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionVerifier", True, "AgileEncryptionVerifier", "(String)", "", "Argument[0]", "xxe", "ai-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptor", True, "updateIntegrityHMAC", "(File,int)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionHeader", True, "AgileEncryptionHeader", "(AgileEncryptionHeader)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionHeader", True, "getEncryptedHmacKey", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionHeader", True, "getEncryptedHmacValue", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionHeader", True, "setKeySalt", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionHeader.keySalt]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionVerifier", True, "AgileEncryptionVerifier", "(AgileEncryptionVerifier)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionVerifier", True, "setEncryptedKey", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedKey]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionVerifier", True, "setEncryptedVerifier", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifier]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionVerifier", True, "setEncryptedVerifierHash", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifierHash]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "AgileEncryptionVerifier", True, "setSalt", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.salt]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "CertificateKeyEncryptor", True, "getCertVerifier", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.CertificateKeyEncryptor.certVerifier]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "CertificateKeyEncryptor", True, "getEncryptedKeyValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.CertificateKeyEncryptor.encryptedKeyValue]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "CertificateKeyEncryptor", True, "getX509Certificate", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.CertificateKeyEncryptor.x509Certificate]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "CertificateKeyEncryptor", True, "setCertVerifier", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.CertificateKeyEncryptor.certVerifier]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "CertificateKeyEncryptor", True, "setEncryptedKeyValue", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.CertificateKeyEncryptor.encryptedKeyValue]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "CertificateKeyEncryptor", True, "setX509Certificate", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.CertificateKeyEncryptor.x509Certificate]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "DataIntegrity", True, "getEncryptedHmacKey", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.DataIntegrity.encryptedHmacKey]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "DataIntegrity", True, "getEncryptedHmacValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.DataIntegrity.encryptedHmacValue]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "DataIntegrity", True, "setEncryptedHmacKey", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.DataIntegrity.encryptedHmacKey]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "DataIntegrity", True, "setEncryptedHmacValue", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.DataIntegrity.encryptedHmacValue]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "EncryptionDocument", True, "getDataIntegrity", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.EncryptionDocument.dataIntegrity]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "EncryptionDocument", True, "getKeyData", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.EncryptionDocument.keyData]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "EncryptionDocument", True, "getKeyEncryptors", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt.agile", "EncryptionDocument", True, "setDataIntegrity", "(DataIntegrity)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.EncryptionDocument.dataIntegrity]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "EncryptionDocument", True, "setKeyData", "(KeyData)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.EncryptionDocument.keyData]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "KeyData", True, "getSaltValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.KeyData.saltValue]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "KeyData", True, "setSaltValue", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.KeyData.saltValue]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "KeyEncryptor", True, "getCertificateKeyEncryptor", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.KeyEncryptor.certificateKeyEncryptor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "KeyEncryptor", True, "getPasswordKeyEncryptor", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.KeyEncryptor.passwordKeyEncryptor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "KeyEncryptor", True, "setCertificateKeyEncryptor", "(CertificateKeyEncryptor)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.KeyEncryptor.certificateKeyEncryptor]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "KeyEncryptor", True, "setPasswordKeyEncryptor", "(PasswordKeyEncryptor)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.KeyEncryptor.passwordKeyEncryptor]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "PasswordKeyEncryptor", True, "getEncryptedKeyValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.PasswordKeyEncryptor.encryptedKeyValue]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "PasswordKeyEncryptor", True, "getEncryptedVerifierHashInput", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.PasswordKeyEncryptor.encryptedVerifierHashInput]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "PasswordKeyEncryptor", True, "getEncryptedVerifierHashValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.PasswordKeyEncryptor.encryptedVerifierHashValue]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "PasswordKeyEncryptor", True, "getSaltValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.PasswordKeyEncryptor.saltValue]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "PasswordKeyEncryptor", True, "setEncryptedKeyValue", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.PasswordKeyEncryptor.encryptedKeyValue]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "PasswordKeyEncryptor", True, "setEncryptedVerifierHashInput", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.PasswordKeyEncryptor.encryptedVerifierHashInput]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "PasswordKeyEncryptor", True, "setEncryptedVerifierHashValue", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.PasswordKeyEncryptor.encryptedVerifierHashValue]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.agile", "PasswordKeyEncryptor", True, "setSaltValue", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.agile.PasswordKeyEncryptor.saltValue]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.binaryrc4.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.binaryrc4.model.yml new file mode 100644 index 000000000000..d0c0e802aa72 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.binaryrc4.model.yml @@ -0,0 +1,10 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.crypt.binaryrc4", "BinaryRC4EncryptionVerifier", True, "setEncryptedVerifier", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifier]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.binaryrc4", "BinaryRC4EncryptionVerifier", True, "setEncryptedVerifierHash", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifierHash]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.binaryrc4", "BinaryRC4EncryptionVerifier", True, "setSalt", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.salt]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.cryptoapi.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.cryptoapi.model.yml new file mode 100644 index 000000000000..62a9c6faa923 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.cryptoapi.model.yml @@ -0,0 +1,10 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.crypt.cryptoapi", "CryptoAPIEncryptor", True, "initCipherForBlock", "(Cipher,int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.cryptoapi", "CryptoAPIEncryptor", True, "setSummaryEntries", "(DirectoryNode,String,POIFSFileSystem)", "", "Argument[1]", "Argument[0].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byUCName].MapKey", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.cryptoapi", "CryptoAPIEncryptor", True, "setSummaryEntries", "(DirectoryNode,String,POIFSFileSystem)", "", "Argument[1]", "Argument[0].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byname].MapKey", "taint", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.model.yml new file mode 100644 index 000000000000..5c80ade1ef4b --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.model.yml @@ -0,0 +1,80 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.crypt", "ChunkedCipherOutputStream", True, "ChunkedCipherOutputStream", "(DirectoryNode,int)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.poifs.crypt", "ChunkedCipherOutputStream", True, "ChunkedCipherOutputStream", "(OutputStream,int)", "", "Argument[0]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "ChunkedCipherOutputStream", True, "initCipherForBlock", "(int,boolean)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "ChunkedCipherOutputStream", True, "writePlain", "(byte[],int,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "CryptoFunctions", False, "createXorArray1", "(String)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "CryptoFunctions", False, "generateIv", "(HashAlgorithm,byte[],byte[],int)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "CryptoFunctions", False, "getBlock0", "(byte[],int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$DataSpaceDefinition", True, "DataSpaceDefinition", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$DataSpaceDefinition", True, "DataSpaceDefinition", "(String[])", "", "Argument[0].ArrayElement", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$DataSpaceMap", True, "DataSpaceMap", "(DataSpaceMapUtils$DataSpaceMapEntry[])", "", "Argument[0].ArrayElement", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$DataSpaceMapEntry", True, "DataSpaceMapEntry", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$DataSpaceMapEntry", True, "DataSpaceMapEntry", "(int[],String[],String)", "", "Argument[1].ArrayElement", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$DataSpaceMapEntry", True, "DataSpaceMapEntry", "(int[],String[],String)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$DataSpaceVersionInfo", True, "DataSpaceVersionInfo", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$DataSpaceVersionInfo", True, "DataSpaceVersionInfo", "(String,int,int,int,int,int,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$IRMDSTransformInfo", True, "IRMDSTransformInfo", "(DataSpaceMapUtils$TransformInfoHeader,int,String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$IRMDSTransformInfo", True, "IRMDSTransformInfo", "(DataSpaceMapUtils$TransformInfoHeader,int,String)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$IRMDSTransformInfo", True, "IRMDSTransformInfo", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$TransformInfoHeader", True, "TransformInfoHeader", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$TransformInfoHeader", True, "TransformInfoHeader", "(int,String,String,int,int,int,int,int,int)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils$TransformInfoHeader", True, "TransformInfoHeader", "(int,String,String,int,int,int,int,int,int)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils", True, "createEncryptionEntry", "(DirectoryEntry,String,EncryptionRecord)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils", True, "createEncryptionEntry", "(DirectoryEntry,String,EncryptionRecord)", "", "Argument[1]", "Argument[0].Element", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils", True, "readUnicodeLPP4", "(LittleEndianInput)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils", True, "readUtf8LPP4", "(LittleEndianInput)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils", True, "writeUnicodeLPP4", "(LittleEndianOutput,String)", "", "Argument[1]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "DataSpaceMapUtils", True, "writeUtf8LPP4", "(LittleEndianOutput,String)", "", "Argument[1]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "copy", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "getEncryptionInfo", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.Decryptor.encryptionInfo]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "getInstance", "(EncryptionInfo)", "", "Argument[0].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.decryptor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "getIntegrityHmacKey", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "getIntegrityHmacValue", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "getSecretKey", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "getVerifier", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "initCipherForBlock", "(Cipher,int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "setEncryptionInfo", "(EncryptionInfo)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.Decryptor.encryptionInfo]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Decryptor", True, "verifyPassword", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionHeader", True, "getCspName", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionHeader.cspName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionHeader", True, "getKeySalt", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionHeader.keySalt]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionHeader", True, "setCspName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionHeader.cspName]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionHeader", True, "setKeySalt", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionHeader.keySalt]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "EncryptionInfo", "(EncryptionInfo)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "EncryptionInfo", "(LittleEndianInput,EncryptionMode)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "copy", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "getDecryptor", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.decryptor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "getEncryptor", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.encryptor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "getHeader", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.header]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "getVerifier", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.verifier]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "setDecryptor", "(Decryptor)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.decryptor]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "setEncryptor", "(Encryptor)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.encryptor]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "setHeader", "(EncryptionHeader)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.header]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfo", True, "setVerifier", "(EncryptionVerifier)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.verifier]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionInfoBuilder", True, "initialize", "(EncryptionInfo,LittleEndianInput)", "", "Argument[1]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionVerifier", True, "getEncryptedKey", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedKey]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionVerifier", True, "getEncryptedVerifier", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifier]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionVerifier", True, "getEncryptedVerifierHash", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifierHash]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionVerifier", True, "getSalt", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.salt]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionVerifier", True, "setEncryptedKey", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedKey]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionVerifier", True, "setEncryptedVerifier", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifier]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionVerifier", True, "setEncryptedVerifierHash", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifierHash]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "EncryptionVerifier", True, "setSalt", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.salt]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "confirmPassword", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "confirmPassword", "(String,byte[],byte[],byte[],byte[],byte[])", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "confirmPassword", "(String,byte[],byte[],byte[],byte[],byte[])", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "confirmPassword", "(String,byte[],byte[],byte[],byte[],byte[])", "", "Argument[5]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "copy", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "getDataStream", "(OutputStream,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "getDataStream", "(POIFSFileSystem)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "getEncryptionInfo", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.Encryptor.encryptionInfo]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "getInstance", "(EncryptionInfo)", "", "Argument[0].SyntheticField[org.apache.poi.poifs.crypt.EncryptionInfo.encryptor]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "getSecretKey", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.Encryptor.secretKey]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "setEncryptionInfo", "(EncryptionInfo)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.Encryptor.encryptionInfo]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt", "Encryptor", True, "setSecretKey", "(SecretKey)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.Encryptor.secretKey]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.standard.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.standard.model.yml new file mode 100644 index 000000000000..f58b26491c27 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.standard.model.yml @@ -0,0 +1,11 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.crypt.standard", "EncryptionRecord", True, "write", "(LittleEndianByteArrayOutputStream)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.poifs.crypt.standard", "StandardEncryptionVerifier", True, "setEncryptedVerifier", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifier]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.standard", "StandardEncryptionVerifier", True, "setEncryptedVerifierHash", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifierHash]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.standard", "StandardEncryptionVerifier", True, "setSalt", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.salt]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.xor.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.xor.model.yml new file mode 100644 index 000000000000..dabdbaaf0f89 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.crypt.xor.model.yml @@ -0,0 +1,9 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.crypt.xor", "XOREncryptionVerifier", True, "setEncryptedKey", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedKey]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.crypt.xor", "XOREncryptionVerifier", True, "setEncryptedVerifier", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.crypt.EncryptionVerifier.encryptedVerifier]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.dev.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.dev.model.yml new file mode 100644 index 000000000000..9301b0164088 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.dev.model.yml @@ -0,0 +1,28 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.poifs.dev", "POIFSDump", True, "dump", "(DirectoryEntry,File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.dev", "POIFSDump", True, "dump", "(DirectoryEntry,File)", "", "Argument[1]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.dev", "POIFSDump", True, "dump", "(POIFSFileSystem,int,String,File)", "", "Argument[2]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.dev", "POIFSDump", True, "dump", "(POIFSFileSystem,int,String,File)", "", "Argument[3]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.dev", "POIFSLister", True, "viewFile", "(String,boolean)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.dev", "POIFSLister", True, "viewFileOld", "(String,boolean)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.dev", "POIFSViewer", True, "main", "(String[])", "", "Argument[0].Element", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.poifs.dev", "POIFSDump", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] + - ["org.apache.poi.poifs.dev", "POIFSLister", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] + - ["org.apache.poi.poifs.dev", "POIFSViewer", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.dev", "POIFSViewEngine", True, "inspectViewable", "(Object,boolean,int,String)", "", "Argument[3]", "ReturnValue.Element", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.dev", "POIFSViewable", True, "getShortDescription", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.dev", "POIFSViewable", True, "getViewableIterator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.eventfilesystem.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.eventfilesystem.model.yml new file mode 100644 index 000000000000..49e3b7883d32 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.eventfilesystem.model.yml @@ -0,0 +1,22 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.poifs.eventfilesystem", "POIFSReader", True, "read", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.poifs.eventfilesystem", "POIFSReader", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] + - ["org.apache.poi.poifs.eventfilesystem", "POIFSReaderListener", True, "processPOIFSReaderEvent", "(POIFSReaderEvent)", "", "Parameter[0]", "file", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.eventfilesystem", "POIFSReaderEvent", True, "getName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.eventfilesystem", "POIFSReaderEvent", True, "getPath", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.eventfilesystem", "POIFSReaderEvent", True, "getStorageClassId", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.eventfilesystem", "POIFSReaderEvent", True, "getStream", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.filesystem.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.filesystem.model.yml new file mode 100644 index 000000000000..9b8fd10635f7 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.filesystem.model.yml @@ -0,0 +1,131 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.poifs.filesystem", "FileMagic", True, "valueOf", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File,boolean)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "create", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "main", "(String[])", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File)", "", "Argument[this]", "file", "ai-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File,boolean)", "", "Argument[this]", "file", "ai-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.filesystem", "DirectoryEntry", True, "createDirectory", "(String)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryEntry", True, "createDirectory", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryEntry", True, "createDocument", "(String,InputStream)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryEntry", True, "createDocument", "(String,InputStream)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryEntry", True, "createDocument", "(String,int,POIFSWriterListener)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryEntry", True, "getEntries", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryEntry", True, "getEntry", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryEntry", True, "getEntryCaseInsensitive", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryEntry", True, "getEntryNames", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createDirectory", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byUCName].MapKey", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createDirectory", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byname].MapKey", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createDirectory", "(String)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.poifs.filesystem.EntryNode._property].SyntheticField[org.apache.poi.poifs.property.Property._name]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createDirectory", "(String)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._filesystem]", "ReturnValue.SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._filesystem]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createDocument", "(String,InputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byUCName].MapKey", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createDocument", "(String,InputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byname].MapKey", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createDocumentInputStream", "(Entry)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createDocumentInputStream", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createOrUpdateDocument", "(String,InputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byUCName].MapKey", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createOrUpdateDocument", "(String,InputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byname].MapKey", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "createOrUpdateDocument", "(String,InputStream)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byUCName].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "getEntry", "(String)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byname].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "getEntryCaseInsensitive", "(String)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byUCName].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "getEntryNames", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._byname].MapKey", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "getFileSystem", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._filesystem]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "getPath", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "getShortDescription", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.EntryNode._property].SyntheticField[org.apache.poi.poifs.property.Property._name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "getStorageClsid", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.EntryNode._property].SyntheticField[org.apache.poi.poifs.property.Property._storage_clsid]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DirectoryNode", True, "setStorageClsid", "(ClassID)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.EntryNode._property].SyntheticField[org.apache.poi.poifs.property.Property._storage_clsid]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "DocumentDescriptor", True, "DocumentDescriptor", "(POIFSDocumentPath,String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DocumentDescriptor", True, "DocumentDescriptor", "(POIFSDocumentPath,String)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DocumentFactoryHelper", False, "getDecryptedStream", "(DirectoryNode,String)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DocumentFactoryHelper", False, "getDecryptedStream", "(POIFSFileSystem,String)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DocumentInputStream", False, "DocumentInputStream", "(DocumentEntry)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DocumentInputStream", False, "DocumentInputStream", "(POIFSDocument)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.poifs.filesystem", "DocumentOutputStream", False, "DocumentOutputStream", "(DirectoryEntry,String)", "", "Argument[1]", "Argument[0].Element", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "DocumentOutputStream", False, "DocumentOutputStream", "(DocumentEntry)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "Entry", True, "getName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "Entry", True, "getParent", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "EntryUtils", False, "copyNodeRecursively", "(Entry,DirectoryEntry)", "", "Argument[0]", "Argument[1].Element", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "EntryUtils", False, "copyNodes", "(DirectoryEntry,DirectoryEntry)", "", "Argument[0].Element", "Argument[1].Element", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "FileMagic", False, "prepareToCheckMagic", "(InputStream)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "FilteringDirectoryNode", True, "FilteringDirectoryNode", "(DirectoryEntry,Collection)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "FilteringDirectoryNode", True, "FilteringDirectoryNode", "(DirectoryEntry,Collection)", "", "Argument[1].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "NotOLE2FileException", True, "NotOLE2FileException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "OfficeXmlFileException", True, "OfficeXmlFileException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "Ole10Native", "(String,String,String,byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.label]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "Ole10Native", "(String,String,String,byte[])", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.fileName]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "Ole10Native", "(String,String,String,byte[])", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.command2]", "value", "manual"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "Ole10Native", "(String,String,String,byte[])", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.command]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "Ole10Native", "(String,String,String,byte[])", "", "Argument[3]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.dataBuffer]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "Ole10Native", "(byte[],int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "getCommand", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.command]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "getCommand2", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.command2]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "getDataBuffer", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.dataBuffer]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "getFileName", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.fileName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "getFileName2", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.fileName2]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "getLabel", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.label]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "getLabel2", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.label2]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "setCommand", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.command]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "setCommand2", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.command2]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "setDataBuffer", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.dataBuffer]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "setFileName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.fileName]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "setFileName2", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.fileName2]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "setLabel", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.label]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "setLabel2", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.label2]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10Native", True, "writeOut", "(OutputStream)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.Ole10Native.dataBuffer]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10NativeException", True, "Ole10NativeException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10NativeException", True, "Ole10NativeException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10NativeException", True, "Ole10NativeException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "Ole10NativeException", True, "Ole10NativeException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocument", False, "POIFSDocument", "(DocumentNode)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocument", False, "POIFSDocument", "(DocumentProperty,POIFSFileSystem)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocument", False, "POIFSDocument", "(DocumentProperty,POIFSFileSystem)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocument", False, "POIFSDocument", "(String,POIFSFileSystem,InputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocument._property].SyntheticField[org.apache.poi.poifs.property.Property._name]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocument", False, "POIFSDocument", "(String,int,POIFSFileSystem,POIFSWriterListener)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocument._property].SyntheticField[org.apache.poi.poifs.property.Property._name]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocument", False, "getShortDescription", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocument._property].SyntheticField[org.apache.poi.poifs.property.Property._name]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocumentPath", True, "POIFSDocumentPath", "(POIFSDocumentPath,String[])", "", "Argument[0].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocumentPath.components].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocumentPath.components].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocumentPath", True, "POIFSDocumentPath", "(POIFSDocumentPath,String[])", "", "Argument[1].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocumentPath.components].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocumentPath", True, "POIFSDocumentPath", "(String[])", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocumentPath.components].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocumentPath", True, "getComponent", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocumentPath.components].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocumentPath", True, "getName", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocumentPath.components].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSDocumentPath", True, "getParent", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocumentPath.components].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.poifs.filesystem.POIFSDocumentPath.components].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File,boolean)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(FileChannel)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(FileChannel,boolean)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(FileChannel,boolean,boolean)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(InputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "create", "(File)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "createDirectory", "(String)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "createDirectory", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "createDocument", "(InputStream,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "createDocument", "(InputStream,String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "createDocument", "(String,int,POIFSWriterListener)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "createDocumentInputStream", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "createOrUpdateDocument", "(InputStream,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "createOrUpdateDocument", "(InputStream,String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "getBigBlockSizeDetails", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "getHeaderBlock", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "getPropertyTable", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "getRoot", "()", "", "Argument[this]", "ReturnValue.SyntheticField[org.apache.poi.poifs.filesystem.DirectoryNode._filesystem]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "writeFilesystem", "(OutputStream)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSStream", True, "POIFSStream", "(BlockStore)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSStream", True, "POIFSStream", "(BlockStore,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSStream", True, "getOutputStream", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSWriterEvent", True, "getName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSWriterEvent", True, "getPath", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.filesystem", "POIFSWriterEvent", True, "getStream", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.macros.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.macros.model.yml new file mode 100644 index 000000000000..0d7e58f8608d --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.macros.model.yml @@ -0,0 +1,25 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.poifs.macros", "VBAMacroExtractor", True, "extract", "(File,File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.macros", "VBAMacroExtractor", True, "extract", "(File,File)", "", "Argument[1]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.macros", "VBAMacroExtractor", True, "extract", "(File,File,String)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.macros", "VBAMacroExtractor", True, "extract", "(File,File,String)", "", "Argument[1]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.macros", "VBAMacroExtractor", True, "extract", "(File,File,String)", "", "Argument[2]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.macros", "VBAMacroReader", True, "VBAMacroReader", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.poifs.macros", "VBAMacroExtractor", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] + - ["org.apache.poi.poifs.macros", "VBAMacroReader", True, "VBAMacroReader", "(File)", "", "Argument[this]", "file", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.macros", "Module", True, "getContent", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.macros", "VBAMacroReader", True, "VBAMacroReader", "(POIFSFileSystem)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.nio.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.nio.model.yml new file mode 100644 index 000000000000..f1bf7663f275 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.nio.model.yml @@ -0,0 +1,30 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "FileBackedDataSource", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "FileBackedDataSource", "(File,boolean)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "FileBackedDataSource", "(File)", "", "Argument[this]", "file", "ai-generated"] + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "FileBackedDataSource", "(File,boolean)", "", "Argument[this]", "file", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.nio", "ByteArrayBackedDataSource", True, "ByteArrayBackedDataSource", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.ByteArrayBackedDataSource.buffer]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.nio", "ByteArrayBackedDataSource", True, "ByteArrayBackedDataSource", "(byte[],int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.ByteArrayBackedDataSource.buffer]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.nio", "ByteArrayBackedDataSource", True, "read", "(int,long)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.ByteArrayBackedDataSource.buffer]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.nio", "DataSource", True, "copyTo", "(OutputStream)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "FileBackedDataSource", "(File)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.FileBackedDataSource.channel]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "FileBackedDataSource", "(File,boolean)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.FileBackedDataSource.channel]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "FileBackedDataSource", "(FileChannel,boolean)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.FileBackedDataSource.channel]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "FileBackedDataSource", "(FileChannel,boolean,boolean)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.FileBackedDataSource.channel]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "FileBackedDataSource", "(RandomAccessFile,boolean)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.FileBackedDataSource.channel]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "getChannel", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.FileBackedDataSource.channel]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.nio", "FileBackedDataSource", True, "read", "(int,long)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.nio.FileBackedDataSource.channel]", "ReturnValue", "taint", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.property.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.property.model.yml new file mode 100644 index 000000000000..de671c934bc4 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.property.model.yml @@ -0,0 +1,29 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.property", "DirectoryProperty", True, "DirectoryProperty", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.property", "DirectoryProperty", True, "addChild", "(Property)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.property.DirectoryProperty._children].Element", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "DirectoryProperty", True, "changeName", "(Property,String)", "", "Argument[1]", "Argument[0].SyntheticField[org.apache.poi.poifs.property.Property._name]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.property", "DirectoryProperty", True, "getChildren", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.DirectoryProperty._children].Element", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "DocumentProperty", True, "DocumentProperty", "(String,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.property", "DocumentProperty", True, "getDocument", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.DocumentProperty._document]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "DocumentProperty", True, "setDocument", "(POIFSDocument)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.property.DocumentProperty._document]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "getName", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "getNextChild", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._next_child]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "getPreviousChild", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._previous_child]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "getShortDescription", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._name]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "getStorageClsid", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._storage_clsid]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "getViewableArray", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._name]", "ReturnValue.ArrayElement", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "setNextChild", "(Child)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._next_child]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "setPreviousChild", "(Child)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._previous_child]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "setStorageClsid", "(ClassID)", "", "Argument[0].SyntheticField[org.apache.poi.hpsf.ClassID.bytes]", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._raw_data]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "setStorageClsid", "(ClassID)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._storage_clsid]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "Property", True, "writeData", "(OutputStream)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.Property._raw_data]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.property", "PropertyTable", False, "PropertyTable", "(HeaderBlock)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.property", "PropertyTable", False, "PropertyTable", "(HeaderBlock,POIFSFileSystem)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.poifs.property", "PropertyTable", False, "addProperty", "(Property)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.property.PropertyTable._properties].Element", "value", "dfc-generated"] + - ["org.apache.poi.poifs.property", "PropertyTable", False, "getRoot", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.property.PropertyTable._properties].Element", "ReturnValue", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.storage.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.storage.model.yml new file mode 100644 index 000000000000..631f62ad77bb --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.storage.model.yml @@ -0,0 +1,17 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.poifs.storage", "BATBlock$BATBlockAndIndex", False, "getBlock", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.storage.BATBlock$BATBlockAndIndex.block]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.storage", "BATBlock", False, "createBATBlock", "(POIFSBigBlockSize,ByteBuffer)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.storage", "BATBlock", False, "createEmptyBATBlock", "(POIFSBigBlockSize,boolean)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.poifs.storage", "BATBlock", False, "getBATBlockAndIndex", "(int,HeaderBlock,List)", "", "Argument[2].Element", "ReturnValue.SyntheticField[org.apache.poi.poifs.storage.BATBlock$BATBlockAndIndex.block]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.storage", "BATBlock", False, "getSBATBlockAndIndex", "(int,HeaderBlock,List)", "", "Argument[2].Element", "ReturnValue.SyntheticField[org.apache.poi.poifs.storage.BATBlock$BATBlockAndIndex.block]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.storage", "HeaderBlock", False, "HeaderBlock", "(ByteBuffer)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.storage.HeaderBlock._data]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.storage", "HeaderBlock", False, "HeaderBlock", "(InputStream)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.storage.HeaderBlock._data]", "taint", "dfc-generated"] + - ["org.apache.poi.poifs.storage", "HeaderBlock", False, "HeaderBlock", "(POIFSBigBlockSize)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.poifs.storage.HeaderBlock.bigBlockSize]", "value", "dfc-generated"] + - ["org.apache.poi.poifs.storage", "HeaderBlock", False, "getBigBlockSize", "()", "", "Argument[this].SyntheticField[org.apache.poi.poifs.storage.HeaderBlock.bigBlockSize]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.poifs.storage", "HeaderBlock", False, "writeData", "(OutputStream)", "", "Argument[this].SyntheticField[org.apache.poi.poifs.storage.HeaderBlock._data]", "Argument[0]", "taint", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.draw.geom.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.draw.geom.model.yml new file mode 100644 index 000000000000..4b446f433562 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.draw.geom.model.yml @@ -0,0 +1,86 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.sl.draw.geom", "AdjustPoint", True, "getX", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.AdjustPoint.x]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "AdjustPoint", True, "getY", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.AdjustPoint.y]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "AdjustPoint", True, "setX", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.AdjustPoint.x]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "AdjustPoint", True, "setY", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.AdjustPoint.y]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ArcToCommand", True, "getHR", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ArcToCommand.hr]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ArcToCommand", True, "getStAng", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ArcToCommand.stAng]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ArcToCommand", True, "getSwAng", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ArcToCommand.swAng]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ArcToCommand", True, "getWR", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ArcToCommand.wr]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ArcToCommand", True, "setHR", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ArcToCommand.hr]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ArcToCommand", True, "setStAng", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ArcToCommand.stAng]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ArcToCommand", True, "setSwAng", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ArcToCommand.swAng]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ArcToCommand", True, "setWR", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ArcToCommand.wr]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ConnectionSite", False, "getAng", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ConnectionSite.ang]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ConnectionSite", False, "setAng", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.ConnectionSite.ang]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "ConnectionSiteIf", True, "getPos", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "ConnectionSiteIf", True, "setPos", "(AdjustPointIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "Context", True, "Context", "(CustomGeometry,Rectangle2D,IAdjustableShape)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "Context", True, "Context", "(CustomGeometry,Rectangle2D,IAdjustableShape)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "Context", True, "Context", "(CustomGeometry,Rectangle2D,IAdjustableShape)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "Context", True, "evaluate", "(Formula)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CurveToCommandIf", True, "getPt1", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CurveToCommandIf", True, "getPt2", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CurveToCommandIf", True, "getPt3", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CurveToCommandIf", True, "setPt1", "(AdjustPointIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CurveToCommandIf", True, "setPt2", "(AdjustPointIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CurveToCommandIf", True, "setPt3", "(AdjustPointIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CustomGeometry", False, "addAdjustGuide", "(AdjustValueIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CustomGeometry", False, "addAdjustHandle", "(AdjustHandle)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CustomGeometry", False, "addConnectionSite", "(ConnectionSiteIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CustomGeometry", False, "addGeomGuide", "(GuideIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CustomGeometry", False, "addPath", "(PathIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "CustomGeometry", False, "getTextBounds", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "Guide", True, "getFmla", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.Guide.fmla]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "Guide", True, "getName", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.Guide.name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "Guide", True, "setFmla", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.Guide.fmla]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "Guide", True, "setName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.Guide.name]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "LineToCommandIf", True, "getPt", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "LineToCommandIf", True, "setPt", "(AdjustPointIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "MoveToCommandIf", True, "getPt", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "MoveToCommandIf", True, "setPt", "(AdjustPointIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "Outline", True, "Outline", "(Shape,PathIf)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.Outline.shape]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "Outline", True, "Outline", "(Shape,PathIf)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.Outline.path]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "Outline", True, "getOutline", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.Outline.shape]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "Outline", True, "getPath", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.Outline.path]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PathIf", True, "addCommand", "(PathCommand)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "getGdRefAng", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.gdRefAng]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "getGdRefR", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.gdRefR]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "getMaxAng", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.maxAng]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "getMaxR", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.maxR]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "getMinAng", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.minAng]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "getMinR", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.minR]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "getPos", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.pos]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "setGdRefAng", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.gdRefAng]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "setGdRefR", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.gdRefR]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "setMaxAng", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.maxAng]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "setMaxR", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.maxR]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "setMinAng", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.minAng]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "setMinR", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.minR]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PolarAdjustHandle", False, "setPos", "(AdjustPoint)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.PolarAdjustHandle.pos]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "PresetGeometries", False, "get", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "PresetGeometries", False, "keySet", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "QuadToCommandIf", True, "getPt1", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "QuadToCommandIf", True, "getPt2", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "QuadToCommandIf", True, "setPt1", "(AdjustPointIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "QuadToCommandIf", True, "setPt2", "(AdjustPointIf)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "getGdRefX", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.gdRefX]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "getGdRefY", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.gdRefY]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "getMaxX", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.maxX]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "getMaxY", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.maxY]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "getMinX", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.minX]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "getMinY", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.minY]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "getPos", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.pos]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "setGdRefX", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.gdRefX]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "setGdRefY", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.gdRefY]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "setMaxX", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.maxX]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "setMaxY", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.maxY]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "setMinX", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.minX]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "setMinY", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.minY]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw.geom", "XYAdjustHandle", False, "setPos", "(AdjustPoint)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.geom.XYAdjustHandle.pos]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.draw.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.draw.model.yml new file mode 100644 index 000000000000..7b4ff4b4b490 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.draw.model.yml @@ -0,0 +1,102 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.sl.draw", "BitmapImageRenderer", True, "getCachedContentType", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.BitmapImageRenderer.cachedContentType]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "BitmapImageRenderer", True, "getCachedImage", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.BitmapImageRenderer.cachedImage]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "BitmapImageRenderer", True, "loadImage", "(InputStream,String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.BitmapImageRenderer.cachedImage]", "taint", "dfc-generated"] + - ["org.apache.poi.sl.draw", "BitmapImageRenderer", True, "loadImage", "(InputStream,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.BitmapImageRenderer.cachedContentType]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "BitmapImageRenderer", True, "loadImage", "(byte[],String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.BitmapImageRenderer.cachedImage]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "BitmapImageRenderer", True, "loadImage", "(byte[],String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.BitmapImageRenderer.cachedContentType]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "BitmapImageRenderer", True, "setAlpha", "(BufferedImage,double)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawAutoShape", True, "DrawAutoShape", "(AutoShape)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawBackground", True, "DrawBackground", "(Background)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawConnectorShape", True, "DrawConnectorShape", "(ConnectorShape)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(Background)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(ConnectorShape)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(FreeformShape)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(GraphicalFrame)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(GroupShape)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(MasterSheet)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(PictureShape)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(Shape)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(Sheet)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(Slide)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.sl.draw.DrawSheet.sheet]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(TableShape)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(TextBox)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getDrawable", "(TextShape)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getFontManager", "(Graphics2D)", "", "Argument[0].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getInstance", "(Graphics2D)", "", "Argument[0].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getPaint", "(PlaceableShape)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getTextFragment", "(TextLayout,AttributedString)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.sl.draw.DrawTextFragment.layout]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawFactory", True, "getTextFragment", "(TextLayout,AttributedString)", "", "Argument[1]", "ReturnValue.SyntheticField[org.apache.poi.sl.draw.DrawTextFragment.str]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawFontManager", True, "getFallbackFont", "(Graphics2D,FontInfo)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawFontManager", True, "getMappedFont", "(Graphics2D,FontInfo)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawFontManager", True, "mapFontCharset", "(Graphics2D,FontInfo,String)", "", "Argument[2]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawFreeformShape", True, "DrawFreeformShape", "(FreeformShape)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawGraphicalFrame", True, "DrawGraphicalFrame", "(GraphicalFrame)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawGroupShape", True, "DrawGroupShape", "(GroupShape)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawMasterSheet", True, "DrawMasterSheet", "(MasterSheet)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawNothing", True, "DrawNothing", "(Shape)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawPaint", True, "DrawPaint", "(PlaceableShape)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawPaint", True, "createSolidPaint", "(ColorStyle)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawPaint", True, "getPaint", "(Graphics2D,PaintStyle)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawPaint", True, "getPaint", "(Graphics2D,PaintStyle)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawPaint", True, "getPaint", "(Graphics2D,PaintStyle,PaintStyle$PaintModifier)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawPaint", True, "getPaint", "(Graphics2D,PaintStyle,PaintStyle$PaintModifier)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawPictureShape", True, "DrawPictureShape", "(PictureShape)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawPictureShape", True, "getImageRenderer", "(Graphics2D,String)", "", "Argument[0].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawShape", True, "DrawShape", "(Shape)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawShape", True, "getAnchor", "(Graphics2D,Rectangle2D)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawSheet", True, "DrawSheet", "(Sheet)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawSimpleShape", True, "DrawSimpleShape", "(SimpleShape)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawSlide", True, "DrawSlide", "(Slide)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.DrawSheet.sheet]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawSlide", True, "draw", "(Graphics2D)", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.DrawSheet.sheet]", "Argument[0].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawTableShape", True, "DrawTableShape", "(TableShape)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawTextBox", True, "DrawTextBox", "(TextBox)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawTextFragment", True, "DrawTextFragment", "(TextLayout,AttributedString)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.DrawTextFragment.layout]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawTextFragment", True, "DrawTextFragment", "(TextLayout,AttributedString)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.DrawTextFragment.str]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawTextFragment", True, "getAttributedString", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.DrawTextFragment.str]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawTextFragment", True, "getLayout", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.DrawTextFragment.layout]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "DrawTextParagraph", True, "DrawTextParagraph", "(TextParagraph)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawTextShape", True, "DrawTextShape", "(TextShape)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.sl.draw", "DrawTexturePaint", True, "getAwtShape", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawTexturePaint", True, "getFill", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "DrawTexturePaint", True, "getImageRenderer", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "EmbeddedExtractor$EmbeddedPart", True, "getData", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.EmbeddedExtractor$EmbeddedPart.data]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "EmbeddedExtractor$EmbeddedPart", True, "getName", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.EmbeddedExtractor$EmbeddedPart.name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "EmbeddedExtractor$EmbeddedPart", True, "setData", "(Supplier)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.EmbeddedExtractor$EmbeddedPart.data]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "EmbeddedExtractor$EmbeddedPart", True, "setName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.EmbeddedExtractor$EmbeddedPart.name]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "ImageRenderer", True, "getImage", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "ImageRenderer", True, "getImage", "(Dimension2D)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "PathGradientPaint$PathGradientContext", True, "createRaster", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "PathGradientPaint", True, "createContext", "(ColorModel,Rectangle,Rectangle2D,AffineTransform,RenderingHints)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "PathGradientPaint", True, "createContext", "(ColorModel,Rectangle,Rectangle2D,AffineTransform,RenderingHints)", "", "Argument[2]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "PathGradientPaint", True, "createContext", "(ColorModel,Rectangle,Rectangle2D,AffineTransform,RenderingHints)", "", "Argument[3]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "PathGradientPaint", True, "createContext", "(ColorModel,Rectangle,Rectangle2D,AffineTransform,RenderingHints)", "", "Argument[4].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "SLGraphics", "(GroupShape)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._group]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "addRenderingHints", "(Map)", "", "Argument[0].MapKey", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapKey", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "addRenderingHints", "(Map)", "", "Argument[0].MapValue", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "create", "()", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "getBackground", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._background]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "getColor", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._foreground]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "getFont", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._font]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "getPaint", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._paint]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "getRenderingHint", "(RenderingHints$Key)", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "getRenderingHints", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "getShapeGroup", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._group]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "getStroke", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._stroke]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setBackground", "(Color)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._background]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setColor", "(Color)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._foreground]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setColor", "(Color)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._paint]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setFont", "(Font)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._font]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setPaint", "(Paint)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._foreground]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setPaint", "(Paint)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._paint]", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setRenderingHint", "(RenderingHints$Key,Object)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapKey", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setRenderingHint", "(RenderingHints$Key,Object)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setRenderingHints", "(Map)", "", "Argument[0].MapKey", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapKey", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setRenderingHints", "(Map)", "", "Argument[0].MapValue", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._hints].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.draw", "SLGraphics", True, "setStroke", "(Stroke)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.draw.SLGraphics._stroke]", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.extractor.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.extractor.model.yml new file mode 100644 index 000000000000..f4238b4fde90 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.extractor.model.yml @@ -0,0 +1,10 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.sl.extractor", "SlideShowExtractor", True, "SlideShowExtractor", "(SlideShow)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.extractor.SlideShowExtractor.slideshow]", "value", "dfc-generated"] + - ["org.apache.poi.sl.extractor", "SlideShowExtractor", True, "getDocument", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.extractor.SlideShowExtractor.slideshow]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.sl.extractor", "SlideShowExtractor", True, "getFilesystem", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.extractor.SlideShowExtractor.slideshow]", "ReturnValue", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.image.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.image.model.yml new file mode 100644 index 000000000000..96c45388c0a0 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.image.model.yml @@ -0,0 +1,13 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.sl.image", "ImageHeaderBitmap", True, "getSize", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.image", "ImageHeaderEMF", True, "getBounds", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.image", "ImageHeaderPICT", True, "getBounds", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.sl.image", "ImageHeaderPNG", False, "ImageHeaderPNG", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.sl.image.ImageHeaderPNG.data]", "value", "dfc-generated"] + - ["org.apache.poi.sl.image", "ImageHeaderPNG", False, "extractPNG", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.image.ImageHeaderPNG.data].ArrayElement", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.sl.image", "ImageHeaderPNG", False, "extractPNG", "()", "", "Argument[this].SyntheticField[org.apache.poi.sl.image.ImageHeaderPNG.data]", "ReturnValue", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.usermodel.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.usermodel.model.yml new file mode 100644 index 000000000000..b3727f6eac62 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.sl.usermodel.model.yml @@ -0,0 +1,23 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.sl.usermodel", "SlideShow", True, "addPicture", "(File,PictureData$PictureType)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.sl.usermodel", "SlideShowFactory", True, "create", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.sl.usermodel", "SlideShowFactory", True, "create", "(File,String)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.sl.usermodel", "SlideShowFactory", True, "create", "(File,String,boolean)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.sl.usermodel", "SlideShowFactory", True, "create", "(File)", "", "ReturnValue", "file", "ai-generated"] + - ["org.apache.poi.sl.usermodel", "SlideShowFactory", True, "create", "(File,String)", "", "ReturnValue", "file", "ai-generated"] + - ["org.apache.poi.sl.usermodel", "SlideShowFactory", True, "create", "(File,String,boolean)", "", "ReturnValue", "file", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.sl.usermodel", "PaintStyle$SolidPaint", True, "getSolidColor", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.extractor.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.extractor.model.yml new file mode 100644 index 000000000000..fc826a5e8b4f --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.extractor.model.yml @@ -0,0 +1,20 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "EmbeddedData", "(String,byte[],String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.filename]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "EmbeddedData", "(String,byte[],String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.embeddedData]", "value", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "EmbeddedData", "(String,byte[],String)", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.contentType]", "value", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "getContentType", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.contentType]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "getEmbeddedData", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.embeddedData]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "getFilename", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.filename]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "getShape", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.shape]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "setContentType", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.contentType]", "value", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "setEmbeddedData", "(byte[])", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.embeddedData]", "value", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "setFilename", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.filename]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedData", True, "setShape", "(Shape)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.shape]", "value", "dfc-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedExtractor", True, "extractAll", "(Sheet)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.extractor", "EmbeddedExtractor", True, "extractOne", "(DirectoryNode)", "", "Argument[0].SyntheticField[org.apache.poi.poifs.filesystem.EntryNode._property].SyntheticField[org.apache.poi.poifs.property.Property._name]", "ReturnValue.SyntheticField[org.apache.poi.ss.extractor.EmbeddedData.filename]", "taint", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.format.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.format.model.yml new file mode 100644 index 000000000000..53a6a15d6f27 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.format.model.yml @@ -0,0 +1,52 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.format", "CellDateFormatter", True, "CellDateFormatter", "(Locale,String)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellDateFormatter", True, "CellDateFormatter", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellElapsedFormatter", True, "CellElapsedFormatter", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormat", True, "apply", "(Cell)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormat", True, "apply", "(JLabel,Cell)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormat", True, "apply", "(JLabel,Object)", "", "Argument[1]", "ReturnValue.Field[org.apache.poi.ss.format.CellFormatResult.text]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormat", True, "apply", "(Object)", "", "Argument[0]", "ReturnValue.Field[org.apache.poi.ss.format.CellFormatResult.text]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormat", True, "getInstance", "(Locale,String)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormat", True, "getInstance", "(Locale,String)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormat", True, "getInstance", "(String)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormatPart", True, "CellFormatPart", "(Locale,String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormatPart", True, "CellFormatPart", "(Locale,String)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormatPart", True, "CellFormatPart", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormatPart", True, "apply", "(JLabel,Object)", "", "Argument[1]", "ReturnValue.Field[org.apache.poi.ss.format.CellFormatResult.text]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormatPart", True, "apply", "(Object)", "", "Argument[0]", "ReturnValue.Field[org.apache.poi.ss.format.CellFormatResult.text]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormatPart", True, "group", "(Matcher,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormatResult", True, "CellFormatResult", "(boolean,String,Color)", "", "Argument[1]", "Argument[this].Field[org.apache.poi.ss.format.CellFormatResult.text]", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormatResult", True, "CellFormatResult", "(boolean,String,Color)", "", "Argument[2]", "Argument[this].Field[org.apache.poi.ss.format.CellFormatResult.textColor]", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormatter", True, "CellFormatter", "(Locale,String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormatter", True, "CellFormatter", "(Locale,String)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormatter", True, "CellFormatter", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellFormatter", True, "format", "(Object)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormatter", True, "formatValue", "(StringBuffer,Object)", "", "Argument[1]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormatter", True, "simpleFormat", "(Object)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellFormatter", True, "simpleValue", "(StringBuffer,Object)", "", "Argument[1]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellGeneralFormatter", True, "CellGeneralFormatter", "(Locale)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellNumberFormatter", True, "CellNumberFormatter", "(Locale,String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellNumberFormatter", True, "CellNumberFormatter", "(Locale,String)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellNumberFormatter", True, "CellNumberFormatter", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellNumberPartHandler", True, "getDecimalPoint", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellNumberPartHandler", True, "getExponent", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellNumberPartHandler", True, "getNumerator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellNumberPartHandler", True, "getSlash", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellNumberPartHandler", True, "getSpecials", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.format", "CellNumberPartHandler", True, "handlePart", "(Matcher,String,CellFormatType,StringBuffer)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellNumberStringMod", True, "CellNumberStringMod", "(CellNumberFormatter$Special,CharSequence,int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.format.CellNumberStringMod.special]", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellNumberStringMod", True, "CellNumberStringMod", "(CellNumberFormatter$Special,CharSequence,int)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.format.CellNumberStringMod.toAdd]", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellNumberStringMod", True, "CellNumberStringMod", "(CellNumberFormatter$Special,boolean,CellNumberFormatter$Special,boolean)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.format.CellNumberStringMod.special]", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellNumberStringMod", True, "CellNumberStringMod", "(CellNumberFormatter$Special,boolean,CellNumberFormatter$Special,boolean)", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.ss.format.CellNumberStringMod.end]", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellNumberStringMod", True, "CellNumberStringMod", "(CellNumberFormatter$Special,boolean,CellNumberFormatter$Special,boolean,char)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.format.CellNumberStringMod.special]", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellNumberStringMod", True, "CellNumberStringMod", "(CellNumberFormatter$Special,boolean,CellNumberFormatter$Special,boolean,char)", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.ss.format.CellNumberStringMod.end]", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellNumberStringMod", True, "getEnd", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.format.CellNumberStringMod.end]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellNumberStringMod", True, "getSpecial", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.format.CellNumberStringMod.special]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellNumberStringMod", True, "getToAdd", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.format.CellNumberStringMod.toAdd]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.format", "CellTextFormatter", True, "CellTextFormatter", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.constant.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.constant.model.yml new file mode 100644 index 000000000000..9f98cf1f0ce2 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.constant.model.yml @@ -0,0 +1,9 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.formula.constant", "ConstantValueParser", False, "encode", "(LittleEndianOutput,Object[])", "", "Argument[1].ArrayElement", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.constant", "ConstantValueParser", False, "parse", "(LittleEndianInput,int)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.eval.forked.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.eval.forked.model.yml new file mode 100644 index 000000000000..39f245c01960 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.eval.forked.model.yml @@ -0,0 +1,9 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.formula.eval.forked", "ForkedEvaluator", False, "create", "(Workbook,IStabilityClassifier,UDFFinder)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval.forked", "ForkedEvaluator", False, "create", "(Workbook,IStabilityClassifier,UDFFinder)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.eval.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.eval.model.yml new file mode 100644 index 000000000000..e2a03a380cde --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.eval.model.yml @@ -0,0 +1,41 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.formula.eval", "AreaEval", True, "getAbsoluteValue", "(int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval", "AreaEval", True, "offset", "(int,int,int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval", "EvaluationException", False, "EvaluationException", "(ErrorEval)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.EvaluationException._errorEval]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "EvaluationException", False, "getErrorEval", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.EvaluationException._errorEval]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "ExternalNameEval", False, "ExternalNameEval", "(EvaluationName)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.ExternalNameEval._name]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "ExternalNameEval", False, "getName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.ExternalNameEval._name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "FunctionNameEval", False, "FunctionNameEval", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.FunctionNameEval._functionName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "FunctionNameEval", False, "getFunctionName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.FunctionNameEval._functionName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "IntersectionEval", False, "evaluate", "(int,int,ValueEval,ValueEval)", "", "Argument[2].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "NotImplementedException", True, "NotImplementedException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval", "NotImplementedException", True, "NotImplementedException", "(String,NotImplementedException)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval", "NotImplementedException", True, "NotImplementedException", "(String,NotImplementedException)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval", "NotImplementedFunctionException", False, "NotImplementedFunctionException", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.NotImplementedFunctionException.functionName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "NotImplementedFunctionException", False, "NotImplementedFunctionException", "(String,NotImplementedException)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.NotImplementedFunctionException.functionName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "NotImplementedFunctionException", False, "getFunctionName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.NotImplementedFunctionException.functionName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "OperandResolver", False, "chooseSingleElementFromArea", "(AreaEval,int,int)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "OperandResolver", False, "coerceValueToString", "(ValueEval)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval", "OperandResolver", False, "getElementFromArray", "(AreaEval,EvaluationCell)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "OperandResolver", False, "getSingleValue", "(ValueEval,int,int)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "OperandResolver", False, "getSingleValue", "(ValueEval,int,int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "RangeEval", False, "evaluate", "(int,int,ValueEval,ValueEval)", "", "Argument[2].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "RefEval", True, "offset", "(int,int,int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval", "RefListEval", True, "RefListEval", "(ValueEval,ValueEval)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.RefListEval.list].Element", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "RefListEval", True, "RefListEval", "(ValueEval,ValueEval)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.RefListEval.list].Element", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "RefListEval", True, "getList", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.RefListEval.list]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "RelationalOperationEval", True, "evaluateArray", "(ValueEval[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "StringEval", False, "StringEval", "(Ptg)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval", "StringEval", False, "StringEval", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.StringEval._value]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "StringEval", False, "getStringValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.eval.StringEval._value]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "StringValueEval", True, "getStringValue", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.eval", "TwoOperandNumericOperation", True, "evaluateArray", "(ValueEval[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "UnaryMinusEval", False, "evaluateArray", "(ValueEval[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "UnaryPlusEval", False, "evaluate", "(int,int,ValueEval)", "", "Argument[2].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.eval", "UnaryPlusEval", False, "evaluateArray", "(ValueEval[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.function.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.function.model.yml new file mode 100644 index 000000000000..ff34c22e0133 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.function.model.yml @@ -0,0 +1,9 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.formula.function", "FunctionMetadata", False, "getName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.function", "FunctionMetadata", False, "getParameterClassCodes", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.functions.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.functions.model.yml new file mode 100644 index 000000000000..ee53e636e1a4 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.functions.model.yml @@ -0,0 +1,55 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.formula.functions", "ArrayFunction", True, "_evaluateOneArrayArg", "(ValueEval,int,int,Function)", "", "Argument[0]", "ReturnValue", "value", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "ArrayFunction", True, "_evaluateTwoArrayArgs", "(ValueEval,ValueEval,int,int,BiFunction)", "", "Argument[0]", "ReturnValue", "value", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "ArrayFunction", True, "_evaluateTwoArrayArgs", "(ValueEval,ValueEval,int,int,BiFunction)", "", "Argument[1]", "ReturnValue", "value", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "ArrayFunction", True, "evaluateArray", "(ValueEval[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "ArrayFunction", True, "evaluateOneArrayArg", "(ValueEval,int,int,Function)", "", "Argument[0]", "ReturnValue", "value", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "ArrayFunction", True, "evaluateTwoArrayArgs", "(ValueEval,ValueEval,int,int,BiFunction)", "", "Argument[0]", "ReturnValue", "value", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "ArrayFunction", True, "evaluateTwoArrayArgs", "(ValueEval,ValueEval,int,int,BiFunction)", "", "Argument[1]", "ReturnValue", "value", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "Countif$ErrorMatcher", False, "ErrorMatcher", "(int,Countif$CmpOp)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "Countif$StringMatcher", False, "StringMatcher", "(String,Countif$CmpOp)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "Countif$StringMatcher", False, "StringMatcher", "(String,Countif$CmpOp)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "DGet", False, "getResult", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.functions.DGet.result]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "DGet", False, "processMatch", "(ValueEval)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.functions.DGet.result]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "DMax", False, "getResult", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.functions.DMax.maximumValue]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "DMax", False, "processMatch", "(ValueEval)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.functions.DMax.maximumValue]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "DMin", False, "getResult", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.functions.DMin.minimumValue]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "DMin", False, "processMatch", "(ValueEval)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.functions.DMin.minimumValue]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "FreeRefFunction", True, "evaluate", "(ValueEval[],OperationEvaluationContext)", "", "Argument[0].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Function1Arg", True, "evaluate", "(int,int,ValueEval)", "", "Argument[2]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Function2Arg", True, "evaluate", "(int,int,ValueEval,ValueEval)", "", "Argument[2]", "ReturnValue", "value", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "Function2Arg", True, "evaluate", "(int,int,ValueEval,ValueEval)", "", "Argument[3]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Function3Arg", True, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval)", "", "Argument[2]", "ReturnValue", "value", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "Function3Arg", True, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval)", "", "Argument[3]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Function3Arg", True, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval)", "", "Argument[4]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Function4Arg", True, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval,ValueEval)", "", "Argument[2]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "Function4Arg", True, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval,ValueEval)", "", "Argument[4]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "Function4Arg", True, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval,ValueEval)", "", "Argument[5]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "Function", True, "evaluate", "(ValueEval[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Hlookup", False, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval)", "", "Argument[3].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Hlookup", False, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval,ValueEval)", "", "Argument[3].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "IDStarAlgorithm", True, "processMatch", "(ValueEval)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "IfFunc", False, "evaluateArray", "(ValueEval[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "LogicalFunction", True, "evaluateArray", "(ValueEval[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Lookup", False, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval)", "", "Argument[4].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "LookupUtils$ValueVector", True, "getItem", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "LookupUtils", False, "createColumnVector", "(TwoDEval,int)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "LookupUtils", False, "createRowVector", "(TwoDEval,int)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "LookupUtils", False, "createVector", "(RefEval)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "LookupUtils", False, "createVector", "(TwoDEval)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.functions", "LookupUtils", False, "resolveTableArrayArg", "(ValueEval)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "NotImplementedFunction", False, "NotImplementedFunction", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.functions.NotImplementedFunction._functionName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "NotImplementedFunction", False, "getFunctionName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.functions.NotImplementedFunction._functionName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "PercentRank", False, "getValues", "(ValueEval,int,int)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "PercentRank", False, "getValues", "(ValueEval,int,int)", "", "Argument[0]", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Roman", True, "makeConcise", "(String,int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "T", False, "evaluate", "(int,int,ValueEval)", "", "Argument[2].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Value", False, "evaluateArray", "(ValueEval[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Vlookup", False, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval)", "", "Argument[3].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.functions", "Vlookup", False, "evaluate", "(int,int,ValueEval,ValueEval,ValueEval,ValueEval)", "", "Argument[3].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.model.yml new file mode 100644 index 000000000000..defd8e6daf01 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.model.yml @@ -0,0 +1,121 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.formula", "CacheAreaEval", False, "CacheAreaEval", "(AreaI,ValueEval[])", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "CacheAreaEval", False, "CacheAreaEval", "(int,int,int,int,ValueEval[])", "", "Argument[4]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "CacheAreaEval", False, "getColumn", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "CacheAreaEval", False, "getRelativeValue", "(int,int)", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "CacheAreaEval", False, "getRelativeValue", "(int,int,int)", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "CacheAreaEval", False, "getRow", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "CacheAreaEval", False, "offset", "(int,int,int,int)", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "CollaboratingWorkbooksEnvironment", False, "getWorkbookEvaluator", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "ConditionalFormattingEvaluator", True, "ConditionalFormattingEvaluator", "(Workbook,WorkbookEvaluatorProvider)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.ss.formula", "ConditionalFormattingEvaluator", True, "ConditionalFormattingEvaluator", "(Workbook,WorkbookEvaluatorProvider)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "ConditionalFormattingEvaluator", True, "getConditionalFormattingForCell", "(Cell)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "ConditionalFormattingEvaluator", True, "getConditionalFormattingForCell", "(CellReference)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "ConditionalFormattingEvaluator", True, "getConditionalFormattingForCell", "(CellReference)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "ConditionalFormattingEvaluator", True, "getFormatRulesForSheet", "(Sheet)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "ConditionalFormattingEvaluator", True, "getFormatRulesForSheet", "(Sheet)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "ConditionalFormattingEvaluator", True, "getFormatRulesForSheet", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "ConditionalFormattingEvaluator", True, "getMatchingCells", "(Sheet,int,int)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator$DataValidationContext", True, "DataValidationContext", "(DataValidation,DataValidationEvaluator,CellRangeAddressBase,CellReference)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.dv]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator$DataValidationContext", True, "DataValidationContext", "(DataValidation,DataValidationEvaluator,CellRangeAddressBase,CellReference)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.dve]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator$DataValidationContext", True, "DataValidationContext", "(DataValidation,DataValidationEvaluator,CellRangeAddressBase,CellReference)", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.region]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator$DataValidationContext", True, "DataValidationContext", "(DataValidation,DataValidationEvaluator,CellRangeAddressBase,CellReference)", "", "Argument[3]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.target]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator$DataValidationContext", True, "getEvaluator", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.dve]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator$DataValidationContext", True, "getRegion", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.region]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator$DataValidationContext", True, "getTarget", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.target]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator$DataValidationContext", True, "getValidation", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.dv]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator", True, "DataValidationEvaluator", "(Workbook,WorkbookEvaluatorProvider)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator", True, "DataValidationEvaluator", "(Workbook,WorkbookEvaluatorProvider)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator", True, "getValidationContextForCell", "(CellReference)", "", "Argument[0]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.target]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator", True, "getValidationContextForCell", "(CellReference)", "", "Argument[this]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.DataValidationEvaluator$DataValidationContext.dve]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "DataValidationEvaluator", True, "getValidationForCell", "(CellReference)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationCell", True, "getIdentityKey", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationCell", True, "getSheet", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationCell", True, "getStringCellValue", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "EvaluationConditionalFormatRule", "(WorkbookEvaluator,Sheet,ConditionalFormatting,int,ConditionalFormattingRule,int,CellRangeAddress[])", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationConditionalFormatRule.sheet]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "EvaluationConditionalFormatRule", "(WorkbookEvaluator,Sheet,ConditionalFormatting,int,ConditionalFormattingRule,int,CellRangeAddress[])", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationConditionalFormatRule.formatting]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "EvaluationConditionalFormatRule", "(WorkbookEvaluator,Sheet,ConditionalFormatting,int,ConditionalFormattingRule,int,CellRangeAddress[])", "", "Argument[4]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationConditionalFormatRule.rule]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "EvaluationConditionalFormatRule", "(WorkbookEvaluator,Sheet,ConditionalFormatting,int,ConditionalFormattingRule,int,CellRangeAddress[])", "", "Argument[6]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationConditionalFormatRule.regions]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "evaluateDuplicateValues", "(List)", "", "Argument[0].Element", "ReturnValue.Element", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "getFormatting", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationConditionalFormatRule.formatting]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "getFormula1", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "getFormula2", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "getNumberFormat", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "getRegions", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationConditionalFormatRule.regions]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "getRule", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationConditionalFormatRule.rule]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "getSheet", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationConditionalFormatRule.sheet]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "getText", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationConditionalFormatRule", True, "getType", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationName", True, "getNameText", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationSheet", True, "getCell", "(int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalName", True, "ExternalName", "(String,int,int)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalName._nameName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalName", True, "getName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalName._nameName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalSheet", True, "ExternalSheet", "(String,String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalSheet._workbookName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalSheet", True, "ExternalSheet", "(String,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalSheet._sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalSheet", True, "getSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalSheet._sheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalSheet", True, "getWorkbookName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalSheet._workbookName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalSheetRange", True, "ExternalSheetRange", "(String,String,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalSheet._sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalSheetRange", True, "ExternalSheetRange", "(String,String,String)", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalSheetRange._lastSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalSheetRange", True, "getFirstSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalSheet._sheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook$ExternalSheetRange", True, "getLastSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.EvaluationWorkbook$ExternalSheetRange._lastSheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook", True, "getSheet", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "EvaluationWorkbook", True, "getUDFFinder", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "Formula", True, "Formula", "(Formula)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "Formula", True, "copy", "()", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "Formula", True, "getTokens", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "Formula", True, "getTokens", "(Formula)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "Formula", True, "read", "(int,LittleEndianInput)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "Formula", True, "read", "(int,LittleEndianInput,int)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "Formula", True, "serialize", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "Formula", True, "serializeTokens", "(LittleEndianOutput)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "FormulaParseException", False, "FormulaParseException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "FormulaParsingWorkbook", True, "createName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "FormulaRenderer", True, "toFormulaString", "(FormulaRenderingWorkbook,Ptg[])", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "FormulaShifter", False, "createForColumnCopy", "(int,String,int,int,int,SpreadsheetVersion)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "FormulaShifter", False, "createForColumnShift", "(int,String,int,int,int,SpreadsheetVersion)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "FormulaShifter", False, "createForRowCopy", "(int,String,int,int,int,SpreadsheetVersion)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "FormulaShifter", False, "createForRowShift", "(int,String,int,int,int,SpreadsheetVersion)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "IEvaluationListener$ICacheEntry", True, "getValue", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "LazyRefEval", False, "LazyRefEval", "(int,int,SheetRangeEvaluator)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "NameIdentifier", True, "NameIdentifier", "(String,boolean)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.NameIdentifier._name]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "NameIdentifier", True, "getName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.NameIdentifier._name]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "OperationEvaluationContext", False, "OperationEvaluationContext", "(WorkbookEvaluator,EvaluationWorkbook,int,int,int,EvaluationTracker)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.OperationEvaluationContext._workbook]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "OperationEvaluationContext", False, "OperationEvaluationContext", "(WorkbookEvaluator,EvaluationWorkbook,int,int,int,EvaluationTracker,boolean)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.OperationEvaluationContext._workbook]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "OperationEvaluationContext", False, "getNameXEval", "(NameXPxg)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "OperationEvaluationContext", False, "getWorkbook", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.OperationEvaluationContext._workbook]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SharedFormula", True, "convertSharedFormulas", "(Ptg[],int,int)", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "SheetIdentifier", True, "SheetIdentifier", "(String,NameIdentifier)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.SheetIdentifier._bookName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetIdentifier", True, "SheetIdentifier", "(String,NameIdentifier)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.SheetIdentifier._sheetIdentifier]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetIdentifier", True, "asFormulaString", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "SheetIdentifier", True, "getBookName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.SheetIdentifier._bookName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetIdentifier", True, "getSheetIdentifier", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.SheetIdentifier._sheetIdentifier]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetNameFormatter", False, "appendFormat", "(Appendable,String,String)", "", "Argument[1]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetNameFormatter", False, "appendFormat", "(Appendable,String,String)", "", "Argument[2]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetRangeAndWorkbookIndexFormatter", True, "format", "(StringBuilder,int,String,String)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetRangeAndWorkbookIndexFormatter", True, "format", "(StringBuilder,int,String,String)", "", "Argument[2]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetRangeAndWorkbookIndexFormatter", True, "format", "(StringBuilder,int,String,String)", "", "Argument[2]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetRangeAndWorkbookIndexFormatter", True, "format", "(StringBuilder,int,String,String)", "", "Argument[3]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetRangeAndWorkbookIndexFormatter", True, "format", "(StringBuilder,int,String,String)", "", "Argument[3]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetRangeIdentifier", True, "SheetRangeIdentifier", "(String,NameIdentifier,NameIdentifier)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.SheetIdentifier._sheetIdentifier]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetRangeIdentifier", True, "SheetRangeIdentifier", "(String,NameIdentifier,NameIdentifier)", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.SheetRangeIdentifier._lastSheetIdentifier]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetRangeIdentifier", True, "getFirstSheetIdentifier", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.SheetIdentifier._sheetIdentifier]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "SheetRangeIdentifier", True, "getLastSheetIdentifier", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.SheetRangeIdentifier._lastSheetIdentifier]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "ThreeDEval", True, "getValue", "(int,int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "TwoDEval", True, "getColumn", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "TwoDEval", True, "getRow", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "TwoDEval", True, "getValue", "(int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "WorkbookEvaluator", False, "WorkbookEvaluator", "(EvaluationWorkbook,IStabilityClassifier,UDFFinder)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "WorkbookEvaluator", False, "WorkbookEvaluator", "(EvaluationWorkbook,IStabilityClassifier,UDFFinder)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "WorkbookEvaluator", False, "dereferenceResult", "(ValueEval,int,int)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.CacheAreaEval._values].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "WorkbookEvaluator", False, "dereferenceResult", "(ValueEval,int,int)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula", "WorkbookEvaluator", False, "evaluate", "(EvaluationCell)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "WorkbookEvaluator", False, "evaluate", "(EvaluationCell)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "WorkbookEvaluator", False, "notifyDeleteCell", "(EvaluationCell)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "WorkbookEvaluator", False, "notifyUpdateCell", "(EvaluationCell)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula", "WorkbookEvaluatorProvider", True, "_getWorkbookEvaluator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.ptg.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.ptg.model.yml new file mode 100644 index 000000000000..553e63be9a17 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.ptg.model.yml @@ -0,0 +1,68 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "Area3DPxg", "(Area3DPxg)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.firstSheetName]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.firstSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "Area3DPxg", "(Area3DPxg)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.lastSheetName]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.lastSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "Area3DPxg", "(SheetIdentifier,AreaReference)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "Area3DPxg", "(SheetIdentifier,String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "Area3DPxg", "(int,SheetIdentifier,AreaReference)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "Area3DPxg", "(int,SheetIdentifier,String)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.firstSheetName]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.firstSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.lastSheetName]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.lastSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "getLastSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.lastSheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "getSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.firstSheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "setLastSheetName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.lastSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "setSheetName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.firstSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "toFormulaString", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.firstSheetName]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Area3DPxg", False, "toFormulaString", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Area3DPxg.lastSheetName]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "ArrayPtg", False, "ArrayPtg", "(ArrayPtg)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.ptg.ArrayPtg._arrayValues]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.ArrayPtg._arrayValues]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "ArrayPtg", False, "ArrayPtg", "(Object[][])", "", "Argument[0].ArrayElement.ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.ArrayPtg._arrayValues].ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "ArrayPtg", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.ArrayPtg._arrayValues]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.ptg.ArrayPtg._arrayValues]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "ArrayPtg", False, "toFormulaString", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.ArrayPtg._arrayValues].ArrayElement", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "ArrayPtg", False, "writeTokenValueBytes", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.ArrayPtg._arrayValues].ArrayElement", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "AttrPtg", False, "toFormulaString", "(String[])", "", "Argument[0].ArrayElement", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Deleted3DPxg", False, "Deleted3DPxg", "(Deleted3DPxg)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.ptg.Deleted3DPxg.sheetName]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Deleted3DPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Deleted3DPxg", False, "Deleted3DPxg", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Deleted3DPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Deleted3DPxg", False, "Deleted3DPxg", "(int,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Deleted3DPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Deleted3DPxg", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Deleted3DPxg.sheetName]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.ptg.Deleted3DPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Deleted3DPxg", False, "getSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Deleted3DPxg.sheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Deleted3DPxg", False, "setSheetName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Deleted3DPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "NameXPxg", "(NameXPxg)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.nameName]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.nameName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "NameXPxg", "(NameXPxg)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.sheetName]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "NameXPxg", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.nameName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "NameXPxg", "(String,String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "NameXPxg", "(String,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.nameName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "NameXPxg", "(int,String,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "NameXPxg", "(int,String,String)", "", "Argument[2]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.nameName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.nameName]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.nameName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.sheetName]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "getNameName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.nameName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "getSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.sheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "setSheetName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "NameXPxg", False, "toFormulaString", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.NameXPxg.nameName]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "OperationPtg", True, "toFormulaString", "(String[])", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "ParenthesisPtg", False, "toFormulaString", "(String[])", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ptg", True, "createPtg", "(LittleEndianInput)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ptg", True, "readTokens", "(int,LittleEndianInput)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "Ref3DPxg", "(Ref3DPxg)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.firstSheetName]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.firstSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "Ref3DPxg", "(Ref3DPxg)", "", "Argument[0].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.lastSheetName]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.lastSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "Ref3DPxg", "(SheetIdentifier,CellReference)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "Ref3DPxg", "(SheetIdentifier,String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "Ref3DPxg", "(int,SheetIdentifier,CellReference)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "Ref3DPxg", "(int,SheetIdentifier,String)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.firstSheetName]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.firstSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.lastSheetName]", "ReturnValue.SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.lastSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "getLastSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.lastSheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "getSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.firstSheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "setLastSheetName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.lastSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "setSheetName", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.firstSheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "toFormulaString", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.firstSheetName]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "Ref3DPxg", False, "toFormulaString", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.Ref3DPxg.lastSheetName]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "StringPtg", False, "StringPtg", "(LittleEndianInput)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.ptg", "StringPtg", False, "StringPtg", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.StringPtg.field_3_string]", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "StringPtg", False, "getValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.StringPtg.field_3_string]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.ptg", "StringPtg", False, "write", "(LittleEndianOutput)", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.ptg.StringPtg.field_3_string]", "Argument[0]", "taint", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.udf.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.udf.model.yml new file mode 100644 index 000000000000..9db74ec26a4c --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.formula.udf.model.yml @@ -0,0 +1,16 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.formula.udf", "AggregatingUDFFinder", True, "AggregatingUDFFinder", "(UDFFinder[])", "", "Argument[0].ArrayElement", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.udf", "AggregatingUDFFinder", True, "add", "(UDFFinder)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.udf", "DefaultUDFFinder", False, "DefaultUDFFinder", "(String[],FreeRefFunction[])", "", "Argument[0].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ss.formula.udf.DefaultUDFFinder._functionsByName].MapKey", "taint", "dfc-generated"] + - ["org.apache.poi.ss.formula.udf", "DefaultUDFFinder", False, "DefaultUDFFinder", "(String[],FreeRefFunction[])", "", "Argument[1].ArrayElement", "Argument[this].SyntheticField[org.apache.poi.ss.formula.udf.DefaultUDFFinder._functionsByName].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.udf", "DefaultUDFFinder", False, "findFunction", "(String)", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.udf.DefaultUDFFinder._functionsByName].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.udf", "IndexedUDFFinder", True, "IndexedUDFFinder", "(UDFFinder[])", "", "Argument[0].ArrayElement", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.formula.udf", "IndexedUDFFinder", True, "findFunction", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.formula.udf.IndexedUDFFinder._funcMap].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.udf", "IndexedUDFFinder", True, "getFunctionName", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.ss.formula.udf.IndexedUDFFinder._funcMap].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.formula.udf", "UDFFinder", True, "findFunction", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.usermodel.helpers.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.usermodel.helpers.model.yml new file mode 100644 index 000000000000..5373fd8cacc8 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.usermodel.helpers.model.yml @@ -0,0 +1,10 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.usermodel.helpers", "BaseRowColShifter", True, "shiftRange", "(FormulaShifter,CellRangeAddress,int)", "", "Argument[1]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel.helpers", "RowShifter", True, "RowShifter", "(Sheet)", "", "Argument[0].Element", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel.helpers", "ColumnShifter", True, "ColumnShifter", "(Sheet)", "", "Argument[0]", "Argument[this]", "taint", "manual"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.usermodel.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.usermodel.model.yml new file mode 100644 index 000000000000..0be81cdf4b59 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.usermodel.model.yml @@ -0,0 +1,137 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.ss.usermodel", "WorkbookFactory", True, "create", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.ss.usermodel", "WorkbookFactory", True, "create", "(File,String)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.ss.usermodel", "WorkbookFactory", True, "create", "(File,String,boolean)", "", "Argument[0]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.ss.usermodel", "WorkbookFactory", True, "create", "(File)", "", "ReturnValue", "file", "ai-generated"] + - ["org.apache.poi.ss.usermodel", "WorkbookFactory", True, "create", "(File,String)", "", "ReturnValue", "file", "ai-generated"] + - ["org.apache.poi.ss.usermodel", "WorkbookFactory", True, "create", "(File,String,boolean)", "", "ReturnValue", "file", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.usermodel", "Cell", True, "getCellStyle", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Cell", True, "getRichStringCellValue", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Cell", True, "getRow", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Cell", True, "setCellValue", "(RichTextString)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Cell", True, "setCellValue", "(RichTextString)", "", "Argument[this]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyContext", True, "getMappedStyle", "(CellStyle)", "", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.CellCopyContext.styleMap].MapValue", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyContext", True, "putMappedStyle", "(CellStyle,CellStyle)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.CellCopyContext.styleMap].MapKey", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyContext", True, "putMappedStyle", "(CellStyle,CellStyle)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.CellCopyContext.styleMap].MapValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyPolicy$Builder", True, "cellFormula", "(boolean)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyPolicy$Builder", True, "cellStyle", "(boolean)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyPolicy$Builder", True, "cellValue", "(boolean)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyPolicy$Builder", True, "condenseRows", "(boolean)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyPolicy$Builder", True, "copyHyperlink", "(boolean)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyPolicy$Builder", True, "mergeHyperlink", "(boolean)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyPolicy$Builder", True, "mergedRegions", "(boolean)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellCopyPolicy$Builder", True, "rowHeight", "(boolean)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellStyle", True, "getFormatProperties", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "CellValue", False, "CellValue", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.CellValue._textValue]", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellValue", False, "formatAsString", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.CellValue._textValue]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "CellValue", False, "getStringValue", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.CellValue._textValue]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "ColorScaleFormatting", True, "createThreshold", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ColorScaleFormatting", True, "getColors", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ColorScaleFormatting", True, "getThresholds", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ConditionalFormatting", True, "getRule", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ConditionalFormattingRule", True, "createBorderFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ConditionalFormattingRule", True, "createFontFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ConditionalFormattingRule", True, "createPatternFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ConditionalFormattingRule", True, "getColorScaleFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ConditionalFormattingRule", True, "getDataBarFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ConditionalFormattingRule", True, "getMultiStateFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "CreationHelper", True, "createDataFormat", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "CreationHelper", True, "createFormulaEvaluator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataBarFormatting", True, "getColor", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataBarFormatting", True, "getMaxThreshold", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataBarFormatting", True, "getMinThreshold", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataBarFormatting", True, "setColor", "(Color)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "DataFormatter", "(Locale)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "DataFormatter", "(Locale,boolean)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "DataFormatter", "(Locale,boolean,boolean)", "", "Argument[this]", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.DataFormatter.pcs]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "addFormat", "(String,Format)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "addFormat", "(String,Format)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "createFormat", "(Cell)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "formatRawCellContents", "(double,int,String)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "formatRawCellContents", "(double,int,String,boolean)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "getDefaultFormat", "(Cell)", "", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.DataFormatter.defaultNumFormat]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "getLocaleChangedObservable", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.DataFormatter.pcs]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "setDefaultNumberFormat", "(Format)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.DataFormatter.defaultNumFormat]", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "DataFormatter", True, "updateLocale", "(Locale)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DateUtil", True, "getJavaCalendar", "(double,boolean,TimeZone)", "", "Argument[2]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DateUtil", True, "getJavaCalendar", "(double,boolean,TimeZone,boolean)", "", "Argument[2]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DifferentialStyleProvider", True, "getBorderFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DifferentialStyleProvider", True, "getFontFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "DifferentialStyleProvider", True, "getPatternFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ExcelGeneralNumberFormat", True, "ExcelGeneralNumberFormat", "(Locale)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ExcelNumberFormat", True, "ExcelNumberFormat", "(int,String)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.ExcelNumberFormat.format]", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "ExcelNumberFormat", True, "from", "(Cell,ConditionalFormattingEvaluator)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ExcelNumberFormat", True, "getFormat", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.usermodel.ExcelNumberFormat.format]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "ExcelStyleDateFormatter", True, "ExcelStyleDateFormatter", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ExcelStyleDateFormatter", True, "ExcelStyleDateFormatter", "(String,DateFormatSymbols)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ExcelStyleDateFormatter", True, "ExcelStyleDateFormatter", "(String,DateFormatSymbols)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ExcelStyleDateFormatter", True, "ExcelStyleDateFormatter", "(String,Locale)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ExcelStyleDateFormatter", True, "format", "(Date,StringBuffer,FieldPosition)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "ExtendedColor", True, "getRGBWithTint", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "FormulaEvaluator", True, "evaluateInCell", "(Cell)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.usermodel", "FractionFormat", True, "FractionFormat", "(String,String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "IconMultiStateFormatting", True, "createThreshold", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "IconMultiStateFormatting", True, "getThresholds", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "ObjectData", True, "getDirectory", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Picture", True, "getSheet", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "PictureData", True, "getData", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "RangeCopier", True, "RangeCopier", "(Sheet)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.ss.usermodel", "RangeCopier", True, "RangeCopier", "(Sheet,Sheet)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.ss.usermodel", "RangeCopier", True, "RangeCopier", "(Sheet,Sheet)", "", "Argument[1]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.ss.usermodel", "RangeCopier", True, "cloneCellContent", "(Cell,Cell,Map)", "", "Argument[1]", "Argument[2].Element", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Row", True, "getRowStyle", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "createDrawingPatriarch", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getCellComment", "(CellAddress)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getCellComments", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getColumnStyle", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getDrawingPatriarch", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getFooter", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getHeader", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getHyperlink", "(CellAddress)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getHyperlink", "(int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getHyperlinkList", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getRow", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "getSheetConditionalFormatting", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "removeArrayFormula", "(Cell)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "rowIterator", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "setArrayFormula", "(String,CellRangeAddress)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Sheet", True, "setAutoFilter", "(CellRangeAddress)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "SheetConditionalFormatting", True, "createConditionalFormattingColorScaleRule", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "SheetConditionalFormatting", True, "createConditionalFormattingRule", "(ExtendedColor)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "SheetConditionalFormatting", True, "createConditionalFormattingRule", "(IconMultiStateFormatting$IconSet)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "SheetConditionalFormatting", True, "createConditionalFormattingRule", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "SheetConditionalFormatting", True, "createConditionalFormattingRule", "(byte,String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "SheetConditionalFormatting", True, "createConditionalFormattingRule", "(byte,String,String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "SheetConditionalFormatting", True, "getConditionalFormattingAt", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "createCellStyle", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "createDataFormat", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "createEvaluationWorkbook", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "createFont", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "createName", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "findFont", "(boolean,short,short,String,boolean,boolean,short,byte)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "getAllNames", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "getCellStyleAt", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "getCreationHelper", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "getFontAt", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "getName", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "getNames", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "getSheet", "(String)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "Workbook", True, "getSheetAt", "(int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "WorkbookFactory", False, "create", "(DirectoryNode)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "WorkbookFactory", False, "create", "(DirectoryNode,String)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "WorkbookFactory", False, "create", "(POIFSFileSystem)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.usermodel", "WorkbookProvider", True, "create", "(DirectoryNode,String)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.util.cellwalk.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.util.cellwalk.model.yml new file mode 100644 index 000000000000..7b2e035e1d7a --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.util.cellwalk.model.yml @@ -0,0 +1,9 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.util.cellwalk", "CellWalk", True, "CellWalk", "(Sheet,CellRangeAddress)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.ss.util.cellwalk", "CellWalk", True, "CellWalk", "(Sheet,CellRangeAddress)", "", "Argument[1]", "Argument[this]", "taint", "manual"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.util.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.util.model.yml new file mode 100644 index 000000000000..d1dc6c55fe40 --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.ss.util.model.yml @@ -0,0 +1,51 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.ss.util", "AreaReference", True, "AreaReference", "(CellReference,CellReference,SpreadsheetVersion)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.util.AreaReference._firstCell]", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "AreaReference", True, "AreaReference", "(CellReference,CellReference,SpreadsheetVersion)", "", "Argument[1]", "Argument[this].SyntheticField[org.apache.poi.ss.util.AreaReference._lastCell]", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "AreaReference", True, "AreaReference", "(String,SpreadsheetVersion)", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.AreaReference._firstCell]", "Argument[this].SyntheticField[org.apache.poi.ss.util.AreaReference._lastCell]", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "AreaReference", True, "getAllReferencedCells", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.AreaReference._firstCell]", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "AreaReference", True, "getFirstCell", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.AreaReference._firstCell]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "AreaReference", True, "getLastCell", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.AreaReference._lastCell]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellRangeAddressList", True, "addCellRangeAddress", "(CellRangeAddress)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.util.CellRangeAddressList._list].Element", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellRangeAddressList", True, "getCellRangeAddress", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.CellRangeAddressList._list].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellRangeAddressList", True, "getCellRangeAddresses", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.CellRangeAddressList._list].Element", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellRangeAddressList", True, "getGenericChildren", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.CellRangeAddressList._list]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellRangeAddressList", True, "remove", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.CellRangeAddressList._list].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellRangeUtil", False, "mergeCellRanges", "(CellRangeAddress[])", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellReference", True, "CellReference", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.util.CellReference._sheetName]", "taint", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellReference", True, "CellReference", "(String,int,int,boolean,boolean)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.util.CellReference._sheetName]", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellReference", True, "getCellRefParts", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.CellReference._sheetName]", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellReference", True, "getSheetName", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.CellReference._sheetName]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "CellUtil", False, "copyCell", "(Cell,Cell,CellCopyPolicy,CellCopyContext)", "", "Argument[0]", "Argument[1]", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "CellUtil", False, "copyCell", "(Cell,Cell,CellCopyPolicy,CellCopyContext)", "", "Argument[1]", "Argument[0]", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "CellUtil", False, "createCell", "(Row,int,String)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "CellUtil", False, "createCell", "(Row,int,String,CellStyle)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "CellUtil", False, "getCell", "(Row,int)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "CellUtil", False, "getRow", "(int,Sheet)", "", "Argument[1].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "CellUtil", False, "translateUnicodeValues", "(Cell)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "DateFormatConverter$DateFormatTokenizer", True, "DateFormatTokenizer", "(String)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.ss.util.DateFormatConverter$DateFormatTokenizer.format]", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "DateFormatConverter$DateFormatTokenizer", True, "getNextToken", "()", "", "Argument[this].SyntheticField[org.apache.poi.ss.util.DateFormatConverter$DateFormatTokenizer.format]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.util", "DateFormatConverter$DateFormatTokenizer", True, "tokenize", "(String)", "", "Argument[0]", "ReturnValue.ArrayElement", "taint", "dfc-generated"] + - ["org.apache.poi.ss.util", "DateFormatConverter", False, "convert", "(Locale,DateFormat)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "DateFormatConverter", False, "convert", "(Locale,String)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.util", "DateFormatConverter", False, "getJavaDatePattern", "(int,Locale)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "DateFormatConverter", False, "getJavaDateTimePattern", "(int,Locale)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "DateFormatConverter", False, "getJavaTimePattern", "(int,Locale)", "", "Argument[1]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "SSCellRange", False, "create", "(int,int,int,int,List,Class)", "", "Argument[4].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "SSCellRange", False, "getCell", "(int,int)", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "SSCellRange", False, "getFlattenedCells", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "SSCellRange", False, "getTopLeftCell", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "SheetBuilder", True, "SheetBuilder", "(Workbook,Object[][])", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["org.apache.poi.ss.util", "SheetBuilder", True, "SheetBuilder", "(Workbook,Object[][])", "", "Argument[1].ArrayElement", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "SheetBuilder", True, "build", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "SheetBuilder", True, "setCreateEmptyCells", "(boolean)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "SheetBuilder", True, "setSheetName", "(String)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.ss.util", "SheetUtil", True, "getCell", "(Sheet,int,int)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "SheetUtil", True, "getCellWithMerges", "(Sheet,int,int)", "", "Argument[0].Element", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.ss.util", "WorkbookUtil", True, "createSafeSheetName", "(String)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.ss.util", "WorkbookUtil", True, "createSafeSheetName", "(String,char)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.util.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.util.model.yml new file mode 100644 index 000000000000..17d26b26656b --- /dev/null +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.util.model.yml @@ -0,0 +1,195 @@ +# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT. +# Generated from https://github.com/apache/poi#bd97feb849ab86670fe5b5513d4066c46b599797 by codeql-mads-via-llm +extensions: + - addsTo: + pack: codeql/java-all + extensible: sinkModel + data: + - ["org.apache.poi.util", "GenericRecordJsonWriter", True, "GenericRecordJsonWriter", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.util", "GenericRecordXmlWriter", True, "GenericRecordXmlWriter", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.util", "HexRead", True, "readData", "(String)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.util", "HexRead", True, "readData", "(String,String)", "", "Argument[0]", "path-injection", "ai-generated"] + - ["org.apache.poi.util", "IOUtils", True, "copy", "(InputStream,File)", "", "Argument[1]", "path-injection", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["org.apache.poi.util", "DefaultTempFileCreationStrategy", True, "getJavaIoTmpDir", "()", "", "ReturnValue", "environment", "ai-generated"] + - ["org.apache.poi.util", "DrawingDump", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] + - ["org.apache.poi.util", "FontMetricsDumper", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] + - ["org.apache.poi.util", "HexRead", True, "readData", "(String)", "", "ReturnValue", "file", "ai-generated"] + - ["org.apache.poi.util", "HexRead", True, "readData", "(String,String)", "", "ReturnValue", "file", "ai-generated"] + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["org.apache.poi.util", "CodePageUtil", True, "getBytesInCodePage", "(String,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "CodePageUtil", True, "getStringFromCodePage", "(byte[],int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "CodePageUtil", True, "getStringFromCodePage", "(byte[],int,int,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "CodepointsUtil", True, "primitiveIterator", "(String)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.util", "DefaultTempFileCreationStrategy", True, "DefaultTempFileCreationStrategy", "(File)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "DelayableLittleEndianOutput", True, "createDelayedOutput", "(int)", "", "Argument[this]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "DocumentFormatException", True, "DocumentFormatException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "DocumentFormatException", True, "DocumentFormatException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "DocumentFormatException", True, "DocumentFormatException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "DocumentFormatException", True, "DocumentFormatException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "GenericRecordJsonWriter", True, "GenericRecordJsonWriter", "(Appendable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier)", "", "Argument[0]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier)", "", "Argument[1]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier)", "", "Argument[0]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier)", "", "Argument[1]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier)", "", "Argument[2]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier)", "", "Argument[3]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier)", "", "Argument[0]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier)", "", "Argument[1]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier)", "", "Argument[2]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier)", "", "Argument[3]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier)", "", "Argument[4]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier)", "", "Argument[5]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[0]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[1]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[2]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[3]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[4]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[5]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[6]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[7]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[0]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[1]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[2]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[3]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[4]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[5]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[6]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[7]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[8]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[9]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[0]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[10]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[11]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[1]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[2]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[3]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[4]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[5]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[6]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[7]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[8]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[9]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[0]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[10]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[11]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[12]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[13]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[1]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[2]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[3]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[4]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[5]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[6]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[7]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[8]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[9]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[0]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[10]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[11]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[12]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[13]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[14]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[15]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[1]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[2]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[3]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[4]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[5]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[6]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[7]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[8]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[9]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[0]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[10]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[11]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[12]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[13]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[14]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[15]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[16]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[17]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[1]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[2]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[3]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[4]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[5]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[6]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[7]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[8]", "ReturnValue.MapKey", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil", False, "getGenericProperties", "(String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier,String,Supplier)", "", "Argument[9]", "ReturnValue.MapValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "GenericRecordUtil$AnnotatedFlag", True, "getDescription", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.util", "GenericRecordUtil$AnnotatedFlag", True, "getValue", "()", "", "Argument[this]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.util", "GenericRecordXmlWriter", True, "GenericRecordXmlWriter", "(Appendable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "IOUtils", False, "copy", "(InputStream,OutputStream)", "", "Argument[0]", "Argument[1]", "taint", "df-generated"] + - ["org.apache.poi.util", "IOUtils", False, "copy", "(InputStream,OutputStream,long)", "", "Argument[0]", "Argument[1]", "taint", "df-generated"] + - ["org.apache.poi.util", "IOUtils", False, "newFile", "(File,String)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "newFile", "(File,String)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "normalizePath", "(String)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "readFully", "(InputStream,byte[])", "", "Argument[0]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "readFully", "(InputStream,byte[],int,int)", "", "Argument[0]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "readFully", "(ReadableByteChannel,ByteBuffer)", "", "Argument[0]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "safelyClone", "(byte[],int,int,int)", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "safelyClone", "(byte[],int,int,int,String)", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "toByteArray", "(ByteBuffer,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "toByteArray", "(InputStream)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "toByteArray", "(InputStream,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "toByteArray", "(InputStream,int,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "toByteArray", "(InputStream,int,int,String)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "toByteArray", "(InputStream,long,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "toByteArray", "(InputStream,long,int,String)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IOUtils", False, "toByteArrayWithMaxLength", "(InputStream,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "IntMapper", True, "IntMapper", "(IntMapper)", "", "Argument[0].SyntheticField[org.apache.poi.util.IntMapper.elements].Element", "Argument[this].SyntheticField[org.apache.poi.util.IntMapper.elements].Element", "value", "dfc-generated"] + - ["org.apache.poi.util", "IntMapper", True, "add", "(Object)", "", "Argument[0]", "Argument[this].SyntheticField[org.apache.poi.util.IntMapper.elements].Element", "value", "dfc-generated"] + - ["org.apache.poi.util", "IntMapper", True, "copy", "()", "", "Argument[this].SyntheticField[org.apache.poi.util.IntMapper.elements].Element", "ReturnValue.SyntheticField[org.apache.poi.util.IntMapper.elements].Element", "value", "dfc-generated"] + - ["org.apache.poi.util", "IntMapper", True, "get", "(int)", "", "Argument[this].SyntheticField[org.apache.poi.util.IntMapper.elements].Element", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "IntMapper", True, "getElements", "()", "", "Argument[this].SyntheticField[org.apache.poi.util.IntMapper.elements]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "LittleEndianByteArrayInputStream", True, "LittleEndianByteArrayInputStream", "(byte[])", "", "Argument[0]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "LittleEndianByteArrayInputStream", True, "LittleEndianByteArrayInputStream", "(byte[],int)", "", "Argument[0]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "LittleEndianByteArrayInputStream", True, "LittleEndianByteArrayInputStream", "(byte[],int,int)", "", "Argument[0]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "LittleEndianByteArrayOutputStream", False, "LittleEndianByteArrayOutputStream", "(byte[],int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "LittleEndianByteArrayOutputStream", False, "LittleEndianByteArrayOutputStream", "(byte[],int,int)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "LittleEndianInput", True, "readFully", "(byte[])", "", "Argument[this]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "LittleEndianInput", True, "readFully", "(byte[],int,int)", "", "Argument[this]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "LittleEndianInput", True, "readPlain", "(byte[],int,int)", "", "Argument[this]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "LittleEndianOutput", True, "write", "(byte[])", "", "Argument[0]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "LittleEndianOutput", True, "write", "(byte[],int,int)", "", "Argument[0]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "LittleEndianOutputStream", False, "LittleEndianOutputStream", "(OutputStream)", "", "Argument[0]", "Argument[this]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "LocaleUtil", False, "getLocaleCalendar", "(TimeZone)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.util", "RLEDecompressingInputStream", True, "RLEDecompressingInputStream", "(InputStream)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "RecordFormatException", True, "RecordFormatException", "(String)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "RecordFormatException", True, "RecordFormatException", "(String,Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "RecordFormatException", True, "RecordFormatException", "(String,Throwable)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "RecordFormatException", True, "RecordFormatException", "(Throwable)", "", "Argument[0]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "ReplacingInputStream", True, "ReplacingInputStream", "(InputStream,String,String)", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "ReplacingInputStream", True, "ReplacingInputStream", "(InputStream,String,String)", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "ReplacingInputStream", True, "ReplacingInputStream", "(InputStream,byte[],byte[])", "", "Argument[1]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "ReplacingInputStream", True, "ReplacingInputStream", "(InputStream,byte[],byte[])", "", "Argument[2]", "Argument[this]", "taint", "df-generated"] + - ["org.apache.poi.util", "StringUtil", False, "getFromCompressedUTF8", "(byte[],int,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "getFromCompressedUnicode", "(byte[],int,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "getFromUnicodeLE", "(byte[])", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "getFromUnicodeLE", "(byte[],int,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "getFromUnicodeLE0Terminated", "(byte[],int,int)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "getToUnicodeLE", "(String)", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "join", "(Object[])", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "join", "(Object[],String)", "", "Argument[0].ArrayElement", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "join", "(Object[],String)", "", "Argument[1]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "join", "(String,Object[])", "", "Argument[0]", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "join", "(String,Object[])", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "mapMsCodepointString", "(String)", "", "Argument[0]", "ReturnValue", "value", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "putCompressedUnicode", "(String,LittleEndianOutput)", "", "Argument[0]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "putCompressedUnicode", "(String,byte[],int)", "", "Argument[0]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "putUnicodeLE", "(String,LittleEndianOutput)", "", "Argument[0]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "putUnicodeLE", "(String,byte[],int)", "", "Argument[0]", "Argument[1]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "readCompressedUnicode", "(LittleEndianInput,int)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.util", "StringUtil", False, "readUnicodeLE", "(LittleEndianInput,int)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.util", "StringUtil", False, "readUnicodeString", "(LittleEndianInput)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.util", "StringUtil", False, "readUnicodeString", "(LittleEndianInput,int)", "", "Argument[0]", "ReturnValue", "taint", "df-generated"] + - ["org.apache.poi.util", "StringUtil", False, "writeUnicodeString", "(LittleEndianOutput,String)", "", "Argument[1]", "Argument[0]", "taint", "dfc-generated"] + - ["org.apache.poi.util", "StringUtil", False, "writeUnicodeStringFlagAndData", "(LittleEndianOutput,String)", "", "Argument[1]", "Argument[0]", "taint", "dfc-generated"] From 982f6a5e8ab30df3f39b7b636582ea34c18c07fa Mon Sep 17 00:00:00 2001 From: Asger F Date: Wed, 1 Jul 2026 21:49:48 +0200 Subject: [PATCH 03/44] unified: Move Comments.ql into AstExtra.qll Also move into 'internal' and expose through a Public module --- unified/ql/lib/codeql/unified/Comments.qll | 18 --------------- .../lib/codeql/unified/internal/AstExtra.qll | 22 +++++++++++++++++++ unified/ql/lib/unified.qll | 2 +- 3 files changed, 23 insertions(+), 19 deletions(-) delete mode 100644 unified/ql/lib/codeql/unified/Comments.qll create mode 100644 unified/ql/lib/codeql/unified/internal/AstExtra.qll diff --git a/unified/ql/lib/codeql/unified/Comments.qll b/unified/ql/lib/codeql/unified/Comments.qll deleted file mode 100644 index e839af2dbee2..000000000000 --- a/unified/ql/lib/codeql/unified/Comments.qll +++ /dev/null @@ -1,18 +0,0 @@ -/** Provides classes for working with comments. */ - -private import unified - -/** - * A comment appearing in the source code. - */ -class Comment extends TriviaToken { - // At the moment, comments are the only type trivia token we extract - /** - * Gets the text inside this comment, not counting the delimeters. - */ - string getCommentText() { - result = this.getValue().regexpCapture("//(.*)", 1) - or - result = this.getValue().regexpCapture("(?s)/\\*(.*)\\*/", 1) - } -} diff --git a/unified/ql/lib/codeql/unified/internal/AstExtra.qll b/unified/ql/lib/codeql/unified/internal/AstExtra.qll new file mode 100644 index 000000000000..df98711c9750 --- /dev/null +++ b/unified/ql/lib/codeql/unified/internal/AstExtra.qll @@ -0,0 +1,22 @@ +/** + * Provides additional AST-like classes outside the generated tree-sitter classes. + */ + +private import unified + +module Public { + /** + * A comment appearing in the source code. + */ + class Comment extends TriviaToken { + // At the moment, comments are the only type trivia token we extract + /** + * Gets the text inside this comment, not counting the delimeters. + */ + string getCommentText() { + result = this.getValue().regexpCapture("//(.*)", 1) + or + result = this.getValue().regexpCapture("(?s)/\\*(.*)\\*/", 1) + } + } +} diff --git a/unified/ql/lib/unified.qll b/unified/ql/lib/unified.qll index 4f7387ef8f1c..73af928aa4e4 100644 --- a/unified/ql/lib/unified.qll +++ b/unified/ql/lib/unified.qll @@ -5,4 +5,4 @@ import codeql.Locations import codeql.files.FileSystem import codeql.unified.Ast::Unified -import codeql.unified.Comments +import codeql.unified.internal.AstExtra::Public From 970e991b2c690c046d2879f8fd609cb2b40d43e8 Mon Sep 17 00:00:00 2001 From: Asger F Date: Wed, 1 Jul 2026 21:50:04 +0200 Subject: [PATCH 04/44] unified: Add a few more AST helper classes --- .../lib/codeql/unified/internal/AstExtra.qll | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/unified/ql/lib/codeql/unified/internal/AstExtra.qll b/unified/ql/lib/codeql/unified/internal/AstExtra.qll index df98711c9750..ba625aad5fe7 100644 --- a/unified/ql/lib/codeql/unified/internal/AstExtra.qll +++ b/unified/ql/lib/codeql/unified/internal/AstExtra.qll @@ -5,6 +5,39 @@ private import unified module Public { + /** + * A logical 'and' expression with short-circuiting. + */ + class LogicalAndExpr extends BinaryExpr { + LogicalAndExpr() { this.getOperator().getValue() = "&&" } + + Expr getAnOperand() { result = [this.getLeft(), this.getRight()] } + } + + /** + * Declaration of a local or top-level variable. + */ + class LocalVariableDeclaration extends VariableDeclaration { + private Block block; + + LocalVariableDeclaration() { this = block.getStmt(_) } + + /** Gets the block in which this variable is declared. */ + Block getDeclaringBlock() { result = block } + } + + /** + * Declaration of a local or top-level function. + */ + class LocalFunctionDeclaration extends FunctionDeclaration { + private Block block; + + LocalFunctionDeclaration() { this = block.getStmt(_) } + + /** Gets the block in which this function is declared. */ + Block getDeclaringBlock() { result = block } + } + /** * A comment appearing in the source code. */ From bced7bb6d2577d57846cea318636271a6ec92f4c Mon Sep 17 00:00:00 2001 From: Asger F Date: Wed, 1 Jul 2026 21:51:21 +0200 Subject: [PATCH 05/44] unified: Add local name binding and tests As documented in the test, 'guard if' statements are still not properly supported. --- .../lib/codeql/unified/internal/Variables.qll | 244 ++++++++++++++ unified/ql/lib/qlpack.yml | 1 + unified/ql/lib/unified.qll | 1 + .../test/library-tests/variables/test.swift | 309 ++++++++++++++++++ .../variables/variables.expected | 0 .../test/library-tests/variables/variables.ql | 51 +++ 6 files changed, 606 insertions(+) create mode 100644 unified/ql/lib/codeql/unified/internal/Variables.qll create mode 100644 unified/ql/test/library-tests/variables/test.swift create mode 100644 unified/ql/test/library-tests/variables/variables.expected create mode 100644 unified/ql/test/library-tests/variables/variables.ql diff --git a/unified/ql/lib/codeql/unified/internal/Variables.qll b/unified/ql/lib/codeql/unified/internal/Variables.qll new file mode 100644 index 000000000000..51ff5a5ab7f1 --- /dev/null +++ b/unified/ql/lib/codeql/unified/internal/Variables.qll @@ -0,0 +1,244 @@ +/** + * Provides classes for reasoning about lexically scoped variables and references to these. + */ + +private import unified +private import unified as U +private import codeql.namebinding.LocalNameBinding + +private module LocalNameBindingInput implements LocalNameBindingInputSig { + class AstNode = U::AstNode; + + private class LogicalAndRoot extends LogicalAndExpr { + LogicalAndRoot() { not this = any(LogicalAndExpr e).getAnOperand() } + + private Expr getDescendent(string path) { + path = "" and result = this + or + exists(LogicalAndExpr mid, string midPath | mid = this.getDescendent(midPath) | + result = mid.getLeft() and path = midPath + "A" + or + result = mid.getRight() and path = midPath + "B" + ) + } + + Expr getNthLeaf(int n) { + result = + rank[n](Expr e, string path | + e = this.getDescendent(path) and not e instanceof LogicalAndExpr + | + e order by path + ) + } + + Expr getLastLeaf() { result = max(int n | | this.getNthLeaf(n) order by n) } + } + + private AstNode getChild1(AstNode n, int index) { + result = n.(Block).getStmt(index) + or + result = n.(LogicalAndRoot).getNthLeaf(index) + or + exists(PatternGuardExpr guard | n = guard | + index = 0 and result = guard.getPattern() + or + index = 1 and result = guard.getValue() + ) + or + exists(IfExpr expr | n = expr | + index = 0 and result = expr.getCondition() + or + index = 1 and result = expr.getThen() + or + index = 2 and result = expr.getElse() + ) + or + exists(VariableDeclaration decl | n = decl | + index = 0 and result = decl.getPattern() + or + index = 1 and result = decl.getType() + or + index = 2 and result = decl.getValue() + ) + } + + AstNode getChild(AstNode n, int index) { + result = getChild1(n, index) + or + not exists(getChild1(n, _)) and + not n instanceof LogicalAndExpr and // also ignore intermediate nodes within a 'logical and' tree + index = 0 and + result = n.getAFieldOrChild() + } + + abstract class Conditional extends AstNode { + /** Gets the condition of this conditional. */ + abstract AstNode getCondition(); + + /** Gets the then-branch of this conditional. */ + abstract AstNode getThen(); + + /** Gets the else-branch of this conditional. */ + abstract AstNode getElse(); + } + + private class IfExprConditional extends Conditional instanceof IfExpr { + override AstNode getCondition() { result = IfExpr.super.getCondition() } + + override AstNode getThen() { result = IfExpr.super.getThen() } + + override AstNode getElse() { result = IfExpr.super.getElse() } + } + + abstract class SiblingShadowingDecl extends AstNode { + /** Gets the left-hand side of this declaration. */ + abstract AstNode getLhs(); + + /** + * Gets the right-hand side of this declaration. + * + * Any local declared in the left-hand side of this declaration is _not_ in scope + * in the right-hand side. + */ + abstract AstNode getRhs(); + + /** + * Gets the else-branch of this declaration, if any. + * + * Any local declared in the left-hand side of this declaration is _not_ in scope + * in the else-branch. + */ + abstract AstNode getElse(); + } + + private class LocalVariableDeclarationSiblingShadowingDecl extends SiblingShadowingDecl instanceof LocalVariableDeclaration + { + override AstNode getLhs() { result = LocalVariableDeclaration.super.getPattern() } + + override AstNode getRhs() { result = LocalVariableDeclaration.super.getValue() } + + override AstNode getElse() { none() } + } + + private class PatternGuardExprSiblingShadowingDecl extends SiblingShadowingDecl instanceof PatternGuardExpr + { + override AstNode getLhs() { result = PatternGuardExpr.super.getPattern() } + + override AstNode getRhs() { result = PatternGuardExpr.super.getValue() } + + override AstNode getElse() { none() } + } + + private class GuardIfStmtSiblingShadowingDecl extends SiblingShadowingDecl instanceof GuardIfStmt { + override AstNode getLhs() { result = GuardIfStmt.super.getCondition() } + + override AstNode getRhs() { none() } + + override AstNode getElse() { result = GuardIfStmt.super.getElse() } + } + + private predicate bindingContext(AstNode pattern, AstNode scope) { + exists(LocalVariableDeclaration decl | + scope = decl and // LocalVariableDeclaration is a ShadowingSiblingDecl, it must use itself as the scope + pattern = decl.getPattern() + ) + or + exists(LocalFunctionDeclaration func | + scope = func.getDeclaringBlock() and + pattern = func.getName() + ) + or + exists(Parameter param | + scope = param.getParent() and // TODO: add SourceCallable and use .getParameter() instead + pattern = param.getPattern() + ) + or + exists(CatchClause catch | + scope = catch and // ensure both 'body' and 'guard' clause are in scope + pattern = catch.getPattern() + ) + or + exists(SwitchCase case | + scope = case and // ensure both 'body' and 'guard' clause are in scope (TODO: merge CatchClause and SwitchCase?) + pattern = case.getPattern() + ) + or + exists(ForEachStmt stmt | + scope = stmt and // ensure both 'body' and 'guard' are in scope + pattern = stmt.getPattern() + ) + or + exists(TuplePattern pat | + bindingContext(pat, scope) and + pattern = pat.getElement(_).getPattern() + ) + or + exists(ConstructorPattern pat | + bindingContext(pat, scope) and + pattern = pat.getElement(_).getPattern() + ) + or + exists(OrPattern pat | + bindingContext(pat, scope) and + pattern = pat.getPattern(_) + ) + or + exists(PatternGuardExpr expr | + pattern = expr.getPattern() and + scope = expr + ) + } + + predicate declInScope(AstNode definingNode, string name, AstNode scope) { + bindingContext(definingNode, scope) and + ( + definingNode.(NamePattern).getIdentifier().getValue() = name + or + definingNode.(Identifier).getValue() = name + ) + } + + predicate implicitDeclInScope(string name, AstNode scope) { + none() + // TODO: self + } + + predicate accessCand(AstNode n, string name) { + n.(NameExpr).getIdentifier().getValue() = name + or + n.(NamePattern).getIdentifier().getValue() = name + or + n = any(LocalFunctionDeclaration f).getName() and + n.(Identifier).getValue() = name + } + + predicate lookupStartsAt(AstNode n, AstNode scope) { none() } +} + +module LocalNameBindingOutput = LocalNameBinding; + +module Public { + /** + * A local variable. + */ + class Variable extends LocalNameBindingOutput::Local { + VariableAccess getAnAccess() { result.getVariable() = this } + } + + /** + * An AST node that is a reference to a local variable. + */ + class VariableAccess extends AstNode instanceof LocalNameBindingOutput::LocalAccess { + Variable getVariable() { result = super.getLocal() } + + Identifier getIdentifier() { + result = this.(NameExpr).getIdentifier() + or + result = this.(NamePattern).getIdentifier() + or + result = this + } + + string getName() { result = this.getIdentifier().getValue() } + } +} diff --git a/unified/ql/lib/qlpack.yml b/unified/ql/lib/qlpack.yml index 896bf37ac5e5..d67af16271b6 100644 --- a/unified/ql/lib/qlpack.yml +++ b/unified/ql/lib/qlpack.yml @@ -7,5 +7,6 @@ library: true upgrades: upgrades dependencies: codeql/util: ${workspace} + codeql/namebinding: ${workspace} warnOnImplicitThis: true compileForOverlayEval: true diff --git a/unified/ql/lib/unified.qll b/unified/ql/lib/unified.qll index 73af928aa4e4..477ac22f3661 100644 --- a/unified/ql/lib/unified.qll +++ b/unified/ql/lib/unified.qll @@ -6,3 +6,4 @@ import codeql.Locations import codeql.files.FileSystem import codeql.unified.Ast::Unified import codeql.unified.internal.AstExtra::Public +import codeql.unified.internal.Variables::Public diff --git a/unified/ql/test/library-tests/variables/test.swift b/unified/ql/test/library-tests/variables/test.swift new file mode 100644 index 000000000000..2f942605029c --- /dev/null +++ b/unified/ql/test/library-tests/variables/test.swift @@ -0,0 +1,309 @@ +func t1() -> Int { + let x = 42 // name=x1 + return x // $ access=x1 +} + +func t2() -> Int { + let x = 42 // name=x1 + + if case let x = x + 10 { // $ access=x1 // name=x2 + print(x) // $ access=x2 + } + print(x) // $ access=x1 +} + +func t3() -> Int { + guard let x = foo() else { // name=x1 + return 0 + } + print(x) // $ MISSING: access=x1 +} + +// Function parameters +func t4(x: Int) -> Int { // name=x1 + return x // $ access=x1 +} + +// Multiple parameters +func t5(x: Int, // name=x1 + y: Int) -> Int { // name=y1 + let z = x + // $ access=x1 // name=z1 + y // $ access=y1 + return z // $ access=z1 +} + +// Parameter shadowed by local variable +func t6(x: Int) -> Int { // name=x1 + let x = x * 2 // $ access=x1 // name=x2 + return x // $ access=x2 +} + +// Nested blocks +func t7() { + let x = 1 // name=x1 + { + print(x) // $ MISSING: access=x1 + let x = 2 // name=x2 + print(x) // $ access=x2 + } + print(x) // $ access=x1 +} + +// For-in loop +func t8() { + let array = [1, 2, 3] // name=array1 + for x in array { // $ access=array1 // name=x1 + print(x) // $ access=x1 + } +} + +// For-in loop with shadowing +func t9() { + let x = 0 // name=x1 + let array = [1, 2, 3] // name=array1 + for x in array { // $ access=array1 // name=x2 + print(x) // $ access=x2 + } + print(x) // $ access=x1 +} + +// Switch statement with case bindings +func t10(value: Int) { // name=value1 + switch value { // $ access=value1 + case let x: // name=x1 + print(x) // $ access=x1 + default: + break + } +} + +// Switch with multiple cases +func t11(value: Int) { // name=value1 + switch value { // $ access=value1 + case let x where x > 0: // name=x1 + print(x) // $ access=x1 + case let x: // name=x2 + print(x) // $ access=x2 + } +} + +// Tuple unpacking +func t12() { + let tuple = (1, 2) // name=tuple1 + let (x, // name=x1 + y) = tuple // $ access=tuple1 // name=y1 + print(x) // $ MISSING: access=x1 // because x,y are incorrectly mapped to expr_equality_pattern + print(y) // $ MISSING: access=y1 +} + +// Tuple unpacking with underscore +func t13() { + let tuple = (1, 2, 3) // name=tuple1 + let (x, // name=x1 + _, + y) = tuple // $ access=tuple1 // name=y1 + print(x) // $ MISSING: access=x1 + print(y) // $ MISSING: access=y1 +} + +// Optional binding (if let) +func t14(optional: Int?) { // name=optional1 + if let x = optional { // $ access=optional1 // name=x1 + print(x) // $ access=x1 + } +} + +// Multiple optional bindings +func t15(opt1: Int?, // name=opt11 + opt2: String?) { // name=opt21 + if let x = opt1, // $ access=opt11 // name=x1 + let y = opt2 { // $ access=opt21 // name=y1 + print(x) // $ access=x1 + print(y) // $ access=y1 + } +} + +// Do-catch blocks +func t16() throws { + do { + let x = try foo() // name=x1 + print(x) // $ access=x1 + } catch let error { // name=error1 + print(error) // $ access=error1 + } +} + +// Closure captures +func t17() { + let x = 1 // name=x1 + let closure = { // name=closure1 + print(x) // $ access=x1 + } + closure() // $ access=closure1 +} + +// Closure with parameter shadowing +func t18() { + let x = 1 // name=x1 + let closure = + { (x: Int) -> Void in // name=x2 + print(x) // $ access=x2 + } + closure(2) // $ access=closure + print(x) // $ access=x1 +} + +// While loop +func t19() { + var x = 0 // name=x1 + while x < 10 { // $ access=x1 + x = x + 1 // $ access=x1 + print(x) // $ access=x1 + } +} + +// Repeat-while loop +func t20() { + var x = 0 // name=x1 + repeat { + x = x + 1 // $ access=x1 + print(x) // $ access=x1 + } while x < 10 // $ access=x1 +} + +// Property shadowing (var) +func t21() { + var x = 1 // name=x1 + var x = 2 // name=x2 + print(x) // $ access=x2 +} + +// Nested functions +func t22() { + let x = 1 // name=x1 + func inner() { // name=inner1 + let x = 2 // name=x2 + print(x) // $ access=x2 + } + inner() // $ access=inner1 + print(x) // $ access=x1 +} + +// Three levels of shadowing +func t23() { + let x = 1 // name=x1 + { + let x = 2 // name=x2 + { + let x = 3 // name=x3 + print(x) // $ access=x3 + } + print(x) // $ access=x2 + } + print(x) // $ access=x1 +} + +// If-let followed by regular if +func t24(optional: Int?) { // name=optional1 + if let x = optional { // $ access=optional1 // name=x1 + print(x) // $ access=x1 + } + if true { + let x = 5 // name=x2 + print(x) // $ access=x2 + } +} + +// Switch with same variable name in different cases +func t25(value: Int) { // name=value1 + switch value { // $ access=value1 + case let x: // name=x1 + print(x) // $ access=x1 + let x = 10 // name=x2 + print(x) // $ access=x2 + } +} + +func t26() -> Int { + let x = 42 // name=x1 + guard let x = foo() else { // name=x2 + return x // $ access=x1 + } + print(x) // $ MISSING: access=x2 SPURIOUS: access=x1 +} + +// if with multiple conditions, mixing boolean and optional binding +func t27(opt: Int?) { // name=opt1 + if opt != nil, // $ access=opt1 + let x = opt { // $ access=opt1 + print(x) // $ access=x + } +} + +// if with multiple let bindings and a boolean condition +func t28(a: Int?, b: Int?) { // name=a1 // name=b1 + if let x = a, // $ access=a1 SPURIOUS: access=b1 + let y = b, // $ access=b1 SPURIOUS: access=a1 + x < y { // $ $ access=x access=y + print(x) // $ access=x + print(y) // $ access=y + } +} + +// if with multiple conditions where a later binding shadows an outer variable +func t29(opt: Int?) { // name=opt1 + let x = 0 // name=x1 + if opt != nil, // $ access=opt1 + let x = opt { // $ access=opt1 + print(x) // $ access=x + } + print(x) // $ access=x1 +} + +// guard with multiple conditions, mixing boolean and optional binding +func t30(opt: Int?) { // name=opt1 + guard opt != nil, // $ access=opt1 + let x = opt else { // $ access=opt1 + return + } + print(x) // $ MISSING: access=x +} + +// guard with multiple let bindings and a boolean condition +func t31(a: Int?, b: Int?) { // name=a1 // name=b1 + guard let x = a, // $ access=a1 SPURIOUS: access=b1 + let y = b, // $ access=b1 SPURIOUS: access=a1 + x < y else { // $ $ access=x access=y + return + } + print(x) // $ MISSING: access=x + print(y) // $ MISSING: access=y +} + +// guard with multiple conditions where bound variable is used in later condition +func t32(opt: Int?) { // name=opt1 + guard let x = opt, // $ access=opt1 + x > 0 else { // $ access=x + return + } + print(x) // $ MISSING: access=x +} + +func t33() { + let x = 1 // name=x1 + guard x > 0, // $ access=x1 + let x = x, // $ MISSING: access=x2 SPURIOUS: access=x1 // name=x2 + x > 0 else { // $ access=x2 + return + } + print(x) // $ MISSING: access=x2 SPURIOUS: access=x1 +} + +func t34() { + let x = 1 // name=x1 + if x > 0, // $ access=x1 + let x = x, // $ access=x1 // name=x2 + x > 0 else { // $ access=x2 + print(x) // $ access=x2 + } +} diff --git a/unified/ql/test/library-tests/variables/variables.expected b/unified/ql/test/library-tests/variables/variables.expected new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/unified/ql/test/library-tests/variables/variables.ql b/unified/ql/test/library-tests/variables/variables.ql new file mode 100644 index 000000000000..146da296ae74 --- /dev/null +++ b/unified/ql/test/library-tests/variables/variables.ql @@ -0,0 +1,51 @@ +import unified +import utils.test.InlineExpectationsTest + +/** Holds if a comment with `text` appears at `filepath:line`, excluding the text in a `$` section. */ +predicate plainCommentAt(string filepath, int line, string text) { + exists(Comment comment | + comment.getLocation().hasLocationInfo(filepath, line, _, _, _) and + text = comment.getCommentText().regexpReplaceAll("\\$([^/]|/[^/])*", "") + ) +} + +/** Holds if a `key=value` comment appears on `filepath:line` (not in the `$` section). */ +predicate keyValueCommentAt(string filepath, int line, string key, string value) { + exists(string text, string regexp, string match | + plainCommentAt(filepath, line, text) and + regexp = "(\\w+)=(\\w+)" and + match = text.regexpFind(regexp, _, _) and + key = match.regexpCapture(regexp, 1) and + value = match.regexpCapture(regexp, 2) + ) +} + +module VariableAccessTest implements TestSig { + string getARelevantTag() { result = "access" } + + private predicate declAt(Variable v, string filepath, int line) { + v.getLocation().hasLocationInfo(filepath, _, _, line, _) + } + + private predicate decl(Variable v, string alias) { + exists(string filepath, int line | declAt(v, filepath, line) | + keyValueCommentAt(filepath, line, "name", alias) + or + not keyValueCommentAt(filepath, line, "name", _) and + alias = v.getName() + ) + } + + predicate hasActualResult(Location location, string element, string tag, string value) { + exists(VariableAccess va, Variable v | + v = va.getVariable() and + not va = v.getDefiningNode() and + location = va.getLocation() and + element = va.toString() and + decl(v, value) and + tag = "access" + ) + } +} + +import MakeTest From 36b31a855c714492d6dd1493d1c277f28f3e62fc Mon Sep 17 00:00:00 2001 From: Asger F Date: Wed, 1 Jul 2026 21:51:41 +0200 Subject: [PATCH 06/44] unified: Add debug query for local scoping graph --- .../codeql/namebinding/LocalNameBinding.qll | 25 +++++++++++++++++++ .../unified/internal/dev/debugScopeGraph.ql | 19 ++++++++++++++ 2 files changed, 44 insertions(+) create mode 100644 unified/ql/lib/codeql/unified/internal/dev/debugScopeGraph.ql diff --git a/shared/namebinding/codeql/namebinding/LocalNameBinding.qll b/shared/namebinding/codeql/namebinding/LocalNameBinding.qll index a467568f9832..9aa265f161a4 100644 --- a/shared/namebinding/codeql/namebinding/LocalNameBinding.qll +++ b/shared/namebinding/codeql/namebinding/LocalNameBinding.qll @@ -296,6 +296,31 @@ module LocalNameBinding ) } + /** Holds if `node` should be included in the debug tree. */ + private signature predicate relevantNodeSig(AstNode node); + + module DebugScopeGraph { + private string getANodeAnnotation(AstNode node) { + result = + "[scope=" + + strictconcat(string name | + declInScope(_, name, node) or implicitDeclInScope(name, node) + | + name, "," + ) + "]" + } + + query predicate nodes(AstNode node, string key, string value) { + relevantNode(node) and + key = "semmle.label" and + value = node.toString() + concat(getANodeAnnotation(node)) + } + + query predicate edges(AstNode node1, AstNode node2) { + relevantNode(node2) and node2 = getParentForScoping(node1) + } + } + /** Gets the immediately enclosing variable scope of `n`. */ private Scope getEnclosingScope(AstNode n) { result = getParentForScoping(n) diff --git a/unified/ql/lib/codeql/unified/internal/dev/debugScopeGraph.ql b/unified/ql/lib/codeql/unified/internal/dev/debugScopeGraph.ql new file mode 100644 index 000000000000..2f9376b1732e --- /dev/null +++ b/unified/ql/lib/codeql/unified/internal/dev/debugScopeGraph.ql @@ -0,0 +1,19 @@ +/** + * @name Debug scope graph + * @description Renders the graph used to perform local variable lookups + * @kind graph + * @id unified/debug-scope-graph + */ + +private import unified +private import codeql.unified.internal.Variables + +/** + * Holds if `node` should be shown in the graph. + */ +predicate relevantNode(AstNode node) { + // Match an ancestor node by location so its whole subtree is shown. + node.getParent*().getLocation().toString().matches("%test.swift@227:%") +} + +import LocalNameBindingOutput::DebugScopeGraph From 05ce686d4366c07148933ccd073121fe825d6b0b Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Thu, 2 Jul 2026 21:05:50 +0200 Subject: [PATCH 07/44] Type inference: Small join-order tweak --- .../typeinference/internal/TypeInference.qll | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/shared/typeinference/codeql/typeinference/internal/TypeInference.qll b/shared/typeinference/codeql/typeinference/internal/TypeInference.qll index af818dc94d95..4e9ea9c0502b 100644 --- a/shared/typeinference/codeql/typeinference/internal/TypeInference.qll +++ b/shared/typeinference/codeql/typeinference/internal/TypeInference.qll @@ -1416,7 +1416,7 @@ module Make1 Input1> { tp = target.getDeclaredType(dpos, pathToTp) and conditionSatisfiesConstraintTypeAt(_, condition, constraint, TypePath::nil(), constraintRootType) and - constraintRootType = target.getDeclaredType(dpos, TypePath::nil()) and + constraintRootType.getATypeParameter() = pathToTp.getHead() and argRootType = condition.getTypeAt(TypePath::nil()) ) } @@ -1445,19 +1445,19 @@ module Make1 Input1> { } pragma[nomagic] - private predicate argRootTypeSatisfiesTargetTypeCand( - Type argRootType, Access a, AccessEnvironment e, Declaration target, AccessPosition apos, - TypeParameter tp, TypePath pathToTp + private predicate accessTargetsWithArgRootType( + Access a, AccessEnvironment e, Declaration target, AccessPosition apos, Type t ) { target = a.getTarget(e) and - argRootTypeSatisfiesTargetTypeCand(argRootType, target, apos, tp, pathToTp) and - not exists(getTypeArgument(a, target, tp, _)) + t = a.getInferredType(e, apos, TypePath::nil()) } private newtype TRelevantAccess = MkRelevantAccess(Access a, AccessPosition apos, AccessEnvironment e) { - argRootTypeSatisfiesTargetTypeCand(a.getInferredType(e, apos, TypePath::nil()), a, e, _, - apos, _, _) + exists(Declaration target, Type t | + accessTargetsWithArgRootType(a, e, target, apos, t) and + argRootTypeSatisfiesTargetTypeCand(t, target, apos, _, _) + ) } private class RelevantAccess extends MkRelevantAccess { @@ -1525,9 +1525,11 @@ module Make1 Input1> { Access a, AccessEnvironment e, Declaration target, TypePath path, Type t, TypeParameter tp ) { exists(AccessPosition apos, TypePath pathToTp | - argRootTypeSatisfiesTargetTypeCand(_, a, e, target, apos, tp, pathToTp) and - SatisfiesParameterConstraint::satisfiesConstraint(MkRelevantAccess(a, apos, e), - MkRelevantTarget(target, apos), pathToTp.appendInverse(path), t) + argRootTypeSatisfiesTargetTypeCand(_, target, pragma[only_bind_into](apos), tp, pathToTp) and + SatisfiesParameterConstraint::satisfiesConstraint(MkRelevantAccess(a, + pragma[only_bind_into](apos), e), + MkRelevantTarget(target, pragma[only_bind_into](apos)), pathToTp.appendInverse(path), + t) ) } } From d0cd4ac536915534eb3ae899c26904e4b34442e2 Mon Sep 17 00:00:00 2001 From: Asger F Date: Thu, 2 Jul 2026 15:39:54 +0200 Subject: [PATCH 08/44] Shared: remove unused getLhs() predicate --- ruby/ql/lib/codeql/ruby/ast/internal/Variable.qll | 2 -- .../namebinding/codeql/namebinding/LocalNameBinding.qll | 3 --- unified/ql/lib/codeql/unified/internal/Variables.qll | 9 --------- 3 files changed, 14 deletions(-) diff --git a/ruby/ql/lib/codeql/ruby/ast/internal/Variable.qll b/ruby/ql/lib/codeql/ruby/ast/internal/Variable.qll index 5ff48191534b..8eed5ee6f702 100644 --- a/ruby/ql/lib/codeql/ruby/ast/internal/Variable.qll +++ b/ruby/ql/lib/codeql/ruby/ast/internal/Variable.qll @@ -170,8 +170,6 @@ private module Input implements LocalNameBindingInputSig { class SiblingShadowingDecl extends AstNode { SiblingShadowingDecl() { none() } - AstNode getLhs() { none() } - AstNode getRhs() { none() } AstNode getElse() { none() } diff --git a/shared/namebinding/codeql/namebinding/LocalNameBinding.qll b/shared/namebinding/codeql/namebinding/LocalNameBinding.qll index 9aa265f161a4..57c792027ba8 100644 --- a/shared/namebinding/codeql/namebinding/LocalNameBinding.qll +++ b/shared/namebinding/codeql/namebinding/LocalNameBinding.qll @@ -82,9 +82,6 @@ signature module LocalNameBindingInputSig { * ``` */ class SiblingShadowingDecl extends AstNode { - /** Gets the left-hand side of this declaration. */ - AstNode getLhs(); - /** * Gets the right-hand side of this declaration. * diff --git a/unified/ql/lib/codeql/unified/internal/Variables.qll b/unified/ql/lib/codeql/unified/internal/Variables.qll index 51ff5a5ab7f1..2203eaf5a68e 100644 --- a/unified/ql/lib/codeql/unified/internal/Variables.qll +++ b/unified/ql/lib/codeql/unified/internal/Variables.qll @@ -91,9 +91,6 @@ private module LocalNameBindingInput implements LocalNameBindingInputSig Date: Thu, 2 Jul 2026 16:57:52 +0200 Subject: [PATCH 09/44] unified: Flatten GuardIfStmt into the enclosing block --- .../lib/codeql/unified/internal/Variables.qll | 39 +++++++++++++++---- .../test/library-tests/variables/test.swift | 14 +++---- 2 files changed, 39 insertions(+), 14 deletions(-) diff --git a/unified/ql/lib/codeql/unified/internal/Variables.qll b/unified/ql/lib/codeql/unified/internal/Variables.qll index 2203eaf5a68e..46eee90e7e29 100644 --- a/unified/ql/lib/codeql/unified/internal/Variables.qll +++ b/unified/ql/lib/codeql/unified/internal/Variables.qll @@ -34,8 +34,38 @@ private module LocalNameBindingInput implements LocalNameBindingInputSig Int { guard let x = foo() else { // name=x1 return 0 } - print(x) // $ MISSING: access=x1 + print(x) // $ access=x1 } // Function parameters @@ -229,7 +229,7 @@ func t26() -> Int { guard let x = foo() else { // name=x2 return x // $ access=x1 } - print(x) // $ MISSING: access=x2 SPURIOUS: access=x1 + print(x) // $ access=x2 } // if with multiple conditions, mixing boolean and optional binding @@ -266,7 +266,7 @@ func t30(opt: Int?) { // name=opt1 let x = opt else { // $ access=opt1 return } - print(x) // $ MISSING: access=x + print(x) // $ access=x } // guard with multiple let bindings and a boolean condition @@ -276,8 +276,8 @@ func t31(a: Int?, b: Int?) { // name=a1 // name=b1 x < y else { // $ $ access=x access=y return } - print(x) // $ MISSING: access=x - print(y) // $ MISSING: access=y + print(x) // $ access=x + print(y) // $ access=y } // guard with multiple conditions where bound variable is used in later condition @@ -286,7 +286,7 @@ func t32(opt: Int?) { // name=opt1 x > 0 else { // $ access=x return } - print(x) // $ MISSING: access=x + print(x) // $ access=x } func t33() { @@ -296,7 +296,7 @@ func t33() { x > 0 else { // $ access=x2 return } - print(x) // $ MISSING: access=x2 SPURIOUS: access=x1 + print(x) // $ access=x2 } func t34() { From 6ea146f65b26cb9c617d1fc5bbabe132a9e8cd08 Mon Sep 17 00:00:00 2001 From: Asger F Date: Thu, 2 Jul 2026 17:09:31 +0200 Subject: [PATCH 10/44] unified: Fix broken block syntax The original test was not valid Swift syntax --- unified/ql/test/library-tests/variables/test.swift | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/unified/ql/test/library-tests/variables/test.swift b/unified/ql/test/library-tests/variables/test.swift index 2d8a8f7a0b3b..c915303caede 100644 --- a/unified/ql/test/library-tests/variables/test.swift +++ b/unified/ql/test/library-tests/variables/test.swift @@ -40,9 +40,9 @@ func t6(x: Int) -> Int { // name=x1 // Nested blocks func t7() { - let x = 1 // name=x1 - { - print(x) // $ MISSING: access=x1 + let x = 1; // name=x1 + do { + print(x) // $ access=x1 let x = 2 // name=x2 print(x) // $ access=x2 } From e7bff859e8aa371b907441fad276ebfc4c716d48 Mon Sep 17 00:00:00 2001 From: Asger F Date: Thu, 2 Jul 2026 17:11:44 +0200 Subject: [PATCH 11/44] unified: More fixes in test cases --- unified/ql/test/library-tests/variables/test.swift | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/unified/ql/test/library-tests/variables/test.swift b/unified/ql/test/library-tests/variables/test.swift index c915303caede..7860c801fbed 100644 --- a/unified/ql/test/library-tests/variables/test.swift +++ b/unified/ql/test/library-tests/variables/test.swift @@ -241,9 +241,9 @@ func t27(opt: Int?) { // name=opt1 } // if with multiple let bindings and a boolean condition -func t28(a: Int?, b: Int?) { // name=a1 // name=b1 - if let x = a, // $ access=a1 SPURIOUS: access=b1 - let y = b, // $ access=b1 SPURIOUS: access=a1 +func t28(a: Int?, b: Int?) { + if let x = a, // $ access=a + let y = b, // $ access=b x < y { // $ $ access=x access=y print(x) // $ access=x print(y) // $ access=y @@ -270,9 +270,9 @@ func t30(opt: Int?) { // name=opt1 } // guard with multiple let bindings and a boolean condition -func t31(a: Int?, b: Int?) { // name=a1 // name=b1 - guard let x = a, // $ access=a1 SPURIOUS: access=b1 - let y = b, // $ access=b1 SPURIOUS: access=a1 +func t31(a: Int?, b: Int?) { + guard let x = a, // $ access=a + let y = b, // $ access=b x < y else { // $ $ access=x access=y return } @@ -292,7 +292,7 @@ func t32(opt: Int?) { // name=opt1 func t33() { let x = 1 // name=x1 guard x > 0, // $ access=x1 - let x = x, // $ MISSING: access=x2 SPURIOUS: access=x1 // name=x2 + let x = x, // $ access=x1 // name=x2 x > 0 else { // $ access=x2 return } From c8eb2071d8c835fdc8bf990ea49f042e268c1034 Mon Sep 17 00:00:00 2001 From: Asger F Date: Thu, 2 Jul 2026 17:17:47 +0200 Subject: [PATCH 12/44] unified: Add tests with 'while let' --- .../test/library-tests/variables/test.swift | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/unified/ql/test/library-tests/variables/test.swift b/unified/ql/test/library-tests/variables/test.swift index 7860c801fbed..4b96101bd4ac 100644 --- a/unified/ql/test/library-tests/variables/test.swift +++ b/unified/ql/test/library-tests/variables/test.swift @@ -307,3 +307,30 @@ func t34() { print(x) // $ access=x2 } } + +// While-let optional binding +func t35(optional: Int?) { // name=optional1 + while let x = optional { // $ access=optional1 // name=x1 + print(x) // $ MISSING: access=x1 + } +} + +// While with a sequence of variable bindings in the condition +func t36(a: Int?, b: Int?) { + while let x = a, // $ access=a + let y = b, // $ access=b + x < y { // $ $ access=x access=y + print(x) // $ MISSING: access=x + print(y) // $ MISSING: access=y + } +} + +// While-let with a sequence of shadowing variable declarations +func t37() { + let x = 1 // name=x1 + while let x = x, // $ access=x1 // name=x2 + let x = x, // $ access=x2 // name=x3 + x > 0 { // $ access=x3 + print(x) // $ MISSING: access=x3 SPURIOUS: access=x1 + } +} From 891e2441165fe4b7ebbb9bff394d0c1646379d4b Mon Sep 17 00:00:00 2001 From: Asger F Date: Thu, 2 Jul 2026 17:20:12 +0200 Subject: [PATCH 13/44] unified: Add WhileStmt as a Conditional --- unified/ql/lib/codeql/unified/internal/Variables.qll | 8 ++++++++ unified/ql/test/library-tests/variables/test.swift | 8 ++++---- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/unified/ql/lib/codeql/unified/internal/Variables.qll b/unified/ql/lib/codeql/unified/internal/Variables.qll index 46eee90e7e29..97dc25382c7b 100644 --- a/unified/ql/lib/codeql/unified/internal/Variables.qll +++ b/unified/ql/lib/codeql/unified/internal/Variables.qll @@ -121,6 +121,14 @@ private module LocalNameBindingInput implements LocalNameBindingInputSig 0 { // $ access=x3 - print(x) // $ MISSING: access=x3 SPURIOUS: access=x1 + print(x) // $ access=x3 } } From 036ed04eee203addbe1982ef7b00d44aa872cfb6 Mon Sep 17 00:00:00 2001 From: Asger F Date: Fri, 3 Jul 2026 09:21:21 +0200 Subject: [PATCH 14/44] unified: Support OrPattern bindings --- .../lib/codeql/unified/internal/Variables.qll | 37 ++++++++++++++++--- .../test/library-tests/variables/test.swift | 15 ++++++++ 2 files changed, 47 insertions(+), 5 deletions(-) diff --git a/unified/ql/lib/codeql/unified/internal/Variables.qll b/unified/ql/lib/codeql/unified/internal/Variables.qll index 97dc25382c7b..a7e8160deb86 100644 --- a/unified/ql/lib/codeql/unified/internal/Variables.qll +++ b/unified/ql/lib/codeql/unified/internal/Variables.qll @@ -213,12 +213,39 @@ private module LocalNameBindingInput implements LocalNameBindingInputSig Date: Fri, 3 Jul 2026 11:23:26 +0200 Subject: [PATCH 15/44] unified: Translate bare names in patterns correctly - Context is fully reset when stepping into an expr/stmt/body. - Binding modifier is rolled into outer_modifiers. --- shared/yeast/src/build.rs | 31 +++++ .../extractor/src/languages/swift/swift.rs | 128 ++++++++++++------ ...g-modifier-does-not-leak-to-sibling.output | 86 ++++++++++++ ...ng-modifier-does-not-leak-to-sibling.swift | 7 + ...er-does-not-leak-into-accessor-body.output | 100 ++++++++++++++ ...ier-does-not-leak-into-accessor-body.swift | 10 ++ ...fier-does-not-leak-into-initializer.output | 63 +++++++++ ...ifier-does-not-leak-into-initializer.swift | 4 + .../tuple-destructuring-binding.output | 12 +- .../test/library-tests/variables/test.swift | 8 +- 10 files changed, 394 insertions(+), 55 deletions(-) create mode 100644 unified/extractor/tests/corpus/swift/control-flow/binding-modifier-does-not-leak-to-sibling.output create mode 100644 unified/extractor/tests/corpus/swift/control-flow/binding-modifier-does-not-leak-to-sibling.swift create mode 100644 unified/extractor/tests/corpus/swift/types/binding-modifier-does-not-leak-into-accessor-body.output create mode 100644 unified/extractor/tests/corpus/swift/types/binding-modifier-does-not-leak-into-accessor-body.swift create mode 100644 unified/extractor/tests/corpus/swift/variables/binding-modifier-does-not-leak-into-initializer.output create mode 100644 unified/extractor/tests/corpus/swift/variables/binding-modifier-does-not-leak-into-initializer.swift diff --git a/shared/yeast/src/build.rs b/shared/yeast/src/build.rs index a5f454a5f544..7136e2332f8f 100644 --- a/shared/yeast/src/build.rs +++ b/shared/yeast/src/build.rs @@ -177,6 +177,37 @@ impl BuildCtx<'_, C> { None => Err("translate() called on a BuildCtx without a translator handle".into()), } } + + /// Translate every node in an iterator with a **fresh** user context + /// (reset to `C::default()`), restoring the previous context afterwards. + /// + /// Use when descending into a subtree — a body, expression, or statement + /// list — that must not inherit any of the surrounding translation + /// context (for example an enclosing binding modifier). Accepts single + /// (`Id`), optional (`Option`), and repeated (`Vec`) captures, + /// since all of them are `IntoIterator`. + pub fn translate_reset>( + &mut self, + ids: impl IntoIterator, + ) -> Result, String> + where + C: Default, + { + let saved = std::mem::take(&mut *self.user_ctx); + let mut out = Vec::new(); + let mut result = Ok(()); + for id in ids { + match self.translate(id) { + Ok(v) => out.extend(v), + Err(e) => { + result = Err(e); + break; + } + } + } + *self.user_ctx = saved; + result.map(|()| out) + } } impl std::ops::Deref for BuildCtx<'_, C> { diff --git a/unified/extractor/src/languages/swift/swift.rs b/unified/extractor/src/languages/swift/swift.rs index 5689d930bff3..0f4f80a8f019 100644 --- a/unified/extractor/src/languages/swift/swift.rs +++ b/unified/extractor/src/languages/swift/swift.rs @@ -25,16 +25,13 @@ struct SwiftContext { /// by the outer `function_parameter` rule; read by the `parameter` /// rules. default_value: Option, - /// Translated outer modifiers (e.g. visibility, attributes) to - /// attach to each child of a flattening outer rule. Set by - /// `property_declaration`, `enum_entry`, and - /// `protocol_property_declaration`. + /// Translated outer modifiers to attach to each child of a flattening + /// outer rule. Set by `property_declaration`, `binding_pattern`, + /// `enum_entry`, and `protocol_property_declaration`. For `let`/`var` + /// declarations and `binding_pattern`s the list is led by the binding + /// modifier, which also serves as the "this is a binding" signal for + /// pattern translation (see `in_binding_pattern`). outer_modifiers: Vec, - /// The `let`/`var` binding modifier for a `property_declaration`. - /// Set by `property_declaration`; read by the inner declaration - /// rules (`property_binding` variants, accessor rules) so they - /// emit it as part of the output node's `modifier:` field. - binding_modifier: Option, /// True when the current child of a flattening outer rule is not /// the first one — its inner rule should emit a /// `chained_declaration` modifier so the original grouping can be @@ -42,6 +39,20 @@ struct SwiftContext { is_chained: bool, } +impl SwiftContext { + /// Whether the pattern currently being translated is a binding + /// (the LHS of a `let`/`var` declaration or a `binding_pattern`). + /// + /// True exactly when an enclosing binding has published its modifier into + /// `outer_modifiers`. This is reliable because non-binding subtrees + /// (bodies, initializer values, ...) are translated with a reset context + /// (see `BuildCtx::translate_reset`), so a bare identifier only sees a + /// non-empty `outer_modifiers` when it really is a binding. + fn in_binding_pattern(&self) -> bool { + !self.outer_modifiers.is_empty() + } +} + /// Build a freshly-created `chained_declaration` modifier node if /// `ctx.is_chained`, else `None`. Used by inner declaration rules to /// emit the chained tag for non-first children of a flattening outer @@ -220,16 +231,15 @@ fn translation_rules() -> Vec> { (property_binding name: (pattern bound_identifier: @name) type: _? @ty - computed_value: (computed_property statement: _* @body)) + computed_value: (computed_property statement: _* @@body)) => (accessor_declaration - modifier: {ctx.binding_modifier} modifier: {ctx.outer_modifiers.clone()} modifier: {chained_modifier(&mut ctx)} name: (identifier #{name}) type: {ty} accessor_kind: (accessor_kind "get") - body: (block stmt: {body})) + body: (block stmt: {ctx.translate_reset(body)?})) ), // Stored property with willSet/didSet observers (initializer // optional) → a `variable_declaration` followed by one @@ -246,13 +256,19 @@ fn translation_rules() -> Vec> { (property_binding name: (pattern bound_identifier: @name) type: _? @ty - value: _? @val + value: _? @@val observers: (willset_didset_block willset: _? @@ws didset: _? @@ds)) => {{ + // The initializer value must not inherit the binding context + // (it may contain patterns, e.g. a switch expression), so + // translate it with a reset context. The observers keep the + // context: each willSet/didSet accessor emits the binding + // modifier and resets its own body. + let val = ctx.translate_reset(val)?; + let var_decl = tree!( (variable_declaration - modifier: {ctx.binding_modifier} modifier: {ctx.outer_modifiers.clone()} modifier: {chained_modifier(&mut ctx)} pattern: (name_pattern identifier: (identifier #{name})) @@ -275,19 +291,23 @@ fn translation_rules() -> Vec> { ), // property_binding with any pattern name (identifier or // destructuring). Reads outer modifiers / chained tag from `ctx`. + // + // The enclosing `property_declaration` leads `ctx.outer_modifiers` + // with the `let`/`var` binding modifier, so the auto-translated name + // pattern (the LHS) becomes a binding, while the initializer value is + // translated with a reset context (see `translate_reset`). rule!( (property_binding name: @pattern type: _? @ty - value: _? @val) + value: _? @@val) => (variable_declaration - modifier: {ctx.binding_modifier} modifier: {ctx.outer_modifiers.clone()} modifier: {chained_modifier(&mut ctx)} pattern: {pattern} type: {ty} - value: {val}) + value: {ctx.translate_reset(val)?}) // reset context: the initializer must not see the binding ), // property_declaration: flatten declarators (each may translate // to multiple nodes — variable_declaration and/or @@ -307,8 +327,11 @@ fn translation_rules() -> Vec> { => {{ let binding_text = ctx.ast.source_text(binding_kind); - ctx.binding_modifier = Some(ctx.literal("modifier", &binding_text)); - ctx.outer_modifiers = mods; + let binding = ctx.literal("modifier", &binding_text); + // The `let`/`var` binding modifier leads the declaration's + // modifier list and doubles as the "this is a binding" signal + // for pattern translation (see `in_binding_pattern`). + ctx.outer_modifiers = std::iter::once(binding).chain(mods).collect(); let mut result = Vec::new(); for (i, decl) in decls.into_iter().enumerate() { @@ -403,14 +426,23 @@ fn translation_rules() -> Vec> { rule!((type name: @inner) => {inner}), // `directly_assignable_expression` is just a wrapper; unwrap it rule!((directly_assignable_expression expr: @inner) => {inner}), - // Pattern with bound_identifier → name_pattern - rule!((pattern bound_identifier: @name) => (name_pattern identifier: (identifier #{name}))), - // Pattern with 'let' or 'var' binding: extract the inner pattern - // TODO: Names in a pattern need to be translated to expr_equality_pattern if not under a 'var/let' but we lack a way to pass down context to do this. + // Pattern with bound_identifier → name_pattern. + rule!( + (pattern bound_identifier: @name) + => + (name_pattern identifier: (identifier #{name})) + ), + // Pattern with 'let' or 'var' binding: publish the binding modifier + // into `ctx` and translate the inner pattern under it. rule!( - (pattern kind: (binding_pattern binding: _? pattern: @pattern)) + (pattern kind: (binding_pattern binding: (value_binding_pattern mutability: @@binding_kind) pattern: @@pattern)) => - {pattern} + {{ + let binding_text = ctx.ast.source_text(binding_kind); + let binding = ctx.literal("modifier", &binding_text); + ctx.outer_modifiers = vec![binding]; + ctx.translate(pattern)? + }} ), // case T.foo(x,y) pattern rule!( @@ -436,6 +468,22 @@ fn translation_rules() -> Vec> { rule!((pattern kind: (type_casting_pattern)) => (unsupported_node)), // Wildcard pattern rule!((pattern kind: (wildcard_pattern)) => (ignore_pattern)), + // A bare identifier used as an expression-pattern. Under a `var`/`let` + // binding it introduces a new variable and becomes a `name_pattern`; + // otherwise it matches by equality and is left as an `expr_equality_pattern` + // over the name expression. + rule!( + (pattern kind: (simple_identifier) @name) + => + { + if ctx.in_binding_pattern() { + tree!((name_pattern identifier: (identifier #{name}))) + } else { + let expr = tree!((name_expr identifier: (identifier #{name}))); + tree!((expr_equality_pattern expr: {expr})) + } + } + ), // Expression pattern // We lack a way to check if 'expr' is actually an expression, but due to rule ordering // the 'expression' case is the only remaining possibility when this rule tries to match. @@ -1062,56 +1110,52 @@ fn translation_rules() -> Vec> { // and binding/outer modifiers + chained tag from the outer // property_declaration rule. rule!( - (computed_getter body: (block statement: _* @body)?) + (computed_getter body: (block statement: _* @@body)?) => (accessor_declaration - modifier: {ctx.binding_modifier} modifier: {ctx.outer_modifiers.clone()} modifier: {chained_modifier(&mut ctx)} name: {ctx.property_name.ok_or("computed_getter outside property_binding context")?} type: {ctx.property_type} accessor_kind: (accessor_kind "get") - body: (block stmt: {body})) + body: (block stmt: {ctx.translate_reset(body)?})) ), // Computed setter with explicit parameter name. rule!( - (computed_setter parameter: @param body: (block statement: _* @body)) + (computed_setter parameter: @param body: (block statement: _* @@body)) => (accessor_declaration - modifier: {ctx.binding_modifier} modifier: {ctx.outer_modifiers.clone()} modifier: {chained_modifier(&mut ctx)} name: {ctx.property_name.ok_or("computed_setter outside property_binding context")?} type: {ctx.property_type} accessor_kind: (accessor_kind "set") parameter: (parameter pattern: (name_pattern identifier: (identifier #{param}))) - body: (block stmt: {body})) + body: (block stmt: {ctx.translate_reset(body)?})) ), // Computed setter without explicit parameter name; body optional. rule!( - (computed_setter body: (block statement: _* @body)?) + (computed_setter body: (block statement: _* @@body)?) => (accessor_declaration - modifier: {ctx.binding_modifier} modifier: {ctx.outer_modifiers.clone()} modifier: {chained_modifier(&mut ctx)} name: {ctx.property_name.ok_or("computed_setter outside property_binding context")?} type: {ctx.property_type} accessor_kind: (accessor_kind "set") - body: (block stmt: {body})) + body: (block stmt: {ctx.translate_reset(body)?})) ), // Computed modify → accessor_declaration rule!( - (computed_modify body: (block statement: _* @body)) + (computed_modify body: (block statement: _* @@body)) => (accessor_declaration - modifier: {ctx.binding_modifier} modifier: {ctx.outer_modifiers.clone()} modifier: {chained_modifier(&mut ctx)} name: {ctx.property_name.ok_or("computed_modify outside property_binding context")?} type: {ctx.property_type} accessor_kind: (accessor_kind "modify") - body: (block stmt: {body})) + body: (block stmt: {ctx.translate_reset(body)?})) ), // willset/didset block — spread to children (only reachable as a // fallback; the outer property_binding manual rule normally @@ -1122,27 +1166,25 @@ fn translation_rules() -> Vec> { // binding/outer modifiers + chained tag from the outer // property_declaration rule. rule!( - (willset_clause body: (block statement: _* @body)?) + (willset_clause body: (block statement: _* @@body)?) => (accessor_declaration - modifier: {ctx.binding_modifier} modifier: {ctx.outer_modifiers.clone()} modifier: {chained_modifier(&mut ctx)} name: {ctx.property_name.ok_or("willset_clause outside property_binding context")?} accessor_kind: (accessor_kind "willSet") - body: (block stmt: {body})) + body: (block stmt: {ctx.translate_reset(body)?})) ), // didset clause → accessor_declaration (body optional). rule!( - (didset_clause body: (block statement: _* @body)?) + (didset_clause body: (block statement: _* @@body)?) => (accessor_declaration - modifier: {ctx.binding_modifier} modifier: {ctx.outer_modifiers.clone()} modifier: {chained_modifier(&mut ctx)} name: {ctx.property_name.ok_or("didset_clause outside property_binding context")?} accessor_kind: (accessor_kind "didSet") - body: (block stmt: {body})) + body: (block stmt: {ctx.translate_reset(body)?})) ), // Preprocessor conditionals — unsupported rule!((diagnostic) => (unsupported_node)), diff --git a/unified/extractor/tests/corpus/swift/control-flow/binding-modifier-does-not-leak-to-sibling.output b/unified/extractor/tests/corpus/swift/control-flow/binding-modifier-does-not-leak-to-sibling.output new file mode 100644 index 000000000000..3919b875b96a --- /dev/null +++ b/unified/extractor/tests/corpus/swift/control-flow/binding-modifier-does-not-leak-to-sibling.output @@ -0,0 +1,86 @@ +let x = 1 +switch y { +case someConstant: + print("matched") +default: + break +} + +--- + +source_file + statement: + property_declaration + binding: + value_binding_pattern + mutability: let + declarator: + property_binding + name: + pattern + bound_identifier: simple_identifier "x" + value: integer_literal "1" + switch_statement + entry: + switch_entry + pattern: + switch_pattern + pattern: + pattern + kind: simple_identifier "someConstant" + statement: + call_expression + function: simple_identifier "print" + suffix: + call_suffix + arguments: + value_arguments + argument: + value_argument + value: + line_string_literal + text: line_str_text "matched" + switch_entry + default: default_keyword "default" + statement: + control_transfer_statement + kind: break + expr: simple_identifier "y" + +--- + +top_level + body: + block + stmt: + variable_declaration + modifier: modifier "let" + pattern: + name_pattern + identifier: identifier "x" + value: int_literal "1" + switch_expr + case: + switch_case + body: + block + stmt: + call_expr + argument: + argument + value: string_literal "\"matched\"" + callee: + name_expr + identifier: identifier "print" + pattern: + expr_equality_pattern + expr: + name_expr + identifier: identifier "someConstant" + switch_case + body: + block + stmt: break_expr "break" + value: + name_expr + identifier: identifier "y" diff --git a/unified/extractor/tests/corpus/swift/control-flow/binding-modifier-does-not-leak-to-sibling.swift b/unified/extractor/tests/corpus/swift/control-flow/binding-modifier-does-not-leak-to-sibling.swift new file mode 100644 index 000000000000..1338097e8280 --- /dev/null +++ b/unified/extractor/tests/corpus/swift/control-flow/binding-modifier-does-not-leak-to-sibling.swift @@ -0,0 +1,7 @@ +let x = 1 +switch y { +case someConstant: + print("matched") +default: + break +} diff --git a/unified/extractor/tests/corpus/swift/types/binding-modifier-does-not-leak-into-accessor-body.output b/unified/extractor/tests/corpus/swift/types/binding-modifier-does-not-leak-into-accessor-body.output new file mode 100644 index 000000000000..4ee195672bb2 --- /dev/null +++ b/unified/extractor/tests/corpus/swift/types/binding-modifier-does-not-leak-into-accessor-body.output @@ -0,0 +1,100 @@ +var p: Int { + get { + switch y { + case someConstant: + return 1 + default: + return 2 + } + } +} + +--- + +source_file + statement: + property_declaration + binding: + value_binding_pattern + mutability: var + declarator: + property_binding + computed_value: + computed_property + accessor: + computed_getter + body: + block + statement: + switch_statement + entry: + switch_entry + pattern: + switch_pattern + pattern: + pattern + kind: simple_identifier "someConstant" + statement: + control_transfer_statement + kind: return + result: integer_literal "1" + switch_entry + default: default_keyword "default" + statement: + control_transfer_statement + kind: return + result: integer_literal "2" + expr: simple_identifier "y" + specifier: + getter_specifier + name: + pattern + bound_identifier: simple_identifier "p" + type: + type_annotation + type: + type + name: + user_type + part: + simple_user_type + name: type_identifier "Int" + +--- + +top_level + body: + block + stmt: + accessor_declaration + body: + block + stmt: + switch_expr + case: + switch_case + body: + block + stmt: + return_expr + value: int_literal "1" + pattern: + expr_equality_pattern + expr: + name_expr + identifier: identifier "someConstant" + switch_case + body: + block + stmt: + return_expr + value: int_literal "2" + value: + name_expr + identifier: identifier "y" + modifier: modifier "var" + name: identifier "p" + type: + named_type_expr + name: identifier "Int" + accessor_kind: accessor_kind "get" diff --git a/unified/extractor/tests/corpus/swift/types/binding-modifier-does-not-leak-into-accessor-body.swift b/unified/extractor/tests/corpus/swift/types/binding-modifier-does-not-leak-into-accessor-body.swift new file mode 100644 index 000000000000..74430bb282f5 --- /dev/null +++ b/unified/extractor/tests/corpus/swift/types/binding-modifier-does-not-leak-into-accessor-body.swift @@ -0,0 +1,10 @@ +var p: Int { + get { + switch y { + case someConstant: + return 1 + default: + return 2 + } + } +} diff --git a/unified/extractor/tests/corpus/swift/variables/binding-modifier-does-not-leak-into-initializer.output b/unified/extractor/tests/corpus/swift/variables/binding-modifier-does-not-leak-into-initializer.output new file mode 100644 index 000000000000..65364c1ef918 --- /dev/null +++ b/unified/extractor/tests/corpus/swift/variables/binding-modifier-does-not-leak-into-initializer.output @@ -0,0 +1,63 @@ +let x = switch y { +case someConstant: 1 +default: 2 +} + +--- + +source_file + statement: + property_declaration + binding: + value_binding_pattern + mutability: let + declarator: + property_binding + name: + pattern + bound_identifier: simple_identifier "x" + value: + switch_statement + entry: + switch_entry + pattern: + switch_pattern + pattern: + pattern + kind: simple_identifier "someConstant" + statement: integer_literal "1" + switch_entry + default: default_keyword "default" + statement: integer_literal "2" + expr: simple_identifier "y" + +--- + +top_level + body: + block + stmt: + variable_declaration + modifier: modifier "let" + pattern: + name_pattern + identifier: identifier "x" + value: + switch_expr + case: + switch_case + body: + block + stmt: int_literal "1" + pattern: + expr_equality_pattern + expr: + name_expr + identifier: identifier "someConstant" + switch_case + body: + block + stmt: int_literal "2" + value: + name_expr + identifier: identifier "y" diff --git a/unified/extractor/tests/corpus/swift/variables/binding-modifier-does-not-leak-into-initializer.swift b/unified/extractor/tests/corpus/swift/variables/binding-modifier-does-not-leak-into-initializer.swift new file mode 100644 index 000000000000..2e6224b95019 --- /dev/null +++ b/unified/extractor/tests/corpus/swift/variables/binding-modifier-does-not-leak-into-initializer.swift @@ -0,0 +1,4 @@ +let x = switch y { +case someConstant: 1 +default: 2 +} diff --git a/unified/extractor/tests/corpus/swift/variables/tuple-destructuring-binding.output b/unified/extractor/tests/corpus/swift/variables/tuple-destructuring-binding.output index a0a45eb6d22a..5709911171c1 100644 --- a/unified/extractor/tests/corpus/swift/variables/tuple-destructuring-binding.output +++ b/unified/extractor/tests/corpus/swift/variables/tuple-destructuring-binding.output @@ -38,16 +38,12 @@ top_level element: pattern_element pattern: - expr_equality_pattern - expr: - name_expr - identifier: identifier "a" + name_pattern + identifier: identifier "a" pattern_element pattern: - expr_equality_pattern - expr: - name_expr - identifier: identifier "b" + name_pattern + identifier: identifier "b" value: name_expr identifier: identifier "pair" diff --git a/unified/ql/test/library-tests/variables/test.swift b/unified/ql/test/library-tests/variables/test.swift index 07929a0f0382..3a43ffeb7bbf 100644 --- a/unified/ql/test/library-tests/variables/test.swift +++ b/unified/ql/test/library-tests/variables/test.swift @@ -92,8 +92,8 @@ func t12() { let tuple = (1, 2) // name=tuple1 let (x, // name=x1 y) = tuple // $ access=tuple1 // name=y1 - print(x) // $ MISSING: access=x1 // because x,y are incorrectly mapped to expr_equality_pattern - print(y) // $ MISSING: access=y1 + print(x) // $ access=x1 + print(y) // $ access=y1 } // Tuple unpacking with underscore @@ -102,8 +102,8 @@ func t13() { let (x, // name=x1 _, y) = tuple // $ access=tuple1 // name=y1 - print(x) // $ MISSING: access=x1 - print(y) // $ MISSING: access=y1 + print(x) // $ access=x1 + print(y) // $ access=y1 } // Optional binding (if let) From 077b531e4109e9b14110e8f9a65012190bbae6da Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Fri, 3 Jul 2026 11:04:47 +0100 Subject: [PATCH 16/44] Add failing TaintedPath test for @Pattern sanitizer --- .../semmle/tests/SanitizationTests2.java | 30 +++++++++++++++++++ .../CWE-022/semmle/tests/TaintedPath.expected | 8 +++++ .../security/CWE-022/semmle/tests/options | 2 +- 3 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 java/ql/test/query-tests/security/CWE-022/semmle/tests/SanitizationTests2.java diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/SanitizationTests2.java b/java/ql/test/query-tests/security/CWE-022/semmle/tests/SanitizationTests2.java new file mode 100644 index 000000000000..3dcdfff8cf6f --- /dev/null +++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/SanitizationTests2.java @@ -0,0 +1,30 @@ +import java.io.FileInputStream; +import java.io.IOException; +import java.nio.charset.StandardCharsets; + +import org.springframework.http.ResponseEntity; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.RequestParam; +import org.springframework.web.bind.annotation.RestController; + +@RestController +public class SanitizationTests2 { + + @GetMapping("/product/vuln/path-injection") + public ResponseEntity vulnerablePathInjection(@RequestParam("path") String path) throws IOException { // $ Source[java/path-injection] + // Intentionally vulnerable for SAST testing: user-controlled path reaches file read sink. + try (FileInputStream stream = new FileInputStream(path)) { // $ Alert[java/path-injection] + byte[] fileContents = stream.readNBytes(1024); + return ResponseEntity.ok(new String(fileContents, StandardCharsets.UTF_8)); + } + } + + @GetMapping("/product/vuln/path-injection-fix") + public ResponseEntity vulnerablePathInjectionFix(@RequestParam("path") + @javax.validation.constraints.Pattern(regexp = "[a-zA-Z0-9]*") String path) throws IOException { // $ SPURIOUS: Source + try (FileInputStream stream = new FileInputStream(path)) { // $ SPURIOUS: Alert + byte[] fileContents = stream.readNBytes(1024); + return ResponseEntity.ok(new String(fileContents, StandardCharsets.UTF_8)); + } + } +} diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected index 06ab1d6340d8..297187e8ece8 100644 --- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected +++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected @@ -1,4 +1,6 @@ #select +| SanitizationTests2.java:16:59:16:62 | path | SanitizationTests2.java:14:59:14:91 | path : String | SanitizationTests2.java:16:59:16:62 | path | This path depends on a $@. | SanitizationTests2.java:14:59:14:91 | path | user-provided value | +| SanitizationTests2.java:25:59:25:62 | path | SanitizationTests2.java:23:62:24:139 | path : String | SanitizationTests2.java:25:59:25:62 | path | This path depends on a $@. | SanitizationTests2.java:23:62:24:139 | path | user-provided value | | TaintedPath.java:16:71:16:78 | filename | TaintedPath.java:13:58:13:78 | getInputStream(...) : InputStream | TaintedPath.java:16:71:16:78 | filename | This path depends on a $@. | TaintedPath.java:13:58:13:78 | getInputStream(...) | user-provided value | | Test.java:37:52:37:68 | (...)... | Test.java:32:16:32:45 | getParameter(...) : String | Test.java:37:52:37:68 | (...)... | This path depends on a $@. | Test.java:32:16:32:45 | getParameter(...) | user-provided value | | Test.java:39:32:39:48 | (...)... | Test.java:32:16:32:45 | getParameter(...) : String | Test.java:39:32:39:48 | (...)... | This path depends on a $@. | Test.java:32:16:32:45 | getParameter(...) | user-provided value | @@ -77,6 +79,8 @@ | Test.java:199:19:199:33 | (...)... | Test.java:32:16:32:45 | getParameter(...) : String | Test.java:199:19:199:33 | (...)... | This path depends on a $@. | Test.java:32:16:32:45 | getParameter(...) | user-provided value | | Test.java:204:20:204:36 | (...)... | Test.java:32:16:32:45 | getParameter(...) : String | Test.java:204:20:204:36 | (...)... | This path depends on a $@. | Test.java:32:16:32:45 | getParameter(...) | user-provided value | edges +| SanitizationTests2.java:14:59:14:91 | path : String | SanitizationTests2.java:16:59:16:62 | path | provenance | Sink:MaD:23 | +| SanitizationTests2.java:23:62:24:139 | path : String | SanitizationTests2.java:25:59:25:62 | path | provenance | Sink:MaD:23 | | TaintedPath.java:13:17:13:89 | new BufferedReader(...) : BufferedReader | TaintedPath.java:14:27:14:40 | filenameReader : BufferedReader | provenance | | | TaintedPath.java:13:36:13:88 | new InputStreamReader(...) : InputStreamReader | TaintedPath.java:13:17:13:89 | new BufferedReader(...) : BufferedReader | provenance | MaD:74 | | TaintedPath.java:13:58:13:78 | getInputStream(...) : InputStream | TaintedPath.java:13:36:13:88 | new InputStreamReader(...) : InputStreamReader | provenance | Src:MaD:72 MaD:76 | @@ -312,6 +316,10 @@ models | 75 | Summary: java.io; BufferedReader; true; readLine; ; ; Argument[this]; ReturnValue; taint; manual | | 76 | Summary: java.io; InputStreamReader; false; InputStreamReader; ; ; Argument[0]; Argument[this]; taint; manual | nodes +| SanitizationTests2.java:14:59:14:91 | path : String | semmle.label | path : String | +| SanitizationTests2.java:16:59:16:62 | path | semmle.label | path | +| SanitizationTests2.java:23:62:24:139 | path : String | semmle.label | path : String | +| SanitizationTests2.java:25:59:25:62 | path | semmle.label | path | | TaintedPath.java:13:17:13:89 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader | | TaintedPath.java:13:36:13:88 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader | | TaintedPath.java:13:58:13:78 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream | diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/options b/java/ql/test/query-tests/security/CWE-022/semmle/tests/options index 547355c8e106..4d285fc6e927 100644 --- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/options +++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/options @@ -1 +1 @@ -// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/apache-commons-io-2.6:${testdir}/../../../../../stubs/cargo:${testdir}/../../../../../stubs/apache-ant-1.10.13:${testdir}/../../../../../stubs/stapler-1.263:${testdir}/../../../../../stubs/javax-servlet-2.5:${testdir}/../../../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../../../stubs/saxon-xqj-9.x:${testdir}/../../../../../stubs/apache-commons-beanutils:${testdir}/../../../../../stubs/dom4j-2.1.1:${testdir}/../../../../../stubs/apache-commons-lang:${testdir}/../../../../../stubs/jaxen-1.2.0:${testdir}/../../../../../stubs/jmh-1.3.6:${testdir}/../../../../../stubs/springframework-5.8.x:${testdir}/../../../../../stubs/jaxws-api-2.0:${testdir}/../../../../../stubs/apache-cxf +// semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/javax-validation-constraints:${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/apache-commons-io-2.6:${testdir}/../../../../../stubs/cargo:${testdir}/../../../../../stubs/apache-ant-1.10.13:${testdir}/../../../../../stubs/stapler-1.263:${testdir}/../../../../../stubs/javax-servlet-2.5:${testdir}/../../../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../../../stubs/saxon-xqj-9.x:${testdir}/../../../../../stubs/apache-commons-beanutils:${testdir}/../../../../../stubs/dom4j-2.1.1:${testdir}/../../../../../stubs/apache-commons-lang:${testdir}/../../../../../stubs/jaxen-1.2.0:${testdir}/../../../../../stubs/jmh-1.3.6:${testdir}/../../../../../stubs/springframework-5.8.x:${testdir}/../../../../../stubs/jaxws-api-2.0:${testdir}/../../../../../stubs/apache-cxf From 76b4f4f22343747ebf934aafbf23d6f92c69c268 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Fri, 3 Jul 2026 11:08:54 +0100 Subject: [PATCH 17/44] Fix @Pattern sanitizer for TaintedPath --- .../semmle/code/java/security/PathSanitizer.qll | 17 +++++++++++++++-- .../semmle/tests/SanitizationTests2.java | 4 ++-- .../CWE-022/semmle/tests/TaintedPath.expected | 4 ---- 3 files changed, 17 insertions(+), 8 deletions(-) diff --git a/java/ql/lib/semmle/code/java/security/PathSanitizer.qll b/java/ql/lib/semmle/code/java/security/PathSanitizer.qll index 1288569fa5bb..1b833b7d9160 100644 --- a/java/ql/lib/semmle/code/java/security/PathSanitizer.qll +++ b/java/ql/lib/semmle/code/java/security/PathSanitizer.qll @@ -470,7 +470,12 @@ private class DirectoryCharactersGuard extends PathGuard { Expr checkedExpr; boolean branch; - DirectoryCharactersGuard() { isMatchesCall(this, checkedExpr, branch) } + DirectoryCharactersGuard() { + // Annotations are handled directly as barriers in `DirectoryCharactersSanitizer`, + // since they don't dominate the sanitized expression and so can't act as barrier guards. + not this instanceof Annotation and + isMatchesCall(this, checkedExpr, branch) + } override Expr getCheckedExpr() { result = checkedExpr } @@ -493,7 +498,15 @@ private predicate directoryCharactersGuard(Guard g, Expr e, boolean branch) { */ private class DirectoryCharactersSanitizer extends PathInjectionSanitizer { DirectoryCharactersSanitizer() { - this.asExpr() instanceof ReplaceDirectoryCharactersSanitizer or + this.asExpr() instanceof ReplaceDirectoryCharactersSanitizer + or this = DataFlow::BarrierGuard::getABarrierNode() + or + // Annotations don't fit into the model of barrier guards because the + // annotation doesn't dominate the sanitized expression, so we instead + // treat them as barriers directly. + exists(RegexMatch rm | rm instanceof Annotation and isMatchesCall(rm, _, true) | + this.asExpr() = rm.getString() + ) } } diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/SanitizationTests2.java b/java/ql/test/query-tests/security/CWE-022/semmle/tests/SanitizationTests2.java index 3dcdfff8cf6f..19f4996f0cbe 100644 --- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/SanitizationTests2.java +++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/SanitizationTests2.java @@ -21,8 +21,8 @@ public ResponseEntity vulnerablePathInjection(@RequestParam("path") Stri @GetMapping("/product/vuln/path-injection-fix") public ResponseEntity vulnerablePathInjectionFix(@RequestParam("path") - @javax.validation.constraints.Pattern(regexp = "[a-zA-Z0-9]*") String path) throws IOException { // $ SPURIOUS: Source - try (FileInputStream stream = new FileInputStream(path)) { // $ SPURIOUS: Alert + @javax.validation.constraints.Pattern(regexp = "[a-zA-Z0-9]*") String path) throws IOException { + try (FileInputStream stream = new FileInputStream(path)) { byte[] fileContents = stream.readNBytes(1024); return ResponseEntity.ok(new String(fileContents, StandardCharsets.UTF_8)); } diff --git a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected index 297187e8ece8..bfeb4d730c25 100644 --- a/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected +++ b/java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected @@ -1,6 +1,5 @@ #select | SanitizationTests2.java:16:59:16:62 | path | SanitizationTests2.java:14:59:14:91 | path : String | SanitizationTests2.java:16:59:16:62 | path | This path depends on a $@. | SanitizationTests2.java:14:59:14:91 | path | user-provided value | -| SanitizationTests2.java:25:59:25:62 | path | SanitizationTests2.java:23:62:24:139 | path : String | SanitizationTests2.java:25:59:25:62 | path | This path depends on a $@. | SanitizationTests2.java:23:62:24:139 | path | user-provided value | | TaintedPath.java:16:71:16:78 | filename | TaintedPath.java:13:58:13:78 | getInputStream(...) : InputStream | TaintedPath.java:16:71:16:78 | filename | This path depends on a $@. | TaintedPath.java:13:58:13:78 | getInputStream(...) | user-provided value | | Test.java:37:52:37:68 | (...)... | Test.java:32:16:32:45 | getParameter(...) : String | Test.java:37:52:37:68 | (...)... | This path depends on a $@. | Test.java:32:16:32:45 | getParameter(...) | user-provided value | | Test.java:39:32:39:48 | (...)... | Test.java:32:16:32:45 | getParameter(...) : String | Test.java:39:32:39:48 | (...)... | This path depends on a $@. | Test.java:32:16:32:45 | getParameter(...) | user-provided value | @@ -80,7 +79,6 @@ | Test.java:204:20:204:36 | (...)... | Test.java:32:16:32:45 | getParameter(...) : String | Test.java:204:20:204:36 | (...)... | This path depends on a $@. | Test.java:32:16:32:45 | getParameter(...) | user-provided value | edges | SanitizationTests2.java:14:59:14:91 | path : String | SanitizationTests2.java:16:59:16:62 | path | provenance | Sink:MaD:23 | -| SanitizationTests2.java:23:62:24:139 | path : String | SanitizationTests2.java:25:59:25:62 | path | provenance | Sink:MaD:23 | | TaintedPath.java:13:17:13:89 | new BufferedReader(...) : BufferedReader | TaintedPath.java:14:27:14:40 | filenameReader : BufferedReader | provenance | | | TaintedPath.java:13:36:13:88 | new InputStreamReader(...) : InputStreamReader | TaintedPath.java:13:17:13:89 | new BufferedReader(...) : BufferedReader | provenance | MaD:74 | | TaintedPath.java:13:58:13:78 | getInputStream(...) : InputStream | TaintedPath.java:13:36:13:88 | new InputStreamReader(...) : InputStreamReader | provenance | Src:MaD:72 MaD:76 | @@ -318,8 +316,6 @@ models nodes | SanitizationTests2.java:14:59:14:91 | path : String | semmle.label | path : String | | SanitizationTests2.java:16:59:16:62 | path | semmle.label | path | -| SanitizationTests2.java:23:62:24:139 | path : String | semmle.label | path : String | -| SanitizationTests2.java:25:59:25:62 | path | semmle.label | path | | TaintedPath.java:13:17:13:89 | new BufferedReader(...) : BufferedReader | semmle.label | new BufferedReader(...) : BufferedReader | | TaintedPath.java:13:36:13:88 | new InputStreamReader(...) : InputStreamReader | semmle.label | new InputStreamReader(...) : InputStreamReader | | TaintedPath.java:13:58:13:78 | getInputStream(...) : InputStream | semmle.label | getInputStream(...) : InputStream | From e5bd62dbd3ff27d1feec5b05db8050d81f57a3ae Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Fri, 3 Jul 2026 11:13:58 +0100 Subject: [PATCH 18/44] Add change note --- .../2026-07-03-fix-pattern-sanitizer-tainted-path.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 java/ql/lib/change-notes/2026-07-03-fix-pattern-sanitizer-tainted-path.md diff --git a/java/ql/lib/change-notes/2026-07-03-fix-pattern-sanitizer-tainted-path.md b/java/ql/lib/change-notes/2026-07-03-fix-pattern-sanitizer-tainted-path.md new file mode 100644 index 000000000000..b04c65944459 --- /dev/null +++ b/java/ql/lib/change-notes/2026-07-03-fix-pattern-sanitizer-tainted-path.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Regular expression checks via annotation with `@javax.validation.constraints.Pattern` are now recognized as sanitizers for `java/path-injection`. From bfb3ead31409041d683116eb6c1170b4e34386ae Mon Sep 17 00:00:00 2001 From: Asger F Date: Fri, 3 Jul 2026 14:29:54 +0200 Subject: [PATCH 19/44] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- shared/yeast/src/build.rs | 6 +++--- unified/ql/lib/codeql/unified/internal/AstExtra.qll | 2 +- unified/ql/lib/codeql/unified/internal/Variables.qll | 6 +++--- unified/ql/test/library-tests/variables/test.swift | 8 ++++---- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/shared/yeast/src/build.rs b/shared/yeast/src/build.rs index 7136e2332f8f..6c2a9d4181d7 100644 --- a/shared/yeast/src/build.rs +++ b/shared/yeast/src/build.rs @@ -183,9 +183,9 @@ impl BuildCtx<'_, C> { /// /// Use when descending into a subtree — a body, expression, or statement /// list — that must not inherit any of the surrounding translation - /// context (for example an enclosing binding modifier). Accepts single - /// (`Id`), optional (`Option`), and repeated (`Vec`) captures, - /// since all of them are `IntoIterator`. + /// context (for example an enclosing binding modifier). Accepts optional + /// (`Option`) and repeated (`Vec`) captures (both `IntoIterator`); + /// for a single `Id`, wrap it in `std::iter::once(id)`. pub fn translate_reset>( &mut self, ids: impl IntoIterator, diff --git a/unified/ql/lib/codeql/unified/internal/AstExtra.qll b/unified/ql/lib/codeql/unified/internal/AstExtra.qll index ba625aad5fe7..e14043dc46d2 100644 --- a/unified/ql/lib/codeql/unified/internal/AstExtra.qll +++ b/unified/ql/lib/codeql/unified/internal/AstExtra.qll @@ -44,7 +44,7 @@ module Public { class Comment extends TriviaToken { // At the moment, comments are the only type trivia token we extract /** - * Gets the text inside this comment, not counting the delimeters. + * Gets the text inside this comment, not counting the delimiters. */ string getCommentText() { result = this.getValue().regexpCapture("//(.*)", 1) diff --git a/unified/ql/lib/codeql/unified/internal/Variables.qll b/unified/ql/lib/codeql/unified/internal/Variables.qll index a7e8160deb86..97629f2c57ff 100644 --- a/unified/ql/lib/codeql/unified/internal/Variables.qll +++ b/unified/ql/lib/codeql/unified/internal/Variables.qll @@ -12,10 +12,10 @@ private module LocalNameBindingInput implements LocalNameBindingInputSig 0, // $ access=x1 let x = x, // $ access=x1 // name=x2 - x > 0 else { // $ access=x2 + x > 0 { // $ access=x2 print(x) // $ access=x2 } } @@ -319,7 +319,7 @@ func t35(optional: Int?) { // name=optional1 func t36(a: Int?, b: Int?) { while let x = a, // $ access=a let y = b, // $ access=b - x < y { // $ $ access=x access=y + x < y { // $ access=x access=y print(x) // $ access=x print(y) // $ access=y } From 8f026b1dc2219e9d2e3ceeda5e5bdcc385bb9f4d Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Mon, 6 Jul 2026 13:15:40 +0100 Subject: [PATCH 20/44] Allow inline expectation comments in more file formats --- .../internal/InlineExpectationsTestImpl.qll | 46 +++++++++++++++++-- 1 file changed, 42 insertions(+), 4 deletions(-) diff --git a/csharp/ql/lib/utils/test/internal/InlineExpectationsTestImpl.qll b/csharp/ql/lib/utils/test/internal/InlineExpectationsTestImpl.qll index 962ea7aa0044..6916c5f61067 100644 --- a/csharp/ql/lib/utils/test/internal/InlineExpectationsTestImpl.qll +++ b/csharp/ql/lib/utils/test/internal/InlineExpectationsTestImpl.qll @@ -1,13 +1,51 @@ private import csharp as CS +private import semmle.code.asp.AspNet as ASP private import codeql.util.test.InlineExpectationsTest module Impl implements InlineExpectationsTestSig { + private newtype TExpectationComment = + TCSharpComment(CS::SinglelineComment c) or + TXmlComment(CS::XmlComment c) or + TAspComment(ASP::AspComment c) + /** - * A class representing line comments in C# used by the InlineExpectations core code + * A class representing comments that may contain inline expectations. + * Supports C# single-line comments (`//`), XML comments (``), and + * ASP.NET comments (`` and `<%-- --%>`) in their respective file types. */ - class ExpectationComment extends CS::SinglelineComment { - /** Gets the contents of the given comment, _without_ the preceding comment marker (`//`). */ - string getContents() { result = this.getText() } + class ExpectationComment extends TExpectationComment { + CS::SinglelineComment asCSharpComment() { this = TCSharpComment(result) } + + CS::XmlComment asXmlComment() { this = TXmlComment(result) } + + ASP::AspComment asAspComment() { this = TAspComment(result) } + + /** Gets the contents of this comment, _without_ the preceding comment marker. */ + string getContents() { + result = this.asCSharpComment().getText() + or + result = this.asXmlComment().getText() + or + result = this.asAspComment().getBody() + } + + /** Gets the location of this comment. */ + Location getLocation() { + result = this.asCSharpComment().getLocation() + or + result = this.asXmlComment().getLocation() + or + result = this.asAspComment().getLocation() + } + + /** Gets a textual representation of this comment. */ + string toString() { + result = this.asCSharpComment().toString() + or + result = this.asXmlComment().toString() + or + result = this.asAspComment().toString() + } } class Location = CS::Location; From 0ca353dc7f95b5c3b34a3b2d4607a3b5b83f5fde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jack=20N=C3=B8rskov=20J=C3=B8rgensen?= Date: Wed, 1 Jul 2026 13:26:55 +0200 Subject: [PATCH 21/44] Add Changenote --- java/ql/lib/change-notes/2026-07-01-org.apache.poi-mads.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 java/ql/lib/change-notes/2026-07-01-org.apache.poi-mads.md diff --git a/java/ql/lib/change-notes/2026-07-01-org.apache.poi-mads.md b/java/ql/lib/change-notes/2026-07-01-org.apache.poi-mads.md new file mode 100644 index 000000000000..741372b8e59a --- /dev/null +++ b/java/ql/lib/change-notes/2026-07-01-org.apache.poi-mads.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Added summary and LLM-generated source and sink models for `org.apache.poi`. From a2c5d4c81817178d81ebfc73fa968bc9c0c3170c Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 7 Jul 2026 09:49:50 +0100 Subject: [PATCH 22/44] C++: Convert qlref tests to inline expectations --- .../examples/BadLocking/AV Rule 107.qlref | 3 +- .../LocalVariableHidesGlobalVariable.qlref | 3 +- .../BadLocking/UnintendedDeclaration.cpp | 6 +- .../NoCheckBeforeUnsafePutUser.qlref | 3 +- .../tests/LateCheckOfFunctionArgument.qlref | 3 +- .../Security/CWE/CWE-020/semmle/tests/test.c | 2 +- .../Security/CWE/CWE-078/WordexpTainted.qlref | 3 +- .../query-tests/Security/CWE/CWE-078/test.cpp | 4 +- .../semmle/tests/FindWrapperFunctions.qlref | 3 +- .../CWE/CWE-1041/semmle/tests/test.cpp | 2 +- ...OfVariableWithUnnecessarilyWideScope.qlref | 3 +- .../Security/CWE/CWE-1126/semmle/tests/test.c | 2 +- .../CustomCryptographicPrimitive.qlref | 3 +- .../Security/CWE/CWE-1240/tests_crypto.cpp | 8 +- ...usWorksWithMultibyteOrWideCharacters.qlref | 3 +- .../CWE/CWE-125/semmle/tests/test.cpp | 16 +- .../CWE/CWE-125/semmle/tests/test1.cpp | 14 +- .../CWE/CWE-125/semmle/tests/test2.cpp | 16 +- .../CWE/CWE-125/semmle/tests/test3.cpp | 6 +- .../AllocMultiplicationOverflow.qlref | 3 +- .../AllocMultiplicationOverflow/test.cpp | 22 +- ...ousUseOfTransformationAfterOperation.qlref | 3 +- .../test.cpp | 14 +- .../IfStatementAdditionOverflow.qlref | 3 +- .../IfStatementAdditionOverflow/test.cpp | 80 +++---- .../array-access/ArrayAccessProductFlow.qlref | 3 +- .../CWE/CWE-193/array-access/test.cpp | 20 +- .../ConstantSizeArrayOffByOne.qlref | 3 +- .../CWE/CWE-193/constant-size/test.cpp | 68 +++--- ...ensitiveInformationUnauthorizedActor.qlref | 3 +- .../Security/CWE/CWE-200/test1/test.cpp | 2 +- ...ensitiveInformationUnauthorizedActor.qlref | 3 +- ...ensitiveInformationUnauthorizedActor.qlref | 3 +- .../IncorrectChangingWorkingDirectory.qlref | 3 +- .../CWE/CWE-243/semmle/tests/test.cpp | 8 +- .../tests/IncorrectPrivilegeAssignment.qlref | 3 +- .../CWE/CWE-266/semmle/tests/test.cpp | 4 +- .../CWE/CWE-285/PamAuthorization.qlref | 3 +- .../query-tests/Security/CWE/CWE-285/test.cpp | 2 +- .../Security/CWE/CWE-295/CurlSSL.cpp | 4 +- .../Security/CWE/CWE-295/CurlSSL.qlref | 3 +- .../semmle/tests/PrivateCleartextWrite.qlref | 3 +- .../CWE/CWE-359/semmle/tests/test.cpp | 16 +- .../tests/DivideByZeroUsingReturnValue.qlref | 3 +- .../CWE/CWE-369/semmle/tests/test.cpp | 60 +++--- .../semmle/tests/InsecureTemporaryFile.qlref | 3 +- .../CWE/CWE-377/semmle/tests/test.cpp | 2 +- .../MemoryLeakOnFailedCallToRealloc.qlref | 3 +- .../Security/CWE/CWE-401/semmle/tests/test.c | 16 +- .../DecompressionBombs.qlref | 3 +- .../CWE-409/DecompressionBombs/brotliTest.cpp | 4 +- .../DecompressionBombs/libarchiveTests.cpp | 2 +- .../CWE/CWE-409/DecompressionBombs/main.cpp | 2 +- .../DecompressionBombs/minizipTest.cpp | 6 +- .../CWE-409/DecompressionBombs/zlibTest.cpp | 10 +- .../CWE-409/DecompressionBombs/zstdTest.cpp | 2 +- .../CWE/CWE-415/semmle/tests/DoubleFree.qlref | 3 +- .../Security/CWE/CWE-415/semmle/tests/test.c | 8 +- .../tests/DangerousUseOfExceptionBlocks.qlref | 3 +- .../CWE/CWE-476/semmle/tests/test.cpp | 12 +- .../tests/FindIncorrectlyUsedSwitch.qlref | 3 +- .../Security/CWE/CWE-561/semmle/tests/test.c | 8 +- .../tests/DangerousUseSSL_shutdown.qlref | 3 +- .../CWE/CWE-670/semmle/tests/test.cpp | 4 +- .../CWE-675/semmle/tests/DoubleRelease.qlref | 3 +- .../CWE/CWE-675/semmle/tests/test.cpp | 18 +- ...lowManagementAfterRefactoringTheCode.qlref | 3 +- ...FlowManagementWhenUsingBitOperations.qlref | 3 +- .../Security/CWE/CWE-691/semmle/tests/test.c | 12 +- .../tests/FindIncorrectlyUsedExceptions.qlref | 3 +- .../CWE/CWE-703/semmle/tests/test.cpp | 6 +- .../tests/ImproperCheckReturnValueScanf.qlref | 3 +- .../CWE/CWE-754/semmle/tests/test.cpp | 16 +- ...finedOrImplementationDefinedBehavior.qlref | 3 +- .../Security/CWE/CWE-758/semmle/tests/test.c | 4 +- ...rorWhenUseBitwiseOrLogicalOperations.qlref | 3 +- .../CWE/CWE-783/semmle/tests/test.cpp | 22 +- ...yLocationAfterEndOfBufferUsingStrlen.qlref | 3 +- ...rPrecedenceLogicErrorWhenUseBoolType.qlref | 3 +- .../Security/CWE/CWE-788/semmle/tests/test.c | 22 +- .../CWE/CWE-788/semmle/tests/test.cpp | 10 +- ...BufferAccessWithIncorrectLengthValue.qlref | 3 +- .../CWE/CWE-805/semmle/tests/test.cpp | 2 +- .../semmle/tests/MemoryUnsafeFunctionScan.cpp | 6 +- .../tests/MemoryUnsafeFunctionScan.qlref | 3 +- .../ir/aliased_ssa_consistency_unsound.qlref | 2 +- .../aliased_ssa_ssa_consistency_unsound.qlref | 2 +- .../library-tests/ir/ir/raw_consistency.qlref | 2 +- .../unaliased_ssa_consistency_unsound.qlref | 2 +- ...naliased_ssa_ssa_consistency_unsound.qlref | 2 +- .../ssa/aliased_ssa_consistency_unsound.qlref | 2 +- .../ir/ssa/aliased_ssa_ir_unsound.qlref | 2 +- .../aliased_ssa_ssa_consistency_unsound.qlref | 2 +- .../unaliased_ssa_consistency_unsound.qlref | 2 +- .../ir/ssa/unaliased_ssa_ir_unsound.qlref | 2 +- ...naliased_ssa_ssa_consistency_unsound.qlref | 2 +- .../lossy_pointer_cast/lossy_pointer_cast.c | 5 +- .../lossy_pointer_cast.qlref | 3 +- .../syntax-zoo/aliased_ssa_consistency.qlref | 2 +- .../syntax-zoo/raw_consistency.qlref | 2 +- .../unaliased_ssa_consistency.qlref | 2 +- .../FeatureEnvy/FeatureEnvy.qlref | 3 +- .../Architecture/FeatureEnvy/a.cpp | 6 +- .../ClassesWithManyFields/cwmf.cpp | 14 +- .../ClassesWithManyFields/cwmf.qlref | 3 +- .../ClassesWithManyFields/different_types.h | 2 +- .../ComplexFunctions/ComplexFunctions.qlref | 3 +- .../ComplexFunctions/complex.c | 2 +- .../GuardedFree/GuardedFree.qlref | 3 +- .../Best Practices/GuardedFree/test.cpp | 10 +- .../DeclarationHidesParameter.qlref | 3 +- .../DeclarationHidesParameter/hiding.cpp | 14 +- .../DeclarationHidesVariable.qlref | 3 +- .../DeclarationHidesVariable/hiding.cpp | 6 +- .../DeclarationHidesVariable.qlref | 3 +- .../LocalVariableHidesGlobalVariable/Hiding.c | 16 +- .../LocalVariableHidesGlobalVariable.qlref | 3 +- .../CommaBeforeMisleadingIndentation.qlref | 3 +- .../CommaBeforeMisleadingIndentation/test.cpp | 10 +- .../OffsetUseBeforeRangeCheck.qlref | 3 +- .../OffsetUseBeforeRangeCheck/test.cpp | 12 +- .../Likely Errors/Slicing/Slicing.qlref | 3 +- .../Likely Errors/Slicing/test.cpp | 2 +- .../ConstructorOrMethodWithExactDate.cpp | 8 +- .../Japanese Era/JapaneseEraDate.qlref | 3 +- .../Japanese Era/StructWithExactDate.cpp | 6 +- .../MagicConstantsNumbers.qlref | 3 +- .../MagicConstantsNumbers/a123.c | 2 +- .../MagicConstantsNumbers/b123.c | 2 +- .../MagicConstantsNumbers/case.c | 2 +- .../MagicConstantsNumbers/constants.h | 10 +- .../MagicConstantsNumbers/functions.h | 4 +- .../MagicConstantsNumbers/templates.cpp | 4 +- .../MagicConstantsString.qlref | 3 +- .../MagicConstantsString/constants.h | 2 +- .../MagicConstantsString/joining.cpp | 8 +- .../Best Practices/RuleOfTwo/RuleOfTwo.cpp | 12 +- .../Best Practices/RuleOfTwo/RuleOfTwo.qlref | 3 +- .../SloppyGlobal/SloppyGlobal.qlref | 3 +- .../Best Practices/SloppyGlobal/main.cpp | 14 +- .../UnusedIncludes/unusedIncludes.cpp | 8 +- .../UnusedIncludes/unusedIncludes.qlref | 3 +- .../UnusedLocals/UnusedLocals.qlref | 3 +- .../Unused Entities/UnusedLocals/code.c | 26 +-- .../Unused Entities/UnusedLocals/code.cpp | 14 +- .../Unused Entities/UnusedLocals/code2.cpp | 24 +-- .../Unused Entities/UnusedLocals/errors.c | 2 +- .../UnusedStaticFunctions.qlref | 3 +- .../UnusedStaticFunctions/unused_functions.c | 8 +- .../UnusedStaticFunctions/unused_mut.c | 4 +- .../unused_static_functions.cpp | 6 +- .../UnusedStaticFunctions/used_by_var_ref.c | 7 +- .../UnusedStaticVariables.qlref | 3 +- .../UnusedStaticVariables/test.cpp | 8 +- .../DeadCodeFunction/DeadCodeFunction.qlref | 3 +- .../Critical/DeadCodeFunction/test.cpp | 2 +- .../Critical/DeadCodeGoto/DeadCodeGoto.qlref | 3 +- .../Critical/DeadCodeGoto/test.cpp | 6 +- .../FileClosed/FileMayNotBeClosed.qlref | 3 +- .../Critical/FileClosed/FileNeverClosed.qlref | 3 +- .../query-tests/Critical/FileClosed/file.c | 9 +- .../GlobalUseBeforeInit.qlref | 3 +- .../Critical/GlobalUseBeforeInit/test.cpp | 4 +- .../InitialisationNotRun.qlref | 3 +- .../Critical/InitialisationNotRun/test.cpp | 4 +- .../LargeParameter/LargeParameter.qlref | 3 +- .../Critical/LargeParameter/test.cpp | 24 +-- .../Critical/MemoryFreed/DoubleFree.qlref | 3 +- .../MemoryFreed/MemoryMayNotBeFreed.qlref | 3 +- .../MemoryFreed/MemoryNeverFreed.qlref | 3 +- .../Critical/MemoryFreed/UseAfterFree.qlref | 3 +- .../Critical/MemoryFreed/my_auto_ptr.cpp | 12 +- .../query-tests/Critical/MemoryFreed/test.cpp | 26 +-- .../Critical/MemoryFreed/test_free.cpp | 124 +++++------ .../IncorrectCheckScanf.qlref | 3 +- .../MissingCheckScanf/MissingCheckScanf.qlref | 3 +- .../Critical/MissingCheckScanf/test.cpp | 96 ++++----- .../MissingNullTest/MissingNullTest.qlref | 3 +- .../Critical/MissingNullTest/test.cpp | 14 +- .../NewFree/NewArrayDeleteMismatch.qlref | 3 +- .../NewFree/NewDeleteArrayMismatch.qlref | 3 +- .../Critical/NewFree/NewFreeMismatch.qlref | 3 +- .../query-tests/Critical/NewFree/test.cpp | 64 +++--- .../query-tests/Critical/NewFree/test2.cpp | 12 +- .../NotInitialised/NotInitialised.qlref | 3 +- .../Critical/NotInitialised/test.cpp | 6 +- .../NoSpaceForZeroTerminator.qlref | 3 +- .../OverflowCalculated.qlref | 3 +- .../Critical/OverflowCalculated/tests1.cpp | 14 +- .../Critical/OverflowCalculated/tests2.cpp | 4 +- .../Critical/OverflowCalculated/tests3.cpp | 12 +- .../OverflowStatic/OverflowStatic.qlref | 3 +- .../Critical/OverflowStatic/test.c | 8 +- .../Critical/OverflowStatic/test.cpp | 12 +- .../Critical/OverflowStatic/test2.c | 15 +- .../ReturnValueIgnored.qlref | 3 +- .../Critical/ReturnValueIgnored/test.cpp | 2 +- .../Critical/SizeCheck/SizeCheck2.qlref | 3 +- .../query-tests/Critical/SizeCheck/test.c | 14 +- .../query-tests/Critical/SizeCheck/test2.c | 10 +- .../UnsafeUseOfThis/UnsafeUseOfThis.qlref | 3 +- .../Critical/UnsafeUseOfThis/test.cpp | 16 +- .../DocumentApi/DocumentApi.qlref | 3 +- .../DocumentApi/comment_prototypes.c | 12 +- .../Documentation/DocumentApi/definition.c | 4 +- .../Cleanup-DuplicateIncludeGuard.qlref | 3 +- .../Cleanup-DuplicateIncludeGuard/header1.h | 2 +- .../Cleanup-DuplicateIncludeGuard/header2.h | 2 +- .../Cleanup-DuplicateIncludeGuard/header4.h | 2 +- .../Cleanup-DuplicateIncludeGuard/header6.h | 2 +- .../Cleanup-DuplicateIncludeGuard/header7.h | 2 +- .../subfolder/header4.h | 2 +- .../subfolder/header5.h | 2 +- .../LimitedScopeFile/LimitedScopeFile.qlref | 3 +- .../LOC-3/Rule 13/LimitedScopeFile/file1.c | 2 +- .../LimitedScopeFunction.qlref | 3 +- .../LOC-3/Rule 13/LimitedScopeFunction/test.c | 6 +- .../JPL_C/LOC-3/Rule 17/BasicIntTypes.qlref | 3 +- .../query-tests/JPL_C/LOC-3/Rule 17/test.c | 2 +- .../NonConstFunctionPointer.qlref | 3 +- .../Rule 29/NonConstFunctionPointer/test.c | 6 +- .../FunctionPointerConversions.qlref | 3 +- .../Rule 30/FunctionPointerConversions/test.c | 12 +- .../AmbiguouslySignedBitField.qlref | 3 +- .../AmbiguouslySignedBitField/test.cpp | 10 +- .../BadAdditionOverflowCheck.qlref | 3 +- .../ComparisonWithCancelingSubExpr.qlref | 3 +- .../PointlessSelfComparison.qlref | 3 +- .../SignedOverflowCheck.cpp | 15 +- .../SignedOverflowCheck.qlref | 3 +- .../BadAdditionOverflowCheck/templates.cpp | 4 +- .../BadAdditionOverflowCheck/test.cpp | 20 +- .../Arithmetic/BadCheckOdd/BadCheckOdd.qlref | 3 +- .../Arithmetic/BadCheckOdd/test.cpp | 4 +- .../BitwiseSignCheck/BitwiseSignCheck.qlref | 3 +- .../Arithmetic/BitwiseSignCheck/bsc.cpp | 8 +- .../ComparisonPrecedence.qlref | 3 +- .../ComparisonPrecedence/template.cpp | 4 +- .../Arithmetic/ComparisonPrecedence/test.cpp | 16 +- .../FloatComparison/FloatComparison.qlref | 3 +- .../Arithmetic/FloatComparison/c.c | 8 +- .../Arithmetic/IntMultToLong/Buildless.c | 4 +- .../Arithmetic/IntMultToLong/IntMultToLong.c | 32 +-- .../IntMultToLong/IntMultToLong.cpp | 2 +- .../IntMultToLong/IntMultToLong.qlref | 3 +- .../PointlessComparison/ConstVirtual.cpp | 2 +- .../PointlessComparison/PointlessComparison.c | 96 ++++----- .../PointlessComparison.cpp | 12 +- .../PointlessComparison.qlref | 3 +- .../PointlessComparison/RegressionTests.cpp | 2 +- .../PointlessComparison/Templates.cpp | 2 +- .../PointlessComparison/UnsignedGEZero.qlref | 3 +- .../Arithmetic/UnsignedGEZero/Templates.cpp | 2 +- .../UnsignedGEZero/UnsignedGEZero.c | 44 ++-- .../UnsignedGEZero/UnsignedGEZero.cpp | 44 ++-- .../UnsignedGEZero/UnsignedGEZero.qlref | 3 +- .../ContinueInFalseLoop.qlref | 3 +- .../Likely Bugs/ContinueInFalseLoop/test.cpp | 4 +- .../ArrayArgSizeMismatch.qlref | 3 +- .../Conversion/ArrayArgSizeMismatch/test.cpp | 6 +- .../CastArrayPointerArithmetic.qlref | 3 +- .../CastArrayPointerArithmetic/test.cpp | 24 +-- .../ImplicitDowncastFromBitfield.qlref | 3 +- .../ImplicitDowncastFromBitfield/test.cpp | 4 +- .../LossyFunctionResultCast.qlref | 3 +- .../LossyFunctionResultCast/test.cpp | 18 +- .../NonConstantFormat/NonConstantFormat.c | 8 +- .../NonConstantFormat/NonConstantFormat.qlref | 3 +- .../Format/NonConstantFormat/nested.cpp | 12 +- .../Format/NonConstantFormat/test.cpp | 60 +++--- .../SnprintfOverflow/SnprintfOverflow.qlref | 3 +- .../Format/SnprintfOverflow/test.cpp | 8 +- .../TooManyFormatArguments.qlref | 3 +- .../WrongNumberOfFormatArguments.qlref | 3 +- .../Format/WrongNumberOfFormatArguments/a.c | 4 +- .../Format/WrongNumberOfFormatArguments/b.c | 4 +- .../Format/WrongNumberOfFormatArguments/c.c | 4 +- .../custom_printf.cpp | 5 +- .../WrongNumberOfFormatArguments/macros.cpp | 10 +- .../syntax_errors.c | 2 +- .../WrongNumberOfFormatArguments/test.c | 30 +-- .../Buildless/WrongTypeFormatArguments.qlref | 3 +- .../Buildless/second.cpp | 4 +- .../Buildless/tests.c | 2 +- .../Builtin/WrongTypeFormatArguments.qlref | 3 +- .../WrongTypeFormatArguments/Builtin/tests.c | 2 +- .../WrongTypeFormatArguments.qlref | 3 +- .../Linux_mixed_byte_wprintf/tests.cpp | 22 +- .../WrongTypeFormatArguments.qlref | 3 +- .../Linux_mixed_word_size/tests_32.cpp | 4 +- .../Linux_mixed_word_size/tests_64.cpp | 4 +- .../WrongTypeFormatArguments.qlref | 3 +- .../Linux_signed_chars/format.h | 2 +- .../Linux_signed_chars/linux.cpp | 2 +- .../Linux_signed_chars/linux_c.c | 2 +- .../Linux_signed_chars/pri_macros.h | 2 +- .../Linux_signed_chars/printf1.h | 102 ++++----- .../Linux_signed_chars/real_world.h | 8 +- .../Linux_signed_chars/wide_string.h | 2 +- .../WrongTypeFormatArguments.qlref | 3 +- .../Linux_two_byte_wprintf/printf.cpp | 4 +- .../WrongTypeFormatArguments.qlref | 3 +- .../Linux_unsigned_chars/format.h | 2 +- .../Linux_unsigned_chars/pri_macros.h | 2 +- .../Linux_unsigned_chars/printf1.h | 22 +- .../Linux_unsigned_chars/real_world.h | 8 +- .../Linux_unsigned_chars/wide_string.h | 2 +- .../Microsoft/WrongTypeFormatArguments.qlref | 3 +- .../Microsoft/format.h | 2 +- .../Microsoft/pri_macros.h | 2 +- .../Microsoft/printf1.h | 58 ++--- .../Microsoft/real_world.h | 8 +- .../Microsoft/wide_string.h | 4 +- .../WrongTypeFormatArguments.qlref | 3 +- .../Microsoft_no_wchar/format.h | 2 +- .../Microsoft_no_wchar/pri_macros.h | 2 +- .../Microsoft_no_wchar/printf1.h | 54 ++--- .../Microsoft_no_wchar/real_world.h | 8 +- .../Microsoft_no_wchar/wide_string.h | 4 +- .../InconsistentCheckReturnNull.qlref | 3 +- .../InconsistentCheckReturnNull/test.c | 2 +- .../Adding365daysPerYear.qlref | 3 +- .../Leap Year/Adding365DaysPerYear/test.cpp | 10 +- ...UncheckedReturnValueForTimeFunctions.qlref | 3 +- .../test.cpp | 12 +- .../UnsafeArrayForDaysOfYear.qlref | 3 +- .../UnsafeArrayForDaysOfYear/test.cpp | 6 +- .../AssignWhereCompareMeant.qlref | 3 +- .../AssignWhereCompareMeant/test.cpp | 48 ++--- .../CompareWhereAssignMeant.qlref | 3 +- .../ExprHasNoEffect.qlref | 3 +- .../CompareWhereAssignMeant/test.cpp | 20 +- .../DubiousNullCheck/DubiousNullCheck.cpp | 8 +- .../DubiousNullCheck/DubiousNullCheck.qlref | 3 +- .../TryCompile-abcdef/ExprHasNoEffect.qlref | 3 +- .../ExprHasNoEffect/ExprHasNoEffect.qlref | 3 +- .../autoconf/ExprHasNoEffect.qlref | 3 +- .../ExprHasNoEffect/autoconf/conftest.c.c | 2 +- .../ExprHasNoEffect/autoconf/conftest_abc.c | 2 +- .../Likely Typos/ExprHasNoEffect/calls.cpp | 6 +- .../Likely Typos/ExprHasNoEffect/expr.cpp | 8 +- .../tmp_abc/ExprHasNoEffect.qlref | 3 +- .../Likely Typos/ExprHasNoEffect/preproc.c | 4 +- .../Likely Typos/ExprHasNoEffect/template.cpp | 2 +- .../ExprHasNoEffect/templatey.cpp | 2 +- .../Likely Typos/ExprHasNoEffect/test.c | 26 +-- .../Likely Typos/ExprHasNoEffect/test.cpp | 4 +- .../Likely Typos/ExprHasNoEffect/volatile.c | 9 +- .../Likely Typos/ExprHasNoEffect/weak.c | 2 +- .../IncorrectNotOperatorUsage.c | 18 +- .../IncorrectNotOperatorUsage.cpp | 18 +- .../IncorrectNotOperatorUsage.qlref | 3 +- .../ShortCircuitBitMask.qlref | 3 +- .../ShortCircuitBitMask/big_ints.cpp | 24 +-- .../UsingStrcpyAsBoolean.qlref | 3 +- .../Likely Typos/UsingStrcpyAsBoolean/test.c | 24 +-- .../UsingStrcpyAsBoolean/test.cpp | 42 ++-- .../inconsistentLoopDirection.c | 12 +- .../inconsistentLoopDirection.cpp | 44 ++-- .../inconsistentLoopDirection.qlref | 3 +- .../AllocaInLoop/AllocaInLoop.qlref | 3 +- .../AllocaInLoop/AllocaInLoop1.cpp | 8 +- .../AllocaInLoop/AllocaInLoop1ms.cpp | 6 +- .../AllocaInLoop/AllocaInLoop2.c | 2 +- .../AllocaInLoop/AllocaInLoop3.cpp | 2 +- .../AllocaInLoop/BoundedLoop.cpp | 18 +- .../ImproperNullTermination.qlref | 3 +- .../ImproperNullTerminationTainted.qlref | 3 +- .../ImproperNullTermination/test.cpp | 56 ++--- .../NtohlArrayNoBound/NtohlArrayNoBound.qlref | 3 +- .../NtohlArrayNoBound/test.cpp | 18 +- .../More64BitWaste/More64BitWaste.qlref | 3 +- .../Padding/More64BitWaste/test.cpp | 4 +- .../NonPortablePrintf/NonPortablePrintf.qlref | 3 +- .../Padding/NonPortablePrintf/test.cpp | 8 +- .../Suboptimal64BitType.qlref | 3 +- .../Padding/Suboptimal64BitType/types.c | 2 +- .../PointerOverflow/PointerOverflow.qlref | 3 +- .../PointerOverflow/test.cpp | 8 +- .../ReturnCstrOfLocalStdString.qlref | 3 +- .../ReturnCstrOfLocalStdString/test.cpp | 6 +- .../ReturnStackAllocatedMemory.qlref | 3 +- .../ReturnStackAllocatedMemory/test.cpp | 52 ++--- .../StackAddressEscapes.qlref | 3 +- .../StackAddressEscapes/manager.cpp | 2 +- .../StackAddressEscapes/test.cpp | 130 +++++------ .../StrncpyFlippedArgs.qlref | 3 +- .../StrncpyFlippedArgs/test.c | 4 +- .../StrncpyFlippedArgs/test.cpp | 40 ++-- .../SuspiciousCallToMemset.qlref | 3 +- .../SuspiciousCallToMemset/doc_tests.c | 4 +- .../SuspiciousCallToMemset/test.cpp | 66 +++--- .../SuspiciousCallToStrncat.qlref | 3 +- .../SuspiciousCallToStrncat/test.c | 16 +- .../SuspiciousSizeof/SuspiciousSizeof.qlref | 3 +- .../SuspiciousSizeof/test.cpp | 20 +- .../UnsafeUseOfStrcat/strcat.c | 5 +- .../UnsafeUseOfStrcat/strcat.qlref | 3 +- .../UsingExpiredStackAddress.qlref | 3 +- .../UsingExpiredStackAddress/test.cpp | 112 +++++----- .../IncorrectConstructorDelegation.qlref | 3 +- .../IncorrectConstructorDelegation/test.cpp | 4 +- .../NonVirtualDestructorInBaseClass.cpp | 6 +- .../NonVirtualDestructorInBaseClass.qlref | 3 +- .../ThrowInDestructor/ThrowInDestructor.qlref | 3 +- .../Likely Bugs/OO/ThrowInDestructor/test.cpp | 6 +- .../TlsSettingsMisconfiguration.qlref | 3 +- .../UseOfDeprecatedHardcodedProtocol.qlref | 3 +- .../Likely Bugs/Protocols/test.cpp | 42 ++-- .../Likely Bugs/Protocols/test2.cpp | 10 +- .../Likely Bugs/Protocols/test3.cpp | 2 +- .../RedundantNullCheckSimple.cpp | 24 +-- .../RedundantNullCheckSimple.qlref | 3 +- .../ReturnConstType/ReturnConstType.qlref | 3 +- .../Likely Bugs/ReturnConstType/test.cpp | 14 +- .../ReturnConstTypeMember.qlref | 3 +- .../ReturnConstTypeMember/templates.cpp | 2 +- .../ReturnConstTypeMember/test.cpp | 6 +- .../ShortLoopVarName/ShortLoopVarName.cpp | 12 +- .../ShortLoopVarName/ShortLoopVarName.qlref | 3 +- .../ImplicitFunctionDeclaration.qlref | 3 +- .../MistypedFunctionArguments.qlref | 3 +- .../TooFewArguments.qlref | 3 +- .../TooManyArguments.qlref | 3 +- .../Underspecified Functions/test.c | 68 +++--- .../UseInOwnInitializer.qlref | 3 +- .../Likely Bugs/UseInOwnInitializer/test.cpp | 8 +- .../Rule 2/BoundedLoopIterations.qlref | 3 +- .../query-tests/Power of 10/Rule 2/loops.cpp | 26 +-- .../CWE/CWE-014/MemsetMayBeDeleted.qlref | 3 +- .../query-tests/Security/CWE/CWE-014/test.cpp | 16 +- ..._Path_Traversal__char_console_fopen_11.cpp | 4 +- .../SAMATE/TaintedPath/TaintedPath.qlref | 3 +- .../SAMATE/ExecTainted/ExecTainted.qlref | 3 +- .../CWE/CWE-078/SAMATE/ExecTainted/tests.cpp | 4 +- .../semmle/ExecTainted/ExecTainted.qlref | 3 +- .../CWE/CWE-078/semmle/ExecTainted/test.cpp | 66 +++--- .../CWE/CWE-079/semmle/CgiXss/CgiXss.qlref | 3 +- .../CWE/CWE-079/semmle/CgiXss/search.c | 8 +- .../UncontrolledProcessOperation.qlref | 3 +- .../UncontrolledProcessOperation/test.cpp | 4 +- .../UncontrolledProcessOperation.qlref | 3 +- .../UncontrolledProcessOperation/test.cpp | 36 ++-- .../CWE-119/SAMATE/BadlyBoundedWrite.qlref | 3 +- .../SAMATE/OffsetUseBeforeRangeCheck.qlref | 3 +- .../CWE/CWE-119/SAMATE/OverflowBuffer.qlref | 3 +- .../CWE-119/SAMATE/OverflowDestination.qlref | 3 +- .../CWE/CWE-119/SAMATE/OverflowStatic.qlref | 3 +- .../CWE/CWE-119/SAMATE/OverrunWrite.qlref | 3 +- .../CWE-119/SAMATE/OverrunWriteFloat.qlref | 3 +- .../SAMATE/OverrunWriteProductFlow.qlref | 3 +- .../CWE-119/SAMATE/StrncpyFlippedArgs.qlref | 3 +- .../CWE/CWE-119/SAMATE/UnboundedWrite.qlref | 3 +- .../SAMATE/VeryLikelyOverrunWrite.qlref | 3 +- .../Security/CWE/CWE-119/SAMATE/test.cpp | 42 ++-- .../Security/CWE/CWE-119/SAMATE/tests.cpp | 34 +-- .../semmle/tests/BadlyBoundedWrite.qlref | 3 +- .../tests/OffsetUseBeforeRangeCheck.qlref | 3 +- .../CWE-119/semmle/tests/OverflowBuffer.qlref | 3 +- .../semmle/tests/OverflowDestination.qlref | 3 +- .../CWE-119/semmle/tests/OverflowStatic.qlref | 3 +- .../CWE-119/semmle/tests/OverrunWrite.qlref | 3 +- .../semmle/tests/OverrunWriteFloat.qlref | 3 +- .../semmle/tests/StrncpyFlippedArgs.qlref | 3 +- .../CWE-119/semmle/tests/UnboundedWrite.qlref | 3 +- .../semmle/tests/VeryLikelyOverrunWrite.qlref | 3 +- .../CWE/CWE-119/semmle/tests/main.cpp | 2 +- .../semmle/tests/overflowdestination.cpp | 12 +- .../CWE/CWE-119/semmle/tests/tests.cpp | 202 +++++++++--------- .../CWE/CWE-119/semmle/tests/tests_restrict.c | 2 +- .../CWE/CWE-119/semmle/tests/unions.cpp | 6 +- .../CWE-119/semmle/tests/var_size_struct.cpp | 10 +- .../UnsafeUseOfStrcat/UnsafeUseOfStrcat.qlref | 3 +- .../CWE-120/semmle/UnsafeUseOfStrcat/test.c | 4 +- .../semmle/tests/BadlyBoundedWrite.qlref | 3 +- .../CWE-120/semmle/tests/OverrunWrite.qlref | 3 +- .../semmle/tests/OverrunWriteFloat.qlref | 3 +- .../CWE-120/semmle/tests/UnboundedWrite.qlref | 3 +- .../semmle/tests/VeryLikelyOverrunWrite.qlref | 3 +- .../Security/CWE/CWE-120/semmle/tests/tests.c | 46 ++-- .../CWE/CWE-120/semmle/tests/tests2.cpp | 18 +- .../CWE/CWE-120/semmle/tests/unions.c | 8 +- .../CWE-120/semmle/tests/var_size_struct.cpp | 4 +- .../CWE/CWE-120/semmle/tests/varbuffer.c | 22 +- .../tests/UnterminatedVarargsCall.qlref | 3 +- .../CWE/CWE-121/semmle/tests/more_tests.cpp | 12 +- .../Security/CWE/CWE-121/semmle/tests/tests.c | 12 +- ...Based_Buffer_Overflow__c_CWE129_fgets_01.c | 4 +- .../ImproperArrayIndexValidation.qlref | 3 +- .../ImproperArrayIndexValidation.qlref | 3 +- .../ImproperArrayIndexValidation/test1.c | 11 +- .../NoSpaceForZeroTerminator.qlref | 3 +- .../CWE-131/NoSpaceForZeroTerminator/test.c | 8 +- .../CWE-131/NoSpaceForZeroTerminator/test.cpp | 18 +- .../NoSpaceForZeroTerminator/test2.cpp | 16 +- .../SAMATE/UncontrolledFormatString.qlref | 3 +- ...char_connect_socket_w32_vsnprintf_01_bad.c | 4 +- .../SAMATE/char_console_fprintf_01_bad.c | 4 +- .../SAMATE/char_environment_fprintf_01_bad.c | 4 +- .../CWE/CWE-134/semmle/argv/argvLocal.c | 50 ++--- .../CWE/CWE-134/semmle/argv/argvLocal.qlref | 3 +- .../semmle/consts/NonConstantFormat.qlref | 3 +- .../CWE/CWE-134/semmle/consts/consts.cpp | 40 ++-- .../CWE/CWE-134/semmle/funcs/funcsLocal.c | 30 +-- .../CWE/CWE-134/semmle/funcs/funcsLocal.qlref | 3 +- .../globalVars/UncontrolledFormatString.qlref | 3 +- .../CWE-134/semmle/globalVars/globalVars.c | 12 +- .../Security/CWE/CWE-134/semmle/ifs/ifs.c | 24 +-- .../Security/CWE/CWE-134/semmle/ifs/ifs.qlref | 3 +- .../CWE-190/SAMATE/ArithmeticTainted.qlref | 3 +- .../SAMATE/ArithmeticUncontrolled.qlref | 3 +- .../SAMATE/ArithmeticWithExtremeValues.qlref | 3 +- .../SAMATE/IntegerOverflowTainted.qlref | 3 +- .../Security/CWE/CWE-190/SAMATE/examples.cpp | 12 +- .../ArithmeticUncontrolled.qlref | 3 +- .../semmle/ArithmeticUncontrolled/test.c | 60 +++--- .../semmle/ArithmeticUncontrolled/test.cpp | 60 +++--- .../ArithmeticWithExtremeValues.qlref | 3 +- .../semmle/ArithmeticWithExtremeValues/test.c | 12 +- .../ComparisonWithWiderType.qlref | 3 +- .../semmle/ComparisonWithWiderType/test.c | 34 +-- .../TaintedAllocationSize.qlref | 3 +- .../semmle/TaintedAllocationSize/test.cpp | 72 +++---- .../semmle/tainted/ArithmeticTainted.qlref | 3 +- .../tainted/IntegerOverflowTainted.qlref | 3 +- .../CWE/CWE-190/semmle/tainted/main.cpp | 2 +- .../CWE/CWE-190/semmle/tainted/test.c | 8 +- .../CWE/CWE-190/semmle/tainted/test2.cpp | 18 +- .../CWE/CWE-190/semmle/tainted/test3.c | 4 +- .../CWE/CWE-190/semmle/tainted/test4.cpp | 2 +- .../CWE/CWE-190/semmle/tainted/test5.cpp | 10 +- .../CWE/CWE-190/semmle/tainted/test6.cpp | 8 +- ...gnedDifferenceExpressionComparedZero.qlref | 3 +- .../test.cpp | 36 ++-- .../CWE/CWE-193/InvalidPointerDeref.qlref | 3 +- .../query-tests/Security/CWE/CWE-193/test.cpp | 112 +++++----- .../IntegerOverflowTainted.qlref | 3 +- .../SAMATE/IntegerOverflowTainted/tests.cpp | 2 +- .../tests/DangerousFunctionOverflow.qlref | 3 +- .../semmle/tests/DangerousUseOfCin.qlref | 3 +- .../CWE-242/semmle/tests/OverrunWrite.qlref | 3 +- .../semmle/tests/OverrunWriteFloat.qlref | 3 +- .../semmle/tests/VeryLikelyOverrunWrite.qlref | 3 +- .../CWE/CWE-242/semmle/tests/tests.cpp | 106 ++++----- .../CWE/CWE-253/HResultBooleanConversion.c | 24 +-- .../CWE/CWE-253/HResultBooleanConversion.cpp | 28 +-- .../CWE-253/HResultBooleanConversion.qlref | 3 +- .../AuthenticationBypass.qlref | 3 +- .../semmle/AuthenticationBypass/test.cpp | 29 ++- .../CWE/CWE-295/SSLResultConflation.qlref | 3 +- .../CWE/CWE-295/SSLResultNotChecked.qlref | 3 +- .../query-tests/Security/CWE/CWE-295/test.cpp | 24 +-- .../Security/CWE/CWE-295/test2.cpp | 8 +- .../semmle/tests/CleartextBufferWrite.qlref | 3 +- .../semmle/tests/CleartextFileWrite.qlref | 3 +- .../semmle/tests/CleartextTransmission.qlref | 3 +- .../CWE/CWE-311/semmle/tests/test.cpp | 10 +- .../CWE/CWE-311/semmle/tests/test2.cpp | 30 +-- .../CWE/CWE-311/semmle/tests/test3.cpp | 116 +++++----- .../CWE/CWE-319/UseOfHttp/UseOfHttp.qlref | 3 +- .../Security/CWE/CWE-319/UseOfHttp/test.cpp | 14 +- .../CWE/CWE-326/InsufficientKeySize.qlref | 3 +- .../query-tests/Security/CWE/CWE-326/test.cpp | 6 +- .../CWE/CWE-327/BrokenCryptoAlgorithm.qlref | 3 +- .../query-tests/Security/CWE/CWE-327/test.cpp | 6 +- .../Security/CWE/CWE-327/test2.cpp | 2 +- .../CWE-367/semmle/TOCTOUFilesystemRace.qlref | 3 +- .../Security/CWE/CWE-367/semmle/test2.cpp | 34 +-- .../IteratorToExpiredContainer.qlref | 3 +- .../tests/IteratorToExpiredContainer/test.cpp | 46 ++-- .../tests/UseAfterFree/UseAfterFree.qlref | 3 +- .../semmle/tests/UseAfterFree/test.cpp | 52 ++--- .../UseOfStringAfterLifetimeEnds.qlref | 4 +- .../UseOfStringAfterLifetimeEnds/test.cpp | 34 +-- .../UseOfUniquePointerAfterLifetimeEnds.qlref | 3 +- .../UseOfUniquePtrAfterLifetimeEnds/test.cpp | 30 +-- .../CWE/CWE-428/UnsafeCreateProcessCall.cpp | 36 ++-- .../CWE/CWE-428/UnsafeCreateProcessCall.qlref | 3 +- .../ConditionallyUninitializedVariable.qlref | 3 +- .../examples.cpp | 2 +- .../test.cpp | 12 +- .../semmle/tests/UninitializedLocal.qlref | 3 +- .../CWE/CWE-457/semmle/tests/errors.cpp | 4 +- .../CWE/CWE-457/semmle/tests/test.cpp | 54 ++--- .../IncorrectPointerScaling.qlref | 3 +- .../IncorrectPointerScalingChar.qlref | 3 +- .../IncorrectPointerScalingVoid.qlref | 3 +- .../semmle/IncorrectPointerScaling/test.cpp | 18 +- .../SuspiciousAddWithSizeof.qlref | 3 +- .../SuspiciousAddWithSizeof/buildless.cpp | 4 +- .../semmle/SuspiciousAddWithSizeof/test.cpp | 14 +- .../CWE-497/SAMATE/ExposedSystemData.qlref | 3 +- .../SAMATE/PotentiallyExposedSystemData.qlref | 3 +- .../Security/CWE/CWE-497/SAMATE/tests.c | 4 +- .../tests/PotentiallyExposedSystemData.qlref | 3 +- .../CWE/CWE-497/semmle/tests/tests.cpp | 42 ++-- .../CWE/CWE-497/semmle/tests/tests2.cpp | 46 ++-- .../CWE/CWE-497/semmle/tests/tests_passwd.cpp | 6 +- .../CWE-497/semmle/tests/tests_sockets.cpp | 12 +- .../CWE-497/semmle/tests/tests_sysconf.cpp | 8 +- .../IncorrectAllocationErrorHandling.qlref | 3 +- .../query-tests/Security/CWE/CWE-570/test.cpp | 40 ++-- .../Security/CWE/CWE-611/XXE.qlref | 3 +- .../Security/CWE/CWE-611/tests.cpp | 40 ++-- .../Security/CWE/CWE-611/tests2.cpp | 12 +- .../Security/CWE/CWE-611/tests3.cpp | 23 +- .../Security/CWE/CWE-611/tests4.cpp | 10 +- .../Security/CWE/CWE-611/tests5.cpp | 22 +- .../DangerousUseOfCin/DangerousUseOfCin.qlref | 3 +- .../CWE-676/SAMATE/DangerousUseOfCin/test.cpp | 2 +- .../DangerousUseOfCin/DangerousUseOfCin.qlref | 3 +- .../CWE-676/semmle/DangerousUseOfCin/test.cpp | 2 +- .../DangerousFunctionOverflow.qlref | 3 +- .../PotentiallyDangerousFunction.qlref | 3 +- .../PotentiallyDangerousFunction/test.c | 12 +- .../CWE/CWE-732/OpenCallMissingModeArgument.c | 8 +- .../CWE-732/OpenCallMissingModeArgument.qlref | 3 +- .../CWE-732/UnsafeDaclSecurityDescriptor.cpp | 6 +- .../UnsafeDaclSecurityDescriptor.qlref | 3 +- .../semmle/tests/DiningPhilosophers.cpp | 10 +- .../CWE-764/semmle/tests/LockOrderCycle.qlref | 3 +- .../CWE-764/semmle/tests/TwiceLocked.qlref | 3 +- .../CWE-764/semmle/tests/UnreleasedLock.qlref | 3 +- .../CWE/CWE-764/semmle/tests/test.cpp | 54 ++--- .../CWE-772/SAMATE/FileMayNotBeClosed.qlref | 3 +- .../CWE/CWE-772/SAMATE/FileNeverClosed.qlref | 3 +- .../CWE-772/SAMATE/MemoryMayNotBeFreed.qlref | 3 +- .../CWE/CWE-772/SAMATE/MemoryNeverFreed.qlref | 3 +- .../Security/CWE/CWE-772/SAMATE/tests.cpp | 14 +- .../tests-file/FileMayNotBeClosed.qlref | 3 +- .../semmle/tests-file/FileNeverClosed.qlref | 3 +- .../CWE/CWE-772/semmle/tests-file/test.cpp | 54 ++--- .../tests-memory/MemoryMayNotBeFreed.qlref | 3 +- .../tests-memory/MemoryNeverFreed.qlref | 3 +- .../CWE/CWE-772/semmle/tests-memory/test.cpp | 78 +++---- .../TaintedCondition/TaintedCondition.qlref | 3 +- .../CWE-807/semmle/TaintedCondition/test.cpp | 4 +- ...teLoopWithUnsatisfiableExitCondition.qlref | 3 +- .../test.cpp | 10 +- .../Security/CWE/CWE-843/TypeConfusion.qlref | 3 +- .../query-tests/Security/CWE/CWE-843/test.cpp | 38 ++-- .../AV Rule 1/AV Rule 1.c | 2 +- .../AV Rule 1/AV Rule 1.qlref | 3 +- .../AV Rule 13/AV Rule 13.qlref | 3 +- .../jsf/4.04 Environment/AV Rule 13/test.cpp | 4 +- .../AV Rule 32/AV Rule 32.qlref | 3 +- .../AV Rule 32/test.c | 2 +- .../AV Rule 53 54/AV Rule 53.1.qlref | 3 +- .../jsf/4.09 Style/AV Rule 53 54/test.c | 2 +- .../4.10 Classes/AV Rule 73/AV Rule 73.cpp | 2 +- .../4.10 Classes/AV Rule 73/AV Rule 73.qlref | 3 +- .../jsf/4.10 Classes/AV Rule 73/original.cpp | 4 +- .../4.10 Classes/AV Rule 76/AV Rule 76.qlref | 3 +- .../jsf/4.10 Classes/AV Rule 76/test.cpp | 8 +- .../AV Rule 77.1/AV Rule 77.1.qlref | 3 +- .../jsf/4.10 Classes/AV Rule 77.1/test.cpp | 2 +- .../4.10 Classes/AV Rule 78/AV Rule 78.cpp | 6 +- .../4.10 Classes/AV Rule 78/AV Rule 78.qlref | 3 +- .../4.10 Classes/AV Rule 79/AV Rule 79.cpp | 20 +- .../4.10 Classes/AV Rule 79/AV Rule 79.qlref | 3 +- .../4.10 Classes/AV Rule 79/Container2.cpp | 2 +- .../4.10 Classes/AV Rule 79/DeleteThis.cpp | 16 +- .../AV Rule 79/ExternalOwners.cpp | 4 +- .../jsf/4.10 Classes/AV Rule 79/Lambda.cpp | 4 +- .../4.10 Classes/AV Rule 79/ListDelete.cpp | 4 +- .../4.10 Classes/AV Rule 79/NoDestructor.cpp | 6 +- .../4.10 Classes/AV Rule 79/PlacementNew.cpp | 2 +- .../AV Rule 79/SelfRegistering.cpp | 2 +- .../jsf/4.10 Classes/AV Rule 79/Variants.cpp | 18 +- .../jsf/4.10 Classes/AV Rule 79/Wrapped.cpp | 4 +- .../4.10 Classes/AV Rule 82/AV Rule 82.cpp | 10 +- .../4.10 Classes/AV Rule 82/AV Rule 82.qlref | 3 +- .../4.10 Classes/AV Rule 85/AV Rule 85.cpp | 10 +- .../4.10 Classes/AV Rule 85/AV Rule 85.qlref | 3 +- .../4.10 Classes/AV Rule 97/AV Rule 97.qlref | 3 +- .../jsf/4.10 Classes/AV Rule 97/jsf97.cpp | 10 +- .../AV Rule 107/AV Rule 107.qlref | 3 +- .../jsf/4.13 Functions/AV Rule 107/test.c | 8 +- .../AV Rule 114/AV Rule 114.qlref | 3 +- .../jsf/4.13 Functions/AV Rule 114/complex.c | 4 +- .../jsf/4.13 Functions/AV Rule 114/test.c | 6 +- .../jsf/4.13 Functions/AV Rule 114/test.cpp | 18 +- .../AV Rule 145/AV Rule 145.qlref | 3 +- .../4.16 Initialization/AV Rule 145/test.c | 6 +- .../AV Rule 157/AV Rule 157.qlref | 3 +- .../jsf/4.21 Operators/AV Rule 157/test.c | 6 +- .../AV Rule 164/AV Rule 164.qlref | 3 +- .../jsf/4.21 Operators/AV Rule 164/test.c | 19 +- .../AV Rule 165/AV Rule 165.qlref | 3 +- .../jsf/4.21 Operators/AV Rule 165/test.c | 18 +- .../AV Rule 166/AV Rule 166.qlref | 3 +- .../jsf/4.21 Operators/AV Rule 166/test.c | 4 +- .../AV Rule 176/176.cpp | 10 +- .../AV Rule 176/176.qlref | 3 +- .../AV Rule 186/AV Rule 186.qlref | 3 +- .../AV Rule 186/test.c | 4 +- .../AV Rule 193/AV Rule 193.c | 4 +- .../AV Rule 193/AV Rule 193.qlref | 3 +- .../AV Rule 193/nested.c | 4 +- .../AV Rule 193/test.c | 12 +- .../AV Rule 196/AV Rule 196.c | 8 +- .../AV Rule 196/AV Rule 196.qlref | 3 +- .../AV Rule 201/AV Rule 201.c | 30 +-- .../AV Rule 201/AV Rule 201.qlref | 3 +- .../AV Rule 201/NestedLoopSameVar.qlref | 3 +- .../AV Rule 201/StructMembers.cpp | 4 +- .../AV Rule 210/AV Rule 210.c | 10 +- .../AV Rule 210/AV Rule 210.qlref | 3 +- 708 files changed, 3790 insertions(+), 3498 deletions(-) diff --git a/cpp/ql/test/examples/BadLocking/AV Rule 107.qlref b/cpp/ql/test/examples/BadLocking/AV Rule 107.qlref index 57f35c3bcf2d..e24890cc9a86 100644 --- a/cpp/ql/test/examples/BadLocking/AV Rule 107.qlref +++ b/cpp/ql/test/examples/BadLocking/AV Rule 107.qlref @@ -1 +1,2 @@ -jsf/4.13 Functions/AV Rule 107.ql +query: jsf/4.13 Functions/AV Rule 107.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref b/cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref index 0267b31251d3..326ddde08d3e 100644 --- a/cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref +++ b/cpp/ql/test/examples/BadLocking/LocalVariableHidesGlobalVariable.qlref @@ -1 +1,2 @@ -Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql +query: Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp b/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp index 034291f4d197..48f279c83357 100644 --- a/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp +++ b/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp @@ -48,7 +48,7 @@ void test1() void test2() { - Lock myLock(); // BAD (interpreted as a function declaration, this does nothing) + Lock myLock(); // $ Alert[cpp/function-in-block] // BAD (interpreted as a function declaration, this does nothing) // ... } @@ -62,14 +62,14 @@ void test3() void test4() { - Lock(myMutex); // BAD (creates an uninitialized variable called `myMutex`, probably not intended) + Lock(myMutex); // $ Alert[cpp/local-variable-hides-global-variable] // BAD (creates an uninitialized variable called `myMutex`, probably not intended) // ... } void test5() { - Lock myLock(Mutex); // BAD (interpreted as a function declaration, this does nothing) + Lock myLock(Mutex); // $ Alert[cpp/function-in-block] // BAD (interpreted as a function declaration, this does nothing) // ... } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref index a4543b332ddb..b88242c72ab1 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql +query: experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref index e9107625d293..b0ca696135e2 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/LateCheckOfFunctionArgument.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql +query: experimental/Security/CWE/CWE-020/LateCheckOfFunctionArgument.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/test.c index 40fb688fb203..66ca9a32f1d9 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/test.c +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/semmle/tests/test.c @@ -3,6 +3,6 @@ void workFunction_0(char *s) { char buf[80], buf1[8]; if(len<0) return; memset(buf,0,len); //GOOD - memset(buf1,0,len1); //BAD + memset(buf1,0,len1); // $ Alert //BAD if(len1<0) return; } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref index ecff539f3e63..d58923728783 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-078/WordexpTainted.ql \ No newline at end of file +query: experimental/Security/CWE/CWE-078/WordexpTainted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/test.cpp index 0ae98b8f1632..7c8224ce6534 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/test.cpp @@ -19,14 +19,14 @@ enum { int wordexp(const char *restrict s, wordexp_t *restrict p, int flags); -int main(int argc, char** argv) { +int main(int argc, char** argv) { // $ Source char *filePath = argv[2]; { // BAD: the user string is injected directly into `wordexp` which performs command substitution wordexp_t we; - wordexp(filePath, &we, 0); + wordexp(filePath, &we, 0); // $ Alert } { diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref index 22dae13892f8..c3c257615c32 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/FindWrapperFunctions.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql +query: experimental/Security/CWE/CWE-1041/FindWrapperFunctions.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/test.cpp index 4f862a324e59..05610bcfe44c 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1041/semmle/tests/test.cpp @@ -20,7 +20,7 @@ void myFclose(FILE * fmy) int main(int argc, char *argv[]) { fe = fopen("myFile.txt", "wt"); - fclose(fe); // BAD + fclose(fe); // $ Alert // BAD fe = fopen("myFile.txt", "wt"); myFclose(fe); // GOOD return 0; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref index 6da5822f7f02..2a1e44064547 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/DeclarationOfVariableWithUnnecessarilyWideScope.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql +query: experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/test.c index 47d89188e6b4..0af3c7d27c8e 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/test.c +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1126/semmle/tests/test.c @@ -11,7 +11,7 @@ void workFunction_0(char *s) { while(intIndex > 2) { buf[intIndex] = 1; - int intIndex; // BAD + int intIndex; // $ Alert // BAD intIndex--; } intIndex = 10; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref index ddf0380834b1..30a603676bb1 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/CustomCryptographicPrimitive.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql +query: experimental/Security/CWE/CWE-1240/CustomCryptographicPrimitive.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/tests_crypto.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/tests_crypto.cpp index 6aa1bbe06a7f..56dd45e3a64a 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/tests_crypto.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-1240/tests_crypto.cpp @@ -8,7 +8,7 @@ int strlen(const char *string); // the following function is homebrew crypto written for this test. This is a bad algorithm // on multiple levels and should never be used in cryptography. -void encryptString(char *string, unsigned int key) { +void encryptString(char *string, unsigned int key) { // $ Alert char *ptr = string; int len = strlen(string); @@ -27,7 +27,7 @@ void encryptString(char *string, unsigned int key) { // the following function is homebrew crypto written for this test. This is a bad algorithm // on multiple levels and should never be used in cryptography. -void MyEncrypt(const unsigned int *dataIn, unsigned int *dataOut, unsigned int dataSize, unsigned int key[2]) { +void MyEncrypt(const unsigned int *dataIn, unsigned int *dataOut, unsigned int dataSize, unsigned int key[2]) { // $ Alert unsigned int state[2]; unsigned int t; @@ -48,7 +48,7 @@ void MyEncrypt(const unsigned int *dataIn, unsigned int *dataOut, unsigned int d // the following function resembles an implementation of the AES "mix columns" // step. It is not accurate, efficient or safe and should never be used in // cryptography. -void mix_columns(const uint8_t inputs[4], uint8_t outputs[4]) { +void mix_columns(const uint8_t inputs[4], uint8_t outputs[4]) { // $ Alert // The "mix columns" step takes four bytes as inputs. Each byte represents a // polynomial with 8 one-bit coefficients, e.g. input bits 00001101 // represent the polynomial x^3 + x^2 + 1. Arithmetic is reduced modulo @@ -80,7 +80,7 @@ void mix_columns(const uint8_t inputs[4], uint8_t outputs[4]) { // the following function resembles initialization of an S-box as may be done // in an implementation of DES, AES and other encryption algorithms. It is not // accurate, efficient or safe and should never be used in cryptography. -void init_aes_sbox(unsigned char data[256]) { +void init_aes_sbox(unsigned char data[256]) { // $ Alert // initialize `data` in a loop using lots of ^, ^= and << operations and // a few fixed constants. unsigned int state = 0x12345678; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref index 228684a4e250..9c9b71af695a 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/DangerousWorksWithMultibyteOrWideCharacters.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql +query: experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test.cpp index b4f0830039d8..513a5c2ef954 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test.cpp @@ -63,7 +63,7 @@ static void badTest1(const char* ptr) int ret; int len; len = strlen(ptr); - for (wchar_t wc; (ret = mbtowc(&wc, ptr, 4)) > 0; len-=ret) { // BAD:we can get unpredictable results + for (wchar_t wc; (ret = mbtowc(&wc, ptr, 4)) > 0; len-=ret) { // $ Alert // BAD:we can get unpredictable results wprintf(L"%lc", wc); ptr += ret; } @@ -73,7 +73,7 @@ static void badTest2(const char* ptr) int ret; int len; len = strlen(ptr); - for (wchar_t wc; (ret = mbtowc(&wc, ptr, sizeof(wchar_t))) > 0; len-=ret) { // BAD:we can get unpredictable results + for (wchar_t wc; (ret = mbtowc(&wc, ptr, sizeof(wchar_t))) > 0; len-=ret) { // $ Alert // BAD:we can get unpredictable results wprintf(L"%lc", wc); ptr += ret; } @@ -103,7 +103,7 @@ static void badTest3(const char* ptr,int wc_len) len = wc_len; wchar_t *wc = new wchar_t[wc_len]; while (*ptr && len > 0) { - ret = mbtowc(wc, ptr, MB_CUR_MAX); // BAD + ret = mbtowc(wc, ptr, MB_CUR_MAX); // $ Alert // BAD if (ret <0) break; if (ret == 0 || ret > len) @@ -120,7 +120,7 @@ static void badTest4(const char* ptr,int wc_len) len = wc_len; wchar_t *wc = new wchar_t[wc_len]; while (*ptr && len > 0) { - ret = mbtowc(wc, ptr, 16); // BAD + ret = mbtowc(wc, ptr, 16); // $ Alert // BAD if (ret <0) break; if (ret == 0 || ret > len) @@ -137,7 +137,7 @@ static void badTest5(const char* ptr,int wc_len) len = wc_len; wchar_t *wc = new wchar_t[wc_len]; while (*ptr && len > 0) { - ret = mbtowc(wc, ptr, sizeof(wchar_t)); // BAD + ret = mbtowc(wc, ptr, sizeof(wchar_t)); // $ Alert // BAD if (ret <0) break; if (ret == 0 || ret > len) @@ -155,7 +155,7 @@ static void badTest6(const char* ptr,int wc_len) len = wc_len; wchar_t *wc = new wchar_t[wc_len]; while (*ptr && wc_len > 0) { - ret = mbtowc(wc, ptr, wc_len); // BAD + ret = mbtowc(wc, ptr, wc_len); // $ Alert // BAD if (ret <0) if (checkErrors()) { ++ptr; @@ -178,7 +178,7 @@ static void badTest7(const char* ptr,int wc_len) len = wc_len; wchar_t *wc = new wchar_t[wc_len]; while (*ptr && wc_len > 0) { - ret = mbtowc(wc, ptr, len); // BAD + ret = mbtowc(wc, ptr, len); // $ Alert // BAD if (ret <0) break; if (ret == 0 || ret > len) @@ -194,7 +194,7 @@ static void badTest8(const char* ptr,wchar_t *wc) int len; len = strlen(ptr); while (*ptr && len > 0) { - ret = mbtowc(wc, ptr, len); // BAD + ret = mbtowc(wc, ptr, len); // $ Alert // BAD if (ret <0) break; if (ret == 0 || ret > len) diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test1.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test1.cpp index d66f36d38b97..8e59dde9f125 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test1.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test1.cpp @@ -25,8 +25,8 @@ void* calloc (size_t num, size_t size); void* malloc (size_t size); static void badTest1(void *src, int size) { - WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, (LPSTR)src, size, 0, 0); // BAD - MultiByteToWideChar(CP_ACP, 0, (LPCSTR)src, -1, (LPCWSTR)src, 30); // BAD + WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, (LPSTR)src, size, 0, 0); // $ Alert // BAD + MultiByteToWideChar(CP_ACP, 0, (LPCSTR)src, -1, (LPCWSTR)src, 30); // $ Alert // BAD } void goodTest2(){ wchar_t src[] = L"0123456789ABCDEF"; @@ -42,7 +42,7 @@ void goodTest2(){ static void badTest2(){ wchar_t src[] = L"0123456789ABCDEF"; char dst[16]; - WideCharToMultiByte(CP_UTF8, 0, src, -1, dst, 16, NULL, NULL); // BAD + WideCharToMultiByte(CP_UTF8, 0, src, -1, dst, 16, NULL, NULL); // $ Alert // BAD printf("%s\n", dst); } static void goodTest3(){ @@ -55,7 +55,7 @@ static void badTest3(){ char src[] = "0123456789ABCDEF"; int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0); wchar_t * dst = (wchar_t*)calloc(size + 1, 1); - MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD + MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // $ Alert // BAD } static void goodTest4(){ char src[] = "0123456789ABCDEF"; @@ -67,13 +67,13 @@ static void badTest4(){ char src[] = "0123456789ABCDEF"; int size = MultiByteToWideChar(CP_UTF8, 0, src,sizeof(src),NULL,0); wchar_t * dst = (wchar_t*)malloc(size + 1); - MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // BAD + MultiByteToWideChar(CP_UTF8, 0, src, -1, dst, size+1); // $ Alert // BAD } static int goodTest5(void *src){ return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 0, 0, 0); // GOOD } static int badTest5 (void *src) { - return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 3, 0, 0); // BAD + return WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)src, -1, 0, 3, 0, 0); // $ Alert // BAD } static void goodTest6(WCHAR *src) { @@ -90,6 +90,6 @@ static void goodTest6(WCHAR *src) static void badTest6(WCHAR *src) { char dst[5] =""; - WideCharToMultiByte(CP_ACP, 0, src, -1, dst, 260, 0, 0); // BAD + WideCharToMultiByte(CP_ACP, 0, src, -1, dst, 260, 0, 0); // $ Alert // BAD printf("%s\n", dst); } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test2.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test2.cpp index 65e5a9ee275f..ba45ec8497d1 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test2.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test2.cpp @@ -12,11 +12,11 @@ size_t mbsrtowcs(wchar_t *wcstr,const char *mbstr,size_t count, mbstate_t *mbsta static void badTest1(void *src, int size) { - mbstowcs((wchar_t*)src,(char*)src,size); // BAD + mbstowcs((wchar_t*)src,(char*)src,size); // $ Alert // BAD _locale_t locale; - _mbstowcs_l((wchar_t*)src,(char*)src,size,locale); // BAD + _mbstowcs_l((wchar_t*)src,(char*)src,size,locale); // $ Alert // BAD mbstate_t *mbstate; - mbsrtowcs((wchar_t*)src,(char*)src,size,mbstate); // BAD + mbsrtowcs((wchar_t*)src,(char*)src,size,mbstate); // $ Alert // BAD } static void goodTest2(){ char src[] = "0123456789ABCDEF"; @@ -32,7 +32,7 @@ static void goodTest2(){ static void badTest2(){ char src[] = "0123456789ABCDEF"; wchar_t dst[16]; - mbstowcs(dst, src,16); // BAD + mbstowcs(dst, src,16); // $ Alert // BAD printf("%s\n", dst); } static void goodTest3(){ @@ -45,7 +45,7 @@ static void badTest3(){ char src[] = "0123456789ABCDEF"; int size = mbstowcs(NULL, src,NULL); wchar_t * dst = (wchar_t*)calloc(size + 1, 1); - mbstowcs(dst, src,size+1); // BAD + mbstowcs(dst, src,size+1); // $ Alert // BAD } static void goodTest4(){ char src[] = "0123456789ABCDEF"; @@ -57,13 +57,13 @@ static void badTest4(){ char src[] = "0123456789ABCDEF"; int size = mbstowcs(NULL, src,NULL); wchar_t * dst = (wchar_t*)malloc(size + 1); - mbstowcs(dst, src,size+1); // BAD + mbstowcs(dst, src,size+1); // $ Alert // BAD } static int goodTest5(void *src){ return mbstowcs(NULL, (char*)src,NULL); // GOOD } static int badTest5 (void *src) { - return mbstowcs(NULL, (char*)src,3); // BAD + return mbstowcs(NULL, (char*)src,3); // $ Alert // BAD } static void goodTest6(void *src){ wchar_t dst[5]; @@ -77,6 +77,6 @@ static void goodTest6(void *src){ } static void badTest6(void *src){ wchar_t dst[5]; - mbstowcs(dst, (char*)src,260); // BAD + mbstowcs(dst, (char*)src,260); // $ Alert // BAD printf("%s\n", dst); } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test3.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test3.cpp index 662cdfc7be81..5a8ad28ac653 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test3.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-125/semmle/tests/test3.cpp @@ -13,7 +13,7 @@ static size_t badTest1(unsigned char *src){ int cb = 0; unsigned char dst[50]; while( cb < sizeof(dst) ) - dst[cb++]=*src++; // BAD + dst[cb++]=*src++; // $ Alert // BAD return _mbclen(dst); } static void goodTest2(unsigned char *src){ @@ -33,7 +33,7 @@ static void badTest2(unsigned char *src){ unsigned char dst[50]; while( cb < sizeof(dst) ) { - _mbccpy(dst+cb,src); // BAD + _mbccpy(dst+cb,src); // $ Alert // BAD cb+=_mbclen(src); src=_mbsinc(src); } @@ -44,5 +44,5 @@ static void goodTest3(){ } static void badTest3(){ wchar_t name[50]; - name[sizeof(name) - 1] = L'\0'; // BAD + name[sizeof(name) - 1] = L'\0'; // $ Alert // BAD } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref index 7bb108b66280..fc48bdd1c2b3 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql +query: experimental/Security/CWE/CWE-190/AllocMultiplicationOverflow.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp index 3f49ebdece6f..2e9073474366 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp @@ -10,31 +10,31 @@ void test() int y = getAnInt(); char *buffer1 = (char *)malloc(x + y); // GOOD - char *buffer2 = (char *)malloc(x * y); // BAD + char *buffer2 = (char *)malloc(x * y); // $ Alert // BAD int *buffer3 = (int *)malloc(x * sizeof(int)); // GOOD - int *buffer4 = (int *)malloc(x * y * sizeof(int)); // BAD + int *buffer4 = (int *)malloc(x * y * sizeof(int)); // $ Alert // BAD if ((x <= 1000) && (y <= 1000)) { - char *buffer5 = (char *)malloc(x * y); // GOOD [FALSE POSITIVE] + char *buffer5 = (char *)malloc(x * y); // $ Alert // GOOD [FALSE POSITIVE] } - size_t size1 = x * y; - char *buffer5 = (char *)malloc(size1); // BAD + size_t size1 = x * y; // $ Source + char *buffer5 = (char *)malloc(size1); // $ Alert // BAD size_t size2 = x; size2 *= y; char *buffer6 = (char *)malloc(size2); // BAD [NOT DETECTED] char *buffer7 = new char[x * 10]; // GOOD - char *buffer8 = new char[x * y]; // BAD - char *buffer9 = new char[x * x]; // BAD + char *buffer8 = new char[x * y]; // $ Alert // BAD + char *buffer9 = new char[x * x]; // $ Alert // BAD } // --- custom allocators --- - -void *MyMalloc1(size_t size) { return malloc(size); } // [additional detection here] + +void *MyMalloc1(size_t size) { return malloc(size); } // $ Alert // [additional detection here] void *MyMalloc2(size_t size); void customAllocatorTests() @@ -42,6 +42,6 @@ void customAllocatorTests() int x = getAnInt(); int y = getAnInt(); - char *buffer1 = (char *)MyMalloc1(x * y); // BAD - char *buffer2 = (char *)MyMalloc2(x * y); // BAD + char *buffer1 = (char *)MyMalloc1(x * y); // $ Alert Source // BAD + char *buffer2 = (char *)MyMalloc2(x * y); // $ Alert // BAD } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref index 84f717acda79..ec83c625619a 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/DangerousUseOfTransformationAfterOperation.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql +query: experimental/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/test.cpp index 472c8ac0afac..7c1bc89135f8 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/DangerousUseOfTransformationAfterOperation/test.cpp @@ -6,17 +6,17 @@ void functionWork(char aA[10],unsigned int aUI) { int aI; aI = (aUI*8)/10; // GOOD - aI = aUI*8; // BAD + aI = aUI*8; // $ Alert // BAD aP = aA+aI; aI = (int)aUI*8; // GOOD - - aL = (unsigned long)(aI*aI); // BAD + + aL = (unsigned long)(aI*aI); // $ Alert // BAD aL = ((unsigned long)aI*aI); // GOOD - - testCall((unsigned long)(aI*aI)); // BAD + + testCall((unsigned long)(aI*aI)); // $ Alert // BAD testCall(((unsigned long)aI*aI)); // GOOD - - if((unsigned long)(aI*aI) > aL) // BAD + + if((unsigned long)(aI*aI) > aL) // $ Alert // BAD return; if(((unsigned long)aI*aI) > aL) // GOOD return; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref index 0873051581d9..2a390e2a518b 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/IfStatementAdditionOverflow.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql +query: experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/test.cpp index 7c5ab91832e4..28e2c0926343 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/IfStatementAdditionOverflow/test.cpp @@ -15,49 +15,49 @@ void test() unsigned short b1 = getAnUnsignedShort(); unsigned short c1 = getAnUnsignedShort(); - if (a+b>c) a = c-b; // BAD - if (a+b>c) { a = c-b; } // BAD - if (b+a>c) a = c-b; // BAD - if (b+a>c) { a = c-b; } // BAD - if (c>a+b) a = c-b; // BAD - if (c>a+b) { a = c-b; } // BAD - if (c>b+a) a = c-b; // BAD - if (c>b+a) { a = c-b; } // BAD - - if (a+b>=c) a = c-b; // BAD - if (a+b>=c) { a = c-b; } // BAD - if (b+a>=c) a = c-b; // BAD - if (b+a>=c) { a = c-b; } // BAD - if (c>=a+b) a = c-b; // BAD - if (c>=a+b) { a = c-b; } // BAD - if (c>=b+a) a = c-b; // BAD - if (c>=b+a) { a = c-b; } // BAD - - if (a+bd) a = d-b; // BAD + if (a+b>c) a = c-b; // $ Alert // BAD + if (a+b>c) { a = c-b; } // $ Alert // BAD + if (b+a>c) a = c-b; // $ Alert // BAD + if (b+a>c) { a = c-b; } // $ Alert // BAD + if (c>a+b) a = c-b; // $ Alert // BAD + if (c>a+b) { a = c-b; } // $ Alert // BAD + if (c>b+a) a = c-b; // $ Alert // BAD + if (c>b+a) { a = c-b; } // $ Alert // BAD + + if (a+b>=c) a = c-b; // $ Alert // BAD + if (a+b>=c) { a = c-b; } // $ Alert // BAD + if (b+a>=c) a = c-b; // $ Alert // BAD + if (b+a>=c) { a = c-b; } // $ Alert // BAD + if (c>=a+b) a = c-b; // $ Alert // BAD + if (c>=a+b) { a = c-b; } // $ Alert // BAD + if (c>=b+a) a = c-b; // $ Alert // BAD + if (c>=b+a) { a = c-b; } // $ Alert // BAD + + if (a+bd) a = d-b; // $ Alert // BAD if (a+(double)b>c) a = c-b; // GOOD if (a+(-x)>c) a = c-(-y); // GOOD if (a+b>c) { b++; a = c-b; } // GOOD if (a+d>c) a = c-d; // GOOD if (a1+b1>c1) a1 = c1-b1; // GOOD - - if (a+b<=c) { /* ... */ } else { a = c-b; } // BAD - if (a+b<=c) { return; } a = c-b; // BAD + + if (a+b<=c) { /* ... */ } else { a = c-b; } // $ Alert // BAD + if (a+b<=c) { return; } a = c-b; // $ Alert // BAD } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref index 8186dd0721b7..0bcfeb909556 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.qlref @@ -1 +1,2 @@ -experimental/Likely Bugs/ArrayAccessProductFlow.ql +query: experimental/Likely Bugs/ArrayAccessProductFlow.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp index 12fc89470649..dc60e34f2537 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp @@ -1,13 +1,13 @@ char *malloc(int size); void test1(int size) { - char *arr = malloc(size); + char *arr = malloc(size); // $ Source for (int i = 0; i < size; i++) { arr[i] = 0; // GOOD } for (int i = 0; i <= size; i++) { - arr[i] = i; // BAD + arr[i] = i; // $ Alert // BAD } } @@ -18,7 +18,7 @@ typedef struct { array_t mk_array(int size) { array_t arr; - arr.p = malloc(size); + arr.p = malloc(size); // $ Source arr.size = size; return arr; @@ -32,7 +32,7 @@ void test2(int size) { } for (int i = 0; i <= arr.size; i++) { - arr.p[i] = i; // BAD + arr.p[i] = i; // $ Alert // BAD } } @@ -42,7 +42,7 @@ void test3_callee(array_t arr) { } for (int i = 0; i <= arr.size; i++) { - arr.p[i] = i; // BAD + arr.p[i] = i; // $ Alert // BAD } } @@ -52,7 +52,7 @@ void test3(int size) { void test4(int size) { array_t arr; - arr.p = malloc(size); + arr.p = malloc(size); // $ Source arr.size = size; for (int i = 0; i < arr.size; i++) { @@ -60,13 +60,13 @@ void test4(int size) { } for (int i = 0; i <= arr.size; i++) { - arr.p[i] = i; // BAD + arr.p[i] = i; // $ Alert // BAD } } array_t *mk_array_p(int size) { array_t *arr = (array_t*) malloc(sizeof(array_t)); - arr->p = malloc(size); + arr->p = malloc(size); // $ Source arr->size = size; return arr; @@ -80,7 +80,7 @@ void test5(int size) { } for (int i = 0; i <= arr->size; i++) { - arr->p[i] = i; // BAD + arr->p[i] = i; // $ Alert // BAD } } @@ -90,7 +90,7 @@ void test6_callee(array_t *arr) { } for (int i = 0; i <= arr->size; i++) { - arr->p[i] = i; // BAD + arr->p[i] = i; // $ Alert // BAD } } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref index 082e8951c70d..3be7645c1a87 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql +query: experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp index 03de927073a3..a91e14e51936 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp @@ -32,60 +32,60 @@ void testOneArray(OneArray *arr) { void testBig(BigArray *arr) { arr->buf[MAX_SIZE-1] = 0; // GOOD - arr->buf[MAX_SIZE] = 0; // BAD - arr->buf[MAX_SIZE+1] = 0; // BAD + arr->buf[MAX_SIZE] = 0; // $ Alert // BAD + arr->buf[MAX_SIZE+1] = 0; // $ Alert // BAD for(int i = 0; i < MAX_SIZE; i++) { arr->buf[i] = 0; // GOOD } - + for(int i = 0; i <= MAX_SIZE; i++) { - arr->buf[i] = 0; // BAD + arr->buf[i] = 0; // $ Alert // BAD } } void testFields(ArrayAndFields *arr) { arr->buf[MAX_SIZE-1] = 0; // GOOD - arr->buf[MAX_SIZE] = 0; // BAD? - arr->buf[MAX_SIZE+1] = 0; // BAD? + arr->buf[MAX_SIZE] = 0; // $ Alert // BAD? + arr->buf[MAX_SIZE+1] = 0; // $ Alert // BAD? for(int i = 0; i < MAX_SIZE; i++) { arr->buf[i] = 0; // GOOD } - + for(int i = 0; i <= MAX_SIZE; i++) { - arr->buf[i] = 0; // BAD? + arr->buf[i] = 0; // $ Alert // BAD? } for(int i = 0; i < MAX_SIZE+2; i++) { - arr->buf[i] = 0; // BAD? + arr->buf[i] = 0; // $ Alert // BAD? } // is this different if it's a memcpy? } -void assignThroughPointer(int *p) { +void assignThroughPointer(int *p) { // $ Sink *p = 0; // ??? should the result go at a flow source? } void addToPointerAndAssign(int *p) { p[MAX_SIZE-1] = 0; // GOOD - p[MAX_SIZE] = 0; // BAD + p[MAX_SIZE] = 0; // $ Alert // BAD } void testInterproc(BigArray *arr) { assignThroughPointer(&arr->buf[MAX_SIZE-1]); // GOOD - assignThroughPointer(&arr->buf[MAX_SIZE]); // BAD + assignThroughPointer(&arr->buf[MAX_SIZE]); // $ Alert // BAD - addToPointerAndAssign(arr->buf); + addToPointerAndAssign(arr->buf); // $ Source } #define MAX_SIZE_BYTES 4096 void testCharIndex(BigArray *arr) { - char *charBuf = (char*) arr->buf; + char *charBuf = (char*) arr->buf; // $ Source charBuf[MAX_SIZE_BYTES - 1] = 0; // GOOD - charBuf[MAX_SIZE_BYTES] = 0; // BAD + charBuf[MAX_SIZE_BYTES] = 0; // $ Alert // BAD } void testEqRefinement() { @@ -125,7 +125,7 @@ void testStackAllocated() { char *arr[MAX_SIZE]; for(int i = 0; i <= MAX_SIZE; i++) { - arr[i] = 0; // BAD + arr[i] = 0; // $ Alert // BAD } } @@ -133,18 +133,18 @@ int strncmp(const char*, const char*, int); char testStrncmp2(char *arr) { if(strncmp(arr, "", 6) == 0) { - arr += 6; + arr += 6; // $ Alert } - return *arr; // GOOD [FALSE POSITIVE] + return *arr; // $ Sink // GOOD [FALSE POSITIVE] } void testStrncmp1() { char asdf[5]; - testStrncmp2(asdf); + testStrncmp2(asdf); // $ Source } void countdownBuf1(int **p) { - *--(*p) = 1; // GOOD [FALSE POSITIVE] + *--(*p) = 1; // $ Sink // GOOD [FALSE POSITIVE] *--(*p) = 2; // GOOD *--(*p) = 3; // GOOD *--(*p) = 4; // GOOD @@ -153,7 +153,7 @@ void countdownBuf1(int **p) { void countdownBuf2() { int buf[4]; - int *x = buf + 4; + int *x = buf + 4; // $ Alert countdownBuf1(&x); } @@ -182,7 +182,7 @@ int countdownLength1(int *p, int len) { } int callCountdownLength() { - + int buf[6]; return countdownLength1(buf, 6); @@ -192,7 +192,7 @@ int countdownLength2() { int buf[6]; int len = 6; int *p = buf; - + if(len % 8) { return -1; } @@ -215,10 +215,10 @@ int countdownLength2() { void pointer_size_larger_than_array_element_size() { unsigned char buffer[100]; // getByteSize() = 100 - int *ptr = (int *)buffer; // pai.getElementSize() will be sizeof(int) = 4 -> size = 25 + int *ptr = (int *)buffer; // $ Source // pai.getElementSize() will be sizeof(int) = 4 -> size = 25 ptr[24] = 0; // GOOD: writes bytes 96, 97, 98, 99 - ptr[25] = 0; // BAD: writes bytes 100, 101, 102, 103 + ptr[25] = 0; // $ Alert // BAD: writes bytes 100, 101, 102, 103 } struct vec2 { int x, y; }; @@ -226,10 +226,10 @@ struct vec3 { int x, y, z; }; void pointer_size_smaller_than_array_element_size_but_does_not_divide_it() { vec3 array[3]; // getByteSize() = 9 * sizeof(int) - vec2 *ptr = (vec2 *)array; // pai.getElementSize() will be 2 * sizeof(int) -> size = 4 + vec2 *ptr = (vec2 *)array; // $ Source // pai.getElementSize() will be 2 * sizeof(int) -> size = 4 ptr[3] = vec2{}; // GOOD: writes ints 6, 7 - ptr[4] = vec2{}; // BAD: writes ints 8, 9 + ptr[4] = vec2{}; // $ Alert // BAD: writes ints 8, 9 } void pointer_size_larger_than_array_element_size_and_does_not_divide_it() { @@ -258,7 +258,7 @@ void call_use(unsigned char* p, int n) { if(n == 3) { unsigned char x = p[0]; unsigned char y = p[1]; - unsigned char z = p[2]; // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point. + unsigned char z = p[2]; // $ Alert // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point. use(x, y, z); } } @@ -283,7 +283,7 @@ void test_call_use2() { call_call_use(buffer1,1); unsigned char buffer2[2]; - call_call_use(buffer2,2); + call_call_use(buffer2,2); // $ Source unsigned char buffer3[3]; call_call_use(buffer3,3); @@ -296,7 +296,7 @@ int guardingCallee(int *arr, int size) { int sum; for (int i = 0; i < size; i++) { - sum += arr[i]; // GOOD [FALSE POSITIVE] - guarded by size + sum += arr[i]; // $ Alert // GOOD [FALSE POSITIVE] - guarded by size } return sum; } @@ -304,9 +304,9 @@ int guardingCallee(int *arr, int size) { int guardingCaller() { int arr1[MAX_SIZE]; guardingCallee(arr1, MAX_SIZE); - + int arr2[10]; - guardingCallee(arr2, 10); + guardingCallee(arr2, 10); // $ Source } // simplified md5 padding @@ -319,10 +319,10 @@ void correlatedCondition(int num) { end = temp + 56; } else if (num < 64) { - end = temp + 64; // GOOD [FALSE POSITVE] + end = temp + 64; // $ Alert // GOOD [FALSE POSITVE] } char *temp2 = temp + num; - while(temp2 != end) { + while(temp2 != end) { // $ Sink *temp2 = 0; temp2++; } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref index 0fa00ffe3abc..ff0854782f9d 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/ExposureSensitiveInformationUnauthorizedActor.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql +query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/test.cpp index 6323d617ff13..a2c6422f494a 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test1/test.cpp @@ -9,7 +9,7 @@ int main(int argc, char *argv[]) { //umask(0022); FILE *fp; - fp = fopen("myFile.txt","w"); // BAD + fp = fopen("myFile.txt","w"); // $ Alert // BAD //chmod("myFile.txt",0644); fprintf(fp,"%s\n","data to file"); fclose(fp); diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref index 0fa00ffe3abc..ff0854782f9d 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test2/ExposureSensitiveInformationUnauthorizedActor.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql +query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref index 0fa00ffe3abc..ff0854782f9d 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/ExposureSensitiveInformationUnauthorizedActor.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql +query: experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref index 6e5213404373..2689b2c1bc01 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/IncorrectChangingWorkingDirectory.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql +query: experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/test.cpp index 24ff440d1400..2173c76a7f61 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-243/semmle/tests/test.cpp @@ -9,13 +9,13 @@ int chdir(char *path); void exit(int status); int funTest1(){ - if (chroot("/myFold/myTmp") == -1) { // BAD + if (chroot("/myFold/myTmp") == -1) { // $ Alert // BAD exit(-1); } return 0; } -int funTest2(){ +int funTest2(){ if (chdir("/myFold/myTmp") == -1) { // GOOD exit(-1); } @@ -25,8 +25,8 @@ int funTest2(){ return 0; } -int funTest3(){ - chdir("/myFold/myTmp"); // BAD +int funTest3(){ + chdir("/myFold/myTmp"); // $ Alert // BAD return 0; } int main(int argc, char *argv[]) diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref index 9012747f4ba9..835b6c80fb1e 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/IncorrectPrivilegeAssignment.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql +query: experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/test.cpp index 57333e8f586e..181cb87a57c0 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-266/semmle/tests/test.cpp @@ -6,7 +6,7 @@ int fclose(FILE *stream); void funcTest1() { - umask(0666); // BAD + umask(0666); // $ Alert // BAD FILE *fe; fe = fopen("myFile.txt", "wt"); fclose(fe); @@ -27,7 +27,7 @@ void funcTest2(int mode) FILE *fe; fe = fopen("myFile.txt", "wt"); fclose(fe); - chmod("myFile.txt",0555-mode); // BAD + chmod("myFile.txt",0555-mode); // $ Alert // BAD } void funcTest2g(int mode) diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref index f1135f7d536a..77270c3533aa 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/PamAuthorization.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-285/PamAuthorization.ql +query: experimental/Security/CWE/CWE-285/PamAuthorization.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/test.cpp index e2753f10775e..eb6628850ea0 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-285/test.cpp @@ -26,7 +26,7 @@ bool PamAuthBad(const std::string &username_in, return false; } - err = pam_authenticate(pamh, 0); + err = pam_authenticate(pamh, 0); // $ Alert if (err != PAM_SUCCESS) return err; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp index 60a34889e05b..451ce5423e64 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp @@ -22,8 +22,8 @@ char host[] = "codeql.com"; void bad(void) { std::unique_ptr curl = std::unique_ptr(curl_easy_init()); - curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); - curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); + curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); // $ Alert + curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); // $ Alert curl_easy_setopt(curl.get(), CURLOPT_URL, host); curl_easy_perform(curl.get()); } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref index 6b09ac53c9b7..e2dd11da1e8e 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-295/CurlSSL.ql +query: experimental/Security/CWE/CWE-295/CurlSSL.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref index 65c8c9c2dd4c..0952582b4064 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql \ No newline at end of file +query: experimental/Security/CWE/CWE-359/PrivateCleartextWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/test.cpp index 4d69ee5b2b72..b123603654c0 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/test.cpp @@ -54,7 +54,7 @@ void file() FILE *file; // BAD: write zipcode to file in cleartext - fputs(theZipcode, file); + fputs(theZipcode, file); // $ Alert // GOOD: encrypt first char *encrypted = encrypt(theZipcode); @@ -71,15 +71,15 @@ int main(int argc, char **argv) char *buff4; // BAD: write medical to buffer in cleartext - sprintf(buff1, "%s", medical); + sprintf(buff1, "%s", medical); // $ Alert Source // BAD: write medical to buffer in cleartext - char *temp = medical; - sprintf(buff2, "%s", temp); + char *temp = medical; // $ Source + sprintf(buff2, "%s", temp); // $ Alert // BAD: write medical to buffer in cleartext - char *buff5 = func(medical); - sprintf(buff3, "%s", buff5); + char *buff5 = func(medical); // $ Source + sprintf(buff3, "%s", buff5); // $ Alert char *buff6 = encrypt(medical); // GOOD: encrypt first @@ -93,10 +93,10 @@ void stream() ofstream mystream; // BAD: write zipcode to file in cleartext - mystream << "the zipcode is: " << theZipcode; + mystream << "the zipcode is: " << theZipcode; // $ Alert Source // BAD: write zipcode to file in cleartext - (mystream << "the zipcode is: ").write(theZipcode, strlen(theZipcode)); + (mystream << "the zipcode is: ").write(theZipcode, strlen(theZipcode)); // $ Alert // GOOD: encrypt first char *encrypted = encrypt(theZipcode); diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref index e134a5229da1..77407cfd8254 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/DivideByZeroUsingReturnValue.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql +query: experimental/Security/CWE/CWE-369/DivideByZeroUsingReturnValue.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp index 882f66184854..c3f27c3aa648 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp @@ -44,13 +44,13 @@ int getSize2(int type) { int badTestf1(int type, int met) { int is = getSize(type); - if (met == 1) return 123 / is; // BAD - else return 123 / getSize2(type); // BAD + if (met == 1) return 123 / is; // $ Alert // BAD + else return 123 / getSize2(type); // $ Alert // BAD } int badTestf2(int type) { int is; is = getSize(type); - return 123 / is; // BAD + return 123 / is; // $ Alert // BAD } int badTestf3(int type, int met) { @@ -62,23 +62,23 @@ int badTestf3(int type, int met) { case 2: if (0 == is) return 123 / is; // BAD [NOT DETECTED] case 3: - if (!is & 123 / is) // BAD + if (!is & 123 / is) // $ Alert // BAD return 123; case 4: - if (!is | 123 / is) // BAD + if (!is | 123 / is) // $ Alert // BAD return 123; case 5: - if (123 / is || !is) // BAD + if (123 / is || !is) // $ Alert // BAD return 123; case 6: - if (123 / is && !is) // BAD + if (123 / is && !is) // $ Alert // BAD return 123; case 7: - if (!is) return 123 / is; // BAD + if (!is) return 123 / is; // $ Alert // BAD case 8: - if (is > -1) return 123 / is; // BAD + if (is > -1) return 123 / is; // $ Alert // BAD case 9: - if (is < 2) return 123 / is; // BAD + if (is < 2) return 123 / is; // $ Alert // BAD } if (is != 0) return -1; if (is == 0) type += 1; @@ -92,7 +92,7 @@ int goodTestf3(int type, int met) { case 1: if (is < 0) return 123 / is; // GOOD case 2: - if (!is && 123 / is) // GOOD + if (!is && 123 / is) // GOOD return 123; case 3: if (!is || 123 / is) // GOOD @@ -112,10 +112,10 @@ int goodTestf3a(int type, int met) { if (is < 0) return 123 / is; // GOOD case 2: - if (!is && 123 / is) // GOOD + if (!is && 123 / is) // GOOD return 123; case 3: - if (!is || 123 / is) // GOOD + if (!is || 123 / is) // GOOD return 123; } return 1; @@ -125,20 +125,20 @@ int badTestf4(int type) { int is = getSize(type); int d; d = type * is; - return 123 / d; // BAD + return 123 / d; // $ Alert // BAD } int badTestf5(int type) { int is = getSize(type); int d; d = is / type; - return 123 / d; // BAD + return 123 / d; // $ Alert // BAD } int badTestf6(int type) { int is = getSize(type); int d; d = is / type; - return type * 123 / d; // BAD + return type * 123 / d; // $ Alert // BAD } int badTestf7(int type, int met) { @@ -150,7 +150,7 @@ int badTestf7(int type, int met) { return 123 / is; // GOOD } quit: - return 123 / is; // BAD + return 123 / is; // $ Alert // BAD } int goodTestf7(int type, int met) { @@ -169,8 +169,8 @@ int goodTestf7(int type, int met) { int badTestf8(int type) { int is = getSize(type); - type /= is; // BAD - type %= is; // BAD + type /= is; // $ Alert // BAD + type %= is; // $ Alert // BAD return type; } @@ -184,7 +184,7 @@ float getSizeFloat(float type) { } float badTestf9(float type) { float is = getSizeFloat(type); - return 123 / is; // BAD + return 123 / is; // $ Alert // BAD } float goodTestf9(float type) { float is = getSizeFloat(type); @@ -196,18 +196,18 @@ int badTestf10(int type) { int out = type; int is = getSize(type); if (is > -2) { - out /= 123 / (is + 1); // BAD + out /= 123 / (is + 1); // $ Alert // BAD } if (is > 0) { - return 123 / (is - 1); // BAD + return 123 / (is - 1); // $ Alert // BAD } if (is <= 0) return 0; - return 123 / (is - 1); // BAD + return 123 / (is - 1); // $ Alert // BAD return 0; } int badTestf11(int type) { int is = getSize(type); - return 123 / (is - 3); // BAD + return 123 / (is - 3); // $ Alert // BAD } int goodTestf11(int type) { @@ -255,12 +255,12 @@ int badMySubDiv(int type, int is) { void badTestf13(int type) { int is = getSize(type); - badMyDiv(type, is); // BAD - badMyDiv(type, is - 2); // BAD - badMySubDiv(type, is); // BAD + badMyDiv(type, is); // $ Alert // BAD + badMyDiv(type, is - 2); // $ Alert // BAD + badMySubDiv(type, is); // $ Alert // BAD goodMyDiv(type, is); // GOOD if (is < 5) - badMySubDiv(type, is); // BAD + badMySubDiv(type, is); // $ Alert // BAD if (is < 0) badMySubDiv(type, is); // BAD [NOT DETECTED] if (is > 5) @@ -270,9 +270,9 @@ void badTestf13(int type) { if (is > 0) badMyDiv(type, is); // GOOD if (is < 5) - badMyDiv(type, is - 3); // BAD + badMyDiv(type, is - 3); // $ Alert // BAD if (is < 0) - badMyDiv(type, is + 1); // BAD + badMyDiv(type, is + 1); // $ Alert // BAD if (is > 5) badMyDiv(type, is - 3); // GOOD } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref index beec38ab5dc6..d4fa44200b10 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/InsecureTemporaryFile.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql +query: experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp index 07efea49e784..758fdfda8a7b 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp @@ -13,7 +13,7 @@ int fclose(FILE *stream); int funcTest1() { FILE *fp; - char *filename = tmpnam(NULL); // BAD + char *filename = tmpnam(NULL); // $ Alert // BAD fp = fopen(filename,"w"); fprintf(fp,"%s\n","data to file"); fclose(fp); diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref index e80e86cbdccc..d3ede250c5b3 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/MemoryLeakOnFailedCallToRealloc.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql \ No newline at end of file +query: experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c index df33fc19ef60..f5b58b8438fb 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-401/semmle/tests/test.c @@ -31,7 +31,7 @@ unsigned char * badResize_0(unsigned char * buffer,size_t currentSize,size_t new // BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block if (currentSize < newSize) { - buffer = (unsigned char *)realloc(buffer, newSize); + buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert } return buffer; } @@ -60,7 +60,7 @@ unsigned char * badResize_1_0(unsigned char * buffer,size_t currentSize,size_t n // BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block if (currentSize < newSize) { - buffer = (unsigned char *)realloc(buffer, newSize); + buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert } return buffer; } @@ -136,7 +136,7 @@ unsigned char * badResize_1_1(unsigned char * buffer,size_t currentSize,size_t n // BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block if (currentSize < newSize) { - buffer = (unsigned char *)realloc(buffer, newSize); + buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert } if(!buffer) aFakeFailed_1(1, 1); @@ -183,7 +183,7 @@ unsigned char * badResize_2_0(unsigned char * buffer,size_t currentSize,size_t n assert(buffer!=0); if (currentSize < newSize) { - buffer = (unsigned char *)realloc(buffer, newSize); + buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert } return buffer; } @@ -279,7 +279,7 @@ unsigned char *goodResize_3_1(unsigned char *buffer, size_t currentSize, size_t unsigned char *tmp = buffer; if (currentSize < newSize) { - buffer = (unsigned char *)realloc(buffer, newSize); + buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert if (buffer == NULL) { free(tmp); @@ -296,7 +296,7 @@ unsigned char *goodResize_3_2(unsigned char *buffer, size_t currentSize, size_t unsigned char *tmp = buffer; if (currentSize < newSize) { - tmp = (unsigned char *)realloc(tmp, newSize); + tmp = (unsigned char *)realloc(tmp, newSize); // $ Alert if (tmp != 0) { buffer = tmp; @@ -325,7 +325,7 @@ unsigned char * badResize_5_2(unsigned char *buffer, size_t currentSize, size_t // BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block if (currentSize < newSize) { - buffer = (unsigned char *)realloc(buffer, newSize); + buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert } if (cond) { @@ -339,7 +339,7 @@ unsigned char * badResize_5_1(unsigned char *buffer, size_t currentSize, size_t // BAD: on unsuccessful call to realloc, we will lose a pointer to a valid memory block if (currentSize < newSize) { - buffer = (unsigned char *)realloc(buffer, newSize); + buffer = (unsigned char *)realloc(buffer, newSize); // $ Alert assert(cond); // irrelevant } return buffer; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref index 3dcbc9db9ff4..b5c3a8e483da 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-409/DecompressionBombs.ql +query: experimental/Security/CWE/CWE-409/DecompressionBombs.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/brotliTest.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/brotliTest.cpp index 902749434736..df6b620c4205 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/brotliTest.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/brotliTest.cpp @@ -15,12 +15,12 @@ BrotliDecoderResult BrotliDecoderDecompressStream( void brotli_test(int argc, const char **argv) { uint8_t output[1024]; size_t output_size = sizeof(output); - BrotliDecoderDecompress(1024, (uint8_t *) argv[2], &output_size, output); // BAD + BrotliDecoderDecompress(1024, (uint8_t *) argv[2], &output_size, output); // $ Alert // BAD size_t input_size = 1024; const uint8_t *input_p = (const uint8_t*)argv[2]; uint8_t *output_p = output; size_t out_size; - BrotliDecoderDecompressStream(0, &input_size, &input_p, &output_size, // BAD + BrotliDecoderDecompressStream(0, &input_size, &input_p, &output_size, // $ Alert // BAD &output_p, &out_size); } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/libarchiveTests.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/libarchiveTests.cpp index 5988c9d0fc5e..3cd7f69a199e 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/libarchiveTests.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/libarchiveTests.cpp @@ -19,7 +19,7 @@ static int read_data(archive *ar) { size_t size; la_int64_t offset; - int r = archive_read_data_block(ar, &buff, &size, &offset); // BAD + int r = archive_read_data_block(ar, &buff, &size, &offset); // $ Alert // BAD if (r == ARCHIVE_EOF) return ARCHIVE_OK; if (r < ARCHIVE_OK) diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/main.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/main.cpp index 47f76ff079ba..f890ba397a97 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/main.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/main.cpp @@ -4,7 +4,7 @@ void minizip_test(int argc, const char **argv); void zlib_test(int argc, const char **argv); void zstd_test(int argc, const char **argv); -int main(int argc, const char **argv) { +int main(int argc, const char **argv) { // $ Source brotli_test(argc, argv); libarchive_test(argc, argv); minizip_test(argc, argv); diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/minizipTest.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/minizipTest.cpp index 636f579feea7..d67aed7cf93e 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/minizipTest.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/minizipTest.cpp @@ -14,7 +14,7 @@ void minizip_test(int argc, const char **argv) { int32_t bytes_read; char buf[4096]; while(true) { - bytes_read = mz_zip_entry_read(zip_handle, (char *) argv[1], sizeof(buf)); // BAD + bytes_read = mz_zip_entry_read(zip_handle, (char *) argv[1], sizeof(buf)); // $ Alert // BAD if (bytes_read <= 0) { break; } @@ -23,7 +23,7 @@ void minizip_test(int argc, const char **argv) { void *zip_reader = mz_zip_reader_create(); mz_zip_reader_open_file(zip_reader, argv[1]); mz_zip_reader_goto_first_entry(zip_reader); - mz_zip_reader_entry_save(zip_reader, 0, 0); // BAD + mz_zip_reader_entry_save(zip_reader, 0, 0); // $ Alert // BAD - UnzOpen(argv[3]); // BAD + UnzOpen(argv[3]); // $ Alert // BAD } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zlibTest.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zlibTest.cpp index 7643a607407b..931ff03eeb98 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zlibTest.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zlibTest.cpp @@ -22,7 +22,7 @@ void UnsafeInflate(char *input) { infstream.next_out = output; // output char array inflateInit(&infstream); - inflate(&infstream, 0); // BAD + inflate(&infstream, 0); // $ Alert // BAD } @@ -38,7 +38,7 @@ void UnsafeGzread(char *fileName) { gzFile inFileZ = gzopen(fileName, "rb"); unsigned char unzipBuffer[8192]; while (true) { - if (gzread(inFileZ, unzipBuffer, 8192) <= 0) { // BAD + if (gzread(inFileZ, unzipBuffer, 8192) <= 0) { // $ Alert // BAD break; } } @@ -48,7 +48,7 @@ void UnsafeGzfread(char *fileName) { gzFile inFileZ = gzopen(fileName, "rb"); while (true) { char buffer[1000]; - if (!gzfread(buffer, 999, 1, inFileZ)) { // BAD + if (!gzfread(buffer, 999, 1, inFileZ)) { // $ Alert // BAD break; } } @@ -59,7 +59,7 @@ void UnsafeGzgets(char *fileName) { char *buffer = new char[4000000000]; char *result; while (true) { - result = gzgets(inFileZ, buffer, 1000000000); // BAD + result = gzgets(inFileZ, buffer, 1000000000); // $ Alert // BAD if (result == nullptr) { break; } @@ -74,7 +74,7 @@ void InflateString(char *input) { uLong source_length = 500; uLong destination_length = sizeof(output); - uncompress(output, &destination_length, (Bytef *) input, source_length); // BAD + uncompress(output, &destination_length, (Bytef *) input, source_length); // $ Alert // BAD } void zlib_test(int argc, char **argv) { diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zstdTest.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zstdTest.cpp index 42455185823c..07a35d68fdf6 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zstdTest.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/zstdTest.cpp @@ -36,7 +36,7 @@ void zstd_test(int argc, const char **argv) { ZSTD_inBuffer input = {buffIn, read, 0}; while (input.pos < input.size) { ZSTD_outBuffer output = {buffOut, buffOutSize, 0}; - size_t const ret = ZSTD_decompressStream(dctx, &output, &input); // BAD + size_t const ret = ZSTD_decompressStream(dctx, &output, &input); // $ Alert // BAD CHECK_ZSTD(ret); } } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.qlref index 242beb593f8a..c6f509403283 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-415/DoubleFree.ql +query: experimental/Security/CWE/CWE-415/DoubleFree.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/test.c index 1c154c03094c..cc87cef6548d 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/test.c +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/test.c @@ -8,14 +8,14 @@ void workFunction_0(char *s) { char *buf; buf = (char *) malloc(intSize); free(buf); // GOOD - if(buf) free(buf); // BAD + if(buf) free(buf); // $ Alert // BAD } void workFunction_1(char *s) { int intSize = 10; char *buf; buf = (char *) malloc(intSize); free(buf); // GOOD - free(buf); // BAD + free(buf); // $ Alert // BAD } void workFunction_2(char *s) { int intSize = 10; @@ -54,7 +54,7 @@ void workFunction_5(char *s, int intFlag) { if(intFlag) { free(buf); // GOOD } - free(buf); // BAD + free(buf); // $ Alert // BAD } void workFunction_6(char *s, int intFlag) { int intSize = 10; @@ -75,7 +75,7 @@ void workFunction_7(char *s) { char *buf1; buf = (char *) malloc(intSize); buf1 = (char *) realloc(buf,intSize*4); - free(buf); // BAD + free(buf); // $ Alert // BAD } void workFunction_8(char *s) { int intSize = 10; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/DangerousUseOfExceptionBlocks.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/DangerousUseOfExceptionBlocks.qlref index c67adb8774be..5a285aaa56ca 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/DangerousUseOfExceptionBlocks.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/DangerousUseOfExceptionBlocks.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-476/DangerousUseOfExceptionBlocks.ql +query: experimental/Security/CWE/CWE-476/DangerousUseOfExceptionBlocks.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/test.cpp index de0be1efff25..9d7478548fd2 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-476/semmle/tests/test.cpp @@ -68,7 +68,7 @@ void funcWork1b() { } delete [] bufMyData; - } + } // $ Alert } void funcWork1() { @@ -97,7 +97,7 @@ void funcWork1() { } delete [] bufMyData; - } + } // $ Alert } void funcWork2() { @@ -125,7 +125,7 @@ void funcWork2() { } delete [] bufMyData; - } + } // $ Alert } void funcWork3() { int a; @@ -148,7 +148,7 @@ void funcWork3() { } delete [] bufMyData; - } + } // $ Alert } @@ -180,7 +180,7 @@ void funcWork4b() { catch (...) { delete valData; // BAD - } + } // $ Alert } void funcWork5() { int a; @@ -218,7 +218,7 @@ void funcWork5b() { catch (...) { delete valData; // BAD - } + } // $ Alert } void funcWork6() { int a; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/FindIncorrectlyUsedSwitch.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/FindIncorrectlyUsedSwitch.qlref index b16a5e484a60..aeadfbd0d1aa 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/FindIncorrectlyUsedSwitch.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/FindIncorrectlyUsedSwitch.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql +query: experimental/Security/CWE/CWE-561/FindIncorrectlyUsedSwitch.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/test.c index ede4b87d249e..ecb421991a4c 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/test.c +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-561/semmle/tests/test.c @@ -25,7 +25,7 @@ void testFunction(char c1,int i1) case 9: break; dafault: - } + } // $ Alert switch(c1){ // BAD c1=c1*2; @@ -35,7 +35,7 @@ void testFunction(char c1,int i1) break; case 9: break; - } + } // $ Alert if((c1<6)&&(c1>0)) switch(c1){ // BAD @@ -47,7 +47,7 @@ void testFunction(char c1,int i1) break; case 1: break; - } + } // $ Alert if((c1<6)&&(c1>0)) switch(c1){ // BAD @@ -55,6 +55,6 @@ void testFunction(char c1,int i1) break; case 1: break; - } + } // $ Alert } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/DangerousUseSSL_shutdown.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/DangerousUseSSL_shutdown.qlref index 0c2096f68ff8..ee351aa3cfb9 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/DangerousUseSSL_shutdown.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/DangerousUseSSL_shutdown.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-670/DangerousUseSSL_shutdown.ql +query: experimental/Security/CWE/CWE-670/DangerousUseSSL_shutdown.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/test.cpp index 9ebe1cc10a53..ce550684d087 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-670/semmle/tests/test.cpp @@ -42,7 +42,7 @@ int gootTest2(SSL *ssl) int badTest1(SSL *ssl) { int ret; - switch ((ret = SSL_shutdown(ssl))) { + switch ((ret = SSL_shutdown(ssl))) { // $ Alert case 1: break; case 0: @@ -58,7 +58,7 @@ int badTest1(SSL *ssl) int badTest2(SSL *ssl) { int ret; - ret = SSL_shutdown(ssl); + ret = SSL_shutdown(ssl); // $ Alert switch (ret) { case 1: break; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/DoubleRelease.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/DoubleRelease.qlref index 3edd226abaa9..7d28602c7e9f 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/DoubleRelease.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/DoubleRelease.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-675/DoubleRelease.ql \ No newline at end of file +query: experimental/Security/CWE/CWE-675/DoubleRelease.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/test.cpp index 986a95b1ce96..ef16957ebf05 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-675/semmle/tests/test.cpp @@ -6,7 +6,7 @@ extern FILE * fe; void test1() { FILE *f; - + f = fopen("myFile.txt", "wt"); fclose(f); // GOOD f = NULL; @@ -15,9 +15,9 @@ void test1() void test2() { FILE *f; - + f = fopen("myFile.txt", "wt"); - fclose(f); // BAD + fclose(f); // $ Alert // BAD fclose(f); } @@ -25,17 +25,17 @@ void test3() { FILE *f; FILE *g; - + f = fopen("myFile.txt", "wt"); g = f; - fclose(f); // BAD + fclose(f); // $ Alert // BAD fclose(g); } int fGtest4_1() { - fe = fopen("myFile.txt", "wt"); - fclose(fe); // BAD + fe = fopen("myFile.txt", "wt"); + fclose(fe); // $ Alert // BAD return -1; } @@ -46,7 +46,7 @@ int fGtest4_2() } void Gtest4() -{ +{ fGtest4_1(); fGtest4_2(); } @@ -76,7 +76,7 @@ int main(int argc, char *argv[]) test1(); test2(); test3(); - + Gtest4(); Gtest5(); return 0; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref index 496d5f1b7be6..50143aaec229 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementAfterRefactoringTheCode.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql +query: experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementAfterRefactoringTheCode.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref index 9bf28db3c8a8..2e5848da6d23 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/InsufficientControlFlowManagementWhenUsingBitOperations.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql +query: experimental/Security/CWE/CWE-691/InsufficientControlFlowManagementWhenUsingBitOperations.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c index 1f41f499dede..d39bf4c198bc 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-691/semmle/tests/test.c @@ -5,25 +5,25 @@ void workFunction_0(char *s) { int intSize; char buf[80]; if(intSize>0 && intSize<80 && memset(buf,0,intSize)) return; // GOOD - if(intSize>0 & intSize<80 & memset(buf,0,intSize)) return; // BAD + if(intSize>0 & intSize<80 & memset(buf,0,intSize)) return; // $ Alert[cpp/errors-when-using-bit-operations] // BAD if(intSize>0 && tmpFunction()) return; - if(intSize<0 & tmpFunction()) return; // BAD + if(intSize<0 & tmpFunction()) return; // $ Alert[cpp/errors-when-using-bit-operations] // BAD } void workFunction_1(char *s) { int intA,intB; - if(intA + intB) return; // BAD + if(intA + intB) return; // $ Alert[cpp/errors-after-refactoring] // BAD if(intA + intB>4) return; // GOOD - if(intA>0 && (intA + intB)) return; // BAD + if(intA>0 && (intA + intB)) return; // $ Alert[cpp/errors-after-refactoring] // BAD while(intA>0) { if(intB - intA<10) break; intA--; - }while(intA>0); // BAD + }while(intA>0); // $ Alert[cpp/errors-after-refactoring] // BAD for(intA=100; intA>0; intA--) { if(intB - intA<10) break; - }while(intA>0); // BAD + }while(intA>0); // $ Alert[cpp/errors-after-refactoring] // BAD while(intA>0) { if(intB - intA<10) break; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/FindIncorrectlyUsedExceptions.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/FindIncorrectlyUsedExceptions.qlref index 85ac9ad2fd43..5dbfe0957a7b 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/FindIncorrectlyUsedExceptions.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/FindIncorrectlyUsedExceptions.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql +query: experimental/Security/CWE/CWE-703/FindIncorrectlyUsedExceptions.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/test.cpp index f255aabbb422..6c90ab54eae0 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-703/semmle/tests/test.cpp @@ -32,13 +32,13 @@ void funcTest2() void funcTest3() { - std::runtime_error("msg error"); // BAD + std::runtime_error("msg error"); // $ Alert // BAD throw std::runtime_error("msg error"); // GOOD } void TestFunc() { - funcTest1(); - DllMain(); + funcTest1(); // $ Alert + DllMain(); // $ Alert funcTest2(); } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/ImproperCheckReturnValueScanf.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/ImproperCheckReturnValueScanf.qlref index f0cb9dd57c1e..1bc37310f275 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/ImproperCheckReturnValueScanf.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/ImproperCheckReturnValueScanf.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql +query: experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp index b9608b757b9c..72a11620eb3d 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp @@ -49,9 +49,9 @@ int functionWork1b(int retIndex) { char a[10]; int b; int *p = &b; - scanf("%i", &i); // BAD - scanf("%s", a); // BAD - scanf("%i", p); // BAD + scanf("%i", &i); // $ Alert // BAD + scanf("%s", a); // $ Alert // BAD + scanf("%i", p); // $ Alert // BAD if(retIndex == 0) return (int)*a; if(retIndex == 1) @@ -102,9 +102,9 @@ int functionWork2b() { char a[10]; int b; int *p = &b; - scanf("%i", &i); // BAD - scanf("%s", a); // BAD - scanf("%i", p); // BAD + scanf("%i", &i); // $ Alert // BAD + scanf("%s", a); // $ Alert // BAD + scanf("%i", p); // $ Alert // BAD globalVal = i; globalVala = a; globalValp = p; @@ -112,12 +112,12 @@ int functionWork2b() { } int functionWork2b_() { char a[10]; - scanf("%s", a); // BAD + scanf("%s", a); // $ Alert // BAD globalVala2 = a[0]; return 0; } int functionWork3b(int * i) { - scanf("%i", i); // BAD + scanf("%i", i); // $ Alert // BAD return 0; } int functionWork3() { diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/UndefinedOrImplementationDefinedBehavior.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/UndefinedOrImplementationDefinedBehavior.qlref index e178bc348e9b..933f46a7abff 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/UndefinedOrImplementationDefinedBehavior.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/UndefinedOrImplementationDefinedBehavior.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-758/UndefinedOrImplementationDefinedBehavior.ql +query: experimental/Security/CWE/CWE-758/UndefinedOrImplementationDefinedBehavior.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/test.c index 01d8e666cdd8..bb8ce5e70347 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/test.c +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-758/semmle/tests/test.c @@ -10,10 +10,10 @@ char tmpFunction2(char * buf) } void workFunction_0(char *s, char * buf) { int intA; - intA = tmpFunction1(buf) + tmpFunction2(buf); // BAD + intA = tmpFunction1(buf) + tmpFunction2(buf); // $ Alert // BAD intA = tmpFunction1(buf); //GOOD intA += tmpFunction2(buf); // GOOD - buf[intA] = intA++; // BAD + buf[intA] = intA++; // $ Alert // BAD intA++; buf[intA] = intA; // GOOD } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.qlref index 0c3f1c1c6a67..e2b7ace55b93 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql +query: experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/test.cpp index 479a4e5d6a3a..f6bdb8a7c206 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-783/semmle/tests/test.cpp @@ -1,14 +1,14 @@ void testFunction(int i1, int i2, int i3, bool b1, bool b2, bool b3, char c1) { - - if(b1||b2&&b3) //BAD + + if(b1||b2&&b3) // $ Alert //BAD return; if((b1||b2)&&b3) //GOOD return; if(b1||(b2&&b3)) //GOOD return; - if(b1||b2&i1) //BAD + if(b1||b2&i1) // $ Alert //BAD return; if((b1||b2)&i1) //GOOD return; @@ -16,28 +16,28 @@ void testFunction(int i1, int i2, int i3, bool b1, bool b2, bool b3, char c1) return; if(b1&&b2&0) //GOOD return; - if(b1||b2|i1) //BAD + if(b1||b2|i1) // $ Alert //BAD return; if((b1||b2)|i1) //GOOD return; - if(i1|i2&c1) //BAD + if(i1|i2&c1) // $ Alert //BAD return; if((i1|i2)&i3) //GOOD return; - if(i1^i2&c1) //BAD + if(i1^i2&c1) // $ Alert //BAD return; if((i1^i2)&i3) //GOOD return; - - if(i1|i2^c1) //BAD + + if(i1|i2^c1) // $ Alert //BAD return; if((i1|i2)^i3) //GOOD return; - - if(b1|b2^b3) //BAD + + if(b1|b2^b3) // $ Alert //BAD return; if((b1|b2)^b3) //GOOD return; - + } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qlref index 6ba005d087a6..c3aaa7d65a08 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql +query: experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrlen.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref index 5189abcce5d1..47c4540803df 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/OperatorPrecedenceLogicErrorWhenUseBoolType.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql +query: experimental/Security/CWE/CWE-783/OperatorPrecedenceLogicErrorWhenUseBoolType.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c index a204aa4db29e..b79cd2fb0b62 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.c @@ -12,23 +12,23 @@ void strlen_test1(){ unsigned char buff1[12]; struct buffers buffAll; struct buffers * buffAll1; - - buff1[strlen(buff1)]=0; // BAD - buffAll.array[strlen(buffAll.array)]=0; // BAD - buffAll.pointer[strlen(buffAll.pointer)]=0; // BAD - buffAll1->array[strlen(buffAll1->array)]=0; // BAD - buffAll1->pointer[strlen(buffAll1->pointer)]=0; // BAD - globalBuff1.array[strlen(globalBuff1.array)]=0; // BAD - globalBuff1.pointer[strlen(globalBuff1.pointer)]=0; // BAD - globalBuff2->array[strlen(globalBuff2->array)]=0; // BAD - globalBuff2->pointer[strlen(globalBuff2->pointer)]=0; // BAD + + buff1[strlen(buff1)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD + buffAll.array[strlen(buffAll.array)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD + buffAll.pointer[strlen(buffAll.pointer)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD + buffAll1->array[strlen(buffAll1->array)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD + buffAll1->pointer[strlen(buffAll1->pointer)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD + globalBuff1.array[strlen(globalBuff1.array)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD + globalBuff1.pointer[strlen(globalBuff1.pointer)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD + globalBuff2->array[strlen(globalBuff2->array)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD + globalBuff2->pointer[strlen(globalBuff2->pointer)]=0; // $ Alert[cpp/access-memory-location-after-end-buffer-strlen] // BAD } void strlen_test2(){ unsigned char buff1[12],buff1_c[12]; struct buffers buffAll,buffAll_c; struct buffers * buffAll1,*buffAll1_c; - + buff1[strlen(buff1_c)]=0; // GOOD buffAll.array[strlen(buffAll_c.array)]=0; // GOOD buffAll.pointer[strlen(buffAll.array)]=0; // GOOD diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp index f08d2a45757f..ba3d3f417eef 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-788/semmle/tests/test.cpp @@ -7,13 +7,13 @@ void testFunction() int i1,i2,i3; bool b1,b2,b3; char c1,c2,c3; - b1 = -b2; //BAD + b1 = -b2; // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD b1 = !b2; //GOOD - b1++; //BAD - ++b1; //BAD - if(i1=tmpFunc()!=i2) //BAD + b1++; // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD + ++b1; // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD + if(i1=tmpFunc()!=i2) // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD return; - if(i1=tmpFunc()!=11) //BAD + if(i1=tmpFunc()!=11) // $ Alert[cpp/operator-precedence-logic-error-when-use-bool-type] //BAD return; if((i1=tmpFunc())!=i2) //GOOD return; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/BufferAccessWithIncorrectLengthValue.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/BufferAccessWithIncorrectLengthValue.qlref index 6cbb55272112..e92957d34a80 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/BufferAccessWithIncorrectLengthValue.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/BufferAccessWithIncorrectLengthValue.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-805/BufferAccessWithIncorrectLengthValue.ql +query: experimental/Security/CWE/CWE-805/BufferAccessWithIncorrectLengthValue.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/test.cpp index 26c33abab65d..6d99bb432b40 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-805/semmle/tests/test.cpp @@ -24,7 +24,7 @@ bool badTest1(SSL *ssl,char *text) char buf[256]; if( peer = SSL_get_peer_certificate(ssl)) { - X509_NAME_oneline(X509_get_subject_name(peer),buf,1024); // BAD + X509_NAME_oneline(X509_get_subject_name(peer),buf,1024); // $ Alert // BAD if((char*)strcasestr(buf,text)) return true; } return false; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.cpp index 09506cbc0878..1c0f53829356 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.cpp @@ -16,7 +16,7 @@ int main(int argc, char **argv) // BAD, do not use scanf without specifying a length first char buf1[10]; - scanf("%s", buf1); + scanf("%s", buf1); // $ Alert // GOOD, length is specified. The length should be one less than the size of the destination buffer, since the last character is the NULL terminator. char buf2[20]; @@ -25,7 +25,7 @@ int main(int argc, char **argv) // BAD, do not use scanf without specifying a length first char file[10]; - fscanf(file, "%s", buf2); + fscanf(file, "%s", buf2); // $ Alert // GOOD, with 'sscanf' the input can be checked first and enough room allocated [FALSE POSITIVE] if (argc >= 1) @@ -33,7 +33,7 @@ int main(int argc, char **argv) char *src = argv[0]; char *dest = (char *)malloc(strlen(src) + 1); - sscanf(src, "%s", dest); + sscanf(src, "%s", dest); // $ Alert } return 0; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.qlref b/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.qlref index 428d988a161d..b8d5ea8dbe32 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.qlref +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/semmle/tests/MemoryUnsafeFunctionScan.qlref @@ -1 +1,2 @@ -experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.ql \ No newline at end of file +query: experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.qlref b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.qlref index 0c9100ea0432..d0f38acaef82 100644 --- a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/IRConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/IRConsistency.ql diff --git a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_ssa_consistency_unsound.qlref b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_ssa_consistency_unsound.qlref index d0a29f0641af..e3d97770b2e7 100644 --- a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_ssa_consistency_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_ssa_consistency_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.ql diff --git a/cpp/ql/test/library-tests/ir/ir/raw_consistency.qlref b/cpp/ql/test/library-tests/ir/ir/raw_consistency.qlref index eb7cc77b3164..b51532768295 100644 --- a/cpp/ql/test/library-tests/ir/ir/raw_consistency.qlref +++ b/cpp/ql/test/library-tests/ir/ir/raw_consistency.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/raw/IRConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/raw/IRConsistency.ql diff --git a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.qlref b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.qlref index 1d0a35439328..6fc11829f4ac 100644 --- a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql diff --git a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_ssa_consistency_unsound.qlref b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_ssa_consistency_unsound.qlref index fd03efbc2674..6e652e8e75b0 100644 --- a/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_ssa_consistency_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ir/unaliased_ssa_ssa_consistency_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.ql diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.qlref b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.qlref index 0c9100ea0432..d0f38acaef82 100644 --- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/IRConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/IRConsistency.ql diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.qlref b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.qlref index 7d4b2950a35a..ed3f838a0370 100644 --- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/PrintIR.ql \ No newline at end of file +semmle/code/cpp/ir/PrintIR.ql diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ssa_consistency_unsound.qlref b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ssa_consistency_unsound.qlref index d0a29f0641af..e3d97770b2e7 100644 --- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ssa_consistency_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ssa_consistency_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.ql diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_consistency_unsound.qlref b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_consistency_unsound.qlref index 1d0a35439328..6fc11829f4ac 100644 --- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_consistency_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_consistency_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.qlref b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.qlref index 3f7764440366..8b52a3063be0 100644 --- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.ql diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ssa_consistency_unsound.qlref b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ssa_consistency_unsound.qlref index fd03efbc2674..6e652e8e75b0 100644 --- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ssa_consistency_unsound.qlref +++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ssa_consistency_unsound.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.ql diff --git a/cpp/ql/test/library-tests/lossy_pointer_cast/lossy_pointer_cast.c b/cpp/ql/test/library-tests/lossy_pointer_cast/lossy_pointer_cast.c index 8f76cdb42f20..65421e1648af 100644 --- a/cpp/ql/test/library-tests/lossy_pointer_cast/lossy_pointer_cast.c +++ b/cpp/ql/test/library-tests/lossy_pointer_cast/lossy_pointer_cast.c @@ -6,11 +6,10 @@ void f(void) { long long int z; z = (long long int)p1; // OK: long long int is big enough - i = (short int)p2; // Bad: short is too small + i = (short int)p2; // $ Alert // Bad: short is too small i = (short int)(long long int)p3; // OK: we assume they know what // they are doing if they go // via a large-enough type - i = (short int)(void *)p4; // Bad: Going via a pointer type is + i = (short int)(void *)p4; // $ Alert // Bad: Going via a pointer type is // not convincing } - diff --git a/cpp/ql/test/library-tests/lossy_pointer_cast/lossy_pointer_cast.qlref b/cpp/ql/test/library-tests/lossy_pointer_cast/lossy_pointer_cast.qlref index d202b53c6aa6..69e313c34ee4 100644 --- a/cpp/ql/test/library-tests/lossy_pointer_cast/lossy_pointer_cast.qlref +++ b/cpp/ql/test/library-tests/lossy_pointer_cast/lossy_pointer_cast.qlref @@ -1 +1,2 @@ -Likely Bugs/Conversion/LossyPointerCast.ql +query: Likely Bugs/Conversion/LossyPointerCast.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_consistency.qlref b/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_consistency.qlref index 0c9100ea0432..d0f38acaef82 100644 --- a/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_consistency.qlref +++ b/cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_consistency.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/IRConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/IRConsistency.ql diff --git a/cpp/ql/test/library-tests/syntax-zoo/raw_consistency.qlref b/cpp/ql/test/library-tests/syntax-zoo/raw_consistency.qlref index eb7cc77b3164..b51532768295 100644 --- a/cpp/ql/test/library-tests/syntax-zoo/raw_consistency.qlref +++ b/cpp/ql/test/library-tests/syntax-zoo/raw_consistency.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/raw/IRConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/raw/IRConsistency.ql diff --git a/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_consistency.qlref b/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_consistency.qlref index 1d0a35439328..6fc11829f4ac 100644 --- a/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_consistency.qlref +++ b/cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_consistency.qlref @@ -1 +1 @@ -semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql \ No newline at end of file +semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.ql diff --git a/cpp/ql/test/query-tests/Architecture/FeatureEnvy/FeatureEnvy.qlref b/cpp/ql/test/query-tests/Architecture/FeatureEnvy/FeatureEnvy.qlref index cbb26c9c3bf3..0c7c0f33b1eb 100644 --- a/cpp/ql/test/query-tests/Architecture/FeatureEnvy/FeatureEnvy.qlref +++ b/cpp/ql/test/query-tests/Architecture/FeatureEnvy/FeatureEnvy.qlref @@ -1 +1,2 @@ -Architecture/FeatureEnvy.ql +query: Architecture/FeatureEnvy.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Architecture/FeatureEnvy/a.cpp b/cpp/ql/test/query-tests/Architecture/FeatureEnvy/a.cpp index 588364e73096..059908b34869 100644 --- a/cpp/ql/test/query-tests/Architecture/FeatureEnvy/a.cpp +++ b/cpp/ql/test/query-tests/Architecture/FeatureEnvy/a.cpp @@ -7,7 +7,7 @@ void local3(void) { } void local4(void) { } void local5(void) { } -void f1(void) { +void f1(void) { // $ Alert g(); h(); i(); @@ -15,7 +15,7 @@ void f1(void) { k(); } -void f2(void) { +void f2(void) { // $ Alert local1(); g(); h(); @@ -45,7 +45,7 @@ void f4(void) { j(); } -void f5(void) { +void f5(void) { // $ Alert MyClass m; m.mg(); diff --git a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.cpp b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.cpp index 374ad8b6337b..183cae6b6906 100644 --- a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.cpp +++ b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.cpp @@ -6,12 +6,12 @@ struct aa { TEN(int_f) - TEN(int_g) + TEN(int_g) // $ Alert }; class bb { TEN(int_f) - TEN(int_g) + TEN(int_g) // $ Alert }; union cc_not_flagged_up_because_unions_are_not_classes_in_this_sense { @@ -22,13 +22,13 @@ union cc_not_flagged_up_because_unions_are_not_classes_in_this_sense { template struct dd { TEN(int_f) - TEN(int_g) + TEN(int_g) // $ Alert }; template struct ee { TEN(int_f) - TEN(int_g) + TEN(int_g) // $ Alert }; void instantiate() { @@ -54,10 +54,10 @@ struct MyParticle { unsigned char r2, g2, b2, a2; class texture *tex; - float u1, v1, u2, v2; + float u1, v1, u2, v2; // $ Alert }; -struct MyAlphaClass1 { +struct MyAlphaClass1 { // $ Alert int a1, b1, c1, d1, e1, f1, g1, h1, i1, j1; int k1, l1, m1, n1, o1, p1, q1, r1, s1, t1; int u1, v1, w1, x1, y1, z1; @@ -71,7 +71,7 @@ struct MyAlphaClass1 { int u2, v2, w2, x2, y2, z2; }; -struct MyAlphaClass2 { +struct MyAlphaClass2 { // $ Alert int x; // ... diff --git a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.qlref b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.qlref index 1afc89cceef6..6d9540acb23f 100644 --- a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.qlref +++ b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/cwmf.qlref @@ -1 +1,2 @@ -Architecture/Refactoring Opportunities/ClassesWithManyFields.ql +query: Architecture/Refactoring Opportunities/ClassesWithManyFields.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/different_types.h b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/different_types.h index 3e2a6c6e4ced..11aea5dc11c0 100644 --- a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/different_types.h +++ b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ClassesWithManyFields/different_types.h @@ -30,6 +30,6 @@ class DifferentTypes2 { int j6; int j7; int j8; - int j9; + int j9; // $ Alert }; diff --git a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ComplexFunctions/ComplexFunctions.qlref b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ComplexFunctions/ComplexFunctions.qlref index 22bc3d276639..a00aeaa47cf4 100644 --- a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ComplexFunctions/ComplexFunctions.qlref +++ b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ComplexFunctions/ComplexFunctions.qlref @@ -1 +1,2 @@ -Architecture/Refactoring Opportunities/ComplexFunctions.ql +query: Architecture/Refactoring Opportunities/ComplexFunctions.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ComplexFunctions/complex.c b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ComplexFunctions/complex.c index 6499a1bc38de..be209ddbf459 100644 --- a/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ComplexFunctions/complex.c +++ b/cpp/ql/test/query-tests/Architecture/Refactoring Opportunities/ComplexFunctions/complex.c @@ -11,7 +11,7 @@ void g(void) { f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); } -void h(void) { +void h(void) { // $ Alert f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); f(); diff --git a/cpp/ql/test/query-tests/Best Practices/GuardedFree/GuardedFree.qlref b/cpp/ql/test/query-tests/Best Practices/GuardedFree/GuardedFree.qlref index d64671f08c33..8abe92507f2a 100644 --- a/cpp/ql/test/query-tests/Best Practices/GuardedFree/GuardedFree.qlref +++ b/cpp/ql/test/query-tests/Best Practices/GuardedFree/GuardedFree.qlref @@ -1 +1,2 @@ -Best Practices/GuardedFree.ql +query: Best Practices/GuardedFree.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp b/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp index d52bcef72d16..136575fdced0 100644 --- a/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp @@ -2,12 +2,12 @@ extern "C" void free(void *ptr); extern "C" int strcmp(const char *s1, const char *s2); void test0(int *x) { - if (x) // BAD + if (x) // $ Alert // BAD free(x); } void test1(int *x) { - if (x) { // BAD + if (x) { // $ Alert // BAD free(x); } } @@ -39,14 +39,14 @@ bool test4(char *x, char *y) { void test5(char *x) { if (x) *x = 42; - if (x) { // BAD + if (x) { // $ Alert // BAD free(x); } } void test6(char *x) { *x = 42; - if (x) { // BAD + if (x) { // $ Alert // BAD free(x); } } @@ -103,7 +103,7 @@ bool test12(char *x) { } void test13(char *x) { - if (x != nullptr) // BAD + if (x != nullptr) // $ Alert // BAD free(x); } diff --git a/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesParameter/DeclarationHidesParameter.qlref b/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesParameter/DeclarationHidesParameter.qlref index c3e02ee7f47d..339ba0c68884 100644 --- a/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesParameter/DeclarationHidesParameter.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesParameter/DeclarationHidesParameter.qlref @@ -1 +1,2 @@ -Best Practices/Hiding/DeclarationHidesParameter.ql +query: Best Practices/Hiding/DeclarationHidesParameter.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesParameter/hiding.cpp b/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesParameter/hiding.cpp index 0b08a0ae612f..f3cb06fb3234 100644 --- a/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesParameter/hiding.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesParameter/hiding.cpp @@ -1,7 +1,7 @@ void f(int ii) { if (1) { - for(int ii = 1; ii < 10; ii++) { // local variable hides parameter of the same name + for(int ii = 1; ii < 10; ii++) { // $ Alert // local variable hides parameter of the same name ; } } @@ -12,7 +12,7 @@ namespace foo { void f2(int ii, int kk) { try { for (ii = 0; ii < 3; ii++) { - int kk; // local variable hides parameter of the same name + int kk; // $ Alert // local variable hides parameter of the same name } } catch (int ee) { @@ -25,7 +25,7 @@ void myFunction(int a, int b, int c); void myFunction(int a, int b, int _c) { { - int a = a; // local variable hides parameter of the same name + int a = a; // $ Alert // local variable hides parameter of the same name int _b = b; int c = _c; @@ -42,7 +42,7 @@ class MyTemplateClass { template void MyTemplateClass :: myMethod(int a, int b, int _c) { { - int a = a; // local variable hides parameter of the same name + int a = a; // $ Alert // local variable hides parameter of the same name int _b = b; int c = _c; @@ -61,7 +61,7 @@ void test() { void testMacro(int i) { MYMACRO; - for (int i = 0; i < 10; i++) {}; // local variable hides parameter of the same name + for (int i = 0; i < 10; i++) {}; // $ Alert // local variable hides parameter of the same name } #include "hiding.h" @@ -75,7 +75,7 @@ void myClass::myMethod(int arg1, T arg2) { { int protoArg1; T protoArg2; - int arg1; // local variable hides parameter of the same name - T arg2; // local variable hides parameter of the same name + int arg1; // $ Alert // local variable hides parameter of the same name + T arg2; // $ Alert // local variable hides parameter of the same name } } diff --git a/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/DeclarationHidesVariable.qlref b/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/DeclarationHidesVariable.qlref index 8f9a1799e066..73e5d81ddce2 100644 --- a/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/DeclarationHidesVariable.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/DeclarationHidesVariable.qlref @@ -1 +1,2 @@ -Best Practices/Hiding/DeclarationHidesVariable.ql +query: Best Practices/Hiding/DeclarationHidesVariable.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/hiding.cpp b/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/hiding.cpp index 3a96933db7d2..4d1a49cd0e92 100644 --- a/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/hiding.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Hiding/DeclarationHidesVariable/hiding.cpp @@ -3,7 +3,7 @@ void f(void) { if (1) { int i; - for(int i = 1; i < 10; i++) { // BAD + for(int i = 1; i < 10; i++) { // $ Alert // BAD ; } } @@ -15,7 +15,7 @@ namespace foo { int k; try { for (i = 0; i < 3; i++) { - int k; // BAD + int k; // $ Alert // BAD } } catch (int e) { @@ -35,7 +35,7 @@ void structuredBinding() { int xs[1] = {1}; auto [x] = xs; { - auto [x] = xs; // BAD + auto [x] = xs; // $ Alert // BAD auto [y] = xs; // GOOD } } diff --git a/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/DeclarationHidesVariable.qlref b/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/DeclarationHidesVariable.qlref index 8f9a1799e066..73e5d81ddce2 100644 --- a/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/DeclarationHidesVariable.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/DeclarationHidesVariable.qlref @@ -1 +1,2 @@ -Best Practices/Hiding/DeclarationHidesVariable.ql +query: Best Practices/Hiding/DeclarationHidesVariable.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/Hiding.c b/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/Hiding.c index f055d2fff89c..5743edde5832 100644 --- a/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/Hiding.c +++ b/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/Hiding.c @@ -12,16 +12,16 @@ void f(void) { if(1) { int k; if(1) { - int i; // BAD (hides local) - int j; // BAD (hides local) - int k; // BAD (hides local) + int i; // $ Alert[cpp/declaration-hides-variable] // BAD (hides local) + int j; // $ Alert[cpp/declaration-hides-variable] // BAD (hides local) + int k; // $ Alert[cpp/declaration-hides-variable] // BAD (hides local) int l; int m; int n; - int gi; // BAD (hides global) - int gj; // BAD (hides global) - int gk; // BAD (hides global) + int gi; // $ Alert[cpp/local-variable-hides-global-variable] // BAD (hides global) + int gj; // $ Alert[cpp/local-variable-hides-global-variable] // BAD (hides global) + int gk; // $ Alert[cpp/local-variable-hides-global-variable] // BAD (hides global) } int l; // GOOD (scopes do not overlap) } @@ -34,7 +34,7 @@ int g1, g2, g3, g4, g5; void function1(int g1); // GOOD (the hiding name isn't associated with a code block) extern void function2(int g2); // GOOD (the hiding name isn't associated with a code block) -void function3(int g3) {}; // BAD +void function3(int g3) {}; // $ Alert[cpp/local-variable-hides-global-variable] // BAD void function4(int g4); // GOOD (the hiding name isn't associated with a code block) -void function4(int g5) {}; // BAD +void function4(int g5) {}; // $ Alert[cpp/local-variable-hides-global-variable] // BAD diff --git a/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/LocalVariableHidesGlobalVariable.qlref b/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/LocalVariableHidesGlobalVariable.qlref index 0267b31251d3..326ddde08d3e 100644 --- a/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/LocalVariableHidesGlobalVariable.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Hiding/LocalVariableHidesGlobalVariable/LocalVariableHidesGlobalVariable.qlref @@ -1 +1,2 @@ -Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql +query: Best Practices/Hiding/LocalVariableHidesGlobalVariable.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/CommaBeforeMisleadingIndentation.qlref b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/CommaBeforeMisleadingIndentation.qlref index 02b5f38e358f..97f91b75c951 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/CommaBeforeMisleadingIndentation.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/CommaBeforeMisleadingIndentation.qlref @@ -1 +1,2 @@ -Best Practices/Likely Errors/CommaBeforeMisleadingIndentation.ql +query: Best Practices/Likely Errors/CommaBeforeMisleadingIndentation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp index dbf792db3383..7d13d1f2274b 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp @@ -46,10 +46,10 @@ int Foo::test(int (*baz)(int)) if (i) (void)i, // BAD - (void)j; + (void)j; // $ Alert if (1) FOO(i), - (void)x.foo(j); // BAD + (void)x.foo(j); // $ Alert // BAD // Parenthesized comma (borderline example): @@ -157,13 +157,13 @@ int Foo::test(int (*baz)(int)) if (i) (void)i, // GOOD if tab >= 4 spaces else BAD -- can't exclude w/o source code text :/ - (void)j; + (void)j; // $ Alert // LHS ends on same line RHS begins on: if (1) foo( i++ - ), j++; // GOOD? [FALSE POSITIVE] + ), j++; // $ Alert // GOOD? [FALSE POSITIVE] if (1) baz( i++ @@ -175,7 +175,7 @@ int Foo::test(int (*baz)(int)) return i++ , i++ // GOOD(?) [FALSE POSITIVE] -- can't exclude w/o source code text :/ ? 1 - : 2; + : 2; // $ Alert int quux = (tata->titi.tutu(), diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/OffsetUseBeforeRangeCheck.qlref b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/OffsetUseBeforeRangeCheck.qlref index d934901f174f..0e9b8f83382e 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/OffsetUseBeforeRangeCheck.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/OffsetUseBeforeRangeCheck.qlref @@ -1 +1,2 @@ -Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql \ No newline at end of file +query: Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp index 0c7baf7b7ffb..b12fd51c5dca 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp @@ -8,11 +8,11 @@ void test(char *buffer, int bufferSize) while ((i < bufferSize) && (buffer[i] == ' ')) { i++; } // GOOD i = 0; - while ((buffer[i] == ' ') && (i < bufferSize)) { i++; } // BAD + while ((buffer[i] == ' ') && (i < bufferSize)) { i++; } // $ Alert // BAD // check for 'x' if ((i < bufferSize) && (buffer[i] == 'x')) {} // GOOD - if ((buffer[i] == 'x') && (i < bufferSize)) {} // BAD + if ((buffer[i] == 'x') && (i < bufferSize)) {} // $ Alert // BAD if ((bufferSize > i) && (buffer[i] == 'x')) {} // GOOD if ((buffer[i] == 'x') && (bufferSize > i)) {} // BAD [NOT DETECTED] @@ -24,7 +24,7 @@ void test(char *buffer, int bufferSize) if ((buffer[i] == 'x') && (bufferSize >= i + 1)) {} // BAD [NOT DETECTED] if ((i < bufferSize) && (true) && (buffer[i] == 'x')) {} // GOOD - if ((buffer[i] == 'x') && (true) && (i < bufferSize)) {} // BAD + if ((buffer[i] == 'x') && (true) && (i < bufferSize)) {} // $ Alert // BAD if ((i < bufferSize - 1) && (buffer[i + 1] == 'x')) {} // GOOD if ((buffer[i + 1] == 'x') && (i < bufferSize - 1)) {} // BAD [NOT DETECTED] @@ -36,15 +36,15 @@ void test(char *buffer, int bufferSize) // look for 'ab' for (i = 0; i < bufferSize; i++) { - if ((buffer[i] == 'a') && (i < bufferSize - 1) && (buffer[i + 1] == 'b')) // GOOD [FALSE POSITIVE] + if ((buffer[i] == 'a') && (i < bufferSize - 1) && (buffer[i + 1] == 'b')) // $ Alert // GOOD [FALSE POSITIVE] break; } if ((i < bufferSize) && (buffer[i])) {} // GOOD - if ((buffer[i]) && (i < bufferSize)) {} // BAD + if ((buffer[i]) && (i < bufferSize)) {} // $ Alert // BAD if ((i < bufferSize) && (buffer[i] + 1 == 'x')) {} // GOOD - if ((buffer[i] + 1 == 'x') && (i < bufferSize)) {} // BAD + if ((buffer[i] + 1 == 'x') && (i < bufferSize)) {} // $ Alert // BAD if ((buffer != 0) && (i < bufferSize)) {} // GOOD } diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/Slicing/Slicing.qlref b/cpp/ql/test/query-tests/Best Practices/Likely Errors/Slicing/Slicing.qlref index 03280a5c23d9..eb0ac9eff2ea 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/Slicing/Slicing.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/Slicing/Slicing.qlref @@ -1 +1,2 @@ -Best Practices/Likely Errors/Slicing.ql +query: Best Practices/Likely Errors/Slicing.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/Slicing/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/Slicing/test.cpp index b46c749e70e8..7b28598afee4 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/Slicing/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/Slicing/test.cpp @@ -10,7 +10,7 @@ struct Point3 : Point2 { void f() { Point2 p2; Point3 p3; - p2 = p3; + p2 = p3; // $ Alert } void g() { diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/ConstructorOrMethodWithExactDate.cpp b/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/ConstructorOrMethodWithExactDate.cpp index 2720aa8f4035..8c11a811cd63 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/ConstructorOrMethodWithExactDate.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/ConstructorOrMethodWithExactDate.cpp @@ -24,20 +24,20 @@ int Main() { // BAD: constructor creating a EraInfo with exact Heisei era start date - EraInfo * pDateTimeUtil = new EraInfo(1989, 1, 8); + EraInfo * pDateTimeUtil = new EraInfo(1989, 1, 8); // $ Alert // BAD: constructor creating a EraInfo with exact Heisei era start date - EraInfo * pDateTimeUtil1 = new EraInfo(1, 2, 1989, 1, 8, L"\u5e73\u6210"); + EraInfo * pDateTimeUtil1 = new EraInfo(1, 2, 1989, 1, 8, L"\u5e73\u6210"); // $ Alert // Good: constructor creating a EraInfo with another date EraInfo * pDateTimeUtil2 = new EraInfo(1, 2, 1900, 1, 1, L"foo"); // BAD: method call passing exact Haisei era start date as parameters - EraInfo * pDateTimeUtil3 = EraInfo::EraInfoFromDate(1, 2, 1989, 1, 8, L"\u5e73\u6210"); + EraInfo * pDateTimeUtil3 = EraInfo::EraInfoFromDate(1, 2, 1989, 1, 8, L"\u5e73\u6210"); // $ Alert // GOOD: method call with the same parameters in a different order (we only track year, month, day) EraInfo * pDateTimeUtil4 = EraInfo::EraInfoFromDate(1, 2, 8, 1, 1989, L"\u5e73\u6210"); // BAD: constructor creating a EraInfo with exact Reiwa era start date - EraInfo * pDateTimeUtil5 = new EraInfo(2019, 5, 1); + EraInfo * pDateTimeUtil5 = new EraInfo(2019, 5, 1); // $ Alert } \ No newline at end of file diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/JapaneseEraDate.qlref b/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/JapaneseEraDate.qlref index 4240387a36ce..652bac2ede77 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/JapaneseEraDate.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/JapaneseEraDate.qlref @@ -1 +1,2 @@ -Best Practices/Magic Constants/JapaneseEraDate.ql +query: Best Practices/Magic Constants/JapaneseEraDate.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/StructWithExactDate.cpp b/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/StructWithExactDate.cpp index 7bbf3397ff91..aca98d531851 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/StructWithExactDate.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/Japanese Era/StructWithExactDate.cpp @@ -28,7 +28,7 @@ int main() { // BAD: Creation of tm stuct corresponding to the beginning of Heisei era tm *timeTm = new tm(); - timeTm->tm_year = 1989; + timeTm->tm_year = 1989; // $ Alert timeTm->tm_mon = 1; timeTm->tm_mday = 8; @@ -43,7 +43,7 @@ int main() SYSTEMTIME st; st.wDay = 8; st.wMonth = 1; - st.wYear = 1989; + st.wYear = 1989; // $ Alert // GOOD: Creation of SYSTEMTIME stuct with a different date @@ -57,7 +57,7 @@ int main() SYSTEMTIME st2; st2.wDay = 1; st2.wMonth = 5; - st2.wYear = 2019; + st2.wYear = 2019; // $ Alert return 0; } diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/MagicConstantsNumbers.qlref b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/MagicConstantsNumbers.qlref index 46d0c7be3af2..2e58ec2fd5f8 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/MagicConstantsNumbers.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/MagicConstantsNumbers.qlref @@ -1 +1,2 @@ -Best Practices/Magic Constants/MagicConstantsNumbers.ql +query: Best Practices/Magic Constants/MagicConstantsNumbers.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/a123.c b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/a123.c index f4d259ee5b95..61fc525f5505 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/a123.c +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/a123.c @@ -2,6 +2,6 @@ static void f(void) { int i; - i = 123; + i = 123; // $ Alert } diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/b123.c b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/b123.c index dc4dfd79f8f7..3551b7898d2d 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/b123.c +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/b123.c @@ -1,5 +1,5 @@ static void f(void) { - char str[123]; + char str[123]; // $ Alert } diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/case.c b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/case.c index 73b67768c95a..ad76feb26155 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/case.c +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/case.c @@ -1,7 +1,7 @@ void f(int i) { switch(i) { - case 123 ... 129: + case 123 ... 129: // $ Alert break; } } diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/constants.h b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/constants.h index 7136026997f2..3026ecf39bf2 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/constants.h +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/constants.h @@ -2,7 +2,7 @@ void FUN(void) { int i, j, k; - i = 123; + i = 123; // $ Alert i = 123; i = 123; i = 123; @@ -57,7 +57,7 @@ void FUN(void) { k = 789; k = 789; - i = 0x0078; + i = 0x0078; // $ Alert i = 0x0078; i = 0x0078; i = 0x0078; @@ -88,7 +88,7 @@ void FUN(void) { i = 0x0078; i = 0x0078; - i = 0x01f8; + i = 0x01f8; // $ Alert i = 0x01f8; i = 0x01f8; i = 0x01f8; @@ -119,7 +119,7 @@ void FUN(void) { i = 0x01f8; i = 0x01f8; - i = 278UL; + i = 278UL; // $ Alert i = 278UL; i = 278UL; i = 278UL; @@ -150,7 +150,7 @@ void FUN(void) { i = 278UL; i = 278UL; - i = -129; + i = -129; // $ Alert i = -129; i = -129; i = -129; diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/functions.h b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/functions.h index 43e7b089389b..db7e962a5e4a 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/functions.h +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/functions.h @@ -1,6 +1,6 @@ int myFunction1(int x = - 102 + 102 + 102 + + 102 + 102 + 102 + // $ Alert 102 + 102 + 102 + 102 + 102 + 102 + 102 + 102 + 102 + @@ -9,7 +9,7 @@ int myFunction1(int x = 102 + 102 + 102); void myFunction2( - int p1 = 103, + int p1 = 103, // $ Alert int p2 = 103, int p3 = 103, int p4 = 103, diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/templates.cpp b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/templates.cpp index be73c87951c1..0ee90dc2460c 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/templates.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsNumbers/templates.cpp @@ -1,7 +1,7 @@ template void f(T x) { - 23; + 23; // $ Alert 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 23; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; 'A'; @@ -10,7 +10,7 @@ void f(T x) { void g(void) { int i; f(i); - 25; + 25; // $ Alert 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 25; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; 'B'; diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/MagicConstantsString.qlref b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/MagicConstantsString.qlref index 9caedcf3cc42..a75d078753d5 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/MagicConstantsString.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/MagicConstantsString.qlref @@ -1 +1,2 @@ -Best Practices/Magic Constants/MagicConstantsString.ql +query: Best Practices/Magic Constants/MagicConstantsString.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/constants.h b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/constants.h index 231fb35a85da..42537352dffd 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/constants.h +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/constants.h @@ -2,7 +2,7 @@ void FUN(void) { const char *s; - s = "abcabcabc"; + s = "abcabcabc"; // $ Alert s = "abcabcabc"; s = "abcabcabc"; s = "abcabcabc"; diff --git a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/joining.cpp b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/joining.cpp index 766de394c494..c5fc46be54f3 100644 --- a/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/joining.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Magic Constants/MagicConstantsString/joining.cpp @@ -36,7 +36,7 @@ void fn(const string &str1); void joining_test(const string &x, const string &y) \ { - fn("testrepo.git"); // BAD: "testrepo.git" + fn("testrepo.git"); // $ Alert // BAD: "testrepo.git" fn("testrepo.git"); fn("testrepo.git"); fn("testrepo.git"); @@ -104,7 +104,7 @@ void joining_test(const string &x, const string &y) \ ostream os; - os << "NO T_VOID CONSTRUCT"; // BAD: "NO T_VOID CONSTRUCT" + os << "NO T_VOID CONSTRUCT"; // $ Alert // BAD: "NO T_VOID CONSTRUCT" os << "NO T_VOID CONSTRUCT"; os << "NO T_VOID CONSTRUCT"; os << "NO T_VOID CONSTRUCT"; @@ -147,7 +147,7 @@ void joining_test(const string &x, const string &y) \ os << "{" << x << "} else {" << y << "}"; os << "{" << x << "} else {" << y << "}"; os << "{" << x << "} else {" << y << "}"; // (21 times) - + os << "writeString(" << x << ")"; // GOOD os << "writeString(" << x << ")"; os << "writeString(" << x << ")"; @@ -170,7 +170,7 @@ void joining_test(const string &x, const string &y) \ os << "writeString(" << x << ")"; os << "writeString(" << x << ")"; // (21 times) - os << "compiler error: no const of base type " + x; // BAD: "compiler error: no const of base type " + os << "compiler error: no const of base type " + x; // $ Alert // BAD: "compiler error: no const of base type " os << "compiler error: no const of base type " + x; os << "compiler error: no const of base type " + x; os << "compiler error: no const of base type " + x; diff --git a/cpp/ql/test/query-tests/Best Practices/RuleOfTwo/RuleOfTwo.cpp b/cpp/ql/test/query-tests/Best Practices/RuleOfTwo/RuleOfTwo.cpp index b28d6c809dab..946d024691b3 100644 --- a/cpp/ql/test/query-tests/Best Practices/RuleOfTwo/RuleOfTwo.cpp +++ b/cpp/ql/test/query-tests/Best Practices/RuleOfTwo/RuleOfTwo.cpp @@ -1,13 +1,13 @@ // NOT OK struct CopyButNoAssign { CopyButNoAssign() : n(0) {} - CopyButNoAssign(const CopyButNoAssign& copy_from) : n(copy_from.n) {} + CopyButNoAssign(const CopyButNoAssign& copy_from) : n(copy_from.n) {} // $ Alert int n; }; // NOT OK struct AssignButNoCopy { - AssignButNoCopy& operator=(const AssignButNoCopy& assign_from) { return *this; } + AssignButNoCopy& operator=(const AssignButNoCopy& assign_from) { return *this; } // $ Alert }; // OK: before C++11, marking a constructor as private was an @@ -78,7 +78,7 @@ struct NotFriend { // friend of CopyableByFriend. struct MyClassFriend { CopyableByFriend x; - MyClassFriend& operator=(const MyClassFriend& that) { return *this; } + MyClassFriend& operator=(const MyClassFriend& that) { return *this; } // $ Alert }; // OK or NOT OK? An explicit default and an explicit implementation. @@ -141,7 +141,7 @@ struct ProtectedAssign { // NOT OK: this class gets a copy assignment operator because it can access the // (protected) copy assignment operator of its base class. struct IsAProtectedAssign: public ProtectedAssign { - IsAProtectedAssign(const IsAProtectedAssign& that) {} + IsAProtectedAssign(const IsAProtectedAssign& that) {} // $ Alert }; // OK: this class gets no copy assignment operator. It cannot access the @@ -164,7 +164,7 @@ struct ProtectedCC { // NOT OK: this class gets a copy constructor because it can access the // (protected) copy constructor of its base class. struct IsAProtectedCC: public ProtectedCC { - IsAProtectedCC& operator=(const IsAProtectedCC& that) { return *this; } + IsAProtectedCC& operator=(const IsAProtectedCC& that) { return *this; } // $ Alert }; // OK: this class gets no copy constructor. It cannot access the (protected) @@ -309,5 +309,5 @@ class R1_B { // is generated by the compiler and callable outside the class. class R1_C { public: - R1_C(const R1_C& c) {} + R1_C(const R1_C& c) {} // $ Alert }; diff --git a/cpp/ql/test/query-tests/Best Practices/RuleOfTwo/RuleOfTwo.qlref b/cpp/ql/test/query-tests/Best Practices/RuleOfTwo/RuleOfTwo.qlref index eb42b255e975..1a88c8671415 100644 --- a/cpp/ql/test/query-tests/Best Practices/RuleOfTwo/RuleOfTwo.qlref +++ b/cpp/ql/test/query-tests/Best Practices/RuleOfTwo/RuleOfTwo.qlref @@ -1 +1,2 @@ -Best Practices/RuleOfTwo.ql +query: Best Practices/RuleOfTwo.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/SloppyGlobal/SloppyGlobal.qlref b/cpp/ql/test/query-tests/Best Practices/SloppyGlobal/SloppyGlobal.qlref index eb57378dea6b..6d979e18a560 100644 --- a/cpp/ql/test/query-tests/Best Practices/SloppyGlobal/SloppyGlobal.qlref +++ b/cpp/ql/test/query-tests/Best Practices/SloppyGlobal/SloppyGlobal.qlref @@ -1 +1,2 @@ -Best Practices/SloppyGlobal.ql +query: Best Practices/SloppyGlobal.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/SloppyGlobal/main.cpp b/cpp/ql/test/query-tests/Best Practices/SloppyGlobal/main.cpp index e279fbf02579..a5afcec29d82 100644 --- a/cpp/ql/test/query-tests/Best Practices/SloppyGlobal/main.cpp +++ b/cpp/ql/test/query-tests/Best Practices/SloppyGlobal/main.cpp @@ -1,19 +1,19 @@ // main.cpp -int x; // BAD: too short -int ys[1000000]; // BAD: too short +int x; // $ Alert // BAD: too short +int ys[1000000]; // $ Alert // BAD: too short int descriptive_name; // GOOD: sufficient static int z; // GOOD: not a global -int v1; // BAD: too short -int v2; // BAD: too short +int v1; // $ Alert // BAD: too short +int v2; // $ Alert // BAD: too short template -T v3; // BAD: too short +T v3; // $ Alert // BAD: too short template -T v4; // BAD: too short +T v4; // $ Alert // BAD: too short template -T v5; // BAD: too short +T v5; // $ Alert // BAD: too short void use_some_fs() { v2 = 100; diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedIncludes/unusedIncludes.cpp b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedIncludes/unusedIncludes.cpp index b4d0012cd920..9dbc86206289 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedIncludes/unusedIncludes.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedIncludes/unusedIncludes.cpp @@ -1,12 +1,12 @@ // unusedIncludes.cpp -#include "a.h" // unused +#include "a.h" // $ Alert // unused #include "b.h" #include "c.h" #include "d.hpp" -#include "e.hpp" // unused -#include "f.fwd.hpp" // unused -#include "g" // unused +#include "e.hpp" // $ Alert // unused +#include "f.fwd.hpp" // $ Alert // unused +#include "g" // $ Alert // unused int val_b = my_func_b(); int *my_c_ptr = &my_var_c; diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedIncludes/unusedIncludes.qlref b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedIncludes/unusedIncludes.qlref index 9759b522cf3a..c268214a8bf6 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedIncludes/unusedIncludes.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedIncludes/unusedIncludes.qlref @@ -1 +1,2 @@ -Best Practices/Unused Entities/UnusedIncludes.ql +query: Best Practices/Unused Entities/UnusedIncludes.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/UnusedLocals.qlref b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/UnusedLocals.qlref index a206090d0f82..645e1ecaebd8 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/UnusedLocals.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/UnusedLocals.qlref @@ -1 +1,2 @@ -Best Practices/Unused Entities/UnusedLocals.ql +query: Best Practices/Unused Entities/UnusedLocals.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code.c b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code.c index 74385634c419..cb401c72dce9 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code.c +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code.c @@ -7,17 +7,17 @@ void f1(unsigned int x) { } void f2(unsigned int x) { - unsigned int y = x + 1; // BAD: 'y' is unused - unsigned int z = x + 2; // BAD: 'z' is unused + unsigned int y = x + 1; // $ Alert // BAD: 'y' is unused + unsigned int z = x + 2; // $ Alert // BAD: 'z' is unused } #define my_int int #define COMPLEX_MACRO do { int z = 3; } while(0) void f3() { - int x = 1; // BAD: 'x' is unused - my_int y = 2; // BAD: 'y' is unused - COMPLEX_MACRO; // GOOD: unused locals declared in macros are considered OK. + int x = 1; // $ Alert // BAD: 'x' is unused + my_int y = 2; // $ Alert // BAD: 'y' is unused + COMPLEX_MACRO; // GOOD: unused locals declared in macros are considered OK. } void write_ptr(int *ptr) { @@ -27,7 +27,7 @@ void write_ptr(int *ptr) { #define ZERO(x) x = 0 int f4() { - int a, b, c, d, e, f, g, h, i, j, k, l, m, n; // BAD: 'n' is unused + int a, b, c, d, e, f, g, h, i, j, k, l, m, n; // $ Alert // BAD: 'n' is unused a = b; c++; @@ -38,20 +38,20 @@ int f4() { write_ptr(&g); h = (i) ? (j) : (k); ZERO(l); - + return m; } void f5() { - int x; // BAD: 'x' is unused - + int x; // $ Alert // BAD: 'x' is unused + { int x; - + { - int x; // BAD: 'x' is unused + int x; // $ Alert // BAD: 'x' is unused } - + x = 12; } } @@ -64,7 +64,7 @@ void f6() { int arr2[10]; int arr3[10]; int arr4[10]; - int arr5[10]; // BAD: 'arr5' is unused + int arr5[10]; // $ Alert // BAD: 'arr5' is unused int *ptr; int x; diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code.cpp b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code.cpp index 3b9904a9a290..7301fec77caa 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code.cpp @@ -14,9 +14,9 @@ class MyClass { MyClass :: MyClass() { - int a, b, c, d, e; // BAD: 'e' is unused + int a, b, c, d, e; // $ Alert // BAD: 'e' is unused int &f = d; - + write_ref(a); val = b + f; throw c; @@ -29,8 +29,8 @@ MyClass :: ~MyClass() void test() { MyClass mc; // GOOD: constructor and destructor may have side-effects - MyClass *mc_ptr; // BAD: 'mc_ptr' is unused - MyClass &mc_ref = mc; // BAD: 'mc_ref' is unused + MyClass *mc_ptr; // $ Alert // BAD: 'mc_ptr' is unused + MyClass &mc_ref = mc; // $ Alert // BAD: 'mc_ref' is unused } // --- @@ -101,7 +101,7 @@ template void *instantiatedTemplateFunction3() // static unused int variable in twice instantiated template function template void *instantiatedTemplateFunction4() { - static int my_static; // BAD + static int my_static; // $ Alert // BAD static void* my_ptr = 0; return my_ptr; } @@ -129,7 +129,7 @@ void *nonTemplateFunction() // This is a non-template version of the above. void *nonTemplateFunction2() { - static int *my_static; // BAD + static int *my_static; // $ Alert // BAD static void* my_ptr = 0; return my_ptr; } @@ -245,7 +245,7 @@ class MyContainingClass void testFunction() { - MyMethodClass mmc; // BAD: unused + MyMethodClass mmc; // $ Alert // BAD: unused MyConstructorClass mcc; // GOOD MyDerivedClass mdc; // GOOD MyContainingClass mcc2; // GOOD diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp index 9a70fe989064..98a77d4d40be 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp @@ -2,15 +2,15 @@ int test_const_init() { - int v1; // BAD: unused + int v1; // $ Alert // BAD: unused int v2; // GOOD - int v3 = 0; // BAD: unused + int v3 = 0; // $ Alert // BAD: unused int v4 = 0; // GOOD const int v5 = 0; // BAD: unused [NOT DETECTED] const int v6 = 0; // GOOD - constexpr int v7 = 0; // BAD: unused + constexpr int v7 = 0; // $ Alert // BAD: unused constexpr int v8 = 0; // GOOD - + return v2 + v4 + v6 + v8; } @@ -23,7 +23,7 @@ void myFunction() void test_template_parameter() { - constexpr int v1 = 0; // BAD: unused + constexpr int v1 = 0; // $ Alert // BAD: unused constexpr int v2 = 0; // GOOD: used as a template parameter below myFunction(); @@ -39,10 +39,10 @@ class MyBuffer void test_unused() { - MyBuffer myVar1; // BAD: unused + MyBuffer myVar1; // $ Alert // BAD: unused MyBuffer myVar2; // GOOD: used in deliberate void cast below MyBuffer myVar3 __attribute((__unused__)); // GOOD: unused but acknowledged - + (void)myVar2; } @@ -61,7 +61,7 @@ void test_expect() { int v1 = getter(); // GOOD: v1 is used int v2 = getter(); // GOOD: v2 is used - int v3 = getter(); // BAD: unused + int v3 = getter(); // $ Alert // BAD: unused if (unlikely(v1 < 0)) { @@ -99,13 +99,13 @@ void output(int value); void test_range_based_for() { MyContainer myContainer; - + for (int v1 : myContainer) // GOOD: v1 is used { output(v1); } - - for (int v2 : myContainer) // BAD: v2 is not used + + for (int v2 : myContainer) // $ Alert // BAD: v2 is not used { } } @@ -125,7 +125,7 @@ int test_lambdas1() int test_lambdas2() { - int a, b; // BAD: b is not used + int a, b; // $ Alert // BAD: b is not used auto myLambda = [=]() -> int // BAD: myLambda is not used [NOT DETECTED] (due to containing a Constructor) { return a; diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/errors.c b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/errors.c index 5b62ac7500dc..4c3ad88e6d04 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/errors.c +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/errors.c @@ -7,7 +7,7 @@ void f_error(void) { } void g_error(void) { - int x, y, z; + int x, y, z; // $ Alert // This one should be reported despite the error in another function. z = y + y; } diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/UnusedStaticFunctions.qlref b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/UnusedStaticFunctions.qlref index dbf4c4e9172c..4865dfd4d434 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/UnusedStaticFunctions.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/UnusedStaticFunctions.qlref @@ -1 +1,2 @@ -Best Practices/Unused Entities/UnusedStaticFunctions.ql +query: Best Practices/Unused Entities/UnusedStaticFunctions.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_functions.c b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_functions.c index e3c2bc809e43..d9290b80d930 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_functions.c +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_functions.c @@ -13,15 +13,15 @@ static void used_function2(void) { printf("Gets run 2\n"); } -static void unused_function(void) { +static void unused_function(void) { // $ Alert printf("Doesn't get run\n"); } -static void unused_function2(void) { +static void unused_function2(void) { // $ Alert printf("Doesn't get run 2\n"); } -static void unused_function3(void) { +static void unused_function3(void) { // $ Alert printf("Doesn't get run 3\n"); unused_function2(); } @@ -60,5 +60,5 @@ static void __attribute__ ((used)) h1(void) { static void __attribute__ ((unused)) h3(void) { } -static void h4(void) { +static void h4(void) { // $ Alert } diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_mut.c b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_mut.c index 7ce51610eefd..3d824228dbd1 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_mut.c +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_mut.c @@ -2,11 +2,11 @@ static void mut_unused_function(void); static void mut_unused_function2(void); -static void mut_unused_function(void) { +static void mut_unused_function(void) { // $ Alert mut_unused_function2(); } -static void mut_unused_function2(void) { +static void mut_unused_function2(void) { // $ Alert mut_unused_function(); } diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_static_functions.cpp b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_static_functions.cpp index c0d83b52a578..0c36cf719e4c 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_static_functions.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/unused_static_functions.cpp @@ -16,7 +16,7 @@ const funstr myClass::fs[] = { }; // f2 is unreachable -static void f2(void) { } +static void f2(void) { } // $ Alert // f3 is reachable via f4/pf3 static void f3(void) { } @@ -30,8 +30,8 @@ void f4(void) { // f5 and f6 are mutually recursive unreachable static functions static void f6(void); -static void f5(void) { f6(); } -static void f6(void) { f5(); } +static void f5(void) { f6(); } // $ Alert +static void f6(void) { f5(); } // $ Alert // f7 and f8 are reachable from `function_caller` static int f7() { return 1; } // GOOD diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/used_by_var_ref.c b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/used_by_var_ref.c index dc8c10095456..d87a4068f766 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/used_by_var_ref.c +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/used_by_var_ref.c @@ -5,9 +5,9 @@ typedef struct _num_fun { } num_fun; static void f(void) {} // Used, via n1 -static void g(void) {} // Not used (n2 is static) +static void g(void) {} // $ Alert // Not used (n2 is static) static void h(void) {} // Used, via n3, via j -static void i(void) {} // Not used (k is static) +static void i(void) {} // $ Alert // Not used (k is static) num_fun n1 = {1, f}; static num_fun n2 = {1, g}; @@ -17,8 +17,7 @@ void j(void) { // Used (not static) num_fun n = n3; } -static void k(void) { // Not used (static) +static void k(void) { // $ Alert // Not used (static) num_fun n = {1, i}; n1.fun = i; } - diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/UnusedStaticVariables.qlref b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/UnusedStaticVariables.qlref index 1b03ed4104bd..1240fc64dc56 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/UnusedStaticVariables.qlref +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/UnusedStaticVariables.qlref @@ -1 +1,2 @@ -Best Practices/Unused Entities/UnusedStaticVariables.ql +query: Best Practices/Unused Entities/UnusedStaticVariables.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp index 2a5eeef6f0f6..c8d9eb222f8d 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp @@ -4,12 +4,12 @@ static int staticVar1; // GOOD (used) static int staticVar2; // GOOD (used) static int staticVar3 = 3; // GOOD (used) static int staticVar4 = staticVar3; // GOOD (used) -static int staticVar5; // BAD (unused) -static int staticVar6 = 6; // BAD (unused) +static int staticVar5; // $ Alert // BAD (unused) +static int staticVar6 = 6; // $ Alert // BAD (unused) static __attribute__((__unused__)) int staticVar7; // GOOD (unused but this is expected) -const int constVar8 = 8; // BAD (const defaults to static) +const int constVar8 = 8; // $ Alert // BAD (const defaults to static) extern const int constVar9 = 9; // GOOD -static int staticVar10 = 10; // GOOD [FALSE POSITIVE] (referenced in a never instantiated template) +static int staticVar10 = 10; // $ Alert // GOOD [FALSE POSITIVE] (referenced in a never instantiated template) void f() { diff --git a/cpp/ql/test/query-tests/Critical/DeadCodeFunction/DeadCodeFunction.qlref b/cpp/ql/test/query-tests/Critical/DeadCodeFunction/DeadCodeFunction.qlref index d15cbbfecd33..20ad76f506df 100644 --- a/cpp/ql/test/query-tests/Critical/DeadCodeFunction/DeadCodeFunction.qlref +++ b/cpp/ql/test/query-tests/Critical/DeadCodeFunction/DeadCodeFunction.qlref @@ -1 +1,2 @@ -Critical/DeadCodeFunction.ql +query: Critical/DeadCodeFunction.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/DeadCodeFunction/test.cpp b/cpp/ql/test/query-tests/Critical/DeadCodeFunction/test.cpp index 8654b6facd64..e828c24fb8b0 100644 --- a/cpp/ql/test/query-tests/Critical/DeadCodeFunction/test.cpp +++ b/cpp/ql/test/query-tests/Critical/DeadCodeFunction/test.cpp @@ -2,7 +2,7 @@ static void usedByUnused() { } -static void unused() { +static void unused() { // $ Alert usedByUnused(); } diff --git a/cpp/ql/test/query-tests/Critical/DeadCodeGoto/DeadCodeGoto.qlref b/cpp/ql/test/query-tests/Critical/DeadCodeGoto/DeadCodeGoto.qlref index 0786047da5f4..b76abda209d2 100644 --- a/cpp/ql/test/query-tests/Critical/DeadCodeGoto/DeadCodeGoto.qlref +++ b/cpp/ql/test/query-tests/Critical/DeadCodeGoto/DeadCodeGoto.qlref @@ -1 +1,2 @@ -Critical/DeadCodeGoto.ql +query: Critical/DeadCodeGoto.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/DeadCodeGoto/test.cpp b/cpp/ql/test/query-tests/Critical/DeadCodeGoto/test.cpp index 12bef76a1e8a..964145b76f60 100644 --- a/cpp/ql/test/query-tests/Critical/DeadCodeGoto/test.cpp +++ b/cpp/ql/test/query-tests/Critical/DeadCodeGoto/test.cpp @@ -1,12 +1,12 @@ int test1(int x) { - goto label; // BAD + goto label; // $ Alert // BAD x++; label: return x; } int test2(int x) { do { - break; // BAD + break; // $ Alert // BAD x++; } while(false); return x; @@ -34,7 +34,7 @@ int test5(int x, int y) { goto label; // GOOD break; case 2: - break; // BAD + break; // $ Alert // BAD return x; case 3: return x; diff --git a/cpp/ql/test/query-tests/Critical/FileClosed/FileMayNotBeClosed.qlref b/cpp/ql/test/query-tests/Critical/FileClosed/FileMayNotBeClosed.qlref index 0f09c329e844..8d189be099bf 100644 --- a/cpp/ql/test/query-tests/Critical/FileClosed/FileMayNotBeClosed.qlref +++ b/cpp/ql/test/query-tests/Critical/FileClosed/FileMayNotBeClosed.qlref @@ -1 +1,2 @@ -Critical/FileMayNotBeClosed.ql +query: Critical/FileMayNotBeClosed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/FileClosed/FileNeverClosed.qlref b/cpp/ql/test/query-tests/Critical/FileClosed/FileNeverClosed.qlref index 825ac26f500c..25b57b1736d7 100644 --- a/cpp/ql/test/query-tests/Critical/FileClosed/FileNeverClosed.qlref +++ b/cpp/ql/test/query-tests/Critical/FileClosed/FileNeverClosed.qlref @@ -1 +1,2 @@ -Critical/FileNeverClosed.ql +query: Critical/FileNeverClosed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/FileClosed/file.c b/cpp/ql/test/query-tests/Critical/FileClosed/file.c index 3d4bd39b1dce..a36c1321c457 100644 --- a/cpp/ql/test/query-tests/Critical/FileClosed/file.c +++ b/cpp/ql/test/query-tests/Critical/FileClosed/file.c @@ -5,7 +5,7 @@ int fclose(FILE *fp); #define NULL ((FILE *)0) void f1(int i) { - FILE *f = fopen("somefile.txt", "r"); + FILE *f = fopen("somefile.txt", "r"); // $ Alert[cpp/file-may-not-be-closed] if (!f) return; @@ -15,7 +15,7 @@ void f1(int i) { } FILE *f2(int i) { - FILE *f = fopen("somefile.txt", "r"); + FILE *f = fopen("somefile.txt", "r"); // $ Alert[cpp/file-may-not-be-closed] if (!f) return NULL; @@ -31,7 +31,7 @@ void g2(int i) { } void f3(int i) { - FILE *f = fopen("somefile.txt", "r"); // Never closed + FILE *f = fopen("somefile.txt", "r"); // $ Alert[cpp/file-never-closed] // Never closed if (!f) return; @@ -63,7 +63,7 @@ void g5(void) { int f6(int b) { FILE *f; - f = fopen("somefile.txt", "r"); // Not always closed + f = fopen("somefile.txt", "r"); // $ Alert[cpp/file-may-not-be-closed] // Not always closed if (f) { if (b) { @@ -95,4 +95,3 @@ int f8(void) { return 0; } - diff --git a/cpp/ql/test/query-tests/Critical/GlobalUseBeforeInit/GlobalUseBeforeInit.qlref b/cpp/ql/test/query-tests/Critical/GlobalUseBeforeInit/GlobalUseBeforeInit.qlref index a186cc827ec5..7d2be720b2a7 100644 --- a/cpp/ql/test/query-tests/Critical/GlobalUseBeforeInit/GlobalUseBeforeInit.qlref +++ b/cpp/ql/test/query-tests/Critical/GlobalUseBeforeInit/GlobalUseBeforeInit.qlref @@ -1 +1,2 @@ -Critical/GlobalUseBeforeInit.ql +query: Critical/GlobalUseBeforeInit.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/GlobalUseBeforeInit/test.cpp b/cpp/ql/test/query-tests/Critical/GlobalUseBeforeInit/test.cpp index 81883a1a8a16..0a3ceabaef8f 100644 --- a/cpp/ql/test/query-tests/Critical/GlobalUseBeforeInit/test.cpp +++ b/cpp/ql/test/query-tests/Critical/GlobalUseBeforeInit/test.cpp @@ -25,7 +25,7 @@ int my_printf(const char * fmt, ...) return ret; } -int f1() +int f1() // $ Alert { my_printf("%d\n", a + 2); my_printf("%d\n", b + 2); // BAD @@ -36,7 +36,7 @@ void f2() { my_printf("%d\n", b); // GOOD } -int main() +int main() // $ Alert { unsigned size = sizeof(*c); // GOOD my_printf("%d\n", b); // BAD diff --git a/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.qlref b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.qlref index 7012169e8945..611d7f42e828 100644 --- a/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.qlref +++ b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/InitialisationNotRun.qlref @@ -1 +1,2 @@ -Critical/InitialisationNotRun.ql +query: Critical/InitialisationNotRun.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/InitialisationNotRun/test.cpp b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/test.cpp index ee0d070df088..afbcb8f2c75e 100644 --- a/cpp/ql/test/query-tests/Critical/InitialisationNotRun/test.cpp +++ b/cpp/ql/test/query-tests/Critical/InitialisationNotRun/test.cpp @@ -9,9 +9,9 @@ class GlobalStorage { char name[1000]; }; -GlobalStorage *g1; // BAD +GlobalStorage *g1; // $ Alert // BAD static GlobalStorage g2; // GOOD -static GlobalStorage *g3; // BAD +static GlobalStorage *g3; // $ Alert // BAD // static variables are initialized by compilers static int a; // GOOD static int b = 0; // GOOD diff --git a/cpp/ql/test/query-tests/Critical/LargeParameter/LargeParameter.qlref b/cpp/ql/test/query-tests/Critical/LargeParameter/LargeParameter.qlref index 6ddcc7785549..379794ff5e73 100644 --- a/cpp/ql/test/query-tests/Critical/LargeParameter/LargeParameter.qlref +++ b/cpp/ql/test/query-tests/Critical/LargeParameter/LargeParameter.qlref @@ -1 +1,2 @@ -Critical/LargeParameter.ql +query: Critical/LargeParameter.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/LargeParameter/test.cpp b/cpp/ql/test/query-tests/Critical/LargeParameter/test.cpp index bf6d3d414fc4..f87a937d2052 100644 --- a/cpp/ql/test/query-tests/Critical/LargeParameter/test.cpp +++ b/cpp/ql/test/query-tests/Critical/LargeParameter/test.cpp @@ -13,7 +13,7 @@ class myTemplateClass public: myTemplateClass() {} - void set(T _t) { // BAD: T can be myLargeStruct, which is large + void set(T _t) { // $ Alert // BAD: T can be myLargeStruct, which is large t = _t; } @@ -21,11 +21,11 @@ class myTemplateClass }; template -void myTemplateFunction(myTemplateClass mtc_t) // BAD: T can be myLargeStruct, which is large +void myTemplateFunction(myTemplateClass mtc_t) // $ Alert // BAD: T can be myLargeStruct, which is large { } -void myFunction1(mySmallStruct a, myLargeStruct b) // BAD: b is large +void myFunction1(mySmallStruct a, myLargeStruct b) // $ Alert // BAD: b is large { myTemplateClass mtc_a; myTemplateClass mtc_b; @@ -86,7 +86,7 @@ void myFunction4( { MyLargeClass *mlc_ptr; int *i_ptr; - + a.value++; b.value = 1; c.data[0] += 1; @@ -101,18 +101,18 @@ void myFunction4( } void myFunction5( - MyLargeClass a, // BAD - MyLargeClass b, // BAD - MyLargeClass c, // BAD - MyLargeClass d, // BAD - MyLargeClass e, // BAD - MyLargeClass f // BAD + MyLargeClass a, // $ Alert // BAD + MyLargeClass b, // $ Alert // BAD + MyLargeClass c, // $ Alert // BAD + MyLargeClass d, // $ Alert // BAD + MyLargeClass e, // $ Alert // BAD + MyLargeClass f // $ Alert // BAD ) { const MyLargeClass *mlc_ptr; const int *i_ptr; int i; - + i = a.value; i += b.data[0]; c.myConstMethod(); @@ -158,7 +158,7 @@ struct big void myFunction7( big a, // GOOD - big b // BAD + big b // $ Alert // BAD ) { a.xs[0]++; // modifies a diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/DoubleFree.qlref b/cpp/ql/test/query-tests/Critical/MemoryFreed/DoubleFree.qlref index 8e68f14ce223..eab98ddcb530 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/DoubleFree.qlref +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/DoubleFree.qlref @@ -1 +1,2 @@ -Critical/DoubleFree.ql +query: Critical/DoubleFree.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryMayNotBeFreed.qlref b/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryMayNotBeFreed.qlref index 33da8e296e22..84fd18014db0 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryMayNotBeFreed.qlref +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryMayNotBeFreed.qlref @@ -1 +1,2 @@ -Critical/MemoryMayNotBeFreed.ql \ No newline at end of file +query: Critical/MemoryMayNotBeFreed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryNeverFreed.qlref b/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryNeverFreed.qlref index 2d1336a55ebf..108a872987d7 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryNeverFreed.qlref +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryNeverFreed.qlref @@ -1 +1,2 @@ -Critical/MemoryNeverFreed.ql \ No newline at end of file +query: Critical/MemoryNeverFreed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/UseAfterFree.qlref b/cpp/ql/test/query-tests/Critical/MemoryFreed/UseAfterFree.qlref index e299a3055e04..096090964894 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/UseAfterFree.qlref +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/UseAfterFree.qlref @@ -1 +1,2 @@ -Critical/UseAfterFree.ql \ No newline at end of file +query: Critical/UseAfterFree.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp index e7c00bdf0048..50a4f950e861 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp @@ -52,9 +52,9 @@ template class AutoContainer2 { public: - AutoContainer2() : v(new T) // GOOD [FALSE POSITIVE] + AutoContainer2() : v(new T) // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] { - ns::my_auto_ptr ap(new T); // GOOD [FALSE POSITIVE] + ns::my_auto_ptr ap(new T); // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] } ns::my_auto_ptr v; @@ -68,7 +68,7 @@ class AutoCloner AutoCloner(AutoCloner &from) : val(from.val) {}; ns::my_auto_ptr clone() { - return ns::my_auto_ptr(new AutoCloner(*this)); // GOOD [FALSE POSITIVE] + return ns::my_auto_ptr(new AutoCloner(*this)); // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] } private: @@ -77,9 +77,9 @@ class AutoCloner int main() { - int *i1 = new int; // BAD: never deleted - int *i2 = id(new int); // BAD: never deleted - ignore(new int); // BAD: never deleted + int *i1 = new int; // $ Alert[cpp/memory-never-freed] // BAD: never deleted + int *i2 = id(new int); // $ Alert[cpp/memory-never-freed] // BAD: never deleted + ignore(new int); // $ Alert[cpp/memory-never-freed] // BAD: never deleted ns::my_auto_ptr a1(new char); // GOOD ns::my_auto_ptr a2(new short); // GOOD diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp index 7f3afc95550c..b46cc6b54a4b 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp @@ -23,7 +23,7 @@ myClass1 :: myClass1() array1 = (int *)malloc(sizeof(int) * 100); array2 = (int *)malloc(sizeof(int) * 100); array3 = (int *)malloc(sizeof(int) * 100); - array4 = (int *)malloc(sizeof(int) * 100); // never freed + array4 = (int *)malloc(sizeof(int) * 100); // $ Alert[cpp/memory-never-freed] // never freed free(array1); } @@ -39,7 +39,7 @@ void myClass1 :: method1() array5 = (int *)malloc(sizeof(int) * 100); array6 = (int *)malloc(sizeof(int) * 100); array7 = (int *)malloc(sizeof(int) * 100); - array8 = (int *)malloc(sizeof(int) * 100); // never freed + array8 = (int *)malloc(sizeof(int) * 100); // $ Alert[cpp/memory-never-freed] // never freed free(array3); free(array5); @@ -70,7 +70,7 @@ myClass2 :: myClass2() array1 = (int *)malloc(sizeof(int) * 100); array2 = (int *)malloc(sizeof(int) * 100); array3 = (int *)malloc(sizeof(int) * 100); - array4 = (int *)malloc(sizeof(int) * 100); // never freed + array4 = (int *)malloc(sizeof(int) * 100); // $ Alert[cpp/memory-never-freed] // never freed free(array1); } @@ -86,7 +86,7 @@ void myClass2 :: method1() array5 = (int *)malloc(sizeof(int) * 100); array6 = (int *)malloc(sizeof(int) * 100); array7 = (int *)malloc(sizeof(int) * 100); - array8 = (int *)malloc(sizeof(int) * 100); // never freed + array8 = (int *)malloc(sizeof(int) * 100); // $ Alert[cpp/memory-never-freed] // never freed free(array3); free(array5); @@ -153,8 +153,8 @@ int overloadedNew() { new(buf) int[1]; // GOOD *(int*)buf = 4; - new(std::nothrow) int(3); // BAD - new(std::nothrow) int[2]; // BAD + new(std::nothrow) int(3); // $ Alert[cpp/memory-never-freed] // BAD + new(std::nothrow) int[2]; // $ Alert[cpp/memory-never-freed] // BAD return 0; } @@ -166,7 +166,7 @@ void output_msg(const char *msg); void test_strdup() { char msg[] = "OctoCat"; - char *cpy = strdup(msg); // BAD + char *cpy = strdup(msg); // $ Alert[cpp/memory-never-freed] // BAD output_msg(cpy); } @@ -210,14 +210,14 @@ void test_reassignment() { char *a = (char *)malloc(128); char *b = (char *)malloc(128); - free(a); - a[0] = 0; // BAD + free(a); // $ Source[cpp/use-after-free] + a[0] = 0; // $ Alert[cpp/use-after-free] // BAD a = b; a[0] = 0; // GOOD - free(a); - a[0] = 0; // BAD + free(a); // $ Source[cpp/use-after-free] + a[0] = 0; // $ Alert[cpp/use-after-free] // BAD DataPair p; p.data1 = new char[128]; @@ -225,8 +225,8 @@ void test_reassignment() { p.data1[0] = 0; // GOOD p.data2[0] = 0; // GOOD - delete [] p.data1; - p.data1[0] = 0; // BAD + delete [] p.data1; // $ Source[cpp/use-after-free] + p.data1[0] = 0; // $ Alert[cpp/use-after-free] // BAD p.data2[0] = 0; // GOOD p.data1 = new char[128]; diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp index 0a6532015a76..8eec079f0ef3 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp @@ -8,10 +8,10 @@ int asprintf(char ** strp, const char * fmt, ...); void* test_double_free1(int *a) { - free(a); // GOOD - a[5] = 5; // BAD - *a = 5; // BAD - free(a); // BAD + free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] // GOOD + a[5] = 5; // $ Alert[cpp/use-after-free] // BAD + *a = 5; // $ Alert[cpp/use-after-free] // BAD + free(a); // $ Alert[cpp/double-free] // BAD a = (int*) malloc(8); free(a); // GOOD a = (int*) malloc(8); @@ -27,28 +27,28 @@ void test_double_free_aliasing(void *a, void* b) { } void test_dominance1(void *a) { - free(a); - if (condition()) free(a); // BAD + free(a); // $ Source[cpp/double-free] + if (condition()) free(a); // $ Alert[cpp/double-free] // BAD } void test_dominance2(void *a) { - free(a); - if (condition()) a = malloc(10); - if (condition()) free(a); // BAD + free(a); // $ Source[cpp/double-free] + if (condition()) a = malloc(10); // $ Alert[cpp/memory-may-not-be-freed] + if (condition()) free(a); // $ Alert[cpp/double-free] // BAD } void test_post_dominance1(int *a) { - if (condition()) free(a); + if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] if (condition()) a[2] = 5; // BAD [NOT DETECTED] - if (condition()) free(a); // BAD [NOT DETECTED] - a[2] = 5; // BAD - free(a); // BAD + if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] // BAD [NOT DETECTED] + a[2] = 5; // $ Alert[cpp/use-after-free] // BAD + free(a); // $ Alert[cpp/double-free] // BAD } void test_post_dominance2(void *a) { - if (condition()) free(a); - free(a); // BAD + if (condition()) free(a); // $ Source[cpp/double-free] + free(a); // $ Alert[cpp/double-free] // BAD } void test_post_dominance3(void *a) { @@ -66,10 +66,10 @@ void test_use_after_free6(int *a, int *b) { void test_use_after_free7(int *a) { a[0] = 42; - free(a); + free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] - if (a[3]) { // BAD - free(a); // BAD + if (a[3]) { // $ Alert[cpp/use-after-free] // BAD + free(a); // $ Alert[cpp/double-free] // BAD } } @@ -80,27 +80,27 @@ class A { void test_new1() { A *a = new A(); - delete(a); - a->f(); // BAD - delete(a); // BAD + delete(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] + a->f(); // $ Alert[cpp/use-after-free] // BAD + delete(a); // $ Alert[cpp/double-free] // BAD } void test_dereference1(A *a) { a->f(); // GOOD - free(a); - a->f(); // BAD + free(a); // $ Source[cpp/use-after-free] + a->f(); // $ Alert[cpp/use-after-free] // BAD } void* use_after_free(void *a) { - free(a); - use(a); // BAD + free(a); // $ Source[cpp/use-after-free] + use(a); // $ Alert[cpp/use-after-free] // BAD return a; // BAD } void test_realloc1(void *a) { - free(a); - void *b = realloc(a, sizeof(a)*3); // BAD [NOT DETECTED by cpp/double-free] - free(a); // BAD + free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] + void *b = realloc(a, sizeof(a)*3); // $ Alert[cpp/use-after-free] // BAD [NOT DETECTED by cpp/double-free] + free(a); // $ Alert[cpp/double-free] // BAD free(b); // GOOD } void* test_realloc2(char *a) { @@ -125,8 +125,8 @@ void test_realloc3(void *a) { void test_ptr_deref(void ** a) { free(*a); *a = malloc(10); - free(*a); // GOOD - free(*a); // BAD + free(*a); // $ Source[cpp/double-free] // GOOD + free(*a); // $ Alert[cpp/double-free] // BAD *a = malloc(10); free(a[0]); // GOOD free(a[1]); // GOOD @@ -149,9 +149,9 @@ void test_loop1(struct list ** list_ptr) { } void test_use_after_free8(struct list * a) { - if (condition()) free(a); - a->data = malloc(10); // BAD - free(a); // BAD + if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] + a->data = malloc(10); // $ Alert[cpp/use-after-free] // BAD + free(a); // $ Alert[cpp/double-free] // BAD } void test_loop2(char ** a) { @@ -164,7 +164,7 @@ void test_loop2(char ** a) { void* test_realloc4() { void *a = 0; - void *b = realloc(a, 10); // BAD for cpp/memory-never-freed + void *b = realloc(a, 10); // $ Alert[cpp/memory-never-freed] // BAD for cpp/memory-never-freed if (!b) { return a; } return b; } @@ -204,9 +204,9 @@ char* test_return2(char *a) { void test_condition1(char *a) { free(a); if (asprintf(&a, "Hello world") || condition()); - free(a); //GOOD + free(a); // $ Source[cpp/double-free] //GOOD if (condition() || asprintf(&a, "Hello world")); - free(a); // BAD + free(a); // $ Alert[cpp/double-free] // BAD } void test_condition2(char *a) { @@ -230,27 +230,27 @@ void test_ms_free(void * memory_descriptor_list) { void test_loop3(char ** a, char ** b) { if (*a) { - free(*a); + free(*a); // $ Source[cpp/use-after-free] a++; } - use(*a); // GOOD [FALSE POSITIVE] + use(*a); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] for (;*b; b++) { - free(*b); + free(*b); // $ Source[cpp/use-after-free] } - use(*b); // GOOD [FALSE POSITIVE] + use(*b); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] } void test_deref(char **a) { - free(*a); - use(*a); // GOOD [FALSE POSITIVE] + free(*a); // $ Source[cpp/use-after-free] + use(*a); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] } // Refs void test_ref(char *&p) { free(p); - p = (char *)malloc(sizeof(char)*10); + p = (char *)malloc(sizeof(char)*10); // $ Alert[cpp/memory-never-freed] use(p); // GOOD free(p); // GOOD } @@ -258,13 +258,13 @@ void test_ref(char *&p) { void test_ref_delete(int *&p) { delete p; - p = new int; + p = new int; // $ Alert[cpp/memory-never-freed] use(p); // GOOD delete p; // GOOD } void test_free_assign() { - void *a = malloc(10); + void *a = malloc(10); // $ Alert[cpp/memory-may-not-be-freed] void *b; free(b = a); // GOOD } @@ -274,13 +274,13 @@ struct MyStruct { }; void test_free_struct(MyStruct* s) { - free(s->buf); - char c = s->buf[0]; // BAD + free(s->buf); // $ Source[cpp/use-after-free] + char c = s->buf[0]; // $ Alert[cpp/use-after-free] // BAD } void test_free_struct2(MyStruct s) { - free(s.buf); - char c = s.buf[0]; // BAD + free(s.buf); // $ Source[cpp/use-after-free] + char c = s.buf[0]; // $ Alert[cpp/use-after-free] // BAD } void test_free_struct3(MyStruct s) { @@ -290,16 +290,16 @@ void test_free_struct3(MyStruct s) { } void test_free_struct4(char* buf, MyStruct s) { - free(buf); + free(buf); // $ Source[cpp/use-after-free] s.buf = buf; - char c = s.buf[0]; // BAD + char c = s.buf[0]; // $ Alert[cpp/use-after-free] // BAD } void g_free (void*); void test_g_free(char* buf) { - g_free(buf); - g_free(buf); // BAD + g_free(buf); // $ Source[cpp/double-free] + g_free(buf); // $ Alert[cpp/double-free] // BAD } // inspired by real world FPs @@ -310,26 +310,26 @@ void test_goto() { *a = 1; // GOOD if (condition()) { - delete a; + delete a; // $ Source[cpp/use-after-free] goto after; } *a = 1; // GOOD if (condition()) { - delete a; + delete a; // $ Source[cpp/double-free] Source[cpp/use-after-free] } - *a = 1; // BAD (use after free) - delete a; // BAD (double free) + *a = 1; // $ Alert[cpp/use-after-free] // BAD (use after free) + delete a; // $ Alert[cpp/double-free] Source[cpp/use-after-free] // BAD (double free) after: - *a = 1; // BAD (use after free) + *a = 1; // $ Alert[cpp/use-after-free] // BAD (use after free) } void test_reassign() { int *a = (int *)malloc(sizeof(int)); *a = 1; // GOOD - delete a; - *a = 1; // BAD (use after free) + delete a; // $ Source[cpp/use-after-free] + *a = 1; // $ Alert[cpp/use-after-free] // BAD (use after free) a = (int *)malloc(sizeof(int)); *a = 1; // GOOD delete a; @@ -362,10 +362,10 @@ void test(E* e) { void test_return_by_parameter(int **out_i, MyStruct **out_ms) { int *a = (int *)malloc(sizeof(int)); // GOOD (freed) int *b = (int *)malloc(sizeof(int)); // GOOD (out parameter) - int *d = (int *)malloc(sizeof(int)); // BAD (not freed) + int *d = (int *)malloc(sizeof(int)); // $ Alert[cpp/memory-never-freed] // BAD (not freed) MyStruct *e = (MyStruct *)malloc(sizeof(MyStruct)); // GOOD (freed) MyStruct *f = (MyStruct *)malloc(sizeof(MyStruct)); // GOOD (out parameter) - MyStruct *h = (MyStruct *)malloc(sizeof(MyStruct)); // BAD (not freed) + MyStruct *h = (MyStruct *)malloc(sizeof(MyStruct)); // $ Alert[cpp/memory-never-freed] // BAD (not freed) free(a); *out_i = b; diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/IncorrectCheckScanf.qlref b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/IncorrectCheckScanf.qlref index b166b6b60b9c..39a4f630f4ca 100644 --- a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/IncorrectCheckScanf.qlref +++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/IncorrectCheckScanf.qlref @@ -1 +1,2 @@ -Critical/IncorrectCheckScanf.ql \ No newline at end of file +query: Critical/IncorrectCheckScanf.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.qlref b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.qlref index 97e85b5abbea..7d6dbd18683f 100644 --- a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.qlref +++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.qlref @@ -1 +1,2 @@ -Critical/MissingCheckScanf.ql \ No newline at end of file +query: Critical/MissingCheckScanf.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp index 346cf607977b..abbce0e932db 100644 --- a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp +++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp @@ -31,8 +31,8 @@ int main() { int i; - scanf("%d", &i); - use(i); // BAD: may not have written `i` + scanf("%d", &i); // $ Source[cpp/missing-check-scanf] + use(i); // $ Alert[cpp/missing-check-scanf] // BAD: may not have written `i` } { @@ -64,8 +64,8 @@ int main() { int i; // Reused variable - scanf("%d", &i); - use(i); // BAD + scanf("%d", &i); // $ Source[cpp/missing-check-scanf] + use(i); // $ Alert[cpp/missing-check-scanf] // BAD if (scanf("%d", &i) == 1) { @@ -76,8 +76,8 @@ int main() { int i; // Reset variable - scanf("%d", &i); - use(i); // BAD + scanf("%d", &i); // $ Source[cpp/missing-check-scanf] + use(i); // $ Alert[cpp/missing-check-scanf] // BAD i = 1; use(i); // GOOD @@ -86,16 +86,16 @@ int main() { int *i = (int*)malloc(sizeof(int)); // Allocated variable - scanf("%d", i); - use(*i); // BAD + scanf("%d", i); // $ Source[cpp/missing-check-scanf] + use(*i); // $ Alert[cpp/missing-check-scanf] // BAD free(i); // GOOD } { int *i = new int; // Allocated variable - scanf("%d", i); - use(*i); // BAD + scanf("%d", i); // $ Source[cpp/missing-check-scanf] + use(*i); // $ Alert[cpp/missing-check-scanf] // BAD delete i; // GOOD } @@ -104,15 +104,15 @@ int main() { int i; - fscanf(get_a_stream(), "%d", &i); - use(i); // BAD: may not have written `i` + fscanf(get_a_stream(), "%d", &i); // $ Source[cpp/missing-check-scanf] + use(i); // $ Alert[cpp/missing-check-scanf] // BAD: may not have written `i` } { int i; - sscanf(get_a_string(), "%d", &i); - use(i); // BAD: may not have written `i` + sscanf(get_a_string(), "%d", &i); // $ Source[cpp/missing-check-scanf] + use(i); // $ Alert[cpp/missing-check-scanf] // BAD: may not have written `i` } { @@ -159,7 +159,7 @@ int main() { int i; - if (scanf("%d", &i) != 0) + if (scanf("%d", &i) != 0) // $ Alert[cpp/incorrectly-checked-scanf] { use(i); // BAD: scanf can return EOF } @@ -168,7 +168,7 @@ int main() { int i; - if (scanf("%d", &i) == 0) + if (scanf("%d", &i) == 0) // $ Alert[cpp/incorrectly-checked-scanf] { use(i); // BAD: checks return value incorrectly } @@ -190,7 +190,7 @@ int main() bool b; int i; - b = scanf("%d", &i); + b = scanf("%d", &i); // $ Alert[cpp/incorrectly-checked-scanf] if (b >= 1) { @@ -201,7 +201,7 @@ int main() { int i; - if (scanf("%d", &i)) + if (scanf("%d", &i)) // $ Alert[cpp/incorrectly-checked-scanf] use(i); // BAD } @@ -218,10 +218,10 @@ int main() { int i, j; - if (scanf("%d %d", &i, &j) >= 1) + if (scanf("%d %d", &i, &j) >= 1) // $ Source[cpp/missing-check-scanf] { use(i); // GOOD - use(j); // BAD: checks return value incorrectly + use(j); // $ Alert[cpp/missing-check-scanf] // BAD: checks return value incorrectly } } @@ -243,13 +243,13 @@ int main() if (maybe()) { break; } - else if (maybe() && (scanf("%5c %d", c, &d) == 1)) { // GOOD + else if (maybe() && (scanf("%5c %d", c, &d) == 1)) { // $ Source[cpp/missing-check-scanf] // GOOD use(*(int *)c); // GOOD - use(d); // BAD + use(d); // $ Alert[cpp/missing-check-scanf] // BAD } - else if ((scanf("%5c %d", c, &d) == 1) && maybe()) { // GOOD + else if ((scanf("%5c %d", c, &d) == 1) && maybe()) { // $ Source[cpp/missing-check-scanf] // GOOD use(*(int *)c); // GOOD - use(d); // BAD + use(d); // $ Alert[cpp/missing-check-scanf] // BAD } } } @@ -268,16 +268,16 @@ int main() int i; set_by_ref(i); - scanf("%d", &i); - use(i); // GOOD [FALSE POSITIVE] + scanf("%d", &i); // $ Source[cpp/missing-check-scanf] + use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] } { int i; set_by_ptr(&i); - scanf("%d", &i); - use(i); // GOOD [FALSE POSITIVE] + scanf("%d", &i); // $ Source[cpp/missing-check-scanf] + use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] } { @@ -288,8 +288,8 @@ int main() i = 0; } - scanf("%d", &i); - use(i); // BAD: `i` may not have been initialized + scanf("%d", &i); // $ Source[cpp/missing-check-scanf] + use(i); // $ Alert[cpp/missing-check-scanf] // BAD: `i` may not have been initialized } // --- different use --- @@ -400,8 +400,8 @@ char *my_string_copy() { for (int i = 0; i < len; i += 2) { unsigned int u; - sscanf(src + i, "%2x", &u); - *ptr++ = (char) u; // GOOD [FALSE POSITIVE]? src+i+{0,1} are always valid %x digits, so this should be OK. + sscanf(src + i, "%2x", &u); // $ Source[cpp/missing-check-scanf] + *ptr++ = (char) u; // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]? src+i+{0,1} are always valid %x digits, so this should be OK. } *ptr++ = 0; return DST_STRING; @@ -410,17 +410,17 @@ char *my_string_copy() { void scan_and_write() { { int i; - if (scanf("%d", &i) < 1) { + if (scanf("%d", &i) < 1) { // $ Source[cpp/missing-check-scanf] i = 0; } - use(i); // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails + use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails } { int i; - if (scanf("%d", &i) != 1) { + if (scanf("%d", &i) != 1) { // $ Source[cpp/missing-check-scanf] i = 0; } - use(i); // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails + use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails } } @@ -433,14 +433,14 @@ void scan_and_static_variable() { void bad_check() { { int i = 0; - if (scanf("%d", &i) != 0) { + if (scanf("%d", &i) != 0) { // $ Alert[cpp/incorrectly-checked-scanf] return; } use(i); // GOOD [FALSE POSITIVE]: Technically no security issue, but code is incorrect. } { int i = 0; - int r = scanf("%d", &i); + int r = scanf("%d", &i); // $ Alert[cpp/incorrectly-checked-scanf] if (!r) { return; } @@ -452,47 +452,47 @@ void bad_check() { void disjunct_boolean_condition(const char* modifier_data) { long value; - auto rc = sscanf(modifier_data, "%lx", &value); + auto rc = sscanf(modifier_data, "%lx", &value); // $ Source[cpp/missing-check-scanf] if((rc == EOF) || (rc == 0)) { return; } - use(value); // GOOD + use(value); // $ Alert[cpp/missing-check-scanf] // GOOD } void check_for_negative_test() { int res; int value; - res = scanf("%d", &value); // GOOD + res = scanf("%d", &value); // $ Source[cpp/missing-check-scanf] // GOOD if(res == 0) { return; } if (res < 0) { return; } - use(value); + use(value); // $ Alert[cpp/missing-check-scanf] } void multiple_checks() { { int i; - int res = scanf("%d", &i); + int res = scanf("%d", &i); // $ Source[cpp/missing-check-scanf] if (res >= 0) { if (res != 0) { - use(i); // GOOD: checks return value [FALSE POSITIVE] + use(i); // $ Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] } } } { int i; - int res = scanf("%d", &i); + int res = scanf("%d", &i); // $ Source[cpp/missing-check-scanf] if (res < 0) return; if (res != 0) { - use(i); // GOOD: checks return value [FALSE POSITIVE] + use(i); // $ Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] } } @@ -538,11 +538,11 @@ void switch_cases(const char *data) { float d, e, f; - switch (sscanf(data, "%f %f %f", &d, &e, &f)) { + switch (sscanf(data, "%f %f %f", &d, &e, &f)) { // $ Source[cpp/missing-check-scanf] case 2: use(d); // GOOD use(e); // GOOD - use(f); // BAD + use(f); // $ Alert[cpp/missing-check-scanf] // BAD break; case 3: use(d); // GOOD diff --git a/cpp/ql/test/query-tests/Critical/MissingNullTest/MissingNullTest.qlref b/cpp/ql/test/query-tests/Critical/MissingNullTest/MissingNullTest.qlref index f4e1c9888cb8..f9517d2a96f7 100644 --- a/cpp/ql/test/query-tests/Critical/MissingNullTest/MissingNullTest.qlref +++ b/cpp/ql/test/query-tests/Critical/MissingNullTest/MissingNullTest.qlref @@ -1 +1,2 @@ -Critical/MissingNullTest.ql \ No newline at end of file +query: Critical/MissingNullTest.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp b/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp index 73ebe8b56feb..8872bf79364f 100644 --- a/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp +++ b/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp @@ -14,13 +14,13 @@ void mycopyint(const int *source, int *dest) void test1(bool cond) { int x, y; - + { int *p, *q; y = *p; // BAD (p is uninitialized and could be 0) [NOT DETECTED] p = NULL; - y = *p; // BAD (p is 0) + y = *p; // $ Alert // BAD (p is 0) p = &x; y = *p; // GOOD (p points to x) p = q; @@ -32,7 +32,7 @@ void test1(bool cond) int *q = 0; memcpy(p, &y, sizeof(int)); // GOOD (p points to x) - memcpy(q, &y, sizeof(int)); // BAD (p is 0) + memcpy(q, &y, sizeof(int)); // $ Alert // BAD (p is 0) } { @@ -40,7 +40,7 @@ void test1(bool cond) int *q = 0; bcopy(&y, p, sizeof(int)); // GOOD (p points to x) - bcopy(&y, q, sizeof(int)); // BAD (p is 0) + bcopy(&y, q, sizeof(int)); // $ Alert // BAD (p is 0) } { @@ -48,14 +48,14 @@ void test1(bool cond) int *q = 0; mycopyint(&y, p); // GOOD (p points to x) - mycopyint(&y, q); // BAD (p is 0) + mycopyint(&y, q); // $ Alert // BAD (p is 0) } { int *p = 0; int *q = &x; - y = *p; // BAD (p is 0) + y = *p; // $ Alert // BAD (p is 0) memcpy(&p, &q, sizeof(p)); y = *p; // GOOD (p points to x) } @@ -64,7 +64,7 @@ void test1(bool cond) int *p = 0; int *q = &x; - y = *p; // BAD (p is 0) + y = *p; // $ Alert // BAD (p is 0) bcopy(&q, &p, sizeof(p)); y = *p; // GOOD (p points to x) } diff --git a/cpp/ql/test/query-tests/Critical/NewFree/NewArrayDeleteMismatch.qlref b/cpp/ql/test/query-tests/Critical/NewFree/NewArrayDeleteMismatch.qlref index 72039b834eb1..885b813268e5 100644 --- a/cpp/ql/test/query-tests/Critical/NewFree/NewArrayDeleteMismatch.qlref +++ b/cpp/ql/test/query-tests/Critical/NewFree/NewArrayDeleteMismatch.qlref @@ -1 +1,2 @@ -Critical/NewArrayDeleteMismatch.ql +query: Critical/NewArrayDeleteMismatch.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/NewFree/NewDeleteArrayMismatch.qlref b/cpp/ql/test/query-tests/Critical/NewFree/NewDeleteArrayMismatch.qlref index 0acb486d3005..93e6941508c7 100644 --- a/cpp/ql/test/query-tests/Critical/NewFree/NewDeleteArrayMismatch.qlref +++ b/cpp/ql/test/query-tests/Critical/NewFree/NewDeleteArrayMismatch.qlref @@ -1 +1,2 @@ -Critical/NewDeleteArrayMismatch.ql +query: Critical/NewDeleteArrayMismatch.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/NewFree/NewFreeMismatch.qlref b/cpp/ql/test/query-tests/Critical/NewFree/NewFreeMismatch.qlref index c7d3dfbdf085..f42f4eb16b90 100644 --- a/cpp/ql/test/query-tests/Critical/NewFree/NewFreeMismatch.qlref +++ b/cpp/ql/test/query-tests/Critical/NewFree/NewFreeMismatch.qlref @@ -1 +1,2 @@ -Critical/NewFreeMismatch.ql +query: Critical/NewFreeMismatch.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/NewFree/test.cpp b/cpp/ql/test/query-tests/Critical/NewFree/test.cpp index 0807eadb3338..d886ee070beb 100644 --- a/cpp/ql/test/query-tests/Critical/NewFree/test.cpp +++ b/cpp/ql/test/query-tests/Critical/NewFree/test.cpp @@ -22,7 +22,7 @@ myClass *global_p1, *global_p2; void f1() { myClass *p1, *p2; - + p1 = new myClass; p2 = (myClass *)malloc(sizeof(myClass)); @@ -33,12 +33,12 @@ void f1() void f2() { delete global_p1; // GOOD - delete global_p2; // BAD: malloc -> delete + delete global_p2; // $ Alert[cpp/new-free-mismatch] // BAD: malloc -> delete } void f3() { - free(global_p1); // BAD: new -> delete + free(global_p1); // $ Alert[cpp/new-free-mismatch] // BAD: new -> delete free(global_p2); // GOOD } @@ -65,15 +65,15 @@ int main() delete p1; // GOOD delete [] p2; // GOOD - delete p3; // BAD: malloc -> delete + delete p3; // $ Alert[cpp/new-free-mismatch] // BAD: malloc -> delete } { myClass *p1 = new myClass; myClass *p2 = new myClass[10]; myClass *p3 = (myClass *)malloc(sizeof(myClass)); - free(p1); // BAD: new -> free - free(p2); // BAD: new[] -> free + free(p1); // $ Alert[cpp/new-free-mismatch] // BAD: new -> free + free(p2); // $ Alert[cpp/new-free-mismatch] // BAD: new[] -> free free(p3); // GOOD } @@ -88,7 +88,7 @@ int main() myClass *p1 = (myClass *)my_malloc(sizeof(myClass)); myClass *p2 = (myClass *)my_malloc(sizeof(myClass)); - delete p1; // BAD: malloc -> delete + delete p1; // $ Alert[cpp/new-free-mismatch] // BAD: malloc -> delete free(p2); // GOOD } { @@ -96,13 +96,13 @@ int main() myClass *p2 = (myClass *)malloc(sizeof(myClass)); my_delete(p1); // GOOD - my_delete(p2); // BAD: malloc -> delete + my_delete(p2); // $ Alert[cpp/new-free-mismatch] // BAD: malloc -> delete } // overwritten { myClass *p1 = new myClass; - + delete p1; // GOOD p1 = (myClass *)malloc(sizeof(myClass)); @@ -133,9 +133,9 @@ void test2() { void *a = my_malloc_2(10); void *b = my_malloc_2(10); - + free(a); // GOOD - delete b; // BAD: malloc -> delete + delete b; // $ Alert[cpp/new-free-mismatch] // BAD: malloc -> delete } void *my_malloc_3(size_t size) @@ -150,9 +150,9 @@ void test3() { void *a = my_malloc_3(10); void *b = my_malloc_3(10); - + free(a); // GOOD - delete b; // BAD: malloc -> delete + delete b; // $ Alert[cpp/new-free-mismatch] // BAD: malloc -> delete } void test4(bool do_array_delete) @@ -162,11 +162,11 @@ void test4(bool do_array_delete) if (do_array_delete) { - delete [] mc; // BAD + delete [] mc; // $ Alert[cpp/new-delete-array-mismatch] // BAD delete [] mc_array; // GOOD } else { delete mc; // GOOD - delete mc_array; // BAD + delete mc_array; // $ Alert[cpp/new-array-delete-mismatch] // BAD } } @@ -179,7 +179,7 @@ void test5(bool do_array_delete) { delete [] c_array_ptr_2; // GOOD } else { - delete c_array_ptr_2; // BAD + delete c_array_ptr_2; // $ Alert[cpp/new-array-delete-mismatch] // BAD } } @@ -211,7 +211,7 @@ void test7(bool do_array_delete) { if (do_array_delete) { - delete [] global_mc; // BAD + delete [] global_mc; // $ Alert[cpp/new-delete-array-mismatch] // BAD } else { delete global_mc; // GOOD } @@ -229,15 +229,15 @@ void test8(bool cond) } free(a); // GOOD - delete a; // BAD: malloc -> delete - delete [] a; // BAD: malloc -> delete[] + delete a; // $ Alert[cpp/new-free-mismatch] // BAD: malloc -> delete + delete [] a; // $ Alert[cpp/new-free-mismatch] // BAD: malloc -> delete[] - free(b); // BAD: new -> free + free(b); // $ Alert[cpp/new-free-mismatch] // BAD: new -> free delete b; // GOOD - delete [] b; // BAD: new -> delete[] + delete [] b; // $ Alert[cpp/new-delete-array-mismatch] // BAD: new -> delete[] - free(c); // BAD: new[] -> free - delete c; // BAD: new[] -> delete + free(c); // $ Alert[cpp/new-free-mismatch] // BAD: new[] -> free + delete c; // $ Alert[cpp/new-array-delete-mismatch] // BAD: new[] -> delete delete [] c; // GOOD } @@ -264,12 +264,12 @@ class ClassWithMembers b = new int; c = new int; } - + ~ClassWithMembers() { delete a; // GOOD - delete [] b; // BAD: new -> delete[] - free(c); // BAD: new -> free + delete [] b; // $ Alert[cpp/new-delete-array-mismatch] // BAD: new -> delete[] + free(c); // $ Alert[cpp/new-free-mismatch] // BAD: new -> free } private: @@ -292,7 +292,7 @@ static void map_init() static void map_shutdown() { - delete map; // BAD: new[] -> delete + delete map; // $ Alert[cpp/new-array-delete-mismatch] // BAD: new[] -> delete map = 0; } @@ -307,7 +307,7 @@ class Test10 ~Test10() { - delete data; // BAD: new[] -> delete + delete data; // $ Alert[cpp/new-array-delete-mismatch] // BAD: new[] -> delete } char *data; @@ -332,7 +332,7 @@ class Test11 ~Test11() { - delete data; // BAD: new[] -> delete + delete data; // $ Alert[cpp/new-array-delete-mismatch] // BAD: new[] -> delete } char *data; @@ -438,10 +438,10 @@ void test14() wchar_t *s5 = wcsdup(L"string"); wchar_t *s6 = wcsdup(L"string"); - delete s1; // BAD: strdup -> delete + delete s1; // $ Alert[cpp/new-free-mismatch] // BAD: strdup -> delete free(s2); // GOOD - delete s3; // BAD: strndup -> delete + delete s3; // $ Alert[cpp/new-free-mismatch] // BAD: strndup -> delete free(s4); // GOOD - delete s5; // BAD: wcsdup -> delete + delete s5; // $ Alert[cpp/new-free-mismatch] // BAD: wcsdup -> delete free(s6); // GOOD } diff --git a/cpp/ql/test/query-tests/Critical/NewFree/test2.cpp b/cpp/ql/test/query-tests/Critical/NewFree/test2.cpp index 43a286f6f97f..50de92f17c8b 100644 --- a/cpp/ql/test/query-tests/Critical/NewFree/test2.cpp +++ b/cpp/ql/test/query-tests/Critical/NewFree/test2.cpp @@ -16,14 +16,14 @@ class MyTest2Class MyTest2Class() { int *a = new int; - free(a); // BAD + free(a); // $ Alert[cpp/new-free-mismatch] // BAD int *ptr_b = (int *)malloc(sizeof(int)); int *b = new(ptr_b) int; free(b); // GOOD c = new int; - free(c); // BAD + free(c); // $ Alert[cpp/new-free-mismatch] // BAD int *ptr_d = (int *)malloc(sizeof(int)); d = new(ptr_d) int; @@ -48,13 +48,13 @@ void test_operator_new() delete ptr_new; // GOOD ::operator delete(ptr_new); // GOOD - free(ptr_new); // BAD + free(ptr_new); // $ Alert[cpp/new-free-mismatch] // BAD delete ptr_opnew; // GOOD ::operator delete(ptr_opnew); // GOOD - free(ptr_opnew); // BAD + free(ptr_opnew); // $ Alert[cpp/new-free-mismatch] // BAD - delete ptr_malloc; // BAD - ::operator delete(ptr_malloc); // BAD + delete ptr_malloc; // $ Alert[cpp/new-free-mismatch] // BAD + ::operator delete(ptr_malloc); // $ Alert[cpp/new-free-mismatch] // BAD free(ptr_malloc); // GOOD } diff --git a/cpp/ql/test/query-tests/Critical/NotInitialised/NotInitialised.qlref b/cpp/ql/test/query-tests/Critical/NotInitialised/NotInitialised.qlref index b261c020f534..2a0f2052bea8 100644 --- a/cpp/ql/test/query-tests/Critical/NotInitialised/NotInitialised.qlref +++ b/cpp/ql/test/query-tests/Critical/NotInitialised/NotInitialised.qlref @@ -1 +1,2 @@ -Critical/NotInitialised.ql \ No newline at end of file +query: Critical/NotInitialised.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/NotInitialised/test.cpp b/cpp/ql/test/query-tests/Critical/NotInitialised/test.cpp index bc9093cd53de..c8a9f11ea86e 100644 --- a/cpp/ql/test/query-tests/Critical/NotInitialised/test.cpp +++ b/cpp/ql/test/query-tests/Critical/NotInitialised/test.cpp @@ -1,6 +1,6 @@ void test1() { int local; - int x = local; // BAD + int x = local; // $ Alert // BAD static int static_local; int y = static_local; // GOOD @@ -9,7 +9,7 @@ void test1() { int z = initialised; // GOOD } -int uninitialised_global; // BAD +int uninitialised_global; // $ Alert // BAD static int uninitialised_static_global; // GOOD int initialized_global = 0; // GOOD @@ -17,4 +17,4 @@ void test2() { int a = uninitialised_global; int b = uninitialised_static_global; int c = initialized_global; -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/NoSpaceForZeroTerminator.qlref b/cpp/ql/test/query-tests/Critical/OverflowCalculated/NoSpaceForZeroTerminator.qlref index 53beb09ebd71..0459fddee60f 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/NoSpaceForZeroTerminator.qlref +++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/NoSpaceForZeroTerminator.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql +query: Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/OverflowCalculated.qlref b/cpp/ql/test/query-tests/Critical/OverflowCalculated/OverflowCalculated.qlref index 9895980e2411..7625942ee0f5 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/OverflowCalculated.qlref +++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/OverflowCalculated.qlref @@ -1 +1,2 @@ -Critical/OverflowCalculated.ql +query: Critical/OverflowCalculated.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp index a47679bafc24..e00b70765ed6 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp +++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp @@ -23,7 +23,7 @@ void tests1(int case_num) switch (case_num) { case 1: - buffer = (char *)malloc(strlen(str)); // BAD + buffer = (char *)malloc(strlen(str)); // $ Alert[cpp/no-space-for-terminator] // BAD strcpy(buffer, str); break; @@ -33,7 +33,7 @@ void tests1(int case_num) break; case 3: - buffer = (char *)malloc(strlen(str) * sizeof(char)); // BAD + buffer = (char *)malloc(strlen(str) * sizeof(char)); // $ Alert[cpp/no-space-for-terminator] // BAD strcpy(buffer, str); break; @@ -53,7 +53,7 @@ void tests1(int case_num) break; case 7: - buffer = (char *)realloc(buffer, strlen(str)); // BAD + buffer = (char *)realloc(buffer, strlen(str)); // $ Alert[cpp/no-space-for-terminator] // BAD strcpy(buffer, str); break; @@ -64,7 +64,7 @@ void tests1(int case_num) case 9: int len1 = strlen(str); - buffer = (char *)malloc(len1); // BAD + buffer = (char *)malloc(len1); // $ Alert[cpp/no-space-for-terminator] // BAD strcpy(buffer, str); break; @@ -86,7 +86,7 @@ void tests1(int case_num) break; case 101: - wbuffer = (wchar_t *)malloc(wcslen(wstr)); // BAD + wbuffer = (wchar_t *)malloc(wcslen(wstr)); // $ Alert[cpp/no-space-for-terminator] // BAD wcscpy(wbuffer, wstr); break; @@ -106,7 +106,7 @@ void tests1(int case_num) break; case 105: - wbuffer = (wchar_t *)malloc(wcslen(wstr) * sizeof(wchar_t)); // BAD + wbuffer = (wchar_t *)malloc(wcslen(wstr) * sizeof(wchar_t)); // $ Alert[cpp/no-space-for-terminator] // BAD wcscpy(wbuffer, wstr); break; @@ -125,7 +125,7 @@ void tests1(int case_num) wcscpy(wbuffer, wstr); break; } - + if (buffer != 0) { free(buffer); diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp index 696b566329a3..db6928a7015a 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp +++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp @@ -31,7 +31,7 @@ void tests2(int case_num) case 1: buffer = (char *)malloc(strlen(str1) + 1); // BAD strcpy(buffer, str1); - strcat(buffer, str2); + strcat(buffer, str2); // $ Alert[cpp/overflow-calculated] break; case 2: @@ -49,7 +49,7 @@ void tests2(int case_num) case 4: buffer = (char *)malloc((strlen(str1) + 1) * sizeof(char)); // BAD strcpy(buffer, str1); - strcat(buffer, str2); + strcat(buffer, str2); // $ Alert[cpp/overflow-calculated] break; case 5: diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp index 7a2cc19d269c..d6ff097fd2f5 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp +++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp @@ -22,12 +22,12 @@ void tests3(int case_num) switch (case_num) { case 1: - buffer = (char *)std::malloc(strlen(str3global)); // BAD + buffer = (char *)std::malloc(strlen(str3global)); // $ Alert[cpp/no-space-for-terminator] // BAD strcpy(buffer, str3global); break; case 2: - buffer = (char *)std::malloc(strlen(str3local)); // BAD + buffer = (char *)std::malloc(strlen(str3local)); // $ Alert[cpp/no-space-for-terminator] // BAD strcpy(buffer, str3local); break; @@ -50,7 +50,7 @@ void tests3(int case_num) void test3b() { - char *buffer = new char[strlen(str3global)]; // BAD + char *buffer = new char[strlen(str3global)]; // $ Alert[cpp/no-space-for-terminator] // BAD strcpy(buffer, str3global); @@ -68,7 +68,7 @@ void test3c() } // --- custom allocators --- - + void *MyMalloc1(size_t size) { return std::malloc(size); } void *MyMalloc2(size_t size); @@ -78,9 +78,9 @@ void tests4() char *buffer1 = 0; char *buffer2 = 0; - buffer1 = (char *)MyMalloc1(strlen(str4)); // BAD + buffer1 = (char *)MyMalloc1(strlen(str4)); // $ Alert[cpp/no-space-for-terminator] // BAD strcpy(buffer1, str4); - buffer2 = (char *)MyMalloc2(strlen(str4)); // BAD + buffer2 = (char *)MyMalloc2(strlen(str4)); // $ Alert[cpp/no-space-for-terminator] // BAD strcpy(buffer2, str4); } diff --git a/cpp/ql/test/query-tests/Critical/OverflowStatic/OverflowStatic.qlref b/cpp/ql/test/query-tests/Critical/OverflowStatic/OverflowStatic.qlref index 477af9d71d07..93d88e7802a0 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowStatic/OverflowStatic.qlref +++ b/cpp/ql/test/query-tests/Critical/OverflowStatic/OverflowStatic.qlref @@ -1 +1,2 @@ -Critical/OverflowStatic.ql +query: Critical/OverflowStatic.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c index 3c726a452b9b..8a191a56365a 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c +++ b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c @@ -11,14 +11,14 @@ void f(void) { c = xs[-1]; // BAD [NOT DETECTED] c = xs[0]; // GOOD c = xs[4]; // GOOD - c = xs[5]; // BAD - c = xs[6]; // BAD + c = xs[5]; // $ Alert // BAD + c = xs[6]; // $ Alert // BAD c = stru.ys[-1]; // BAD [NOT DETECTED] c = stru.ys[0]; // GOOD c = stru.ys[4]; // GOOD - c = stru.ys[5]; // BAD - c = stru.ys[6]; // BAD + c = stru.ys[5]; // $ Alert // BAD + c = stru.ys[6]; // $ Alert // BAD c = stru.zs[-1]; // BAD [NOT DETECTED] c = stru.zs[0]; // GOOD (zs is variable size) diff --git a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp index deeb70ffd57d..6f8ce4c7d7ab 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp +++ b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp @@ -16,14 +16,14 @@ void f1(void) } for (i = 0; i < 4; i++) { - buffer1[i] = 0; // BAD - buffer2[i] = 0; // BAD + buffer1[i] = 0; // $ Alert // BAD + buffer2[i] = 0; // $ Alert // BAD } memcpy(buffer1, buffer2, 3); // GOOD - memcpy(buffer1, buffer2, 4); // BAD + memcpy(buffer1, buffer2, 4); // $ Alert // BAD memcpy(buffer2, buffer1, 3); // GOOD - memcpy(buffer2, buffer1, 4); // BAD + memcpy(buffer2, buffer1, 4); // $ Alert // BAD } void f2(char *src) @@ -37,7 +37,7 @@ void f2(char *src) amount = amount + 1; memcpy(buffer, src, amount); // BAD [NOT DETECTED] amount = 101; - memcpy(buffer, src, amount); // BAD + memcpy(buffer, src, amount); // $ Alert // BAD ptr = buffer; memcpy(ptr, src, 101); // BAD [NOT DETECTED] @@ -60,4 +60,4 @@ void f3() { int unevaluated_test() { char buffer[100]; return sizeof(buffer) / sizeof(buffer[101]); // GOOD -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Critical/OverflowStatic/test2.c b/cpp/ql/test/query-tests/Critical/OverflowStatic/test2.c index cd836d759880..627d672b7b2f 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowStatic/test2.c +++ b/cpp/ql/test/query-tests/Critical/OverflowStatic/test2.c @@ -25,14 +25,14 @@ size_t fread(void *ptr, size_t size, size_t nmemb, FILE *stream); void bad0(char *src, FILE *f, va_list ap) { char buffer[40]; - fgets(buffer, 41, f); // BAD: Too many characters read - strncpy(buffer, src, 43); // BAD: Too many characters copied + fgets(buffer, 41, f); // $ Alert // BAD: Too many characters read + strncpy(buffer, src, 43); // $ Alert // BAD: Too many characters copied buffer[0] = 0; - strncat(buffer, src, 44); // BAD: Too many characters copied - memcpy(buffer, src, 45); // BAD: Too many characters copied - memmove(buffer, src, 46); // BAD: Too many characters copied - snprintf(buffer, 47, "%s", src); // BAD: Too many characters copied - vsnprintf(buffer, 48, "%s", ap); // BAD: Too many characters copied + strncat(buffer, src, 44); // $ Alert // BAD: Too many characters copied + memcpy(buffer, src, 45); // $ Alert // BAD: Too many characters copied + memmove(buffer, src, 46); // $ Alert // BAD: Too many characters copied + snprintf(buffer, 47, "%s", src); // $ Alert // BAD: Too many characters copied + vsnprintf(buffer, 48, "%s", ap); // $ Alert // BAD: Too many characters copied } void good0(char *src, FILE *f, va_list ap) { @@ -47,4 +47,3 @@ void good0(char *src, FILE *f, va_list ap) { snprintf(buffer, 57, "%s", src); // GOOD vsnprintf(buffer, 58, "%s", ap); // GOOD } - diff --git a/cpp/ql/test/query-tests/Critical/ReturnValueIgnored/ReturnValueIgnored.qlref b/cpp/ql/test/query-tests/Critical/ReturnValueIgnored/ReturnValueIgnored.qlref index 102d4b7138ce..cd7a89e3ea59 100644 --- a/cpp/ql/test/query-tests/Critical/ReturnValueIgnored/ReturnValueIgnored.qlref +++ b/cpp/ql/test/query-tests/Critical/ReturnValueIgnored/ReturnValueIgnored.qlref @@ -1 +1,2 @@ -Critical/ReturnValueIgnored.ql +query: Critical/ReturnValueIgnored.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/ReturnValueIgnored/test.cpp b/cpp/ql/test/query-tests/Critical/ReturnValueIgnored/test.cpp index 4fbf1f00e33f..ca27fba7e47c 100644 --- a/cpp/ql/test/query-tests/Critical/ReturnValueIgnored/test.cpp +++ b/cpp/ql/test/query-tests/Critical/ReturnValueIgnored/test.cpp @@ -29,7 +29,7 @@ int main() check(myFunction()); // GOOD - myFunction(); // BAD (return value is ignored) + myFunction(); // $ Alert // BAD (return value is ignored) (void)myFunction(); // GOOD } diff --git a/cpp/ql/test/query-tests/Critical/SizeCheck/SizeCheck2.qlref b/cpp/ql/test/query-tests/Critical/SizeCheck/SizeCheck2.qlref index ca677973aea1..b23dbb86fd80 100644 --- a/cpp/ql/test/query-tests/Critical/SizeCheck/SizeCheck2.qlref +++ b/cpp/ql/test/query-tests/Critical/SizeCheck/SizeCheck2.qlref @@ -1 +1,2 @@ -Critical/SizeCheck2.ql +query: Critical/SizeCheck2.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/SizeCheck/test.c b/cpp/ql/test/query-tests/Critical/SizeCheck/test.c index b4ea2dc3f98f..0e0246daed9f 100644 --- a/cpp/ql/test/query-tests/Critical/SizeCheck/test.c +++ b/cpp/ql/test/query-tests/Critical/SizeCheck/test.c @@ -13,8 +13,8 @@ void free(void *ptr); void bad0(void) { - float *fptr = malloc(3); // $ Alert -- Too small - double *dptr = malloc(5); // $ Alert -- Too small + float *fptr = malloc(3); // $ Alert[cpp/allocation-too-small] // Too small + double *dptr = malloc(5); // $ Alert[cpp/allocation-too-small] // Too small free(fptr); free(dptr); } @@ -29,8 +29,8 @@ void good0(void) { void bad1(void) { - float *fptr = malloc(sizeof(short)); // $ Alert -- Too small - double *dptr = malloc(sizeof(float)); // $ Alert -- Too small + float *fptr = malloc(sizeof(short)); // $ Alert[cpp/allocation-too-small] // Too small + double *dptr = malloc(sizeof(float)); // $ Alert[cpp/allocation-too-small] // Too small free(fptr); free(dptr); } @@ -56,7 +56,7 @@ typedef union _myUnion void test_union() { MyUnion *a = malloc(sizeof(MyUnion)); // GOOD - MyUnion *b = malloc(sizeof(MyStruct)); // $ Alert (too small) + MyUnion *b = malloc(sizeof(MyStruct)); // $ Alert[cpp/allocation-too-small] // Too small } // --- custom allocators --- @@ -66,6 +66,6 @@ void *MyMalloc2(size_t size); void customAllocatorTests() { - float *fptr1 = MyMalloc1(3); // $ MISSING: BAD (too small) - float *fptr2 = MyMalloc2(3); // $ MISSING: BAD (too small) + float *fptr1 = MyMalloc1(3); // $ MISSING: Alert[cpp/allocation-too-small] // Too small + float *fptr2 = MyMalloc2(3); // $ MISSING: Alert[cpp/allocation-too-small] // Too small } diff --git a/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c b/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c index 714ca5de9c88..5e09a428bf38 100644 --- a/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c +++ b/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c @@ -13,8 +13,8 @@ void free(void *ptr); void bad0(void) { - long long *lptr = malloc(27); // BAD -- Not a multiple of sizeof(long long) - double *dptr = malloc(33); // BAD -- Not a multiple of sizeof(double) + long long *lptr = malloc(27); // $ Alert[cpp/suspicious-allocation-size] // BAD -- Not a multiple of sizeof(long long) + double *dptr = malloc(33); // $ Alert[cpp/suspicious-allocation-size] // BAD -- Not a multiple of sizeof(double) free(lptr); free(dptr); } @@ -29,8 +29,8 @@ void good0(void) { void bad1(void) { - long long *lptr = malloc(sizeof(long long)*7/2); // BAD -- Not a multiple of sizeof(long long) - double *dptr = malloc(sizeof(double)*5/2); // BAD -- Not a multiple of sizeof(double) + long long *lptr = malloc(sizeof(long long)*7/2); // $ Alert[cpp/suspicious-allocation-size] // BAD -- Not a multiple of sizeof(long long) + double *dptr = malloc(sizeof(double)*5/2); // $ Alert[cpp/suspicious-allocation-size] // BAD -- Not a multiple of sizeof(double) free(lptr); free(dptr); } @@ -82,5 +82,5 @@ void varStructTests() { MyVarStruct1 *a = malloc(sizeof(MyVarStruct1) + 127); // GOOD MyVarStruct2 *b = malloc(sizeof(MyVarStruct2) + 127); // GOOD MyVarStruct3 *c = malloc(sizeof(MyVarStruct3) + 127); // GOOD - MyFixedStruct *d = malloc(sizeof(MyFixedStruct) + 127); // BAD --- Not a multiple of sizeof(MyFixedStruct) + MyFixedStruct *d = malloc(sizeof(MyFixedStruct) + 127); // $ Alert[cpp/suspicious-allocation-size] // BAD --- Not a multiple of sizeof(MyFixedStruct) } diff --git a/cpp/ql/test/query-tests/Critical/UnsafeUseOfThis/UnsafeUseOfThis.qlref b/cpp/ql/test/query-tests/Critical/UnsafeUseOfThis/UnsafeUseOfThis.qlref index 086427166cb0..1bd76706524d 100644 --- a/cpp/ql/test/query-tests/Critical/UnsafeUseOfThis/UnsafeUseOfThis.qlref +++ b/cpp/ql/test/query-tests/Critical/UnsafeUseOfThis/UnsafeUseOfThis.qlref @@ -1 +1,2 @@ -Likely Bugs/OO/UnsafeUseOfThis.ql \ No newline at end of file +query: Likely Bugs/OO/UnsafeUseOfThis.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Critical/UnsafeUseOfThis/test.cpp b/cpp/ql/test/query-tests/Critical/UnsafeUseOfThis/test.cpp index 900418b20ea8..639cdda8f15f 100644 --- a/cpp/ql/test/query-tests/Critical/UnsafeUseOfThis/test.cpp +++ b/cpp/ql/test/query-tests/Critical/UnsafeUseOfThis/test.cpp @@ -4,35 +4,35 @@ struct B; void call_f(B*); struct B : public A { - B() { + B() { // $ Source[cpp/unsafe-use-of-this]=r4 call_f(this); } B(B& b) { - b.f(); // BAD: undefined behavior + b.f(); // $ Alert[cpp/unsafe-use-of-this]=r1 // BAD: undefined behavior } - ~B() { - f(); // BAD: undefined behavior + ~B() { // $ Source[cpp/unsafe-use-of-this]=r2 + f(); // $ Alert[cpp/unsafe-use-of-this]=r2 // BAD: undefined behavior } }; struct C : public B { - C(bool b) { + C(bool b) { // $ Source[cpp/unsafe-use-of-this]=r3 call_f(this); if(b) { - this->f(); // BAD: undefined behavior + this->f(); // $ Alert[cpp/unsafe-use-of-this]=r3 // BAD: undefined behavior } } }; struct D : public B { - D() : B(*this) {} + D() : B(*this) {} // $ Source[cpp/unsafe-use-of-this]=r1 }; void call_f(B* x) { - x->f(); // 2 x BAD: Undefined behavior + x->f(); // $ Alert[cpp/unsafe-use-of-this]=r3 Alert[cpp/unsafe-use-of-this]=r4 // 2 x BAD: Undefined behavior } struct E : public A { diff --git a/cpp/ql/test/query-tests/Documentation/DocumentApi/DocumentApi.qlref b/cpp/ql/test/query-tests/Documentation/DocumentApi/DocumentApi.qlref index 41bcfe740bb4..f46b3b829259 100644 --- a/cpp/ql/test/query-tests/Documentation/DocumentApi/DocumentApi.qlref +++ b/cpp/ql/test/query-tests/Documentation/DocumentApi/DocumentApi.qlref @@ -1 +1,2 @@ -Documentation/DocumentApi.ql +query: Documentation/DocumentApi.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Documentation/DocumentApi/comment_prototypes.c b/cpp/ql/test/query-tests/Documentation/DocumentApi/comment_prototypes.c index bb05ef8c015f..398e84f6f6a0 100644 --- a/cpp/ql/test/query-tests/Documentation/DocumentApi/comment_prototypes.c +++ b/cpp/ql/test/query-tests/Documentation/DocumentApi/comment_prototypes.c @@ -26,12 +26,12 @@ void proto5(void) { int i2; int i3; } -void proto6(void) { +void proto6(void) { // $ Alert int i1; int i2; int i3; } -void proto7(void) { +void proto7(void) { // $ Alert int i1; int i2; int i3; @@ -42,17 +42,17 @@ void proto8(void) { int i2; int i3; } -void proto9(void) { +void proto9(void) { // $ Alert int i1; int i2; int i3; } -void proto10(void) { +void proto10(void) { // $ Alert int i1; int i2; int i3; } -void proto11(void) { +void proto11(void) { // $ Alert int i1; int i2; int i3; @@ -63,7 +63,7 @@ void proto12(void) { int i2; int i3; } -void proto13(void) { +void proto13(void) { // $ Alert int i1; int i2; int i3; diff --git a/cpp/ql/test/query-tests/Documentation/DocumentApi/definition.c b/cpp/ql/test/query-tests/Documentation/DocumentApi/definition.c index 1894482d62f2..650bac038a0e 100644 --- a/cpp/ql/test/query-tests/Documentation/DocumentApi/definition.c +++ b/cpp/ql/test/query-tests/Documentation/DocumentApi/definition.c @@ -1,5 +1,5 @@ -void f1(void) { +void f1(void) { // $ Alert int x1; int x2; int x3; @@ -29,7 +29,7 @@ void f5(void) { int x3; } -void f6(void) { +void f6(void) { // $ Alert int x1; int x2; int x3; diff --git a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/Cleanup-DuplicateIncludeGuard.qlref b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/Cleanup-DuplicateIncludeGuard.qlref index 1e431289b172..d179ad8e2380 100644 --- a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/Cleanup-DuplicateIncludeGuard.qlref +++ b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/Cleanup-DuplicateIncludeGuard.qlref @@ -1 +1,2 @@ -Header Cleanup/Cleanup-DuplicateIncludeGuard.ql \ No newline at end of file +query: Header Cleanup/Cleanup-DuplicateIncludeGuard.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header1.h b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header1.h index a0fa07dbb50a..7de21f0b2b3c 100644 --- a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header1.h +++ b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header1.h @@ -1,6 +1,6 @@ // header1.h -#ifndef INCLUDED_HEADER1 +#ifndef INCLUDED_HEADER1 // $ Alert #define INCLUDED_HEADER1 // ... diff --git a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header2.h b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header2.h index 9e4ad972812b..df4bda161972 100644 --- a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header2.h +++ b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header2.h @@ -1,6 +1,6 @@ // header2.h -#ifndef INCLUDED_HEADER1 // oops! +#ifndef INCLUDED_HEADER1 // $ Alert // oops! #define INCLUDED_HEADER1 // ... diff --git a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header4.h b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header4.h index 57b36896ebd0..a3e19a07615f 100644 --- a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header4.h +++ b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header4.h @@ -1,6 +1,6 @@ // header4.h -#ifndef INCLUDED_HEADER4 +#ifndef INCLUDED_HEADER4 // $ Alert #define INCLUDED_HEADER4 // ... diff --git a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header6.h b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header6.h index 2148e608917d..89c2abaa3313 100644 --- a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header6.h +++ b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header6.h @@ -1,6 +1,6 @@ // header6.h -#ifndef INCLUDED_HEADER6 +#ifndef INCLUDED_HEADER6 // $ Alert #define INCLUDED_HEADER6 // ... diff --git a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header7.h b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header7.h index 4dd8875d69d8..3a034a5c077d 100644 --- a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header7.h +++ b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/header7.h @@ -1,6 +1,6 @@ // header7.h -#ifndef INCLUDED_HEADER6 // oops! +#ifndef INCLUDED_HEADER6 // $ Alert // oops! #define INCLUDED_HEADER6(x) (x) // ... diff --git a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/subfolder/header4.h b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/subfolder/header4.h index c5e44813dcd2..7480de13766c 100644 --- a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/subfolder/header4.h +++ b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/subfolder/header4.h @@ -1,6 +1,6 @@ // header4.h -#ifndef INCLUDED_HEADER4 // duplicate +#ifndef INCLUDED_HEADER4 // $ Alert // duplicate #define INCLUDED_HEADER4 // ... diff --git a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/subfolder/header5.h b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/subfolder/header5.h index ed54e7ea68cd..c46e2e448eb3 100644 --- a/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/subfolder/header5.h +++ b/cpp/ql/test/query-tests/Header Cleanup/Cleanup-DuplicateIncludeGuard/subfolder/header5.h @@ -1,6 +1,6 @@ // header5.h -#ifndef INCLUDED_HEADER4 // duplicate +#ifndef INCLUDED_HEADER4 // $ Alert // duplicate #define INCLUDED_HEADER4 // ... diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFile/LimitedScopeFile.qlref b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFile/LimitedScopeFile.qlref index 5e38f12f9389..15b0c53ec249 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFile/LimitedScopeFile.qlref +++ b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFile/LimitedScopeFile.qlref @@ -1 +1,2 @@ -JPL_C/LOC-3/Rule 13/LimitedScopeFile.ql +query: JPL_C/LOC-3/Rule 13/LimitedScopeFile.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFile/file1.c b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFile/file1.c index 96e8dc7ce864..f4ea9500ed61 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFile/file1.c +++ b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFile/file1.c @@ -1,6 +1,6 @@ // file1.c -int globalInt1; // BAD [only accessed in this file] +int globalInt1; // $ Alert // BAD [only accessed in this file] int globalInt2; // GOOD [accessed in file1.c and file2.c] int globalInt3; // GOOD [referenced in file1.h] int globalInt4; // GOOD [only accessed in one function, should be function scope instead] diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFunction/LimitedScopeFunction.qlref b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFunction/LimitedScopeFunction.qlref index c5e632ca9b6b..26d720a2ac8a 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFunction/LimitedScopeFunction.qlref +++ b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFunction/LimitedScopeFunction.qlref @@ -1 +1,2 @@ -JPL_C/LOC-3/Rule 13/LimitedScopeFunction.ql +query: JPL_C/LOC-3/Rule 13/LimitedScopeFunction.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFunction/test.c b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFunction/test.c index a2089446ca77..0a63e9f10d31 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFunction/test.c +++ b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 13/LimitedScopeFunction/test.c @@ -5,9 +5,9 @@ int globalInt1; // GOOD [used in func1, func2] int globalInt2; // GOOD [used in func1, func2] int globalInt3; // GOOD [used in func1, func2] -int globalInt4; // BAD [only used in func1] -int globalInt5; // BAD [only used in func1] -int globalInt6; // BAD [only used in func1] +int globalInt4; // $ Alert // BAD [only used in func1] +int globalInt5; // $ Alert // BAD [only used in func1] +int globalInt6; // $ Alert // BAD [only used in func1] int globalInt7; // GOOD [not used, should be reported by another query] int globalInt8; // GOOD [used at file level] int *addrGlobalInt8 = &globalInt8; // GOOD [used in func1, func2] diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 17/BasicIntTypes.qlref b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 17/BasicIntTypes.qlref index 687711a321c4..e1e64db86c79 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 17/BasicIntTypes.qlref +++ b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 17/BasicIntTypes.qlref @@ -1 +1,2 @@ -JPL_C/LOC-3/Rule 17/BasicIntTypes.ql +query: JPL_C/LOC-3/Rule 17/BasicIntTypes.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 17/test.c b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 17/test.c index 2becb75d916c..ef0f79598fbb 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 17/test.c +++ b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule 17/test.c @@ -3,7 +3,7 @@ typedef uint8_t U8; typedef U8 something_else; void test1(U8* xptr) { } void test2(U8 x) { } -void test3(unsigned char x) { } +void test3(unsigned char x) { } // $ Alert void test4(uint8_t x){ } void test5(something_else x){ } static U8 test6; diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/NonConstFunctionPointer.qlref b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/NonConstFunctionPointer.qlref index 80637efae7a5..256adc1b4f83 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/NonConstFunctionPointer.qlref +++ b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/NonConstFunctionPointer.qlref @@ -1 +1,2 @@ -JPL_C/LOC-4/Rule 29/NonConstFunctionPointer.ql +query: JPL_C/LOC-4/Rule 29/NonConstFunctionPointer.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c index 9999d95be10d..c87226eba3de 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c +++ b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c @@ -15,7 +15,7 @@ void test() funPtr2 = &myFunc2; //funPtr3 = &myFunc2; --- this would be a compilation error - funPtr1(); // BAD - funPtr2(); // BAD - funPtr3(); // GOOD [FALSE POSITIVE] + funPtr1(); // $ Alert // BAD + funPtr2(); // $ Alert // BAD + funPtr3(); // $ Alert // GOOD [FALSE POSITIVE] } diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/FunctionPointerConversions.qlref b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/FunctionPointerConversions.qlref index 48e8f90bf59b..803c795dc84b 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/FunctionPointerConversions.qlref +++ b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/FunctionPointerConversions.qlref @@ -1 +1,2 @@ -JPL_C/LOC-4/Rule 30/FunctionPointerConversions.ql +query: JPL_C/LOC-4/Rule 30/FunctionPointerConversions.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c index a36c9f396fe8..73ebd802501a 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c +++ b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c @@ -8,14 +8,14 @@ void test() { void (*funPtr1)() = &myFunc1; // GOOD voidFunPtr funPtr2 = &myFunc1; // GOOD - int *intPtr = &myFunc1; // BAD (function pointer -> int pointer) - void *voidPtr = &myFunc1; // BAD (function pointer -> void pointer) + int *intPtr = &myFunc1; // $ Alert // BAD (function pointer -> int pointer) + void *voidPtr = &myFunc1; // $ Alert // BAD (function pointer -> void pointer) int i = &myFunc1; // GOOD (permitted) funPtr1 = funPtr1; // GOOD funPtr2 = funPtr1; // GOOD - intPtr = funPtr1; // BAD (function pointer -> int pointer) - voidPtr = funPtr1; // BAD (function pointer -> void pointer) + intPtr = funPtr1; // $ Alert // BAD (function pointer -> int pointer) + voidPtr = funPtr1; // $ Alert // BAD (function pointer -> void pointer) i = funPtr1; // GOOD (permitted) funPtr1 = funPtr2; // GOOD @@ -26,7 +26,7 @@ void test() funPtr1 = (void (*)())funPtr1; // GOOD funPtr2 = (voidFunPtr)funPtr1; // GOOD - intPtr = (int *)funPtr1; // BAD (function pointer -> int pointer) - voidPtr = (void *)funPtr1; // BAD (function pointer -> void pointer) + intPtr = (int *)funPtr1; // $ Alert // BAD (function pointer -> int pointer) + voidPtr = (void *)funPtr1; // $ Alert // BAD (function pointer -> void pointer) i = (int)funPtr1; // GOOD (permitted) } diff --git a/cpp/ql/test/query-tests/Likely Bugs/AmbiguouslySignedBitField/AmbiguouslySignedBitField.qlref b/cpp/ql/test/query-tests/Likely Bugs/AmbiguouslySignedBitField/AmbiguouslySignedBitField.qlref index 78378f7b2993..c2826b9bade4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/AmbiguouslySignedBitField/AmbiguouslySignedBitField.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/AmbiguouslySignedBitField/AmbiguouslySignedBitField.qlref @@ -1 +1,2 @@ -Likely Bugs/AmbiguouslySignedBitField.ql +query: Likely Bugs/AmbiguouslySignedBitField.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/AmbiguouslySignedBitField/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/AmbiguouslySignedBitField/test.cpp index 19aa4ef2e64b..ae1ea1a5c77a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/AmbiguouslySignedBitField/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/AmbiguouslySignedBitField/test.cpp @@ -9,18 +9,18 @@ enum myEnum { }; struct { - int nosign : 2; // BAD + int nosign : 2; // $ Alert // BAD signed int sign1 : 2; // GOOD unsigned int sign2 : 2; // GOOD signed sign3: 2; // GOOD unsigned sign4 : 2; // GOOD BOOL typedefbool: 2; // GOOD bool cppbool : 2; // GOOD - char nosignchar : 2; // BAD - short nosignshort : 2; // BAD - myAmbiguousType nosigntypedef : 2; // BAD + char nosignchar : 2; // $ Alert // BAD + short nosignshort : 2; // $ Alert // BAD + myAmbiguousType nosigntypedef : 2; // $ Alert // BAD mySignedType signedtypedef : 2; // GOOD - const int nosignconst : 2; // BAD + const int nosignconst : 2; // $ Alert // BAD const signed int signedconst : 2; myEnum nosignenum : 2; const myEnum constnosignenum : 2; diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/BadAdditionOverflowCheck.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/BadAdditionOverflowCheck.qlref index ae8cc803b690..75f106ffa079 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/BadAdditionOverflowCheck.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/BadAdditionOverflowCheck.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql +query: Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/ComparisonWithCancelingSubExpr.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/ComparisonWithCancelingSubExpr.qlref index d17e547e8e66..153457ea9906 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/ComparisonWithCancelingSubExpr.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/ComparisonWithCancelingSubExpr.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/ComparisonWithCancelingSubExpr.ql +query: Likely Bugs/Arithmetic/ComparisonWithCancelingSubExpr.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.qlref index 92873b897597..55be0938e341 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/PointlessSelfComparison.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/PointlessSelfComparison.ql +query: Likely Bugs/Arithmetic/PointlessSelfComparison.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp index e359fb098eb1..6e4f05821f6d 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.cpp @@ -5,7 +5,7 @@ bool cannotHoldAnother8(int n1) { // clang 8.0.0 -O2: deleted (silently) // gcc 9.2 -O2: deleted (silently) // msvc 19.22 /O2: not deleted - return n1 + 8 < n1; // BAD + return n1 + 8 < n1; // $ Alert[cpp/signed-overflow-check] // BAD } /* 2. Signed comparison with a narrower unsigned type. The narrower @@ -15,7 +15,7 @@ bool cannotHoldAnotherUShort(int n1, unsigned short delta) { // clang 8.0.0 -O2: deleted (silently) // gcc 9.2 -O2: deleted (silently) // msvc 19.22 /O2: not deleted - return n1 + delta < n1; // BAD + return n1 + delta < n1; // $ Alert[cpp/signed-overflow-check] // BAD } /* 3. Signed comparison with a non-narrower unsigned type. The @@ -32,7 +32,7 @@ bool shortShort1(unsigned short n1, unsigned short delta) { // BAD [BadAdditionOverflowCheck.ql] // GOOD [SigneOverflowCheck.ql]: Test always fails, but will never overflow. - return n1 + delta < n1; + return n1 + delta < n1; // $ Alert[cpp/bad-addition-overflow-check] } bool shortShort2(unsigned short n1, unsigned short delta) { @@ -70,7 +70,7 @@ extern se *getSo(void); bool func1(se *so) { se *o = getSo(); - if (so->xPos + so->xSize < so->xPos // BAD + if (so->xPos + so->xSize < so->xPos // $ Alert[cpp/signed-overflow-check] // BAD || so->xPos > o->xPos + o->xSize) { // GOOD // clang 8.0.0 -O2: not deleted // gcc 9.2 -O2: not deleted @@ -96,7 +96,7 @@ int checkOverflow4(unsigned int ioff, C c) { int overflow12(int n) { // not deleted by gcc or clang - return (n + 32 <= (unsigned)n? -1: 1); // BAD: n + 32 can overflow + return (n + 32 <= (unsigned)n? -1: 1); // $ Alert[cpp/signed-overflow-check] // BAD: n + 32 can overflow } bool multipleCasts(char x) { @@ -110,7 +110,7 @@ bool multipleCasts2(char x) { // BAD [BadAdditionOverflowCheck.ql] // GOOD [SigneOverflowCheck.ql]: Test always fails, but will never overflow. - return (int)(unsigned short)(x + '1') < (int)(unsigned short)x; + return (int)(unsigned short)(x + '1') < (int)(unsigned short)x; // $ Alert[cpp/bad-addition-overflow-check] } int does_it_overflow(int n1, unsigned short delta) { @@ -119,7 +119,7 @@ int does_it_overflow(int n1, unsigned short delta) { int overflow12b(int n) { // not deleted by gcc or clang - return ((unsigned)(n + 32) <= (unsigned)n? -1: 1); // BAD: n + 32 may overflow + return ((unsigned)(n + 32) <= (unsigned)n? -1: 1); // $ Alert[cpp/signed-overflow-check] // BAD: n + 32 may overflow } #define MACRO(E1, E2) (E1) <= (E2)? -1: 1 @@ -127,4 +127,3 @@ int overflow12b(int n) { int overflow12_macro(int n) { return MACRO((unsigned)(n + 32), (unsigned)n); // GOOD: inside a macro expansion } - diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.qlref index dde648402029..a8d760f993f8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/SignedOverflowCheck.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/SignedOverflowCheck.ql +query: Likely Bugs/Arithmetic/SignedOverflowCheck.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp index 7aa83440fd52..ea71b1bb770b 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp @@ -14,7 +14,7 @@ bool compareValues() { return T1::value < T2::value || // GOOD T1::value < T1::value || // BAD [NOT DETECTED] - C1::value < C1::value ; // BAD + C1::value < C1::value ; // $ Alert[cpp/comparison-of-identical-expressions] // BAD } bool callCompareValues() { @@ -38,4 +38,4 @@ struct Value0 { void instantiation_with_pointless_comparison() { constant_comparison(); // GOOD -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp index e36956f9c690..0dc63a8b2931 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/test.cpp @@ -1,6 +1,6 @@ // Test for BadAdditionOverflowCheck. bool checkOverflow1(unsigned short a, unsigned short b) { - return (a + b < a); // BAD: comparison always false (due to promotion). + return (a + b < a); // $ Alert[cpp/bad-addition-overflow-check] // BAD: comparison always false (due to promotion). } // Test for BadAdditionOverflowCheck. @@ -10,7 +10,7 @@ bool checkOverflow2(unsigned short a, unsigned short b) { // Test for PointlessSelfComparison. bool selfCmp1(int x) { - return (x == (int)x); // BAD: always returns true. + return (x == (int)x); // $ Alert[cpp/comparison-of-identical-expressions] // BAD: always returns true. } // Test for PointlessSelfComparison. @@ -26,8 +26,8 @@ bool isnan(double x) { // Tests for ComparisonWithCancelingSubExpr. void cmpWithCancelingVar1(unsigned short x, unsigned short y, unsigned short z) { bool b; - b = x + y < x + z; // BAD: x can be canceled - b = x + y - x < z; // BAD: x can be canceled + b = x + y < x + z; // $ Alert[cpp/comparison-canceling-subexpr] // BAD: x can be canceled + b = x + y - x < z; // $ Alert[cpp/comparison-canceling-subexpr] // BAD: x can be canceled b = 2*x + y < 2*x + z; // BAD: x can be canceled b = 3*x + y - 2*x < z + x; // BAD: x can be canceled b = (-x) - (+x) < z - 2*x; // BAD: x can be canceled @@ -76,18 +76,18 @@ bool cmpWithCancelingVar3(int x) { bool selfCmp3(unsigned short x) { x++; - return (x == (unsigned short)x); // BAD: always returns true. + return (x == (unsigned short)x); // $ Alert[cpp/comparison-of-identical-expressions] // BAD: always returns true. } bool selfCmp4(int x) { - while (x == x) // BAD: always returns true. + while (x == x) // $ Alert[cpp/comparison-of-identical-expressions] // BAD: always returns true. { x = x + 1; } } bool selfCmp5(int x) { - while (x == x) // BAD: always returns true. [NOT DETECTED] + while (x == x) // $ Alert[cpp/comparison-of-identical-expressions] // BAD: always returns true. [NOT DETECTED] { x++; } @@ -105,7 +105,7 @@ bool checkOverflow3(unsigned int a, unsigned short b) { return false; } - return (a + b < a); // GOOD: b is automatically promoted to unsigned int + return (a + b < a); // $ Alert[cpp/comparison-canceling-subexpr] // GOOD: b is automatically promoted to unsigned int } // We imagine that the next two lines come from a platform-specific header. @@ -115,7 +115,7 @@ typedef unsigned long long size_t; int isSmallEnough(unsigned long long x) { // The cast is to the same syntactic type, and there is no macro involved. // That makes the cast redundant, and therefore the comparison is redundant. - if ((unsigned long long)x != x) { // BAD + if ((unsigned long long)x != x) { // $ Alert[cpp/comparison-of-identical-expressions] // BAD return 0; } // These comparisons are pointless on the platform where this test runs, but @@ -148,5 +148,5 @@ void useMarkRange(int offs) { #define MY_MACRO(x) (x) void myMacroTest(int x) { - MY_MACRO(x == x); // BAD + MY_MACRO(x == x); // $ Alert[cpp/comparison-of-identical-expressions] // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadCheckOdd/BadCheckOdd.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadCheckOdd/BadCheckOdd.qlref index 14c3e5c97e1d..544f107b3ff4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadCheckOdd/BadCheckOdd.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadCheckOdd/BadCheckOdd.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/BadCheckOdd.ql +query: Likely Bugs/Arithmetic/BadCheckOdd.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadCheckOdd/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadCheckOdd/test.cpp index 14d030f14ef7..2fdfe489ce4d 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadCheckOdd/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadCheckOdd/test.cpp @@ -1,5 +1,5 @@ int test1(int x) { - return x % 2 == 1; // BAD + return x % 2 == 1; // $ Alert // BAD } int test2(unsigned int x) { @@ -7,7 +7,7 @@ int test2(unsigned int x) { } int test3(short x) { - return x % 2 == 1; // BAD + return x % 2 == 1; // $ Alert // BAD } int test4(unsigned short x) { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/BitwiseSignCheck.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/BitwiseSignCheck.qlref index 27d5a87962e4..0a74257ab6e0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/BitwiseSignCheck.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/BitwiseSignCheck.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/BitwiseSignCheck.ql \ No newline at end of file +query: Likely Bugs/Arithmetic/BitwiseSignCheck.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp index 8aab27bcf4d2..c1f671a43d1d 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp @@ -1,9 +1,9 @@ bool is_bit_set_v1(int x, int bitnum) { - return (x & (1 << bitnum)) > 0; // BAD + return (x & (1 << bitnum)) > 0; // $ Alert // BAD } bool is_bit_set_v2(int x, int bitnum) { - return ((1 << bitnum) & x) > 0; // BAD + return ((1 << bitnum) & x) > 0; // $ Alert // BAD } bool plain_wrong(int x, int bitnum) { @@ -15,11 +15,11 @@ bool is_bit24_set(int x) { } bool is_bit31_set_bad_v1(int x) { - return (x & (1 << 31)) > 0; // BAD + return (x & (1 << 31)) > 0; // $ Alert // BAD } bool is_bit31_set_bad_v2(int x) { - return 0 < (x & (1 << 31)); // BAD + return 0 < (x & (1 << 31)); // $ Alert // BAD } bool is_bit31_set_good(int x) { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/ComparisonPrecedence.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/ComparisonPrecedence.qlref index 1fd4cfa3e183..1ffebc3c0cbd 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/ComparisonPrecedence.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/ComparisonPrecedence.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/ComparisonPrecedence.ql +query: Likely Bugs/Arithmetic/ComparisonPrecedence.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/template.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/template.cpp index 37280b8da751..e7de054e86aa 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/template.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/template.cpp @@ -1,7 +1,7 @@ template void templateFunc1(T x, T y, T z) { - if (x < y < z) {} // BAD (though dubious as we can imagine other instantiations using an overloaded `operator<`) + if (x < y < z) {} // $ Alert // BAD (though dubious as we can imagine other instantiations using an overloaded `operator<`) if (x < y && y < z) {} // GOOD }; @@ -24,7 +24,7 @@ struct myStruct { int main() { int x = 3; myStruct y; - + templateFunc1(x, x, x); templateFunc2(y, y, y); diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp index 3a82d5c37d59..f727b8bb5669 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp @@ -39,19 +39,19 @@ class MyClass2 { void test1(int x, int y, int z) { // built-in comparison - if (x < y < z) {} // BAD - if (x > y > z) {} // BAD - if (x <= y <= z) {} // BAD - if (x <= y <= z) {} // BAD - if (x < y > z) {} // BAD + if (x < y < z) {} // $ Alert // BAD + if (x > y > z) {} // $ Alert // BAD + if (x <= y <= z) {} // $ Alert // BAD + if (x <= y <= z) {} // $ Alert // BAD + if (x < y > z) {} // $ Alert // BAD if ((x < y) && (y < z)) {} // GOOD if (x < y && y < z) {} // GOOD - if ((x + 1) < (y + 1) < (z + 1)) {} // BAD - if (x < x + y < z) {} // BAD + if ((x + 1) < (y + 1) < (z + 1)) {} // $ Alert // BAD + if (x < x + y < z) {} // $ Alert // BAD if ((x < y) < z) {} // GOOD (this is deliberately allowed) - if (!(x < y < z)) {} // BAD + if (!(x < y < z)) {} // $ Alert // BAD // overloaded comparison { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/FloatComparison.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/FloatComparison.qlref index 7a65c3a0dee0..2984d2c1968a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/FloatComparison.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/FloatComparison.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/FloatComparison.ql +query: Likely Bugs/Arithmetic/FloatComparison.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/c.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/c.c index 9cf59f342c06..5b78d4d4aa70 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/c.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/FloatComparison/c.c @@ -7,13 +7,13 @@ void c_f(void) { x == 3.0; 3.0 == x; x == x; - x == y; + x == y; // $ Alert g() == 3.0; 3.0 == g(); - g() == g(); + g() == g(); // $ Alert - x == g(); - g() == x; + x == g(); // $ Alert + g() == x; // $ Alert } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c index 3d01a28fae0a..388d6a74d6de 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c @@ -3,7 +3,7 @@ void test_float_double1(float f, double d) { float r1 = f * f; // GOOD float r2 = f * d; // GOOD - double r3 = f * f; // BAD + double r3 = f * f; // $ Alert // BAD double r4 = f * d; // GOOD float f1 = fabsf(f * f); // GOOD @@ -18,7 +18,7 @@ float fabsf(float f); void test_float_double2(float f, double d) { float r1 = f * f; // GOOD float r2 = f * d; // GOOD - double r3 = f * f; // BAD + double r3 = f * f; // $ Alert // BAD double r4 = f * d; // GOOD float f1 = fabsf(f * f); // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c index 7639c76bd8fc..08e799fe7950 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c @@ -1,10 +1,10 @@ long long f(short x, int y, long long z) { y == x * x; // safe y == x * (int)x; // safe - z == y * x; // unsafe + z == y * x; // $ Alert // unsafe z == (long long)(y * x); // we assume the user knows what they are doing if(x == 56) - return y * y; // unsafe + return y * y; // $ Alert // unsafe if(x == 56) return (long long)(y * y); // we assume the user knows what they are doing return 42 * 23; // safe @@ -15,10 +15,10 @@ void int_float(int i, int j, long long ll, float f, float g, double h, char c) { // but the target type does not imply that the developer anticipates one as with // an int -> long long conversion. We should therefore not flag these cases. - double v1_1 = f * g; // unsafe (float -> double) + double v1_1 = f * g; // $ Alert // unsafe (float -> double) double v1_2 = f * (double)g; // safe - double v2_1 = (i + j) * f; // unsafe (float -> double) + double v2_1 = (i + j) * f; // $ Alert // unsafe (float -> double) double v2_2 = (i + j) * (double)f; // safe double v3_1 = i * j; // dubious (int -> double) @@ -35,7 +35,7 @@ void int_float(int i, int j, long long ll, float f, float g, double h, char c) { int v6_1 = f * g; // safe (float -> int) int v6_2 = (int)f * g; // safe - double v7_1 = f * f; // unsafe (float -> double) + double v7_1 = f * f; // $ Alert // unsafe (float -> double) double v7_2 = h * h; // safe double v7_3 = (f * f); // unsafe (float -> double) [NOT DETECTED] @@ -54,13 +54,13 @@ void int_float(int i, int j, long long ll, float f, float g, double h, char c) { float v12_1 = 1.0 + f * f + f * f; // dubious (float -> double -> float) float v12_2 = 1.0f + f * f + f * f; // safe - + double v13_1 = f * f * 2.0; // unsafe (float -> double) [NOT DETECTED] - double v13_2 = f * f * 2.0f; // unsafe (float -> double) + double v13_2 = f * f * 2.0f; // $ Alert // unsafe (float -> double) - long long v14_1 = i * (i + 2) + ll; // unsafe (int -> long long) + long long v14_1 = i * (i + 2) + ll; // $ Alert // unsafe (int -> long long) long long v14_2 = i * (i + 2ll) * ll; // safe - long long v14_3 = i * (i + (int)2ll) + ll; // unsafe (int -> long long) + long long v14_3 = i * (i + (int)2ll) + ll; // $ Alert // unsafe (int -> long long) } typedef unsigned long long size_t; @@ -72,7 +72,7 @@ void use_size_t(int W, int H) int y = 20; const int vs[] = {10, 20}; - malloc(W * H); // unsafe (int -> size_t) + malloc(W * H); // $ Alert // unsafe (int -> size_t) malloc((size_t)W * (size_t)H); // safe malloc(10 * 20); // safe (small values) @@ -96,16 +96,16 @@ size_t three_chars(unsigned char a, unsigned char b, unsigned char c) { void g(unsigned char uchar1, unsigned char uchar2, unsigned char uchar3, int i) { unsigned long ulong1, ulong2, ulong3, ulong4, ulong5; ulong1 = (uchar1 + 1) * (uchar2 + 1); // GOOD - ulong2 = (i + 1) * (uchar2 + 1); // BAD + ulong2 = (i + 1) * (uchar2 + 1); // $ Alert // BAD ulong3 = (uchar1 + 1) * (uchar2 + 1) * (uchar3 + 1); // GOOD ulong4 = (uchar1 + (uchar1 + 1)) * (uchar2 + 1); // GOOD - ulong5 = (i + (uchar1 + 1)) * (uchar2 + 1); // BAD + ulong5 = (i + (uchar1 + 1)) * (uchar2 + 1); // $ Alert // BAD ulong5 = (uchar1 + 1073741824) * uchar2; // BAD [NOT DETECTED] ulong5 = (uchar1 + (1 << 30)) * uchar2; // BAD [NOT DETECTED] ulong5 = uchar1 * uchar1 * uchar1 * uchar2 * uchar2 * uchar2; // BAD [NOT DETECTED] - ulong5 = (uchar1 + (unsigned short)(-1)) * (uchar2 + (unsigned short)(-1)); // BAD + ulong5 = (uchar1 + (unsigned short)(-1)) * (uchar2 + (unsigned short)(-1)); // $ Alert // BAD } struct A { @@ -116,13 +116,13 @@ struct A { void g2(struct A* a, short n) { unsigned long ulong1, ulong2; ulong1 = (a->s - 1) * ((*a).s + 1); // GOOD - ulong2 = a->i * (*a).i; // BAD + ulong2 = a->i * (*a).i; // $ Alert // BAD } int global_i; unsigned char global_uchar; void g3() { unsigned long ulong1, ulong2; - ulong1 = global_i * global_i; // BAD + ulong1 = global_i * global_i; // $ Alert // BAD ulong2 = (global_uchar + 1) * 2; // GOOD -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.cpp index 28f22194ff7a..33afaa6677b3 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.cpp @@ -1,5 +1,5 @@ int i = 2000000000; -long j = i * i; // BAD +long j = i * i; // $ Alert // BAD long k = (long) i * i; // GOOD long l = (long) (i * i); // permitted as the conversion is explicit long m = static_cast (i) * i; // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.qlref index d2ced0155755..4616a5ea9dc8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/IntMultToLong.ql +query: Likely Bugs/Arithmetic/IntMultToLong.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/ConstVirtual.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/ConstVirtual.cpp index b04f344c26ab..cb16417afec0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/ConstVirtual.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/ConstVirtual.cpp @@ -21,7 +21,7 @@ int g(C *c, int i) { return -1; } - if (i > 0) { // BAD + if (i > 0) { // $ Alert[cpp/constant-comparison] // BAD return 1; } else { return 0; diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c index fd1bc655051d..b024284751ff 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c @@ -4,19 +4,19 @@ void myFunction1() { for (i = 0;; i = i+1) { - if (i < 20) result++; - if (i <= 20) result++; - if (i > 20) result++; - if (i >= 20) result++; - if (i == 20) result++; - if (i != 20) result++; - - if (i < -1) result++; - if (i <= -1) result++; - if (i > -1) result++; - if (i >= -1) result++; - if (i == -1) result++; - if (i != -1) result++; + if (i < 20) result++; // $ Alert[cpp/constant-comparison] + if (i <= 20) result++; // $ Alert[cpp/constant-comparison] + if (i > 20) result++; // $ Alert[cpp/constant-comparison] + if (i >= 20) result++; // $ Alert[cpp/constant-comparison] + if (i == 20) result++; // $ Alert[cpp/constant-comparison] + if (i != 20) result++; // $ Alert[cpp/constant-comparison] + + if (i < -1) result++; // $ Alert[cpp/constant-comparison] + if (i <= -1) result++; // $ Alert[cpp/constant-comparison] + if (i > -1) result++; // $ Alert[cpp/constant-comparison] + if (i >= -1) result++; // $ Alert[cpp/constant-comparison] + if (i == -1) result++; // $ Alert[cpp/constant-comparison] + if (i != -1) result++; // $ Alert[cpp/constant-comparison] if (i < 5) result++; if (i <= 5) result++; @@ -35,19 +35,19 @@ void myFunction2() { for (i = 0;; i++) { - if (i < 20) result++; - if (i <= 20) result++; - if (i > 20) result++; - if (i >= 20) result++; - if (i == 20) result++; - if (i != 20) result++; + if (i < 20) result++; // $ Alert[cpp/constant-comparison] + if (i <= 20) result++; // $ Alert[cpp/constant-comparison] + if (i > 20) result++; // $ Alert[cpp/constant-comparison] + if (i >= 20) result++; // $ Alert[cpp/constant-comparison] + if (i == 20) result++; // $ Alert[cpp/constant-comparison] + if (i != 20) result++; // $ Alert[cpp/constant-comparison] - if (i < -1) result++; - if (i <= -1) result++; - if (i > -1) result++; - if (i >= -1) result++; - if (i == -1) result++; - if (i != -1) result++; + if (i < -1) result++; // $ Alert[cpp/constant-comparison] + if (i <= -1) result++; // $ Alert[cpp/constant-comparison] + if (i > -1) result++; // $ Alert[cpp/constant-comparison] + if (i >= -1) result++; // $ Alert[cpp/constant-comparison] + if (i == -1) result++; // $ Alert[cpp/constant-comparison] + if (i != -1) result++; // $ Alert[cpp/constant-comparison] if (i < 5) result++; if (i <= 5) result++; @@ -62,7 +62,7 @@ void myFunction2() { int myFunction3(int i) { if (i < 4) { - if (i < 5) { + if (i < 5) { // $ Alert[cpp/constant-comparison] return 1; } } @@ -100,11 +100,11 @@ int myFunction4() { // Pointless checks for unsigned values being negative int unsignedBounds(unsigned int a, unsigned long b, unsigned long long c) { - if (a < 0) { + if (a < 0) { // $ Alert[cpp/constant-comparison] return 1; } - if (b >= 0) { // UnsignedGEZero - if (b > 0 && c < 0) { // Only the test of c is bad here + if (b >= 0) { // $ Alert[cpp/unsigned-comparison-zero] // UnsignedGEZero + if (b > 0 && c < 0) { // $ Alert[cpp/constant-comparison] // Only the test of c is bad here return 1; } } @@ -113,20 +113,20 @@ int unsignedBounds(unsigned int a, unsigned long b, unsigned long long c) { int twoReasons(int a, int b) { if (a <= 0 && b > 5) { - return a < b; + return a < b; // $ Alert[cpp/constant-comparison] } if (a <= 100 && b > 105) { // BUG [Not detected - this clause is always false] - return a > b; + return a > b; // $ Alert[cpp/constant-comparison] } return 0; } int repeatedComparisons(int a) { if (a >= 20) { - return a >= 20; + return a >= 20; // $ Alert[cpp/constant-comparison] } if (a <= 3) { - return a > 3; + return a > 3; // $ Alert[cpp/constant-comparison] } return 0; } @@ -194,7 +194,7 @@ int myFunction5(int x) { i++; } d = i; - if (x < 0) { // Comparison is always false. + if (x < 0) { // $ Alert[cpp/constant-comparison] // Comparison is always false. if (d > -x) { // Unreachable code. return 1; } @@ -239,7 +239,7 @@ void macroExpansionTest() { int x; MAYBE_DO(x = 1); // GOOD (the problem is in the macro) - MAYBE_DO(if (global_setting >= 0) {x = 2;}); // BAD (the problem is in the invocation) + MAYBE_DO(if (global_setting >= 0) {x = 2;}); // $ Alert[cpp/unsigned-comparison-zero] // BAD (the problem is in the invocation) } int overeager_wraparound(unsigned int u32bound, unsigned long long u64bound) { @@ -261,7 +261,7 @@ int overeager_wraparound(unsigned int u32bound, unsigned long long u64bound) { int negative_zero(double dbl) { if (dbl >= 0) { - return dbl >= -dbl; // GOOD [FALSE POSITIVE] + return dbl >= -dbl; // $ Alert[cpp/constant-comparison] // GOOD [FALSE POSITIVE] } return 0; } @@ -270,7 +270,7 @@ typedef unsigned char u8; int widening_cast1(u8 c) { if (c == 0) { - if ((int)c > 0) { // BAD + if ((int)c > 0) { // $ Alert[cpp/constant-comparison] // BAD return 1; } } @@ -280,7 +280,7 @@ int widening_cast1(u8 c) { int widening_cast2(u8 c) { if (c <= 10) return -1; - else if ((c >= 11) /* BAD */ && (c <= 47)) + else if ((c >= 11) /* BAD */ && (c <= 47)) // $ Alert[cpp/constant-comparison] return 0; else return 1; @@ -291,7 +291,7 @@ int unsigned_implicit_conversion(unsigned int ui1) { // implicit signedness conversion is on the constants (0 and 5), not on the // variables (ui1). if (ui1 == 0) { - if (ui1 >= 5) { // BAD + if (ui1 >= 5) { // $ Alert[cpp/constant-comparison] // BAD return 1; } } @@ -300,7 +300,7 @@ int unsigned_implicit_conversion(unsigned int ui1) { int signedness_cast1(u8 c) { if ((signed char)c == 0) { - if (c >= 5) { // BAD + if (c >= 5) { // $ Alert[cpp/constant-comparison] // BAD return 1; } } @@ -309,7 +309,7 @@ int signedness_cast1(u8 c) { int signedness_cast2(signed char c) { if ((u8)c == 0) { - if (c >= 5) { // BAD + if (c >= 5) { // $ Alert[cpp/constant-comparison] // BAD return 1; } } @@ -334,7 +334,7 @@ int nan2(double x) { if (x < 0.0) { return 100; } - else if (x >= 0.0) { // BAD [Always true] + else if (x >= 0.0) { // $ Alert[cpp/constant-comparison] // BAD [Always true] return 200; } else { @@ -369,8 +369,8 @@ void shifts(void) { unsigned int x = 3; - if (x >> 1 >= 1) {} // always true - if (x >> 1 >= 2) {} // always false + if (x >> 1 >= 1) {} // $ Alert[cpp/constant-comparison] // always true + if (x >> 1 >= 2) {} // $ Alert[cpp/constant-comparison] // always false if (x >> 1 == 1) {} // always true [NOT DETECTED] } @@ -380,15 +380,15 @@ void bitwise_ands() if ((x & 2) >= 1) {} if ((x & 2) >= 2) {} - if ((x & 2) >= 3) {} // always false + if ((x & 2) >= 3) {} // $ Alert[cpp/constant-comparison] // always false } void unsigned_mult(unsigned int x, unsigned int y) { if(x < 13 && y < 35) { - if(x * y > 1024) {} // always false + if(x * y > 1024) {} // $ Alert[cpp/constant-comparison] // always false if(x * y < 204) {} if(x >= 3 && y >= 2) { - if(x * y < 5) {} // always false + if(x * y < 5) {} // $ Alert[cpp/constant-comparison] // always false } } } @@ -411,7 +411,7 @@ void mult_overflow() { // to 64-bit unsigned. x = 274177UL; y = 67280421310721UL; - if (x * y == 1) {} // always true [BUG: reported as always false] + if (x * y == 1) {} // $ Alert[cpp/constant-comparison] // always true [BUG: reported as always false] // This bug appears to be caused by // `RangeAnalysisUtils::typeUpperBound(unsigned long)` having a result of diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.cpp index ce04ddcf0814..d6462ea2b991 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.cpp @@ -6,7 +6,7 @@ struct A { const int int_member = 0; A(int n) : int_member(n) { if(int_member <= 10) { - + } } }; @@ -33,13 +33,13 @@ int extreme_values(void) unsigned long long int x = 0xFFFFFFFFFFFFFFFF; unsigned long long int y = 0xFFFFFFFFFFFF; - if (x >> 1 >= 0xFFFFFFFFFFFFFFFF) {} // always false + if (x >> 1 >= 0xFFFFFFFFFFFFFFFF) {} // $ Alert[cpp/constant-comparison] // always false if (x >> 1 >= 0x8000000000000000) {} // always false [NOT DETECTED] if (x >> 1 >= 0x7FFFFFFFFFFFFFFF) {} // always true [NOT DETECTED] if (x >> 1 >= 0xFFFFFFFFFFFFFFF) {} // always true [NOT DETECTED] - if (y >> 1 >= 0xFFFFFFFFFFFF) {} // always false - if (y >> 1 >= 0x800000000000) {} // always false - if (y >> 1 >= 0x7FFFFFFFFFFF) {} // always true - if (y >> 1 >= 0xFFFFFFFFFFF) {} // always true + if (y >> 1 >= 0xFFFFFFFFFFFF) {} // $ Alert[cpp/constant-comparison] // always false + if (y >> 1 >= 0x800000000000) {} // $ Alert[cpp/constant-comparison] // always false + if (y >> 1 >= 0x7FFFFFFFFFFF) {} // $ Alert[cpp/constant-comparison] // always true + if (y >> 1 >= 0xFFFFFFFFFFF) {} // $ Alert[cpp/constant-comparison] // always true } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.qlref index e3713c2911d9..150f789c59dc 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/PointlessComparison.ql +query: Likely Bugs/Arithmetic/PointlessComparison.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/RegressionTests.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/RegressionTests.cpp index 0ba766eda1d2..739c37dc7901 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/RegressionTests.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/RegressionTests.cpp @@ -54,7 +54,7 @@ static int foo(size_t *size) { int bar; - if (*size <= MAX_VAL) // BAD (pointless comparison) [NO LONGER REPORTED] + if (*size <= MAX_VAL) // $ Alert[cpp/constant-comparison] // BAD (pointless comparison) [NO LONGER REPORTED] *size = MAX_VAL; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/Templates.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/Templates.cpp index a211b2307805..a50ce92c30e5 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/Templates.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/Templates.cpp @@ -6,7 +6,7 @@ bool sometimesPointless(T param) { template bool alwaysPointless(T param) { short local = param; - return local <= 0xFFFF; // BAD (in all instantiations) + return local <= 0xFFFF; // $ Alert[cpp/constant-comparison] // BAD (in all instantiations) } static int caller(int i) { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/UnsignedGEZero.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/UnsignedGEZero.qlref index 4cf4c8eb0942..7a798dc7e917 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/UnsignedGEZero.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/UnsignedGEZero.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/UnsignedGEZero.ql +query: Likely Bugs/Arithmetic/UnsignedGEZero.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/Templates.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/Templates.cpp index a56f9c88c81d..dd1f1b6e3a4a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/Templates.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/Templates.cpp @@ -6,7 +6,7 @@ bool sometimesPointless(T param) { template bool alwaysPointless(T param) { unsigned int local = param; - return local >= 0; // BAD (in all instantiations) + return local >= 0; // $ Alert // BAD (in all instantiations) } static int caller(int i) { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.c index 749468450ef9..e1b028fcbb4a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.c @@ -37,7 +37,7 @@ void myFunction() { myEnum1 e1; myEnum2 e2; - if (ui >= 0) { // violation + if (ui >= 0) { // $ Alert // violation } if (ui >= 1) { } @@ -45,21 +45,21 @@ void myFunction() { } if (ui < 0) { } - if (UI >= ZERO) { // violation + if (UI >= ZERO) { // $ Alert // violation } if (si >= 0) { } if (ui_ptr >= NULL) { // unsafe, but not a violation of UnsignedGEZero.ql } - if (uc >= 0) { // violation + if (uc >= 0) { // $ Alert // violation } if (sc >= 0) { } - if (u16 >= 0) { // violation + if (u16 >= 0) { // $ Alert // violation } if (s16 >= 0) { } - if (ull >= 0) { // violation + if (ull >= 0) { // $ Alert // violation } if (sll >= 0) { } @@ -72,33 +72,33 @@ void myFunction() { if (e2 >= 0) { } - if (ui >= const_zero) { // violation + if (ui >= const_zero) { // $ Alert // violation } if (ui >= maybe_zero) { } - if ((unsigned int)si >= 0) { // violation + if ((unsigned int)si >= 0) { // $ Alert // violation } if ((signed int)ui >= 0) { } - if ((unsigned char)ui >= 0) { // violation + if ((unsigned char)ui >= 0) { // $ Alert // violation } if ((signed char)ui >= 0) { } - if ((unsigned char)si >= 0) { // violation + if ((unsigned char)si >= 0) { // $ Alert // violation } if ((signed char)si >= 0) { } - if ((signed int)uc >= 0) { // violation + if ((signed int)uc >= 0) { // $ Alert // violation } - if ((unsigned int)uc >= 0) { // violation + if ((unsigned int)uc >= 0) { // $ Alert // violation } if ((signed int)sc >= 0) { } - if ((unsigned int)sc >= 0) { // violation + if ((unsigned int)sc >= 0) { // $ Alert // violation } - assert(ui >= 0); // violation + assert(ui >= 0); // $ Alert // violation assert(si >= 0); CHECK_RANGE(ui, 0, 10); // reasonable use @@ -108,32 +108,32 @@ void myFunction() { CHECK_RANGE(e2, BANANA, PEAR); CHECK_RANGE(e2, 0, PEAR); - assert(ui >= 0 && ui <= 100); // violation + assert(ui >= 0 && ui <= 100); // $ Alert // violation assert(CHECK_RANGE(ui, 0, 10)); // reasonable use assert(UI >= ZERO); // violation (not detected) - assert(ui GE 0); // violation + assert(ui GE 0); // $ Alert // violation - if ((unsigned char)si >= 0) { // violation + if ((unsigned char)si >= 0) { // $ Alert // violation } - if ((unsigned char)(signed int)si >= 0) { // violation + if ((unsigned char)(signed int)si >= 0) { // $ Alert // violation } - if ((signed int)(unsigned char)si >= 0) { // violation + if ((signed int)(unsigned char)si >= 0) { // $ Alert // violation } - if ((unsigned char)(signed char)si >= 0) { // violation + if ((unsigned char)(signed char)si >= 0) { // $ Alert // violation } if ((signed char)(unsigned char)si >= 0) { } - if ((signed int)(unsigned char)(signed int)si >= 0) { // violation + if ((signed int)(unsigned char)(signed int)si >= 0) { // $ Alert // violation } if ((signed char)(unsigned char)(signed int)si >= 0) { } - if ((signed int)(unsigned char)(signed char)si >= 0) { // violation + if ((signed int)(unsigned char)(signed char)si >= 0) { // $ Alert // violation } if (ui <= 0) { } - if (0 <= ui) { // violation + if (0 <= ui) { // $ Alert // violation } if (0 < ui) { } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.cpp index 6b939e29b76d..baaca124271e 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.cpp @@ -37,7 +37,7 @@ void myFunction() { myEnum1 e1; myEnum2 e2; - if (ui >= 0) { // violation + if (ui >= 0) { // $ Alert // violation } if (ui >= 1) { } @@ -45,21 +45,21 @@ void myFunction() { } if (ui < 0) { } - if (UI >= ZERO) { // violation + if (UI >= ZERO) { // $ Alert // violation } if (si >= 0) { } if (ui_ptr >= NULL) { // unsafe, but not a violation of UnsignedGEZero.ql } - if (uc >= 0) { // violation + if (uc >= 0) { // $ Alert // violation } if (sc >= 0) { } - if (u16 >= 0) { // violation + if (u16 >= 0) { // $ Alert // violation } if (s16 >= 0) { } - if (ull >= 0) { // violation + if (ull >= 0) { // $ Alert // violation } if (sll >= 0) { } @@ -72,33 +72,33 @@ void myFunction() { if (e2 >= 0) { } - if (ui >= const_zero) { // violation + if (ui >= const_zero) { // $ Alert // violation } if (ui >= maybe_zero) { } - if ((unsigned int)si >= 0) { // violation + if ((unsigned int)si >= 0) { // $ Alert // violation } if ((signed int)ui >= 0) { } - if ((unsigned char)ui >= 0) { // violation + if ((unsigned char)ui >= 0) { // $ Alert // violation } if ((signed char)ui >= 0) { } - if ((unsigned char)si >= 0) { // violation + if ((unsigned char)si >= 0) { // $ Alert // violation } if ((signed char)si >= 0) { } - if ((signed int)uc >= 0) { // violation + if ((signed int)uc >= 0) { // $ Alert // violation } - if ((unsigned int)uc >= 0) { // violation + if ((unsigned int)uc >= 0) { // $ Alert // violation } if ((signed int)sc >= 0) { } - if ((unsigned int)sc >= 0) { // violation + if ((unsigned int)sc >= 0) { // $ Alert // violation } - assert(ui >= 0); // violation + assert(ui >= 0); // $ Alert // violation assert(si >= 0); CHECK_RANGE(ui, 0, 10); // reasonable use @@ -108,32 +108,32 @@ void myFunction() { CHECK_RANGE(e2, BANANA, PEAR); CHECK_RANGE(e2, 0, PEAR); - assert(ui >= 0 && ui <= 100); // violation + assert(ui >= 0 && ui <= 100); // $ Alert // violation assert(CHECK_RANGE(ui, 0, 10)); // reasonable use assert(UI >= ZERO); // violation (not detected) - assert(ui GE 0); // violation + assert(ui GE 0); // $ Alert // violation - if ((unsigned char)si >= 0) { // violation + if ((unsigned char)si >= 0) { // $ Alert // violation } - if ((unsigned char)(signed int)si >= 0) { // violation + if ((unsigned char)(signed int)si >= 0) { // $ Alert // violation } - if ((signed int)(unsigned char)si >= 0) { // violation + if ((signed int)(unsigned char)si >= 0) { // $ Alert // violation } - if ((unsigned char)(signed char)si >= 0) { // violation + if ((unsigned char)(signed char)si >= 0) { // $ Alert // violation } if ((signed char)(unsigned char)si >= 0) { } - if ((signed int)(unsigned char)(signed int)si >= 0) { // violation + if ((signed int)(unsigned char)(signed int)si >= 0) { // $ Alert // violation } if ((signed char)(unsigned char)(signed int)si >= 0) { } - if ((signed int)(unsigned char)(signed char)si >= 0) { // violation + if ((signed int)(unsigned char)(signed char)si >= 0) { // $ Alert // violation } if (ui <= 0) { } - if (0 <= ui) { // violation + if (0 <= ui) { // $ Alert // violation } if (0 < ui) { } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.qlref b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.qlref index 4cf4c8eb0942..7a798dc7e917 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.qlref @@ -1 +1,2 @@ -Likely Bugs/Arithmetic/UnsignedGEZero.ql +query: Likely Bugs/Arithmetic/UnsignedGEZero.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/ContinueInFalseLoop/ContinueInFalseLoop.qlref b/cpp/ql/test/query-tests/Likely Bugs/ContinueInFalseLoop/ContinueInFalseLoop.qlref index 48d9feb20721..2ba384a7922b 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ContinueInFalseLoop/ContinueInFalseLoop.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/ContinueInFalseLoop/ContinueInFalseLoop.qlref @@ -1 +1,2 @@ -Likely Bugs/ContinueInFalseLoop.ql +query: Likely Bugs/ContinueInFalseLoop.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/ContinueInFalseLoop/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/ContinueInFalseLoop/test.cpp index 0ece8727e666..e91c6b4b856b 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ContinueInFalseLoop/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/ContinueInFalseLoop/test.cpp @@ -10,7 +10,7 @@ void test1(int x) do { if (cond()) - continue; // BAD + continue; // $ Alert // BAD if (cond()) break; } while (false); @@ -56,7 +56,7 @@ void test1(int x) do { if (cond()) - continue; // BAD + continue; // $ Alert // BAD if (cond()) break; } while (false); diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/ArrayArgSizeMismatch.qlref b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/ArrayArgSizeMismatch.qlref index 2e2747737a9b..2e410dcc8c8c 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/ArrayArgSizeMismatch.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/ArrayArgSizeMismatch.qlref @@ -1 +1,2 @@ -Likely Bugs/Conversion/ArrayArgSizeMismatch.ql +query: Likely Bugs/Conversion/ArrayArgSizeMismatch.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp index 52b8f41bf22b..f4a60ece66a9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp @@ -21,7 +21,7 @@ void test(float f3[3], float f4[4], float f5[5], float *fp) f(arr3); // GOOD f(arr4); // GOOD f(arr5); // GOOD - g(arr3); // BAD + g(arr3); // $ Alert // BAD g(arr4); // GOOD g(arr5); // GOOD @@ -39,11 +39,11 @@ void test(float f3[3], float f4[4], float f5[5], float *fp) ms->data[0] = ms->data[1] = ms->data[2] = ms->data[3] = 0; h(ms->data); // GOOD } - + { // char array char ca[4 * sizeof(int)]; - + g((int *)ca); // GOOD } }; diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/CastArrayPointerArithmetic/CastArrayPointerArithmetic.qlref b/cpp/ql/test/query-tests/Likely Bugs/Conversion/CastArrayPointerArithmetic/CastArrayPointerArithmetic.qlref index 4e95e41b5cb9..dc496d3c7c6a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/CastArrayPointerArithmetic/CastArrayPointerArithmetic.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/CastArrayPointerArithmetic/CastArrayPointerArithmetic.qlref @@ -1 +1,2 @@ -Likely Bugs/Conversion/CastArrayPointerArithmetic.ql +query: Likely Bugs/Conversion/CastArrayPointerArithmetic.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/CastArrayPointerArithmetic/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Conversion/CastArrayPointerArithmetic/test.cpp index fce974f6012f..25df25f1694a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/CastArrayPointerArithmetic/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/CastArrayPointerArithmetic/test.cpp @@ -24,15 +24,15 @@ class DerivedSameSize: public Base { }; void dereference_base(Base *b) { - b[2].x; + b[2].x; // $ Alert } void dereference_array_base(Base b[]) { - b[2].x; + b[2].x; // $ Alert } void pointer_arith_base(Base *b) { - b + 2; + b + 2; // $ Alert } void dereference_derived(Derived *d) { @@ -54,9 +54,9 @@ void char_pointer_arith(Base *b) { void test () { Derived d[4]; - dereference_base(d); // BAD: implicit conversion to Base* - dereference_array_base(d); // BAD: implicit conversion to Base* - pointer_arith_base(d); // BAD: implicit conversion to Base* + dereference_base(d); // $ Source // BAD: implicit conversion to Base* + dereference_array_base(d); // $ Source // BAD: implicit conversion to Base* + pointer_arith_base(d); // $ Source // BAD: implicit conversion to Base* dereference_derived(d); // GOOD: implicit conversion to Derived*, which will be the right size dereference_array_derived(d); // GOOD: implicit conversion to Derived*, which will be the right size @@ -71,9 +71,9 @@ void test () { DerivedSameSize dss[4]; - dereference_base(dss); // BAD: same size on Linux but different on Windows - dereference_array_base(dss); // BAD: same size on Linux but different on Windows - pointer_arith_base(dss); // BAD: same size on Linux but different on Windows + dereference_base(dss); // $ Source // BAD: same size on Linux but different on Windows + dereference_array_base(dss); // $ Source // BAD: same size on Linux but different on Windows + pointer_arith_base(dss); // $ Source // BAD: same size on Linux but different on Windows DerivedNoField dnf[4]; @@ -83,9 +83,9 @@ void test () { Derived2 d2[4]; - dereference_base(d2); // BAD: implicit conversion to Base* - dereference_array_base(d2); // BAD: implicit conversion to Base* - pointer_arith_base(d2); // BAD: implicit conversion to Base* + dereference_base(d2); // $ Source // BAD: implicit conversion to Base* + dereference_array_base(d2); // $ Source // BAD: implicit conversion to Base* + pointer_arith_base(d2); // $ Source // BAD: implicit conversion to Base* dereference_derived(d2); // GOOD: implicit conversion to Derived*, which will be the right size dereference_array_derived(d2); // GOOD: implicit conversion to Derived*, which will be the right size diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ImplicitDowncastFromBitfield/ImplicitDowncastFromBitfield.qlref b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ImplicitDowncastFromBitfield/ImplicitDowncastFromBitfield.qlref index ff7d11977d9c..7ae992bd7520 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ImplicitDowncastFromBitfield/ImplicitDowncastFromBitfield.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ImplicitDowncastFromBitfield/ImplicitDowncastFromBitfield.qlref @@ -1 +1,2 @@ -Likely Bugs/Conversion/ImplicitDowncastFromBitfield.ql +query: Likely Bugs/Conversion/ImplicitDowncastFromBitfield.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ImplicitDowncastFromBitfield/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ImplicitDowncastFromBitfield/test.cpp index 3bcb6afe4b4c..399ee48cdce9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ImplicitDowncastFromBitfield/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ImplicitDowncastFromBitfield/test.cpp @@ -7,7 +7,7 @@ int getX1(my_struct m) { } short getX2(my_struct m) { - return m.x; // BAD + return m.x; // $ Alert // BAD } short getX3(my_struct m) { @@ -23,7 +23,7 @@ short getX5(my_struct m) { } const char& getx6(my_struct& m) { - const char& result = m.x; // BAD + const char& result = m.x; // $ Alert // BAD return result; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/LossyFunctionResultCast.qlref b/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/LossyFunctionResultCast.qlref index cb6a31a262e3..a1dd642e7985 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/LossyFunctionResultCast.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/LossyFunctionResultCast.qlref @@ -1 +1,2 @@ -Likely Bugs/Conversion/LossyFunctionResultCast.ql +query: Likely Bugs/Conversion/LossyFunctionResultCast.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp index 552f3eecc39c..ce5328772201 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp @@ -30,19 +30,19 @@ void test1() setPosInt(getInt()); setPosFloat(getInt()); } - if (getFloat()) // BAD + if (getFloat()) // $ Alert // BAD { - setPosInt(getFloat()); // BAD + setPosInt(getFloat()); // $ Alert // BAD setPosFloat(getFloat()); } - if (getDouble()) // BAD + if (getDouble()) // $ Alert // BAD { - setPosInt(getDouble()); // BAD + setPosInt(getDouble()); // $ Alert // BAD setPosFloat(getDouble()); } - if (getMyLD()) // BAD + if (getMyLD()) // $ Alert // BAD { - setPosInt(getMyLD()); // BAD + setPosInt(getMyLD()); // $ Alert // BAD setPosFloat(getMyLD()); } if (getFloatPtr()) @@ -98,11 +98,11 @@ int test2(double v, double w, int n) case 2: return pow(10, v); // GOOD case 3: - return pow(2.5, v); // BAD + return pow(2.5, v); // $ Alert // BAD case 4: - return pow(v, 2); // BAD + return pow(v, 2); // $ Alert // BAD case 5: - return pow(v, w); // BAD + return pow(v, w); // $ Alert // BAD }; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.c index d7b60aebe88a..2d486dae3510 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.c @@ -25,9 +25,9 @@ extern char *any_random_function(const char *); #define NULL ((void*)0) #define _(X) gettext(X) -int main(int argc, char **argv) { +int main(int argc, char **argv) { // $ Source if(argc > 1) - printf(argv[1]); // BAD + printf(argv[1]); // $ Alert // BAD else printf("No argument supplied.\n"); // GOOD @@ -38,11 +38,11 @@ int main(int argc, char **argv) { printf(ngettext("One argument\n", "%d arguments\n", argc-1), argc-1); // GOOD printf(gettext("%d arguments\n"), argc-1); // GOOD - printf(any_random_function("%d arguments\n"), argc-1); // BAD + printf(any_random_function("%d arguments\n"), argc-1); // $ Alert // BAD - printf(_(any_random_function("%d arguments\n")), argc-1); // BAD + printf(_(any_random_function("%d arguments\n")), argc-1); // $ Alert // BAD return 0; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.qlref index ef8de5d288ac..cb71273232ca 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/NonConstantFormat.ql +query: Likely Bugs/Format/NonConstantFormat.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/nested.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/nested.cpp index 1c3d2513da54..56bf4706bd67 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/nested.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/nested.cpp @@ -18,7 +18,7 @@ extern "C" int snprintf ( char * s, int n, const char * format, ... ); struct A { void do_print(const char *fmt0) { char buf[32]; - snprintf(buf, 32, fmt0); // BAD, all paths from unknown const char*, not assuming literal + snprintf(buf, 32, fmt0); // $ Alert // BAD, all paths from unknown const char*, not assuming literal } }; @@ -39,7 +39,7 @@ struct C { void foo(void) { C c; - c.do_some_printing(c.ext_fmt_str()); + c.do_some_printing(c.ext_fmt_str()); // $ Source } struct some_class { @@ -76,15 +76,15 @@ void diagnostic(const char *fmt, ...) } void bar(void) { - diagnostic (some_instance->get_fmt()); // BAD const char* but not assuming literal + diagnostic (some_instance->get_fmt()); // $ Alert // BAD const char* but not assuming literal } namespace ns { - class blab { + class blab { void out1(void) { - char *fmt = (char *)__builtin_alloca(10); - diagnostic(fmt); // BAD + char *fmt = (char *)__builtin_alloca(10); // $ Source + diagnostic(fmt); // $ Alert // BAD } }; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp index e60db94f9b1c..d562142df536 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp @@ -43,7 +43,7 @@ const char *const_wash(char *str) { return str; } -int main(int argc, char **argv) { +int main(int argc, char **argv) { // $ Source const char *message = messages[2]; printf(choose_message(argc - 1), argc - 1); // GOOD printf(messages[1]); // GOOD @@ -111,9 +111,9 @@ int main(int argc, char **argv) { } { const char *hello = "Hello, World\n"; - const char *const *p = &hello; + const char *const *p = &hello; printf(hello); // GOOD - hello++; + hello++; } printf(argc > 2 ? "More than one\n" : _("Only one\n")); // GOOD @@ -127,7 +127,7 @@ int main(int argc, char **argv) { char buffer[1024]; MYSPRINTF(buffer, "constant"); // GOOD - MYSPRINTF(buffer, argv[0]); // BAD + MYSPRINTF(buffer, argv[0]); // $ Alert // BAD } } @@ -164,10 +164,10 @@ void fmt_with_assignment() { printf(y); // GOOD } -void fmt_via_strcpy_bad(char *data) { - char res[100]; +void fmt_via_strcpy_bad(char *data) { // $ Source + char res[100]; strcpy(res, data); - printf(res); // BAD + printf(res); // $ Alert // BAD } @@ -180,71 +180,71 @@ void StringCchPrintfW( STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszFormat, - ... + ... ); void wchar_t_test_good(){ wchar_t wstr[100]; StringCchPrintfW(wstr, 100, L"STRING"); // GOOD - wprintf(wstr); // GOOD + wprintf(wstr); // GOOD } -void wchar_t_test_bad(wchar_t* str){ +void wchar_t_test_bad(wchar_t* str){ // $ Source wchar_t wstr[100]; - StringCchPrintfW(wstr, 100, str); // BAD + StringCchPrintfW(wstr, 100, str); // $ Alert // BAD - wprintf(wstr); // BAD + wprintf(wstr); // $ Alert // BAD } char* get_string(); void pointer_arithmetic_test_on_bad_string(){ { - const char *hello = get_string(); - printf(hello + 1); // BAD - printf(hello); // BAD + const char *hello = get_string(); // $ Source + printf(hello + 1); // $ Alert // BAD + printf(hello); // $ Alert // BAD } { - const char *hello = get_string(); + const char *hello = get_string(); // $ Source hello += 1; - printf(hello); // BAD + printf(hello); // $ Alert // BAD } { // Same as above block but using "x = x + 1" syntax - const char *hello = get_string(); + const char *hello = get_string(); // $ Source hello = hello + 1; - printf(hello); // BAD + printf(hello); // $ Alert // BAD } { // Same as above block but using "x++" syntax - const char *hello = get_string(); + const char *hello = get_string(); // $ Source hello++; - printf(hello); // BAD + printf(hello); // $ Alert // BAD } { // Same as above block but using "++x" as subexpression - const char *hello = get_string(); - printf(++hello); // BAD + const char *hello = get_string(); // $ Source + printf(++hello); // $ Alert // BAD } { // Same as above block but through a pointer - const char *hello = get_string(); + const char *hello = get_string(); // $ Source const char **p = &hello; (*p)++; - printf(hello); // BAD + printf(hello); // $ Alert // BAD } { // Same as above block but through a C++ reference - const char *hello = get_string(); + const char *hello = get_string(); // $ Source const char *&p = hello; p++; - printf(hello); // BAD + printf(hello); // $ Alert // BAD } { - const char *hello = get_string(); - const char *const *p = &hello; - printf(hello); // BAD + const char *hello = get_string(); // $ Source + const char *const *p = &hello; + printf(hello); // $ Alert // BAD } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/SnprintfOverflow.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/SnprintfOverflow.qlref index 1c3184fc6a78..0cda33d916ec 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/SnprintfOverflow.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/SnprintfOverflow.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/SnprintfOverflow.ql +query: Likely Bugs/Format/SnprintfOverflow.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp index d2785d845b99..a1ddd23aff29 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp @@ -22,7 +22,7 @@ void test1(queue &numbers) while (numbers.has_number()) { - pos += snprintf(&(buffer[pos]), 100 - pos, "%i, ", numbers.get_number()); // BAD + pos += snprintf(&(buffer[pos]), 100 - pos, "%i, ", numbers.get_number()); // $ Alert // BAD } } @@ -59,7 +59,7 @@ void test4(queue &numbers) while (numbers.has_number()) { - amount = snprintf(ptr, remaining, "%i, ", numbers.get_number()); // BAD + amount = snprintf(ptr, remaining, "%i, ", numbers.get_number()); // $ Alert // BAD ptr += amount; remaining -= amount; } @@ -73,7 +73,7 @@ void test5(queue &numbers) while (numbers.has_number()) { - ptr += snprintf(ptr, end - ptr, "%i, ", numbers.get_number()); // BAD + ptr += snprintf(ptr, end - ptr, "%i, ", numbers.get_number()); // $ Alert // BAD } } @@ -97,7 +97,7 @@ void test7(const char *strings) // separated by \0, terminated by \0\0 while (*strings != 0) { - pos += snprintf_s(buffer + pos, sizeof(buffer) - pos, "%s\n", strings); // BAD + pos += snprintf_s(buffer + pos, sizeof(buffer) - pos, "%s\n", strings); // $ Alert // BAD // (note that the protections built into `snprintf_s` appear to mean this is less likely // to be exploitable than with `snprintf`) strings += strlen(strings) + 1; diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/TooManyFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/TooManyFormatArguments.qlref index 131a39abcf7e..56274d702c0d 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/TooManyFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/TooManyFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/TooManyFormatArguments.ql +query: Likely Bugs/Format/TooManyFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/WrongNumberOfFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/WrongNumberOfFormatArguments.qlref index d5e2e86d6e6a..38acf3d83087 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/WrongNumberOfFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/WrongNumberOfFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongNumberOfFormatArguments.ql +query: Likely Bugs/Format/WrongNumberOfFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c index ec28ef511449..c58fd98c2316 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c @@ -13,9 +13,9 @@ void myMultiplyDefinedPrintf3(const char *extraArg, const char *format, ...); void test_custom_printf1() { - myMultiplyDefinedPrintf("%i", 0); // BAD (too few format arguments) + myMultiplyDefinedPrintf("%i", 0); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) myMultiplyDefinedPrintf("%i", 0, 1); // GOOD - myMultiplyDefinedPrintf("%i", 0, 1, 2); // BAD (too many format arguments) + myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c index da7f09123af7..9de6d71014aa 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c @@ -10,9 +10,9 @@ void myMultiplyDefinedPrintf3(const char *format, ...); void test_custom_printf2() { - myMultiplyDefinedPrintf("%i", 0); // BAD (too few format arguments) + myMultiplyDefinedPrintf("%i", 0); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) myMultiplyDefinedPrintf("%i", 0, 1); // GOOD - myMultiplyDefinedPrintf("%i", 0, 1, 2); // BAD (too many format arguments) + myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c index 74183c2374f4..a5f3ef6669b0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c @@ -2,9 +2,9 @@ void test_custom_printf2() { // (implicitly defined) - myMultiplyDefinedPrintf("%i", 0); // BAD (too few format arguments) + myMultiplyDefinedPrintf("%i", 0); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) myMultiplyDefinedPrintf("%i", 0, 1); // GOOD - myMultiplyDefinedPrintf("%i", 0, 1, 2); // BAD (too many format arguments) + myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/custom_printf.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/custom_printf.cpp index 9c04f7a00490..92ff2ba55359 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/custom_printf.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/custom_printf.cpp @@ -26,9 +26,9 @@ void test_custom_printf() { myClass mc; - mc.myPrintf("%i%i", 1); // BAD (too few format arguments) + mc.myPrintf("%i%i", 1); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) mc.myPrintf("%i%i", 1, 2); // GOOD - mc.myPrintf("%i%i", 1, 2, 3); // BAD (too many format arguments) + mc.myPrintf("%i%i", 1, 2, 3); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) mc.myPrintf(NULL, 1, 2, 3); // GOOD (should not be analyzed) } @@ -46,4 +46,3 @@ void test_custom_printf2() } extern "C" void my_logger(int param, char *fmt, ...) __attribute__((format(printf, 2, 3))) {} - diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/macros.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/macros.cpp index 4d8257b776b2..68e198c0daad 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/macros.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/macros.cpp @@ -9,16 +9,16 @@ extern int printf(const char *fmt, ...); void testMacros(int a, int b, int c) { - GOODPRINTF("%i %i\n", a, b, 0); // BAD: too many format arguments + GOODPRINTF("%i %i\n", a, b, 0); // $ Alert[cpp/too-many-format-arguments] // BAD: too many format arguments GOODPRINTF("%i %i %i\n", a, b, c); // GOOD - GOODPRINTF("%i %i %i %i\n", a, b, c); // BAD: too few format arguments + GOODPRINTF("%i %i %i %i\n", a, b, c); // $ Alert[cpp/wrong-number-format-arguments] // BAD: too few format arguments - BADPRINTF("%i %i\n", a, b, 0); // DUBIOUS: too many format arguments + BADPRINTF("%i %i\n", a, b, 0); // $ Alert[cpp/too-many-format-arguments] // DUBIOUS: too many format arguments // ^ here there are too many format arguments, but the design of the Macro forces the user // to do this, and the extra argument is harmlessly ignored in practice. Reporting these // results can be extremely noisy (e.g. in openldap). BADPRINTF("%i %i %i\n", a, b, c); // GOOD - BADPRINTF("%i %i %i %i\n", a, b, c); // BAD: too few format arguments + BADPRINTF("%i %i %i %i\n", a, b, c); // $ Alert[cpp/wrong-number-format-arguments] // BAD: too few format arguments } #define DOTHING(x) \ @@ -29,5 +29,5 @@ void testMacros2() int x; DOTHING(x++); // GOOD - DOTHING(printf("%i", x)); // BAD: the printf inside the macro has too few format arguments + DOTHING(printf("%i", x)); // $ Alert[cpp/wrong-number-format-arguments] // BAD: the printf inside the macro has too few format arguments } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/syntax_errors.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/syntax_errors.c index d10d1025b8f0..df4cd972f502 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/syntax_errors.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/syntax_errors.c @@ -12,7 +12,7 @@ void test_syntax_error() { (UNDEFINED_MACRO)2); // GOOD [FALSE POSITIVE] - printf("%d%d" + printf("%d%d" // $ Alert[cpp/wrong-number-format-arguments] UNDEFINED_MACRO, 1, 2); } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c index 0079d0f0d21b..3fa9e7f33773 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c @@ -4,41 +4,41 @@ extern int printf(const char *fmt, ...); void test(int i, const char *str) { printf("\n"); // GOOD - printf("\n", i); // BAD (too many format arguments) + printf("\n", i); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) - printf("%i\n"); // BAD (too few format arguments) + printf("%i\n"); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) printf("%i\n", i); // GOOD - - printf("%*s\n", str); // BAD (too few format arguments) + + printf("%*s\n", str); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) printf("%*s\n", i, str); // GOOD - printf("%i %i %i\n", 1, 2); // BAD (too few format arguments) + printf("%i %i %i\n", 1, 2); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) printf("%i %i %i\n", 1, 2, 3); // GOOD // indexed format arguments - printf("%2$i \n", 1); // BAD (too few format arguments) + printf("%2$i \n", 1); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) printf("%2$i \n", 1, 2); // GOOD - printf("%2$i \n", 1, 2, 3); // BAD (too many format arguments) + printf("%2$i \n", 1, 2, 3); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) printf("%2$i %2$i %2$i \n", 1, 2); // GOOD printf("%2$02i %1$4.2f \n", 3.3333f, 6); // GOOD { int width, num; - printf("%2$*1$d", 0, width, num); // BAD (too many format arguments) + printf("%2$*1$d", 0, width, num); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) printf("%2$*1$d", width, num); // GOOD - printf("%2$*1$d", width); // BAD (too few format arguments) + printf("%2$*1$d", width); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) - printf("%1$*2$d", 0, num, width); // BAD (too many format arguments) [INCORRECT MESSAGE] - printf("%1$*2$d", num, width); // GOOD [FALSE POSITIVE] + printf("%1$*2$d", 0, num, width); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE] + printf("%1$*2$d", num, width); // $ Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] printf("%1$*2$d", width); // BAD (too few format arguments) [NOT DETECTED] } { int precision; float num; - printf("%2$.*4$f", 0, 0, num, 0, precision); // BAD (too many format arguments) [INCORRECT MESSAGE] - printf("%2$.*4$f", 0, num, 0, precision); // GOOD [FALSE POSITIVE] - printf("%2$.*4$f", num, 0, precision); // BAD (too few format arguments) [INCORRECT MESSAGE] + printf("%2$.*4$f", 0, 0, num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE] + printf("%2$.*4$f", 0, num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] + printf("%2$.*4$f", num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // BAD (too few format arguments) [INCORRECT MESSAGE] } printf("%@ %i %i", 1, 2); // GOOD @@ -50,7 +50,7 @@ void test(int i, const char *str) // Implicit logger function declaration my_logger(0, "%i %i %i %i %i %i\n", 1, 2, 3, 4, 5, 6); // GOOD my_logger(0, "%i %i %i\n", 1, 2, 3); // GOOD - my_logger(0, "%i %i %i\n", 1, 2); // BAD (too few format arguments) + my_logger(0, "%i %i %i\n", 1, 2); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) } // A spurious definition of my_logger diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/WrongTypeFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/WrongTypeFormatArguments.qlref index 6f557ace55a5..370dae334d68 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/WrongTypeFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/WrongTypeFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongTypeFormatArguments.ql +query: Likely Bugs/Format/WrongTypeFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp index 0345e8352bee..bced96527852 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp @@ -23,10 +23,10 @@ void test_size_t() { printf("%zi", &buffer[1023] - buffer); // GOOD printf("%zu", &buffer[1023] - buffer); // GOOD printf("%zx", &buffer[1023] - buffer); // GOOD - printf("%d", &buffer[1023] - buffer); // BAD + printf("%d", &buffer[1023] - buffer); // $ Alert // BAD printf("%ld", &buffer[1023] - buffer); // DUBIOUS [NOT DETECTED] printf("%lld", &buffer[1023] - buffer); // DUBIOUS [NOT DETECTED] - printf("%u", &buffer[1023] - buffer); // BAD + printf("%u", &buffer[1023] - buffer); // $ Alert // BAD // (for the `%ld` and `%lld` cases, the signedness and type sizes match, `%zd` would be most correct // and robust but the developer may know enough to make this safe) } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/tests.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/tests.c index c5b3d1df493a..449669fbc6db 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/tests.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/tests.c @@ -4,7 +4,7 @@ int printf(const char * format, ...); int fprintf(); void f(UNKNOWN_CHAR * str) { - printf("%s", 1); // BAD + printf("%s", 1); // $ Alert // BAD printf("%s", implicit_function()); // GOOD - we should ignore the type sprintf(0, "%s", ""); // GOOD fprintf(0, "%s", ""); // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Builtin/WrongTypeFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Builtin/WrongTypeFormatArguments.qlref index 6f557ace55a5..370dae334d68 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Builtin/WrongTypeFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Builtin/WrongTypeFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongTypeFormatArguments.ql +query: Likely Bugs/Format/WrongTypeFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Builtin/tests.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Builtin/tests.c index f94e01251eec..19e84bf15178 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Builtin/tests.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Builtin/tests.c @@ -1,5 +1,5 @@ void f() { char buf[35]; - __builtin___sprintf_chk(buf, 0, __builtin_object_size(buf, 1), "%s", 1); + __builtin___sprintf_chk(buf, 0, __builtin_object_size(buf, 1), "%s", 1); // $ Alert __builtin___sprintf_chk(buf, 0, __builtin_object_size(buf, 1), "%d", 1); } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_byte_wprintf/WrongTypeFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_byte_wprintf/WrongTypeFormatArguments.qlref index 6f557ace55a5..370dae334d68 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_byte_wprintf/WrongTypeFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_byte_wprintf/WrongTypeFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongTypeFormatArguments.ql +query: Likely Bugs/Format/WrongTypeFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_byte_wprintf/tests.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_byte_wprintf/tests.cpp index 5762ded379db..a799b7dbaaec 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_byte_wprintf/tests.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_byte_wprintf/tests.cpp @@ -15,34 +15,34 @@ void tests() { char16_t buffer[BUF_SIZE]; printf("%s", "Hello"); // GOOD - printf("%s", u"Hello"); // BAD: expecting char - printf("%s", L"Hello"); // BAD: expecting char + printf("%s", u"Hello"); // $ Alert // BAD: expecting char + printf("%s", L"Hello"); // $ Alert // BAD: expecting char - printf("%S", "Hello"); // BAD: expecting wchar_t or char16_t + printf("%S", "Hello"); // $ Alert // BAD: expecting wchar_t or char16_t printf("%S", u"Hello"); // GOOD printf("%S", L"Hello"); // GOOD wprintf(L"%s", "Hello"); // GOOD - wprintf(L"%s", u"Hello"); // BAD: expecting char + wprintf(L"%s", u"Hello"); // $ Alert // BAD: expecting char wprintf(L"%s", L"Hello"); // BAD: expecting char [NOT DETECTED; correct on Microsoft platforms] wprintf(L"%S", "Hello"); // BAD: expecting wchar_t [NOT DETECTED; correct on Microsoft platforms] - wprintf(L"%S", u"Hello"); // BAD: expecting wchar_t + wprintf(L"%S", u"Hello"); // $ Alert // BAD: expecting wchar_t wprintf(L"%S", L"Hello"); // GOOD swprintf(buffer, BUF_SIZE, u"%s", "Hello"); // GOOD swprintf(buffer, BUF_SIZE, u"%s", u"Hello"); // BAD: expecting char [NOT DETECTED; correct on Microsoft platforms] - swprintf(buffer, BUF_SIZE, u"%s", L"Hello"); // BAD: expecting char + swprintf(buffer, BUF_SIZE, u"%s", L"Hello"); // $ Alert // BAD: expecting char swprintf(buffer, BUF_SIZE, u"%S", "Hello"); // BAD: expecting char16_t [NOT DETECTED; correct on Microsoft platforms] swprintf(buffer, BUF_SIZE, u"%S", u"Hello"); // GOOD - swprintf(buffer, BUF_SIZE, u"%S", L"Hello"); // BAD: expecting char16_t + swprintf(buffer, BUF_SIZE, u"%S", L"Hello"); // $ Alert // BAD: expecting char16_t swprintf(buffer, BUF_SIZE, u"%hs", "Hello"); // GOOD - swprintf(buffer, BUF_SIZE, u"%hs", u"Hello"); // BAD: expecting char - swprintf(buffer, BUF_SIZE, u"%hs", L"Hello"); // BAD: expecting char + swprintf(buffer, BUF_SIZE, u"%hs", u"Hello"); // $ Alert // BAD: expecting char + swprintf(buffer, BUF_SIZE, u"%hs", L"Hello"); // $ Alert // BAD: expecting char - swprintf(buffer, BUF_SIZE, u"%ls", "Hello"); // BAD: expecting char16_t + swprintf(buffer, BUF_SIZE, u"%ls", "Hello"); // $ Alert // BAD: expecting char16_t swprintf(buffer, BUF_SIZE, u"%ls", u"Hello"); // GOOD - swprintf(buffer, BUF_SIZE, u"%ls", L"Hello"); // BAD: expecting char16_t + swprintf(buffer, BUF_SIZE, u"%ls", L"Hello"); // $ Alert // BAD: expecting char16_t } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/WrongTypeFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/WrongTypeFormatArguments.qlref index 6f557ace55a5..370dae334d68 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/WrongTypeFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/WrongTypeFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongTypeFormatArguments.ql +query: Likely Bugs/Format/WrongTypeFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/tests_32.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/tests_32.cpp index 3c9b802a7a74..80022633ae20 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/tests_32.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/tests_32.cpp @@ -11,7 +11,7 @@ void test_32() void *void_ptr; printf("%li", l); // GOOD - printf("%li", void_ptr); // BAD - printf("%p", l); // BAD + printf("%li", void_ptr); // $ Alert // BAD + printf("%p", l); // $ Alert // BAD printf("%p", void_ptr); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/tests_64.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/tests_64.cpp index 6b38c4e0245c..9d1abc440921 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/tests_64.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/tests_64.cpp @@ -11,7 +11,7 @@ void test_64() void *void_ptr; printf("%li", l); // GOOD - printf("%li", void_ptr); // BAD - printf("%p", l); // BAD + printf("%li", void_ptr); // $ Alert // BAD + printf("%p", l); // $ Alert // BAD printf("%p", void_ptr); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.qlref index 6f557ace55a5..370dae334d68 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongTypeFormatArguments.ql +query: Likely Bugs/Format/WrongTypeFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/format.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/format.h index 889dd2f58c8c..e5421e760a37 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/format.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/format.h @@ -13,5 +13,5 @@ static void error(int x1, int x2, int x3, int x4, int x5, void format2(char *str, int i, double d) { error(1, 2, 3, 4, 5, "%s %d %f", 1, 2, 3, 4, 5, 6, 7, str, i, d); - error(1, 2, 3, 4, 5, "%d %f %s", 1, 2, 3, 4, 5, 6, 7, str, i, d); + error(1, 2, 3, 4, 5, "%d %f %s", 1, 2, 3, 4, 5, 6, 7, str, i, d); // $ Alert } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/linux.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/linux.cpp index 9b26de4f54ef..971fa07446d0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/linux.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/linux.cpp @@ -12,7 +12,7 @@ struct S { template void template_func_calling_printf(S &obj) { ::printf("%d\n", obj.get_int()); - ::printf("%d\n", obj.get_template_value()); + ::printf("%d\n", obj.get_template_value()); // $ Alert } void instantiate() { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/linux_c.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/linux_c.c index bc6468c593b5..7ff358bb0aad 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/linux_c.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/linux_c.c @@ -8,5 +8,5 @@ void restrict_cases(char * restrict str1, const char * restrict str2, short * re { printf("%s", str1); // GOOD printf("%s", str2); // GOOD - printf("%s", str3); // BAD + printf("%s", str3); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/pri_macros.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/pri_macros.h index 782ee23faf30..36c1dc4206a9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/pri_macros.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/pri_macros.h @@ -12,5 +12,5 @@ void test_PRI_macros() { printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED] - printf("my_u64 = %" PRIu32 "\n", my_u64); // BAD: uint64_t read as uint32_t + printf("my_u64 = %" PRIu32 "\n", my_u64); // $ Alert // BAD: uint64_t read as uint32_t } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h index 2cc67497c6e1..e77ecf54a25f 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/printf1.h @@ -9,22 +9,22 @@ void f(char *s, int i, unsigned char *us, const char *cs, signed char *ss, char const char cc = 'x'; printf("%s: %d\n", s, i); // ok - printf("%s: %f\n", s, i); // not ok (int -> float) + printf("%s: %f\n", s, i); // $ Alert // not ok (int -> float) printf("%s", us); // ok printf("%s", cs); // ok printf("%s", ss); // ok printf("%p", cs); // ok - printf("%p", i); // not ok (int -> void *) + printf("%p", i); // $ Alert // not ok (int -> void *) printf("%p", &f); // ok printf("%*s", i, cs); // ok printf("%*s", mi, cs); // ok printf("%*s", c, cs); // ok printf("%*s", cc, cs); // ok - printf("%*s", i, i); // not ok (int -> char *) + printf("%*s", i, i); // $ Alert // not ok (int -> char *) printf("%d %% %*s", i, i, cs); // ok - printf("%*s", cs, cs); // not ok (the width argument should be integer) + printf("%*s", cs, cs); // $ Alert // not ok (the width argument should be integer) printf("%c", 10); // ok printf("%c", 1000); // not ok [NOT DETECTED] @@ -35,15 +35,15 @@ void f(char *s, int i, unsigned char *us, const char *cs, signed char *ss, char printf("%u", 1000); // ok printf("%i", MYONETHOUSAND); // ok - printf("%s", MYONETHOUSAND); // not ok (enum -> char *) + printf("%s", MYONETHOUSAND); // $ Alert // not ok (enum -> char *) printf("%c", MYONETHOUSAND); // not ok (enum -> char) [NOT DETECTED] printf("%i", mi); // ok printf("%u", mi); // not ok (int -> unsigned int) [NOT DETECTED] - printf("%d", ull); // not ok (unsigned long long -> int) - printf("%u", ull); // not ok (unsigned long long -> unsigned int) - printf("%x", ull); // not ok (unsigned long long -> unsigned int) + printf("%d", ull); // $ Alert // not ok (unsigned long long -> int) + printf("%u", ull); // $ Alert // not ok (unsigned long long -> unsigned int) + printf("%x", ull); // $ Alert // not ok (unsigned long long -> unsigned int) printf("%Lx", ull); // ok printf("%llx", ull); // ok } @@ -110,8 +110,8 @@ void extensions() printf("%Lg", ld); // GOOD printf("%llg", ld); // GOOD (nonstandard equivalent to %Lg) - printf("%Lg", d); // BAD (should be %g) - printf("%llg", d); // BAD (should be %g) + printf("%Lg", d); // $ Alert // BAD (should be %g) + printf("%llg", d); // $ Alert // BAD (should be %g) } { @@ -144,8 +144,8 @@ void fun4() long long ll; unsigned long long ull; - printf("%qi\n", i); // BAD - printf("%qu\n", ui); // BAD + printf("%qi\n", i); // $ Alert // BAD + printf("%qu\n", ui); // $ Alert // BAD printf("%qi\n", l); // GOOD printf("%qu\n", ul); // GOOD printf("%qi\n", ll); // GOOD @@ -157,82 +157,82 @@ void complexFormatSymbols(int i, const char *s) // positional arguments printf("%1$i", i, s); // GOOD printf("%2$s", i, s); // GOOD - printf("%1$s", i, s); // BAD - printf("%2$i", i, s); // BAD + printf("%1$s", i, s); // $ Alert // BAD + printf("%2$i", i, s); // $ Alert // BAD // width / precision printf("%4i", i); // GOOD printf("%.4i", i); // GOOD printf("%4.4i", i); // GOOD - printf("%4s", i); // BAD - printf("%.4s", i); // BAD - printf("%4.4s", i); // BAD + printf("%4s", i); // $ Alert // BAD + printf("%.4s", i); // $ Alert // BAD + printf("%4.4s", i); // $ Alert // BAD printf("%4s", s); // GOOD printf("%.4s", s); // GOOD printf("%4.4s", s); // GOOD - printf("%4i", s); // BAD - printf("%.4i", s); // BAD - printf("%4.4i", s); // BAD + printf("%4i", s); // $ Alert // BAD + printf("%.4i", s); // $ Alert // BAD + printf("%4.4i", s); // $ Alert // BAD // variable width / precision printf("%*s", i, s); // GOOD - printf("%*s", s, s); // BAD - printf("%*s", i, i); // BAD + printf("%*s", s, s); // $ Alert // BAD + printf("%*s", i, i); // $ Alert // BAD printf("%.*s", i, s); // GOOD - printf("%.*s", s, s); // BAD - printf("%.*s", i, i); // BAD + printf("%.*s", s, s); // $ Alert // BAD + printf("%.*s", i, i); // $ Alert // BAD printf("%*.4s", i, s); // GOOD - printf("%*.4s", s, s); // BAD - printf("%*.4s", i, i); // BAD + printf("%*.4s", s, s); // $ Alert // BAD + printf("%*.4s", i, i); // $ Alert // BAD printf("%4.*s", i, s); // GOOD - printf("%4.*s", s, s); // BAD - printf("%4.*s", i, i); // BAD + printf("%4.*s", s, s); // $ Alert // BAD + printf("%4.*s", i, i); // $ Alert // BAD printf("%*.*s", i, i, s); // GOOD - printf("%*.*s", s, i, s); // BAD - printf("%*.*s", i, s, s); // BAD - printf("%*.*s", i, i, i); // BAD + printf("%*.*s", s, i, s); // $ Alert // BAD + printf("%*.*s", i, s, s); // $ Alert // BAD + printf("%*.*s", i, i, i); // $ Alert // BAD // positional arguments mixed with variable width / precision printf("%2$*1$s", i, s); // GOOD - printf("%2$*2$s", i, s); // BAD - printf("%1$*1$s", i, s); // BAD + printf("%2$*2$s", i, s); // $ Alert // BAD + printf("%1$*1$s", i, s); // $ Alert // BAD printf("%2$*1$.4s", i, s); // GOOD - printf("%2$*2$.4s", i, s); // BAD - printf("%1$*1$.4s", i, s); // BAD + printf("%2$*2$.4s", i, s); // $ Alert // BAD + printf("%1$*1$.4s", i, s); // $ Alert // BAD printf("%2$.*1$s", i, s); // GOOD - printf("%2$.*2$s", i, s); // BAD - printf("%1$.*1$s", i, s); // BAD + printf("%2$.*2$s", i, s); // $ Alert // BAD + printf("%1$.*1$s", i, s); // $ Alert // BAD printf("%2$4.*1$s", i, s); // GOOD - printf("%2$4.*2$s", i, s); // BAD - printf("%1$4.*1$s", i, s); // BAD + printf("%2$4.*2$s", i, s); // $ Alert // BAD + printf("%1$4.*1$s", i, s); // $ Alert // BAD printf("%2$*1$.*1$s", i, s); // GOOD - printf("%2$*2$.*1$s", i, s); // BAD - printf("%2$*1$.*2$s", i, s); // BAD - printf("%1$*1$.*1$s", i, s); // BAD + printf("%2$*2$.*1$s", i, s); // $ Alert // BAD + printf("%2$*1$.*2$s", i, s); // $ Alert // BAD + printf("%1$*1$.*1$s", i, s); // $ Alert // BAD // left justify flag printf("%-4s", s); // GOOD printf("%1$-4s", s); // GOOD - printf("%-4i", s); // BAD - printf("%1$-4i", s); // BAD + printf("%-4i", s); // $ Alert // BAD + printf("%1$-4i", s); // $ Alert // BAD printf("%1$-4s", s, i); // GOOD - printf("%2$-4s", s, i); // BAD + printf("%2$-4s", s, i); // $ Alert // BAD printf("%1$-.4s", s, i); // GOOD - printf("%2$-.4s", s, i); // BAD + printf("%2$-.4s", s, i); // $ Alert // BAD printf("%1$-4.4s", s, i); // GOOD - printf("%2$-4.4s", s, i); // BAD + printf("%2$-4.4s", s, i); // $ Alert // BAD printf("%1$-*2$s", s, i); // GOOD - printf("%2$-*2$s", s, i); // BAD - printf("%1$-*1$s", s, i); // BAD + printf("%2$-*2$s", s, i); // $ Alert // BAD + printf("%1$-*1$s", s, i); // $ Alert // BAD } void myvsnprintf(const char *format_string, char *target, size_t buffer_size, va_list args) @@ -273,7 +273,7 @@ void usemyprintf(int i, char *s) char buffer[1024]; mysprintf("%i", buffer, 1024, i); // GOOD - mysprintf("%i", buffer, 1024, s); // BAD + mysprintf("%i", buffer, 1024, s); // $ Alert // BAD myprintf("%i", i); // GOOD - myprintf("%i", s); // BAD + myprintf("%i", s); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/real_world.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/real_world.h index eefb84993e74..dfb144448ca0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/real_world.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/real_world.h @@ -58,9 +58,9 @@ void bar() printf("check %n", &i); // GOOD printf("check %n", &ui); // GOOD [dubious: int is written to unsigned int] printf("check %n", &si); // GOOD - printf("check %n", &s); // BAD: int is written to short - printf("check %hn", &i); // BAD: short is written to int - printf("check %hn", &ui); // BAD: short is written to unsigned int - printf("check %hn", &si); // BAD: short is written to signed int + printf("check %n", &s); // $ Alert // BAD: int is written to short + printf("check %hn", &i); // $ Alert // BAD: short is written to int + printf("check %hn", &ui); // $ Alert // BAD: short is written to unsigned int + printf("check %hn", &si); // $ Alert // BAD: short is written to signed int printf("check %hn", &s); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/wide_string.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/wide_string.h index 73bdee5b8b11..ecee920e3811 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/wide_string.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/wide_string.h @@ -22,7 +22,7 @@ void test_wchar4(char c, const char cc, wchar_t wc, const wchar_t wcc) { printf("%c", c); // GOOD printf("%c", cc); // GOOD printf("%c", 'c'); // GOOD - printf("%c", "c"); // BAD + printf("%c", "c"); // $ Alert // BAD printf("%wc", wc); // GOOD printf("%wc", wcc); // GOOD printf("%wc", L'c'); // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_two_byte_wprintf/WrongTypeFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_two_byte_wprintf/WrongTypeFormatArguments.qlref index 6f557ace55a5..370dae334d68 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_two_byte_wprintf/WrongTypeFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_two_byte_wprintf/WrongTypeFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongTypeFormatArguments.ql +query: Likely Bugs/Format/WrongTypeFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_two_byte_wprintf/printf.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_two_byte_wprintf/printf.cpp index 596e7ac73fc3..cf1f64216fd0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_two_byte_wprintf/printf.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_two_byte_wprintf/printf.cpp @@ -40,12 +40,12 @@ void test2() { void test3() { char string[20]; - sprintf(string, "test %s", u"test"); // BAD: `char16_t` string parameter read as `char` string + sprintf(string, "test %s", u"test"); // $ Alert // BAD: `char16_t` string parameter read as `char` string } void test4() { char string[20]; - sprintf(string, "test %S", L"test"); // BAD: `wchar_t` string parameter read as `char16_t` string + sprintf(string, "test %S", L"test"); // $ Alert // BAD: `wchar_t` string parameter read as `char16_t` string } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/WrongTypeFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/WrongTypeFormatArguments.qlref index 6f557ace55a5..370dae334d68 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/WrongTypeFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/WrongTypeFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongTypeFormatArguments.ql +query: Likely Bugs/Format/WrongTypeFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/format.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/format.h index 889dd2f58c8c..e5421e760a37 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/format.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/format.h @@ -13,5 +13,5 @@ static void error(int x1, int x2, int x3, int x4, int x5, void format2(char *str, int i, double d) { error(1, 2, 3, 4, 5, "%s %d %f", 1, 2, 3, 4, 5, 6, 7, str, i, d); - error(1, 2, 3, 4, 5, "%d %f %s", 1, 2, 3, 4, 5, 6, 7, str, i, d); + error(1, 2, 3, 4, 5, "%d %f %s", 1, 2, 3, 4, 5, 6, 7, str, i, d); // $ Alert } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/pri_macros.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/pri_macros.h index 782ee23faf30..36c1dc4206a9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/pri_macros.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/pri_macros.h @@ -12,5 +12,5 @@ void test_PRI_macros() { printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED] - printf("my_u64 = %" PRIu32 "\n", my_u64); // BAD: uint64_t read as uint32_t + printf("my_u64 = %" PRIu32 "\n", my_u64); // $ Alert // BAD: uint64_t read as uint32_t } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/printf1.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/printf1.h index 60ee2c8caade..0112e253d745 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/printf1.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/printf1.h @@ -9,22 +9,22 @@ void f(char *s, int i, unsigned char *us, const char *cs, signed char *ss, char const char cc = 'x'; printf("%s: %d\n", s, i); // ok - printf("%s: %f\n", s, i); // not ok (int -> float) + printf("%s: %f\n", s, i); // $ Alert // not ok (int -> float) printf("%s", us); // ok printf("%s", cs); // ok printf("%s", ss); // ok printf("%p", cs); // ok - printf("%p", i); // not ok (int -> void *) + printf("%p", i); // $ Alert // not ok (int -> void *) printf("%p", &f); // ok printf("%*s", i, cs); // ok printf("%*s", mi, cs); // ok printf("%*s", c, cs); // ok printf("%*s", cc, cs); // ok - printf("%*s", i, i); // not ok (int -> char *) + printf("%*s", i, i); // $ Alert // not ok (int -> char *) printf("%d %% %*s", i, i, cs); // ok - printf("%*s", cs, cs); // not ok (the width argument should be integer) + printf("%*s", cs, cs); // $ Alert // not ok (the width argument should be integer) printf("%c", 10); // ok printf("%c", 1000); // not ok [NOT DETECTED] @@ -35,15 +35,15 @@ void f(char *s, int i, unsigned char *us, const char *cs, signed char *ss, char printf("%u", 1000); // ok printf("%i", MYONETHOUSAND); // ok - printf("%s", MYONETHOUSAND); // not ok (enum -> char *) + printf("%s", MYONETHOUSAND); // $ Alert // not ok (enum -> char *) printf("%c", MYONETHOUSAND); // not ok (enum -> char) [NOT DETECTED] printf("%i", mi); // ok printf("%u", mi); // not ok (int -> unsigned int) [NOT DETECTED] - printf("%d", ull); // not ok (unsigned long long -> int) - printf("%u", ull); // not ok (unsigned long long -> unsigned int) - printf("%x", ull); // not ok (unsigned long long -> unsigned int) + printf("%d", ull); // $ Alert // not ok (unsigned long long -> int) + printf("%u", ull); // $ Alert // not ok (unsigned long long -> unsigned int) + printf("%x", ull); // $ Alert // not ok (unsigned long long -> unsigned int) printf("%Lx", ull); // ok printf("%llx", ull); // ok } @@ -127,7 +127,7 @@ void fun3(void *p1, VOIDPTR p2, FUNPTR p3, char *p4) printf("%p\n", p3); // GOOD printf("%p\n", p4); // GOOD printf("%p\n", p4 + 1); // GOOD - printf("%p\n", 0); // GOOD [FALSE POSITIVE] + printf("%p\n", 0); // $ Alert // GOOD [FALSE POSITIVE] } typedef unsigned int wint_t; @@ -165,8 +165,8 @@ void fun4() long long ll; unsigned long long ull; - printf("%qi\n", i); // BAD - printf("%qu\n", ui); // BAD + printf("%qi\n", i); // $ Alert // BAD + printf("%qu\n", ui); // $ Alert // BAD printf("%qi\n", l); // GOOD printf("%qu\n", ul); // GOOD printf("%qi\n", ll); // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/real_world.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/real_world.h index eefb84993e74..dfb144448ca0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/real_world.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/real_world.h @@ -58,9 +58,9 @@ void bar() printf("check %n", &i); // GOOD printf("check %n", &ui); // GOOD [dubious: int is written to unsigned int] printf("check %n", &si); // GOOD - printf("check %n", &s); // BAD: int is written to short - printf("check %hn", &i); // BAD: short is written to int - printf("check %hn", &ui); // BAD: short is written to unsigned int - printf("check %hn", &si); // BAD: short is written to signed int + printf("check %n", &s); // $ Alert // BAD: int is written to short + printf("check %hn", &i); // $ Alert // BAD: short is written to int + printf("check %hn", &ui); // $ Alert // BAD: short is written to unsigned int + printf("check %hn", &si); // $ Alert // BAD: short is written to signed int printf("check %hn", &s); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/wide_string.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/wide_string.h index 73bdee5b8b11..ecee920e3811 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/wide_string.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/wide_string.h @@ -22,7 +22,7 @@ void test_wchar4(char c, const char cc, wchar_t wc, const wchar_t wcc) { printf("%c", c); // GOOD printf("%c", cc); // GOOD printf("%c", 'c'); // GOOD - printf("%c", "c"); // BAD + printf("%c", "c"); // $ Alert // BAD printf("%wc", wc); // GOOD printf("%wc", wcc); // GOOD printf("%wc", L'c'); // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/WrongTypeFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/WrongTypeFormatArguments.qlref index 6f557ace55a5..370dae334d68 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/WrongTypeFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/WrongTypeFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongTypeFormatArguments.ql +query: Likely Bugs/Format/WrongTypeFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/format.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/format.h index 889dd2f58c8c..e5421e760a37 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/format.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/format.h @@ -13,5 +13,5 @@ static void error(int x1, int x2, int x3, int x4, int x5, void format2(char *str, int i, double d) { error(1, 2, 3, 4, 5, "%s %d %f", 1, 2, 3, 4, 5, 6, 7, str, i, d); - error(1, 2, 3, 4, 5, "%d %f %s", 1, 2, 3, 4, 5, 6, 7, str, i, d); + error(1, 2, 3, 4, 5, "%d %f %s", 1, 2, 3, 4, 5, 6, 7, str, i, d); // $ Alert } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/pri_macros.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/pri_macros.h index 782ee23faf30..36c1dc4206a9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/pri_macros.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/pri_macros.h @@ -12,5 +12,5 @@ void test_PRI_macros() { printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED] - printf("my_u64 = %" PRIu32 "\n", my_u64); // BAD: uint64_t read as uint32_t + printf("my_u64 = %" PRIu32 "\n", my_u64); // $ Alert // BAD: uint64_t read as uint32_t } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/printf1.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/printf1.h index 2fb361d485c5..e714babda604 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/printf1.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/printf1.h @@ -9,22 +9,22 @@ void f(char *s, int i, unsigned char *us, const char *cs, signed char *ss, char const char cc = 'x'; printf("%s: %d\n", s, i); // ok - printf("%s: %f\n", s, i); // not ok (int -> float) + printf("%s: %f\n", s, i); // $ Alert // not ok (int -> float) printf("%s", us); // ok printf("%s", cs); // ok printf("%s", ss); // ok printf("%p", cs); // ok - printf("%p", i); // not ok (int -> void *) + printf("%p", i); // $ Alert // not ok (int -> void *) printf("%p", &f); // ok printf("%*s", i, cs); // ok printf("%*s", mi, cs); // ok printf("%*s", c, cs); // ok printf("%*s", cc, cs); // ok - printf("%*s", i, i); // not ok (int -> char *) + printf("%*s", i, i); // $ Alert // not ok (int -> char *) printf("%d %% %*s", i, i, cs); // ok - printf("%*s", cs, cs); // not ok (the width argument should be integer) + printf("%*s", cs, cs); // $ Alert // not ok (the width argument should be integer) printf("%c", 10); // ok printf("%c", 1000); // not ok [NOT DETECTED] @@ -35,15 +35,15 @@ void f(char *s, int i, unsigned char *us, const char *cs, signed char *ss, char printf("%u", 1000); // ok printf("%i", MYONETHOUSAND); // ok - printf("%s", MYONETHOUSAND); // not ok (enum -> char *) + printf("%s", MYONETHOUSAND); // $ Alert // not ok (enum -> char *) printf("%c", MYONETHOUSAND); // not ok (enum -> char) [NOT DETECTED] printf("%i", mi); // ok printf("%u", mi); // not ok (int -> unsigned int) [NOT DETECTED] - printf("%d", ull); // not ok (unsigned long long -> int) - printf("%u", ull); // not ok (unsigned long long -> unsigned int) - printf("%x", ull); // not ok (unsigned long long -> unsigned int) + printf("%d", ull); // $ Alert // not ok (unsigned long long -> int) + printf("%u", ull); // $ Alert // not ok (unsigned long long -> unsigned int) + printf("%x", ull); // $ Alert // not ok (unsigned long long -> unsigned int) printf("%Lx", ull); // ok printf("%llx", ull); // ok } @@ -59,20 +59,20 @@ void g() const SIZE_T C_ST = sizeof(st); ssize_t sst; - printf("%zu", ul); // not ok + printf("%zu", ul); // $ Alert // not ok printf("%zu", st); // ok printf("%zu", ST); // ok printf("%zu", c_st); // ok printf("%zu", C_ST); // ok printf("%zu", sizeof(ul)); // ok - printf("%zu", sst); // not ok + printf("%zu", sst); // $ Alert // not ok printf("%zd", ul); // not ok [NOT DETECTED] - printf("%zd", st); // not ok - printf("%zd", ST); // not ok - printf("%zd", c_st); // not ok - printf("%zd", C_ST); // not ok - printf("%zd", sizeof(ul)); // not ok + printf("%zd", st); // $ Alert // not ok + printf("%zd", ST); // $ Alert // not ok + printf("%zd", c_st); // $ Alert // not ok + printf("%zd", C_ST); // $ Alert // not ok + printf("%zd", sizeof(ul)); // $ Alert // not ok printf("%zd", sst); // ok { char *ptr_a, *ptr_b; @@ -81,7 +81,7 @@ void g() printf("%tu", ptr_a - ptr_b); // ok printf("%td", ptr_a - ptr_b); // ok printf("%zu", ptr_a - ptr_b); // ok (dubious) - printf("%zd", ptr_a - ptr_b); // ok (dubious) [FALSE POSITIVE] + printf("%zd", ptr_a - ptr_b); // $ Alert // ok (dubious) [FALSE POSITIVE] } } @@ -113,8 +113,8 @@ void fun2() { printf("%S", myString1); // GOOD printf("%S", myString2); // GOOD - printf("%S", myString3); // BAD - printf("%S", myString4); // BAD + printf("%S", myString3); // $ Alert // BAD + printf("%S", myString4); // $ Alert // BAD } typedef void *VOIDPTR; @@ -127,7 +127,7 @@ void fun3(void *p1, VOIDPTR p2, FUNPTR p3, char *p4) printf("%p\n", p3); // GOOD printf("%p\n", p4); // GOOD printf("%p\n", p4 + 1); // GOOD - printf("%p\n", 0); // GOOD [FALSE POSITIVE] + printf("%p\n", 0); // $ Alert // GOOD [FALSE POSITIVE] } typedef unsigned int wint_t; @@ -178,21 +178,21 @@ void fun4() printf("%I32u\n", ui); // GOOD printf("%I32i\n", l); // GOOD printf("%I32u\n", ul); // GOOD - printf("%I32i\n", ll); // BAD - printf("%I32u\n", ull); // BAD + printf("%I32i\n", ll); // $ Alert // BAD + printf("%I32u\n", ull); // $ Alert // BAD printf("%I32i\n", i32); // GOOD printf("%I32u\n", u32); // GOOD - printf("%I32i\n", i64); // BAD - printf("%I32u\n", u64); // BAD + printf("%I32i\n", i64); // $ Alert // BAD + printf("%I32u\n", u64); // $ Alert // BAD - printf("%I64i\n", i); // BAD - printf("%I64u\n", ui); // BAD - printf("%I64i\n", l); // BAD - printf("%I64u\n", ul); // BAD + printf("%I64i\n", i); // $ Alert // BAD + printf("%I64u\n", ui); // $ Alert // BAD + printf("%I64i\n", l); // $ Alert // BAD + printf("%I64u\n", ul); // $ Alert // BAD printf("%I64i\n", ll); // GOOD printf("%I64u\n", ull); // GOOD - printf("%I64i\n", i32); // BAD - printf("%I64u\n", u32); // BAD + printf("%I64i\n", i32); // $ Alert // BAD + printf("%I64u\n", u32); // $ Alert // BAD printf("%I64i\n", i64); // GOOD printf("%I64u\n", u64); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/real_world.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/real_world.h index e88d0318bb05..4edf73201375 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/real_world.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/real_world.h @@ -58,9 +58,9 @@ void bar() printf("check %n", &i); // GOOD printf("check %n", &ui); // GOOD [dubious: int is written to unsigned int] printf("check %n", &si); // GOOD - printf("check %n", &s); // BAD: int is written to short - printf("check %hn", &i); // BAD: short is written to int - printf("check %hn", &ui); // BAD: short is written to unsigned int - printf("check %hn", &si); // BAD: short is written to signed int + printf("check %n", &s); // $ Alert // BAD: int is written to short + printf("check %hn", &i); // $ Alert // BAD: short is written to int + printf("check %hn", &ui); // $ Alert // BAD: short is written to unsigned int + printf("check %hn", &si); // $ Alert // BAD: short is written to signed int printf("check %hn", &s); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/wide_string.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/wide_string.h index 672329b62706..d8adca04e579 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/wide_string.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/wide_string.h @@ -22,9 +22,9 @@ void test_wchar4(char c, const char cc, wchar_t wc, const wchar_t wcc) { printf("%c", c); // GOOD printf("%c", cc); // GOOD printf("%c", 'c'); // GOOD - printf("%c", "c"); // BAD + printf("%c", "c"); // $ Alert // BAD printf("%wc", wc); // GOOD printf("%wc", wcc); // GOOD printf("%wc", L'c'); // GOOD - printf("%wc", L"c"); // BAD + printf("%wc", L"c"); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/WrongTypeFormatArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/WrongTypeFormatArguments.qlref index 6f557ace55a5..370dae334d68 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/WrongTypeFormatArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/WrongTypeFormatArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/WrongTypeFormatArguments.ql +query: Likely Bugs/Format/WrongTypeFormatArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/format.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/format.h index 889dd2f58c8c..e5421e760a37 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/format.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/format.h @@ -13,5 +13,5 @@ static void error(int x1, int x2, int x3, int x4, int x5, void format2(char *str, int i, double d) { error(1, 2, 3, 4, 5, "%s %d %f", 1, 2, 3, 4, 5, 6, 7, str, i, d); - error(1, 2, 3, 4, 5, "%d %f %s", 1, 2, 3, 4, 5, 6, 7, str, i, d); + error(1, 2, 3, 4, 5, "%d %f %s", 1, 2, 3, 4, 5, 6, 7, str, i, d); // $ Alert } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/pri_macros.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/pri_macros.h index 782ee23faf30..36c1dc4206a9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/pri_macros.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/pri_macros.h @@ -12,5 +12,5 @@ void test_PRI_macros() { printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED] - printf("my_u64 = %" PRIu32 "\n", my_u64); // BAD: uint64_t read as uint32_t + printf("my_u64 = %" PRIu32 "\n", my_u64); // $ Alert // BAD: uint64_t read as uint32_t } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/printf1.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/printf1.h index 8222cfa67b25..8275bc617f51 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/printf1.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/printf1.h @@ -9,22 +9,22 @@ void f(char *s, int i, unsigned char *us, const char *cs, signed char *ss, char const char cc = 'x'; printf("%s: %d\n", s, i); // ok - printf("%s: %f\n", s, i); // not ok (int -> float) + printf("%s: %f\n", s, i); // $ Alert // not ok (int -> float) printf("%s", us); // ok printf("%s", cs); // ok printf("%s", ss); // ok printf("%p", cs); // ok - printf("%p", i); // not ok (int -> void *) + printf("%p", i); // $ Alert // not ok (int -> void *) printf("%p", &f); // ok printf("%*s", i, cs); // ok printf("%*s", mi, cs); // ok printf("%*s", c, cs); // ok printf("%*s", cc, cs); // ok - printf("%*s", i, i); // not ok (int -> char *) + printf("%*s", i, i); // $ Alert // not ok (int -> char *) printf("%d %% %*s", i, i, cs); // ok - printf("%*s", cs, cs); // not ok (the width argument should be integer) + printf("%*s", cs, cs); // $ Alert // not ok (the width argument should be integer) printf("%c", 10); // ok printf("%c", 1000); // not ok [NOT DETECTED] @@ -35,15 +35,15 @@ void f(char *s, int i, unsigned char *us, const char *cs, signed char *ss, char printf("%u", 1000); // ok printf("%i", MYONETHOUSAND); // ok - printf("%s", MYONETHOUSAND); // not ok (enum -> char *) + printf("%s", MYONETHOUSAND); // $ Alert // not ok (enum -> char *) printf("%c", MYONETHOUSAND); // not ok (enum -> char) [NOT DETECTED] printf("%i", mi); // ok printf("%u", mi); // not ok (int -> unsigned int) [NOT DETECTED] - printf("%d", ull); // not ok (unsigned long long -> int) - printf("%u", ull); // not ok (unsigned long long -> unsigned int) - printf("%x", ull); // not ok (unsigned long long -> unsigned int) + printf("%d", ull); // $ Alert // not ok (unsigned long long -> int) + printf("%u", ull); // $ Alert // not ok (unsigned long long -> unsigned int) + printf("%x", ull); // $ Alert // not ok (unsigned long long -> unsigned int) printf("%Lx", ull); // ok printf("%llx", ull); // ok } @@ -59,20 +59,20 @@ void g() const SIZE_T C_ST = sizeof(st); ssize_t sst; - printf("%zu", ul); // not ok + printf("%zu", ul); // $ Alert // not ok printf("%zu", st); // ok printf("%zu", ST); // ok printf("%zu", c_st); // ok printf("%zu", C_ST); // ok printf("%zu", sizeof(ul)); // ok - printf("%zu", sst); // not ok + printf("%zu", sst); // $ Alert // not ok printf("%zd", ul); // not ok [NOT DETECTED] - printf("%zd", st); // not ok - printf("%zd", ST); // not ok - printf("%zd", c_st); // not ok - printf("%zd", C_ST); // not ok - printf("%zd", sizeof(ul)); // not ok + printf("%zd", st); // $ Alert // not ok + printf("%zd", ST); // $ Alert // not ok + printf("%zd", c_st); // $ Alert // not ok + printf("%zd", C_ST); // $ Alert // not ok + printf("%zd", sizeof(ul)); // $ Alert // not ok printf("%zd", sst); // ok { char *ptr_a, *ptr_b; @@ -81,7 +81,7 @@ void g() printf("%tu", ptr_a - ptr_b); // ok printf("%td", ptr_a - ptr_b); // ok printf("%zu", ptr_a - ptr_b); // ok (dubious) - printf("%zd", ptr_a - ptr_b); // ok (dubious) [FALSE POSITIVE] + printf("%zd", ptr_a - ptr_b); // $ Alert // ok (dubious) [FALSE POSITIVE] } } @@ -127,7 +127,7 @@ void fun3(void *p1, VOIDPTR p2, FUNPTR p3, char *p4) printf("%p\n", p3); // GOOD printf("%p\n", p4); // GOOD printf("%p\n", p4 + 1); // GOOD - printf("%p\n", 0); // GOOD [FALSE POSITIVE] + printf("%p\n", 0); // $ Alert // GOOD [FALSE POSITIVE] } void fun4() @@ -152,21 +152,21 @@ void fun4() printf("%I32u\n", ui); // GOOD printf("%I32i\n", l); // GOOD printf("%I32u\n", ul); // GOOD - printf("%I32i\n", ll); // BAD - printf("%I32u\n", ull); // BAD + printf("%I32i\n", ll); // $ Alert // BAD + printf("%I32u\n", ull); // $ Alert // BAD printf("%I32i\n", i32); // GOOD printf("%I32u\n", u32); // GOOD - printf("%I32i\n", i64); // BAD - printf("%I32u\n", u64); // BAD + printf("%I32i\n", i64); // $ Alert // BAD + printf("%I32u\n", u64); // $ Alert // BAD - printf("%I64i\n", i); // BAD - printf("%I64u\n", ui); // BAD - printf("%I64i\n", l); // BAD - printf("%I64u\n", ul); // BAD + printf("%I64i\n", i); // $ Alert // BAD + printf("%I64u\n", ui); // $ Alert // BAD + printf("%I64i\n", l); // $ Alert // BAD + printf("%I64u\n", ul); // $ Alert // BAD printf("%I64i\n", ll); // GOOD printf("%I64u\n", ull); // GOOD - printf("%I64i\n", i32); // BAD - printf("%I64u\n", u32); // BAD + printf("%I64i\n", i32); // $ Alert // BAD + printf("%I64u\n", u32); // $ Alert // BAD printf("%I64i\n", i64); // GOOD printf("%I64u\n", u64); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/real_world.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/real_world.h index eefb84993e74..dfb144448ca0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/real_world.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/real_world.h @@ -58,9 +58,9 @@ void bar() printf("check %n", &i); // GOOD printf("check %n", &ui); // GOOD [dubious: int is written to unsigned int] printf("check %n", &si); // GOOD - printf("check %n", &s); // BAD: int is written to short - printf("check %hn", &i); // BAD: short is written to int - printf("check %hn", &ui); // BAD: short is written to unsigned int - printf("check %hn", &si); // BAD: short is written to signed int + printf("check %n", &s); // $ Alert // BAD: int is written to short + printf("check %hn", &i); // $ Alert // BAD: short is written to int + printf("check %hn", &ui); // $ Alert // BAD: short is written to unsigned int + printf("check %hn", &si); // $ Alert // BAD: short is written to signed int printf("check %hn", &s); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/wide_string.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/wide_string.h index 672329b62706..d8adca04e579 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/wide_string.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/wide_string.h @@ -22,9 +22,9 @@ void test_wchar4(char c, const char cc, wchar_t wc, const wchar_t wcc) { printf("%c", c); // GOOD printf("%c", cc); // GOOD printf("%c", 'c'); // GOOD - printf("%c", "c"); // BAD + printf("%c", "c"); // $ Alert // BAD printf("%wc", wc); // GOOD printf("%wc", wcc); // GOOD printf("%wc", L'c'); // GOOD - printf("%wc", L"c"); // BAD + printf("%wc", L"c"); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/InconsistentCheckReturnNull/InconsistentCheckReturnNull.qlref b/cpp/ql/test/query-tests/Likely Bugs/InconsistentCheckReturnNull/InconsistentCheckReturnNull.qlref index 8ede85c2d6fd..676a003f0585 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/InconsistentCheckReturnNull/InconsistentCheckReturnNull.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/InconsistentCheckReturnNull/InconsistentCheckReturnNull.qlref @@ -1 +1,2 @@ -Likely Bugs/InconsistentCheckReturnNull.ql +query: Likely Bugs/InconsistentCheckReturnNull.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/InconsistentCheckReturnNull/test.c b/cpp/ql/test/query-tests/Likely Bugs/InconsistentCheckReturnNull/test.c index 0f7887666df9..f2383982771b 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/InconsistentCheckReturnNull/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/InconsistentCheckReturnNull/test.c @@ -26,7 +26,7 @@ void f() { int* x7 = maybe_null_func(); if (x7) *x7 = 0; - int* x8 = maybe_null_func(); + int* x8 = maybe_null_func(); // $ Alert *x8 = 0; int* x9 = maybe_null_func(); diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/Adding365daysPerYear.qlref b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/Adding365daysPerYear.qlref index 4420b542ca43..9352fe408e8c 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/Adding365daysPerYear.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/Adding365daysPerYear.qlref @@ -1 +1,2 @@ -Likely Bugs/Leap Year/Adding365DaysPerYear.ql +query: Likely Bugs/Leap Year/Adding365DaysPerYear.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp index a14667c75ca5..0b22366e9764 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp @@ -170,8 +170,8 @@ void antipattern2() qwLongTime += 365 * 24 * 60 * 60 * 10000000LLU; // copy back to a FILETIME - ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // BAD - ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // BAD + ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // $ Alert // BAD + ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // $ Alert // BAD // convert back to SYSTEMTIME for display or other usage FileTimeToSystemTime(&ft, &st); @@ -190,7 +190,7 @@ time_t mkTime(int days) tm.tm_hour = 0; tm.tm_mday = 0; tm.tm_mon = 0; - tm.tm_year = days / 365; // BAD + tm.tm_year = days / 365; // $ Alert // BAD // ... t = mktime(&tm); // convert tm -> time_t @@ -214,8 +214,8 @@ void checkedExample() qwLongTime += 365 * 24 * 60 * 60 * 10000000LLU; // copy back to a FILETIME - ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // GOOD [FALSE POSITIVE] - ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // GOOD [FALSE POSITIVE] + ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // $ Alert // GOOD [FALSE POSITIVE] + ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // $ Alert // GOOD [FALSE POSITIVE] // convert back to SYSTEMTIME for display or other usage if (FileTimeToSystemTime(&ft, &st) == 0) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedReturnValueForTimeFunctions.qlref b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedReturnValueForTimeFunctions.qlref index 70eae8e7edc9..8dfe8a5c1e1e 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedReturnValueForTimeFunctions.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/UncheckedReturnValueForTimeFunctions.qlref @@ -1 +1,2 @@ -Likely Bugs/Leap Year/UncheckedReturnValueForTimeFunctions.ql +query: Likely Bugs/Leap Year/UncheckedReturnValueForTimeFunctions.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/test.cpp index 6e0320e8d84d..7a0b176f8bf9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UncheckedLeapYearAfterYearModification/test.cpp @@ -422,7 +422,7 @@ void AntiPattern_unchecked_filetime_conversion2a() st.wYear += 2; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification] // BUG - UncheckedReturnValueForTimeFunctions - SystemTimeToFileTime(&st, &ft); + SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function] } /** @@ -440,7 +440,7 @@ void AntiPattern_unchecked_filetime_conversion2b() st.wYear++; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification] // BUG - UncheckedReturnValueForTimeFunctions - SystemTimeToFileTime(&st, &ft); + SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function] } /** @@ -456,7 +456,7 @@ void AntiPattern_unchecked_filetime_conversion2b(SYSTEMTIME* st) st->wYear++; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification] // BUG - UncheckedReturnValueForTimeFunctions - SystemTimeToFileTime(st, &ft); + SystemTimeToFileTime(st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function] } /** @@ -950,7 +950,7 @@ void tp_intermediaryVar(struct timespec now, struct logtime ×tamp_remote) // BUG - UncheckedLeapYearAfterYearModification st.wYear = st.wYear + 1; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification] - SystemTimeToFileTime(&st, &ft); + SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function] } /** @@ -968,7 +968,7 @@ void tp_intermediaryVar(struct timespec now, struct logtime ×tamp_remote) // BUG - UncheckedLeapYearAfterYearModification st.wYear++; // $ Alert[cpp/leap-year/unchecked-after-arithmetic-year-modification] - SystemTimeToFileTime(&st, &ft); + SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function] } /** @@ -1032,7 +1032,7 @@ void fp_daymonth_guard(){ st.wDay = st.wMonth == 2 && st.wDay == 29 ? 28 : st.wDay; - SystemTimeToFileTime(&st, &ft); + SystemTimeToFileTime(&st, &ft); // $ Alert[cpp/leap-year/unchecked-return-value-for-time-conversion-function] } void increment_arg(WORD &x){ diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.qlref b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.qlref index 4271a41e0faa..e0d1519153c6 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/UnsafeArrayForDaysOfYear.qlref @@ -1 +1,2 @@ -Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear.ql +query: Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp index 7f6f2cfd3fe7..f76167c1893b 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/UnsafeArrayForDaysOfYear/test.cpp @@ -14,7 +14,7 @@ class vector { void ArrayOfDays_Bug(int dayOfYear, int x) { // BUG - int items[365]; + int items[365]; // $ Alert items[dayOfYear - 1] = x; } @@ -22,7 +22,7 @@ void ArrayOfDays_Bug(int dayOfYear, int x) void ArrayOfDays_Bug2(int dayOfYear, int x) { // BUG - int *items = new int[365]; + int *items = new int[365]; // $ Alert items[dayOfYear - 1] = x; delete items; @@ -49,7 +49,7 @@ void ArrayOfDays_FalsePositive(int dayOfYear, int x) void VectorOfDays_Bug(int dayOfYear, int x) { // BUG - vector items(365); + vector items(365); // $ Alert items[dayOfYear - 1] = x; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/AssignWhereCompareMeant.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/AssignWhereCompareMeant.qlref index ca70196fa6b9..e4598d920438 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/AssignWhereCompareMeant.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/AssignWhereCompareMeant.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/AssignWhereCompareMeant.ql +query: Likely Bugs/Likely Typos/AssignWhereCompareMeant.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/test.cpp index 3cd181254673..799aa0789cdd 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/AssignWhereCompareMeant/test.cpp @@ -24,25 +24,25 @@ class IntHolder { }; void f(int x) { - if (x = 3) { // BAD + if (x = 3) { // $ Alert // BAD } if ((x = 3)) { // GOOD: explicitly bracketed } - if (!(x = 3)) { // BAD + if (!(x = 3)) { // $ Alert // BAD } if (!((x = 3))) { // GOOD: explicitly bracketed } do { - } while (x = 0); // BAD + } while (x = 0); // $ Alert // BAD do { } while ((x = 0)); // GOOD: explicitly bracketed - if ((x = 3) && (x = 4)) { // BAD (x2) + if ((x = 3) && (x = 4)) { // $ Alert // BAD (x2) } if (((x = 3)) && ((x = 4))) { // GOOD: explicitly bracketed } - x = (x = 3) ? 2 : 1; // BAD + x = (x = 3) ? 2 : 1; // $ Alert // BAD x = ((x = 3)) ? 2 : 1; // GOOD: explicitly bracketed - assert(x = 2); // BAD + assert(x = 2); // $ Alert // BAD assert((x = 2)); // GOOD: explicitly bracketed int y; @@ -50,12 +50,12 @@ void f(int x) { if (y = 1) { // GOOD: y was not initialized so it is probably intentional. } y = 2; - if (y = 3) { // BAD: y has been initialized so it is probably a mistake. + if (y = 3) { // $ Alert // BAD: y has been initialized so it is probably a mistake. } int z = 1; - if (z = 2) { // BAD: z has been initialized so it is probably a mistake. + if (z = 2) { // $ Alert // BAD: z has been initialized so it is probably a mistake. } IntHolder holder1(x); IntHolder holder2(x); @@ -73,15 +73,15 @@ void g(int *i_p, int cond) { int i, j, k, x, y; static int s, t = 0; - if (global = 0) { // BAD: this is unlikely to be a deliberate initialization of global + if (global = 0) { // $ Alert // BAD: this is unlikely to be a deliberate initialization of global } - if (*i_p = 0) { // BAD + if (*i_p = 0) { // $ Alert // BAD } - if (s = 0) { // BAD + if (s = 0) { // $ Alert // BAD } - if (s = 0) { // BAD + if (s = 0) { // $ Alert // BAD } - if (t = 0) { // BAD + if (t = 0) { // $ Alert // BAD } for (i = 0, j = 0; i < 10; i++) { // GOOD @@ -89,7 +89,7 @@ void g(int *i_p, int cond) { } } - for (k = 0; !(k = 10); k++) { // BAD + for (k = 0; !(k = 10); k++) { // $ Alert // BAD } if (cond) { @@ -110,7 +110,7 @@ void h() { } int z = 0; - if(z = 1) { // BAD + if(z = 1) { // $ Alert // BAD } } @@ -131,26 +131,26 @@ void f3(int x, int y) { // as an assignment } - if((x == 1) && (y = 2)) { // BAD + if((x == 1) && (y = 2)) { // $ Alert // BAD } long z = x; - if(((z == 42) || (y = 2)) && (x == 1)) { // BAD + if(((z == 42) || (y = 2)) && (x == 1)) { // $ Alert // BAD } if((y = 2) && (x == z || x == 1)) { // GOOD } - if(((x == 42) || x == 1) && (y = 2)) { // BAD + if(((x == 42) || x == 1) && (y = 2)) { // $ Alert // BAD } if(x == 10 || (x == 42 && x == 1) && (y = 2)) { // GOOD } - if(x == 10 || ((x == 42) && (y = 2)) && (z == 1)) { // BAD + if(x == 10 || ((x == 42) && (y = 2)) && (z == 1)) { // $ Alert // BAD } - if((x == 10) || ((z == z) && (x == 1)) && (y = 2)) { // BAD + if((x == 10) || ((z == z) && (x == 1)) && (y = 2)) { // $ Alert // BAD } } @@ -163,11 +163,11 @@ void f4(int x, bool b) { if((x = 10) && use(x) && b) {} // GOOD: Same reason as above if((x = 10) && (use(x) && b)) {} // GOOD: Same reason as above - if(use(x) && b && (x = 10)) {} // BAD: The assignment is the last thing that happens in the comparison. + if(use(x) && b && (x = 10)) {} // $ Alert // BAD: The assignment is the last thing that happens in the comparison. // This doesn't match the usual pattern. - if((use(x) && b) && (x = 10)) {} // BAD: Same reason as above - if(use(x) && (b && (x = 10))) {} // BAD: Same reason as above + if((use(x) && b) && (x = 10)) {} // $ Alert // BAD: Same reason as above + if(use(x) && (b && (x = 10))) {} // $ Alert // BAD: Same reason as above - if((x = 10) || use(x)) {} // BAD: This doesn't follow the usual style of writing an assignment in + if((x = 10) || use(x)) {} // $ Alert // BAD: This doesn't follow the usual style of writing an assignment in // a boolean check. } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/CompareWhereAssignMeant.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/CompareWhereAssignMeant.qlref index 54f62d41b7bb..c197f0008961 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/CompareWhereAssignMeant.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/CompareWhereAssignMeant.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/CompareWhereAssignMeant.ql +query: Likely Bugs/Likely Typos/CompareWhereAssignMeant.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/ExprHasNoEffect.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/ExprHasNoEffect.qlref index 82a90f5413a9..662600c07dd1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/ExprHasNoEffect.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/ExprHasNoEffect.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/ExprHasNoEffect.ql +query: Likely Bugs/Likely Typos/ExprHasNoEffect.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/test.cpp index 2fa421059058..f112f08615c9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/CompareWhereAssignMeant/test.cpp @@ -25,30 +25,30 @@ void f(void) { i = 1; - i == 1; + i == 1; // $ Alert[cpp/compare-where-assign-meant] - i == 1, i == 2; + i == 1, i == 2; // $ Alert[cpp/compare-where-assign-meant] Alert[cpp/useless-expression] - i = i == 1, i == 2; + i = i == 1, i == 2; // $ Alert[cpp/compare-where-assign-meant] - i = (i == 1, i == 2); + i = (i == 1, i == 2); // $ Alert[cpp/compare-where-assign-meant] if (({ int x = 3; x == 3; })) { return; } - if (({ int x = 3; x == 3; x; })) { + if (({ int x = 3; x == 3; x; })) { // $ Alert[cpp/compare-where-assign-meant] return; } - if (({ int x = 3; x == 3; x = 4; })) { + if (({ int x = 3; x == 3; x = 4; })) { // $ Alert[cpp/compare-where-assign-meant] return; } - i != 1; + i != 1; // $ Alert[cpp/useless-expression] IntHolder holder1(i); IntHolder holder2(i); holder1 = holder2; - holder1 == holder2; + holder1 == holder2; // $ Alert[cpp/compare-where-assign-meant] if(holder1 = holder2) { } if(holder1 == holder1) { @@ -69,6 +69,6 @@ void report_error(const char*); void test_inside_macro_expansion(int x, int y) { DOES_NOT_THROW(x == y); // GOOD - x == y; // BAD - x == ID(y); // BAD + x == y; // $ Alert[cpp/compare-where-assign-meant] // BAD + x == ID(y); // $ Alert[cpp/compare-where-assign-meant] // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp index 0c7f9edacd19..f8e8851abec8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp @@ -10,7 +10,7 @@ struct person { bool hasName(person* p) { return p != NULL // This check is sensible, && p->name != NULL // as is this one. - && &p->name != NULL; // But this check is dubious. (BAD) + && &p->name != NULL; // $ Alert // But this check is dubious. (BAD) } // another example @@ -26,11 +26,11 @@ class myClass assert(this->y != NULL); assert(&this->y != NULL); // BAD [NOT DETECTED] assert(ptr->y != NULL); - assert(&ptr->y != NULL); // BAD + assert(&ptr->y != NULL); // $ Alert // BAD assert((ptr->y) != NULL); - assert(&(ptr->y) != NULL); // BAD + assert(&(ptr->y) != NULL); // $ Alert // BAD assert(ref.y != NULL); - assert(&(ref.y) != NULL); // BAD + assert(&(ref.y) != NULL); // $ Alert // BAD }; private: diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.qlref index 4e0443db7906..da788f52f504 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/DubiousNullCheck.ql \ No newline at end of file +query: Likely Bugs/Likely Typos/DubiousNullCheck.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/CMakeFiles/CMakeScratch/TryCompile-abcdef/ExprHasNoEffect.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/CMakeFiles/CMakeScratch/TryCompile-abcdef/ExprHasNoEffect.qlref index 82a90f5413a9..662600c07dd1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/CMakeFiles/CMakeScratch/TryCompile-abcdef/ExprHasNoEffect.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/CMakeFiles/CMakeScratch/TryCompile-abcdef/ExprHasNoEffect.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/ExprHasNoEffect.ql +query: Likely Bugs/Likely Typos/ExprHasNoEffect.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/ExprHasNoEffect.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/ExprHasNoEffect.qlref index 82a90f5413a9..662600c07dd1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/ExprHasNoEffect.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/ExprHasNoEffect.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/ExprHasNoEffect.ql +query: Likely Bugs/Likely Typos/ExprHasNoEffect.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.qlref index 82a90f5413a9..662600c07dd1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/ExprHasNoEffect.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/ExprHasNoEffect.ql +query: Likely Bugs/Likely Typos/ExprHasNoEffect.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c.c index 4ff7c2253358..d968acd38619 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest.c.c @@ -1,6 +1,6 @@ #include "conftest.h" int main3() { - strlen(""); // BAD: not a `conftest` file, as `conftest` is not directly followed by the extension or a sequence of numbers. + strlen(""); // $ Alert // BAD: not a `conftest` file, as `conftest` is not directly followed by the extension or a sequence of numbers. return 0; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest_abc.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest_abc.c index 88215d7434cd..4b473a7934c9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest_abc.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/autoconf/conftest_abc.c @@ -1,6 +1,6 @@ #include "conftest.h" int main1() { - strlen(""); // BAD: not a `conftest` file, as `conftest` is not directly followed by the extension or a sequence of numbers. + strlen(""); // $ Alert // BAD: not a `conftest` file, as `conftest` is not directly followed by the extension or a sequence of numbers. return 0; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/calls.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/calls.cpp index 2acdfcf80f8f..31d8025cb976 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/calls.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/calls.cpp @@ -5,11 +5,11 @@ int external(); class Base { public: virtual int thingy() { - 1; // BAD + 1; // $ Alert // BAD } int our_thingy() { - Base::thingy(); // BAD + Base::thingy(); // $ Alert // BAD return 2; } }; @@ -27,4 +27,4 @@ void internal() { ptr->thingy(); // GOOD } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/expr.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/expr.cpp index 56809a4e05fa..b87eff35ee97 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/expr.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/expr.cpp @@ -5,9 +5,9 @@ int i; void comma_expr_test() { i++, i++; // GOOD - 0, i++; // BAD (first part) - i++, 0; // BAD (second part) - 0, 0; // BAD (whole) + 0, i++; // $ Alert // BAD (first part) + i++, 0; // $ Alert // BAD (second part) + 0, 0; // $ Alert // BAD (whole) } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/meson-private/tmp_abc/ExprHasNoEffect.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/meson-private/tmp_abc/ExprHasNoEffect.qlref index 82a90f5413a9..662600c07dd1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/meson-private/tmp_abc/ExprHasNoEffect.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/meson-private/tmp_abc/ExprHasNoEffect.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/ExprHasNoEffect.ql +query: Likely Bugs/Likely Typos/ExprHasNoEffect.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/preproc.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/preproc.c index 2761476c474e..04cadce0da87 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/preproc.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/preproc.c @@ -86,10 +86,10 @@ void test() fn1(); fn2(); fn3(); - fn4(); // has no effect + fn4(); // $ Alert // has no effect fn5(); fn6(); fn7(); fn8(); - fn9(); // has no effect + fn9(); // $ Alert // has no effect } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/template.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/template.cpp index ecc3d6246034..9c0673bca1a8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/template.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/template.cpp @@ -16,7 +16,7 @@ void myTemplateTest() { Nothing n; i++; // GOOD (always has an effect) - n++; // BAD (never has an effect) + n++; // $ Alert // BAD (never has an effect) Increment(i); Increment(n); } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp index 7d2b6b19777e..c47f7febe414 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp @@ -36,5 +36,5 @@ void call_add_numbers() int accum = 0; add_numbers(accum, 4); // GOOD add_numbers(accum, 10); // GOOD - pointless_add_numbers(accum, 20); // BAD + pointless_add_numbers(accum, 20); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/test.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/test.c index 1b2530fdff5b..d7b65299dad3 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/test.c @@ -4,27 +4,27 @@ extern int g(void); void f(int b) { int i; - 0; + 0; // $ Alert - ({ 1; 2; 3; }); - i = ({ 4; 5; 6; }); - i = ({ 7; 8; 9, 10; }); + ({ 1; 2; 3; }); // $ Alert + i = ({ 4; 5; 6; }); // $ Alert + i = ({ 7; 8; 9, 10; }); // $ Alert - i = 11, 12; - i = 13, 14, 15; - i = (16, 17); - i = (18, 19, 20); - 21, 22; - 23, 24, 25; + i = 11, 12; // $ Alert + i = 13, 14, 15; // $ Alert + i = (16, 17); // $ Alert + i = (18, 19, 20); // $ Alert + 21, 22; // $ Alert + 23, 24, 25; // $ Alert i = b ? 26 : 27; i = b ? g() : 28; i = b ? 29 : g(); i = b ? g() : g(); - b ? 30 : 31; - b ? g() : 32; - b ? 33 : g(); + b ? 30 : 31; // $ Alert + b ? g() : 32; // $ Alert + b ? 33 : g(); // $ Alert b ? g() : g(); } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/test.cpp index da4398f4105b..f46ed1d6722f 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/test.cpp @@ -59,10 +59,10 @@ class MyAssignable : public Assignable void testFunc2() { Assignable u1, u2; - u2 = u1; + u2 = u1; // $ Alert MyAssignable v1, v2; - v2 = v1; + v2 = v1; // $ Alert } namespace std { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/volatile.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/volatile.c index c34e0818f192..e0b2747c59a4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/volatile.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/volatile.c @@ -6,20 +6,19 @@ char *pc; volatile char *pv; void f(void) { - c; // BAD + c; // $ Alert // BAD v; // (accesses to volatile variables are considered impure) - pc[5]; // BAD + pc[5]; // $ Alert // BAD pv[5]; ((volatile char *)pc)[5]; - *pc; // BAD + *pc; // $ Alert // BAD *pv; *((volatile char *)pc); - *(pc + 5); // BAD + *(pc + 5); // $ Alert // BAD *(pv + 5); *((volatile char *)(pc + 5)); *(((volatile char *)pc) + 5); } - diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/weak.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/weak.c index ef4bff229488..2c795760199a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/weak.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/weak.c @@ -15,6 +15,6 @@ int __attribute__((__weak__)) myWeakNothingFunction() } void testWeak() { - myNothingFunction(); // BAD + myNothingFunction(); // $ Alert // BAD myWeakNothingFunction(); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.c index d2a13e17c837..a0a8e5f04141 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.c @@ -3,7 +3,7 @@ void C6317_positive(int i) { - if (i & !FLAGS) // BUG + if (i & !FLAGS) // $ Alert // BUG { } } @@ -28,10 +28,10 @@ void bitwiseAndUsage(unsigned int l, unsigned int r) unsigned int x; unsigned z = 0; - x = l & !r; //BUG - x = !FLAGS & r; //BUG - x = !FLAGS & !!r; //BUG - + x = l & !r; // $ Alert //BUG + x = !FLAGS & r; // $ Alert //BUG + x = !FLAGS & !!r; // $ Alert //BUG + x = !!l & r; // Not a bug - double negation x = !!!l & r; // Not a bug - double negation x = !!FLAGS & r; // Not a bug - double negation @@ -44,9 +44,9 @@ void bitwiseOrUsage(unsigned int l, unsigned int r) { unsigned int x; - x = l | !r; //BUG - x = !FLAGS | r; //BUG - x = !FLAGS | !!r; //BUG + x = l | !r; // $ Alert //BUG + x = !FLAGS | r; // $ Alert //BUG + x = !FLAGS | !!r; // $ Alert //BUG x = !!l | r; // Not a bug - double negation x = !!!l | r; // Not a bug - double negation @@ -67,7 +67,7 @@ void bitwiseOperatorsNotCovered(unsigned int l, unsigned int r) void macroUsage(unsigned int arg1, unsigned int arg2) { - if (((!cap_valid(arg1)) | arg2)) { // BUG + if (((!cap_valid(arg1)) | arg2)) { // $ Alert // BUG } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.cpp index ac3f1ab3ed5c..a6b0f682070c 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.cpp @@ -3,7 +3,7 @@ void C6317_positive(int i) { - if (i & !FLAGS) // BUG + if (i & !FLAGS) // $ Alert // BUG { } } @@ -28,9 +28,9 @@ void bitwiseAndUsage(unsigned int l, unsigned int r) unsigned int x; unsigned z = 0; - x = l & !r; //BUG - x = !FLAGS & r; //BUG - x = !FLAGS & !!r; //BUG + x = l & !r; // $ Alert //BUG + x = !FLAGS & r; // $ Alert //BUG + x = !FLAGS & !!r; // $ Alert //BUG x = !!l & r; // Not a bug - double negation x = !!!l & r; // Not a bug - double negation @@ -44,9 +44,9 @@ void bitwiseOrUsage(unsigned int l, unsigned int r) { unsigned int x; - x = l | !r; //BUG - x = !FLAGS | r; //BUG - x = !FLAGS | !!r; //BUG + x = l | !r; // $ Alert //BUG + x = !FLAGS | r; // $ Alert //BUG + x = !FLAGS | !!r; // $ Alert //BUG x = !!l | r; // Not a bug - double negation x = !!!l | r; // Not a bug - double negation @@ -67,14 +67,14 @@ void bitwiseOperatorsNotCovered(unsigned int l, unsigned int r) void macroUsage(unsigned int arg1, unsigned int arg2) { - if (((!cap_valid(arg1)) | arg2)) { // BUG + if (((!cap_valid(arg1)) | arg2)) { // $ Alert // BUG } } void bool_examples(bool a, bool b) { - if (a & !b) // dubious (confusing intent, but shouldn't produce a wrong result) + if (a & !b) // $ Alert // dubious (confusing intent, but shouldn't produce a wrong result) { } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.qlref index d50294defe2c..2defdf045755 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/IncorrectNotOperatorUsage/IncorrectNotOperatorUsage.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.ql \ No newline at end of file +query: Likely Bugs/Likely Typos/IncorrectNotOperatorUsage.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ShortCircuitBitMask/ShortCircuitBitMask.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ShortCircuitBitMask/ShortCircuitBitMask.qlref index be55343c0a6c..8819dc134bf8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ShortCircuitBitMask/ShortCircuitBitMask.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ShortCircuitBitMask/ShortCircuitBitMask.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/ShortCircuitBitMask.ql \ No newline at end of file +query: Likely Bugs/Likely Typos/ShortCircuitBitMask.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ShortCircuitBitMask/big_ints.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ShortCircuitBitMask/big_ints.cpp index 0f87c3d2fbfc..df149fcaedd4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ShortCircuitBitMask/big_ints.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ShortCircuitBitMask/big_ints.cpp @@ -1,14 +1,14 @@ static void bad(int x) { - x && 2; - x && 4; - x && 16; - x && 256; - x && 0x10000; - x && 0x80000000; - x && 0x100000000LL; - x && 0x800000000LL; - x && 0x10000000000LL; - x && 0x123456789ABLL; + x && 2; // $ Alert + x && 4; // $ Alert + x && 16; // $ Alert + x && 256; // $ Alert + x && 0x10000; // $ Alert + x && 0x80000000; // $ Alert + x && 0x100000000LL; // $ Alert + x && 0x800000000LL; // $ Alert + x && 0x10000000000LL; // $ Alert + x && 0x123456789ABLL; // $ Alert } static void good(int x) { @@ -29,7 +29,7 @@ static void good(int x) { template void templateFunc() { (i & (i - 1)) && true; - 4 && true; + 4 && true; // $ Alert } void templateTest() { @@ -66,4 +66,4 @@ void testMacro() #define MYFLAG (0x80) unsigned int calc1 = 123 & MYFLAG; // OK -unsigned int calc2 = 123 && MYFLAG; // BAD +unsigned int calc2 = 123 && MYFLAG; // $ Alert // BAD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/UsingStrcpyAsBoolean.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/UsingStrcpyAsBoolean.qlref index 6ae254cc9747..008951cee5c1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/UsingStrcpyAsBoolean.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/UsingStrcpyAsBoolean.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/UsingStrcpyAsBoolean.ql +query: Likely Bugs/Likely Typos/UsingStrcpyAsBoolean.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.c index d08742a5add5..912058b77aac 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.c @@ -1,4 +1,4 @@ -typedef unsigned int size_t; +typedef unsigned int size_t; typedef int* locale_t; char* strcpy(char* destination, const char* source) @@ -31,37 +31,37 @@ void PositiveCases() char szbuf2[100]; int result; - if (strcpy(szbuf1, "test")) // Bug, direct usage + if (strcpy(szbuf1, "test")) // $ Alert // Bug, direct usage { } - if (!strcpy(szbuf1, "test")) // Bug, unary binary operator + if (!strcpy(szbuf1, "test")) // $ Alert // Bug, unary binary operator { } - if (strcpy(szbuf1, "test") == 0) // Bug, equality operator + if (strcpy(szbuf1, "test") == 0) // $ Alert // Bug, equality operator { } - if (SomeFunction() && strcpy(szbuf1, "test")) // Bug, binary logical operator + if (SomeFunction() && strcpy(szbuf1, "test")) // $ Alert // Bug, binary logical operator { } - if (strncpy(szbuf1, "test", 100)) // Bug + if (strncpy(szbuf1, "test", 100)) // $ Alert // Bug { } - if (!strncpy(szbuf1, "test", 100)) // Bug + if (!strncpy(szbuf1, "test", 100)) // $ Alert // Bug { } - result = !strncpy(szbuf1, "test", 100); // Bug - result = strcpy(szbuf1, "test") ? 1 : 0; // Bug - result = strcpy(szbuf1, "test") && 1; // Bug + result = !strncpy(szbuf1, "test", 100); // $ Alert // Bug + result = strcpy(szbuf1, "test") ? 1 : 0; // $ Alert // Bug + result = strcpy(szbuf1, "test") && 1; // $ Alert // Bug - result = strcpy(szbuf1, "test") == 0; // Bug + result = strcpy(szbuf1, "test") == 0; // $ Alert // Bug - result = strcpy(szbuf1, "test") != 0; // Bug + result = strcpy(szbuf1, "test") != 0; // $ Alert // Bug } void NegativeCases() diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.cpp index 707cf8466143..c1111b8c9e53 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/UsingStrcpyAsBoolean/test.cpp @@ -1,4 +1,4 @@ -typedef unsigned long size_t; +typedef unsigned long size_t; typedef int* locale_t; char* strcpy(char* destination, const char* source) @@ -72,71 +72,71 @@ void PositiveCases() locale_t x; *x = 0; - if (strcpy(szbuf1, "test")) // Bug, direct usage + if (strcpy(szbuf1, "test")) // $ Alert // Bug, direct usage { } - if (!strcpy(szbuf1, "test")) // Bug, unary binary operator + if (!strcpy(szbuf1, "test")) // $ Alert // Bug, unary binary operator { } - if (strcpy(szbuf1, "test") == 0) // Bug, equality operator + if (strcpy(szbuf1, "test") == 0) // $ Alert // Bug, equality operator { } - if (SomeFunction() && strcpy(szbuf1, "test")) // Bug, binary logical operator + if (SomeFunction() && strcpy(szbuf1, "test")) // $ Alert // Bug, binary logical operator { } - if (WCSCPY_6324(wscbuf1, wscbuf2)) // Bug, using a macro + if (WCSCPY_6324(wscbuf1, wscbuf2)) // $ Alert // Bug, using a macro { } - if (wcscpy(wscbuf1, wscbuf2)) // Bug + if (wcscpy(wscbuf1, wscbuf2)) // $ Alert // Bug { } - if (_mbscpy(mbcbuf1, mbcbuf2)) // Bug + if (_mbscpy(mbcbuf1, mbcbuf2)) // $ Alert // Bug { } - if (strncpy(szbuf1, "test", 100)) // Bug + if (strncpy(szbuf1, "test", 100)) // $ Alert // Bug { } - if (wcsncpy(wscbuf1, wscbuf2, 100)) // Bug + if (wcsncpy(wscbuf1, wscbuf2, 100)) // $ Alert // Bug { } - if (_mbsncpy(mbcbuf1, (const unsigned char*)"test", 100)) // Bug + if (_mbsncpy(mbcbuf1, (const unsigned char*)"test", 100)) // $ Alert // Bug { } - if (_strncpy_l(szbuf1, "test", 100, x)) // Bug + if (_strncpy_l(szbuf1, "test", 100, x)) // $ Alert // Bug { } - if (_wcsncpy_l(wscbuf1, wscbuf2, 100, x)) // Bug + if (_wcsncpy_l(wscbuf1, wscbuf2, 100, x)) // $ Alert // Bug { } - if (_mbsncpy_l(mbcbuf1, (const unsigned char*)"test", 100, x)) //Bug + if (_mbsncpy_l(mbcbuf1, (const unsigned char*)"test", 100, x)) // $ Alert //Bug { } - if (!strncpy(szbuf1, "test", 100)) // Bug + if (!strncpy(szbuf1, "test", 100)) // $ Alert // Bug { } - bool b = strncpy(szbuf1, "test", 100); // Bug + bool b = strncpy(szbuf1, "test", 100); // $ Alert // Bug - bool result = !strncpy(szbuf1, "test", 100); // Bug - result = strcpy(szbuf1, "test") ? 1 : 0; // Bug - result = strcpy(szbuf1, "test") && 1; // Bug + bool result = !strncpy(szbuf1, "test", 100); // $ Alert // Bug + result = strcpy(szbuf1, "test") ? 1 : 0; // $ Alert // Bug + result = strcpy(szbuf1, "test") && 1; // $ Alert // Bug - result = strcpy(szbuf1, "test") == 0; // Bug + result = strcpy(szbuf1, "test") == 0; // $ Alert // Bug - result = strcpy(szbuf1, "test") != 0; // Bug + result = strcpy(szbuf1, "test") != 0; // $ Alert // Bug } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.c b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.c index d66e027bdc1e..74039347afdd 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.c @@ -4,7 +4,7 @@ void Signed() for (i = 0; i < 100; i--) //BUG { - } + } // $ Alert for (i = 0; i < 100; i++) { @@ -12,7 +12,7 @@ void Signed() for (i = 100; i >= 0; i++) //BUG { - } + } // $ Alert for (i = 100; i >= 0; i--) { @@ -26,7 +26,7 @@ void Unsigned() for (i = 0; i < 100; i--) //BUG { - } + } // $ Alert for (i = 0; i < 100; i++) { @@ -34,7 +34,7 @@ void Unsigned() for (i = 100; i >= 0; i++) //BUG { - } + } // $ Alert for (i = 100; i >= 0; i--) { @@ -47,7 +47,7 @@ void InitializationOutsideLoop() for (; i < 100; i--) //BUG { - } + } // $ Alert i = 0; for (; i < 100; i++) @@ -57,7 +57,7 @@ void InitializationOutsideLoop() i = 100; for (; i >= 0; i++) //BUG { - } + } // $ Alert i = 100; for (; i >= 0; i--) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp index 0642eb747c41..794be80efdf4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp @@ -4,7 +4,7 @@ void Signed() for (i = 0; i < 100; i--) //BUG { - } + } // $ Alert for (i = 0; i < 100; i++) { @@ -12,7 +12,7 @@ void Signed() for (i = 100; i >= 0; i++) //BUG { - } + } // $ Alert for (i = 100; i >= 0; i--) { @@ -26,7 +26,7 @@ void Unsigned() for (i = 0; i < 100; i--) //BUG { - } + } // $ Alert for (i = 0; i < 100; i++) { @@ -34,7 +34,7 @@ void Unsigned() for (i = 100; i >= 0; i++) //BUG { - } + } // $ Alert for (i = 100; i >= 0; i--) { @@ -45,7 +45,7 @@ void DeclarationInLoop() { for (signed char i = 0; i < 100; --i) //BUG { - } + } // $ Alert for (signed char i = 0; i < 100; ++i) { @@ -53,7 +53,7 @@ void DeclarationInLoop() for (unsigned char i = 100; i >= 0; ++i) //BUG { - } + } // $ Alert for (unsigned char i = 100; i >= 0; --i) { @@ -68,7 +68,7 @@ void SignedWithVariables() for (i = min; i < max; i--) //BUG { - } + } // $ Alert for (i = min; i < max; i++) { @@ -76,7 +76,7 @@ void SignedWithVariables() for (i = max; i >= min; i++) //BUG { - } + } // $ Alert for (i = max; i >= min; i--) { @@ -90,7 +90,7 @@ void InitializationOutsideLoop() for (; i < 100; --i) //BUG { - } + } // $ Alert i = 0; for (; i < 100; ++i) @@ -100,7 +100,7 @@ void InitializationOutsideLoop() i = 100; for (; i >= 0; ++i) //BUG { - } + } // $ Alert i = 100; for (; i >= 0; --i) @@ -117,11 +117,11 @@ void InvalidCondition() for (i = max; i < min; i--) //BUG { - } + } // $ Alert for (i = min; i > max; i++) //BUG { - } + } // $ Alert } void InvalidConditionUnsignedCornerCase() @@ -132,14 +132,14 @@ void InvalidConditionUnsignedCornerCase() for (i = 100; i < 0; i--) //BUG { - } + } // $ Alert - // Limitation. + // Limitation. // Currently odasa will not detect this for-loop condition as always true // The rule will still detect the mismatch iterator, but the error message may change in the future. for (i = 200; i >= 0; i++) //BUG { - } + } // $ Alert } void NegativeTestCase() @@ -165,18 +165,18 @@ void NegativeTestCaseNested() // Query limitation: // // The following test cases are bugs, -// but will not be found due to the itearion expression +// but will not be found due to the itearion expression // not being a prefix or postfix increment/decrement // void FalseNegativeTestCases() { for (int i = 0; i < 10; i = i - 1) {} // For comparison - for (int i = 0; i < 10; i-- ) {} // BUG + for (int i = 0; i < 10; i-- ) {} // $ Alert // BUG for (int i = 100; i > 0; i += 2) {} // For comparison - for (int i = 100; i > 0; i ++ ) {} // BUG + for (int i = 100; i > 0; i ++ ) {} // $ Alert // BUG } void IntendedOverflow(unsigned char p) @@ -193,15 +193,15 @@ void IntendedOverflow(unsigned char p) for (i = m - 2; i < m; i--) {} // DUBIOUS for (i = m; i < m + 1; i--) {} // GOOD - for (s = 63; s < 64; s--) {} // BAD (signed numbers don't wrap at 0 / at all) - for (s = m + 1; s < m; s--) {} // BAD (never runs) + for (s = 63; s < 64; s--) {} // $ Alert // BAD (signed numbers don't wrap at 0 / at all) + for (s = m + 1; s < m; s--) {} // $ Alert // BAD (never runs) for (i = p - 1; i < p; i--) {} // GOOD for (s = p - 1; s < p; s--) {} // BAD [NOT DETECTED] { int n; - + n = 64; for (i = n - 1; i < n; i--) {} // GOOD n = 64; @@ -212,7 +212,7 @@ void IntendedOverflow(unsigned char p) n = 64; for (s = n - 1; s < n; s--) {} // BAD [NOT DETECTED] n = 64; - for (s = n - 1; s < 64; s--) {} // BAD + for (s = n - 1; s < 64; s--) {} // $ Alert // BAD n = 64; for (s = 63; s < n; s--) {} // BAD [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.qlref b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.qlref index af5f0a899cbd..0436ab0d4bd6 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.qlref @@ -1 +1,2 @@ -Likely Bugs/Likely Typos/inconsistentLoopDirection.ql \ No newline at end of file +query: Likely Bugs/Likely Typos/inconsistentLoopDirection.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop.qlref index d5227c40ee4c..301aedbb9c35 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/AllocaInLoop.ql +query: Likely Bugs/Memory Management/AllocaInLoop.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop1.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop1.cpp index 9071a1052b8d..de5307b9b8f4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop1.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop1.cpp @@ -28,7 +28,7 @@ void foo(const struct vtype* vec, int count) { b1 = new char[w1]; } else { // Allocate the buffer on stack - b1 = (char*) alloca(w1); // BAD + b1 = (char*) alloca(w1); // $ Alert // BAD } } memcpy(b1, v, w1); @@ -52,7 +52,7 @@ void bar(const struct vtype* vec, int count) { b1 = new char[w1]; } else { // Allocate the buffer on stack - b1 = (char*) alloca(w1); // BAD + b1 = (char*) alloca(w1); // $ Alert // BAD } } } while (0); @@ -77,7 +77,7 @@ void baz(const struct vtype* vec, int count) { b1 = new char[w1]; } else { // Allocate the buffer on stack - b1 = (char*) alloca(w1); // BAD + b1 = (char*) alloca(w1); // $ Alert // BAD } } memcpy(b1, v, w1); @@ -107,7 +107,7 @@ void case5() { char *buffer; do { - buffer = (char*)alloca(1024); // BAD + buffer = (char*)alloca(1024); // $ Alert // BAD continue; } while (1); diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop1ms.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop1ms.cpp index 9ebf4f17ba16..887d1f578894 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop1ms.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop1ms.cpp @@ -25,7 +25,7 @@ void foo(const struct vtype* vec, int count) { b1 = new char[w1]; } else { // Allocate the buffer on stack - b1 = (char*) _alloca(w1); // BAD + b1 = (char*) _alloca(w1); // $ Alert // BAD } } memcpy(b1, v, w1); @@ -49,7 +49,7 @@ void bar(const struct vtype* vec, int count) { b1 = new char[w1]; } else { // Allocate the buffer on stack - b1 = (char*) _malloca(w1); // BAD + b1 = (char*) _malloca(w1); // $ Alert // BAD } } } while (0); @@ -76,7 +76,7 @@ void baz(const struct vtype* vec, int count) { b1 = new char[w1]; } else { // Allocate the buffer on stack - b1 = (char*) _alloca(w1); // BAD + b1 = (char*) _alloca(w1); // $ Alert // BAD } } memcpy(b1, v, w1); diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop2.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop2.c index 7f8ce7a07fe0..3f1ae12799e9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop2.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop2.c @@ -36,7 +36,7 @@ void foo(const struct vtype* vec, int count) { b1 = (char *)malloc(w1); } else { // Allocate the buffer on stack - b1 = (char*) alloca(w1); // BAD + b1 = (char*) alloca(w1); // $ Alert // BAD iter = 1; } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop3.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop3.cpp index b3418829e48f..c94f7d628a3f 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop3.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop3.cpp @@ -42,7 +42,7 @@ char *baz(int count) { char *buf; do { buf = ({ - char *b = (char *)alloca(32); // BAD + char *b = (char *)alloca(32); // $ Alert // BAD sprintf(b, "Value is %d\n", count); b; }); diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp index fbecb59588da..d9cf74338922 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp @@ -22,7 +22,7 @@ void forTwice() { void forEver() { for (;;) { - alloca(100); // BAD + alloca(100); // $ Alert // BAD } } @@ -35,7 +35,7 @@ void doTwice() { void unknownStartingPoint(int i) { for (; i < 2; i++) { - alloca(100); // BAD + alloca(100); // $ Alert // BAD } } @@ -52,7 +52,7 @@ void atMostTwice() { void sometimesIncrement() { int i = 0; while (i < 2) { - alloca(100); // BAD + alloca(100); // $ Alert // BAD if (getInt()) { i++; } @@ -61,7 +61,7 @@ void sometimesIncrement() { void upAndDown() { for (int i = 0; i < 2; i++) { - alloca(100); // BAD + alloca(100); // $ Alert // BAD if (getInt()) { i--; } @@ -70,7 +70,7 @@ void upAndDown() { void largeBound() { for (int i = 0; i < 10000; i++) { - alloca(100); // BAD + alloca(100); // $ Alert // BAD } } @@ -94,7 +94,7 @@ void maybeSmallOffset() { i = 9997; } for (; i < 10000; i++) { - alloca(100); // BAD + alloca(100); // $ Alert // BAD } } @@ -102,7 +102,7 @@ void incBefore() { int i = -1; i++; // not understood by data flow for (; i < 2; i++) { - alloca(100); // GOOD [FALSE POSITIVE] + alloca(100); // $ Alert // GOOD [FALSE POSITIVE] } } @@ -135,7 +135,7 @@ void eqFalse() { void eqFalseFlipped() { for (int stop = 0; stop == 0; stop = 0) { - alloca(100); // BAD + alloca(100); // $ Alert // BAD } } @@ -173,7 +173,7 @@ void countDownAssignAdd() { void countDownWrong() { for (int i = 2-1; i >= 0; i++) { - alloca(100); // BAD + alloca(100); // $ Alert // BAD } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTermination.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTermination.qlref index 3120e479150f..c09d3d9d76aa 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTermination.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTermination.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/ImproperNullTermination.ql \ No newline at end of file +query: Likely Bugs/Memory Management/ImproperNullTermination.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTerminationTainted.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTerminationTainted.qlref index 6fbfb31d7801..778616ca43c4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTerminationTainted.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTerminationTainted.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-170/ImproperNullTerminationTainted.ql +query: Security/CWE/CWE-170/ImproperNullTerminationTainted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp index 49dc01a40df9..6a1548052330 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp @@ -23,8 +23,8 @@ void test_unassigned() char buffer1[1024]; char buffer2[1024]; - strdup(buffer1); // BAD - strdup(buffer2); // BAD + strdup(buffer1); // $ Alert[cpp/improper-null-termination] // BAD + strdup(buffer2); // $ Alert[cpp/improper-null-termination] // BAD memcpy(buffer2, buffer1, sizeof(buffer2)); strdup(buffer1); // BAD [NOT DETECTED] @@ -37,7 +37,7 @@ void test_unassigned() strcpy(buffer1, "content"); strdup(buffer1); // GOOD - strdup(buffer2); // BAD + strdup(buffer2); // $ Alert[cpp/improper-null-termination] // BAD memcpy(buffer2, buffer1, sizeof(buffer2)); strdup(buffer1); // GOOD @@ -57,7 +57,7 @@ void test_unassigned() char *ptr1; char *ptr2 = "content"; - strdup(ptr1); // BAD + strdup(ptr1); // $ Alert[cpp/improper-null-termination] // BAD strdup(ptr2); // GOOD } @@ -67,8 +67,8 @@ void test_unassigned() char *ptr; ptr = buffer1; - strdup(buffer1); // BAD - strdup(ptr); // BAD + strdup(buffer1); // $ Alert[cpp/improper-null-termination] // BAD + strdup(ptr); // $ Alert[cpp/improper-null-termination] // BAD strcpy(buffer1, "content"); strdup(buffer1); // GOOD @@ -79,8 +79,8 @@ void test_unassigned() strdup(ptr); // GOOD ptr = buffer2; - strdup(buffer2); // BAD - strdup(ptr); // BAD + strdup(buffer2); // $ Alert[cpp/improper-null-termination] // BAD + strdup(ptr); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -91,7 +91,7 @@ void test_unassigned() strcpy(buffer, "content"); strdup(buffer); // GOOD } - strdup(buffer); // BAD + strdup(buffer); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -114,7 +114,7 @@ void test_unassigned() strcpy(buffer, "content"); strdup(buffer); // GOOD } - strdup(buffer); // BAD + strdup(buffer); // $ Alert[cpp/improper-null-termination] // BAD } } @@ -128,7 +128,7 @@ void test_caller() char buffer[1024]; test_callee("content", buffer); // GOOD - test_callee(buffer, "content"); // BAD + test_callee(buffer, "content"); // $ Alert[cpp/improper-null-termination] // BAD } void test_readlink(int fd, const char *path, size_t sz) @@ -137,7 +137,7 @@ void test_readlink(int fd, const char *path, size_t sz) char buffer[1024]; readlink(path, buffer, sizeof(buffer)); - strdup(buffer); // BAD + strdup(buffer); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -145,7 +145,7 @@ void test_readlink(int fd, const char *path, size_t sz) int v; readlinkat(fd, path, buffer, sizeof(buffer)); - v = strlen(buffer); // BAD + v = strlen(buffer); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -180,7 +180,7 @@ void test_readlink(int fd, const char *path, size_t sz) memset(buffer, 0, sizeof(buffer)); readlink(path, buffer, sizeof(buffer)); - strdup(buffer); // BAD + strdup(buffer); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -233,7 +233,7 @@ void test_strcat() { char buffer[1024]; - strcat(buffer, "content"); // BAD + strcat(buffer, "content"); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -261,7 +261,7 @@ void test_strcat() char buffer[1024]; buffer[0] = 'a'; - strcat(buffer, "content"); // BAD + strcat(buffer, "content"); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -282,7 +282,7 @@ void test_strcat() char buffer[1024]; doNothing(buffer); - strcat(buffer, "content"); // BAD + strcat(buffer, "content"); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -299,7 +299,7 @@ void test_strcat() *buffer_ptr = 0; strcat(buffer1, "content"); // GOOD - strcat(buffer2, "content"); // BAD + strcat(buffer2, "content"); // $ Alert[cpp/improper-null-termination] // BAD strcat(buffer_ptr, "content"); // GOOD buffer_ptr = buffer2; @@ -311,7 +311,7 @@ void test_strcat() char *buffer_ptr = buffer; *buffer_ptr = 'a'; - strcat(buffer, "content"); // BAD + strcat(buffer, "content"); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -333,7 +333,7 @@ void test_strlen(bool cond1, bool cond2) { { char buffer[1024]; - int i = strlen(buffer); // BAD + int i = strlen(buffer); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -418,7 +418,7 @@ void test_strcpy() char buffer1[1024]; char buffer2[1024]; - strcpy(buffer1, buffer2); // BAD + strcpy(buffer1, buffer2); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -445,13 +445,13 @@ void test_wrappers() { char buffer[1024]; - strcatWrapper(buffer, "content"); // BAD + strcatWrapper(buffer, "content"); // $ Alert[cpp/improper-null-termination] // BAD } { char buffer[1024]; - strcatWrapper2(buffer, "content"); // BAD + strcatWrapper2(buffer, "content"); // $ Alert[cpp/improper-null-termination] // BAD } } @@ -463,7 +463,7 @@ void test_read_fread(int read_src, FILE *s) char buffer[buffer_size]; read(read_src, buffer, buffer_size * sizeof(char)); - strlen(buffer); // BAD + strlen(buffer); // $ Alert[cpp/user-controlled-null-termination-tainted] // BAD } { @@ -478,7 +478,7 @@ void test_read_fread(int read_src, FILE *s) char buffer[buffer_size]; fread(buffer, sizeof(char), buffer_size, s); - strlen(buffer); // BAD + strlen(buffer); // $ Alert[cpp/user-controlled-null-termination-tainted] // BAD } { @@ -510,13 +510,13 @@ void test_printf(char *str) { char buffer[1024]; - printf(buffer, ""); // BAD + printf(buffer, ""); // $ Alert[cpp/improper-null-termination] // BAD } { char buffer[1024]; - printf("%s", buffer); // BAD + printf("%s", buffer); // $ Alert[cpp/improper-null-termination] // BAD } { @@ -555,7 +555,7 @@ void test_reassignment() strcpy(buffer_ptr, "content"); // null terminates buffer1 buffer_ptr = buffer2; - strdup(buffer2); // BAD + strdup(buffer2); // $ Alert[cpp/improper-null-termination] // BAD } { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/NtohlArrayNoBound/NtohlArrayNoBound.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/NtohlArrayNoBound/NtohlArrayNoBound.qlref index 58e62b13e6d6..d01f3942fc53 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/NtohlArrayNoBound/NtohlArrayNoBound.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/NtohlArrayNoBound/NtohlArrayNoBound.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/NtohlArrayNoBound.ql \ No newline at end of file +query: Likely Bugs/Memory Management/NtohlArrayNoBound.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/NtohlArrayNoBound/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/NtohlArrayNoBound/test.cpp index 24bdaee0f162..fc444c11cdfc 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/NtohlArrayNoBound/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/NtohlArrayNoBound/test.cpp @@ -10,7 +10,7 @@ void test1(const char *source, size_t len) char buffer[256]; size_t len2 = ntohl(len); - memcpy(buffer, source, ntohl(len)); // BAD + memcpy(buffer, source, ntohl(len)); // $ Alert // BAD if (len2 < 256) { @@ -19,7 +19,7 @@ void test1(const char *source, size_t len) if (source != 0) { - memcpy(buffer, source, len2); // BAD + memcpy(buffer, source, len2); // $ Alert // BAD } if ((len2 < 256) && (source != 0)) @@ -29,7 +29,7 @@ void test1(const char *source, size_t len) if ((len2 < 256) || (source != 0)) { - memcpy(buffer, source, len2); // BAD + memcpy(buffer, source, len2); // $ Alert // BAD } if (len2 < 256) @@ -59,10 +59,10 @@ void test1(const char *source, size_t len) if (strlen(source) < 256) { - memcpy(buffer, source, len2); // BAD + memcpy(buffer, source, len2); // $ Alert // BAD } - buffer[len2] = 0; // BAD + buffer[len2] = 0; // $ Alert // BAD if (len2 < 256) { @@ -71,7 +71,7 @@ void test1(const char *source, size_t len) { unsigned short lens = len2; - buffer[lens] = 0; // BAD + buffer[lens] = 0; // $ Alert // BAD } if (len2 < 256) @@ -84,7 +84,7 @@ void test1(const char *source, size_t len) if (len3 < 256) { len3 = ntohl(len); - buffer[len3] = 0; // BAD + buffer[len3] = 0; // $ Alert // BAD } } @@ -92,7 +92,7 @@ void test2(size_t len) { char buffer[256]; - buffer[len] = 0; // BAD + buffer[len] = 0; // $ Alert // BAD } void test3(size_t len) @@ -104,5 +104,5 @@ int test4(const char *source, size_t len) { char buffer[256]; - return memcmp(buffer, source, ntohl(len)); // BAD + return memcmp(buffer, source, ntohl(len)); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/More64BitWaste/More64BitWaste.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/More64BitWaste/More64BitWaste.qlref index 614ac0198bec..48d907018a89 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/More64BitWaste/More64BitWaste.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/More64BitWaste/More64BitWaste.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/Padding/More64BitWaste.ql \ No newline at end of file +query: Likely Bugs/Memory Management/Padding/More64BitWaste.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/More64BitWaste/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/More64BitWaste/test.cpp index 0703d4dfe78e..e353f92b74f1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/More64BitWaste/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/More64BitWaste/test.cpp @@ -14,7 +14,7 @@ struct test3 int x, y, z; }; -struct test4 // BAD +struct test4 // $ Alert // BAD { int a; long long b; @@ -26,7 +26,7 @@ struct test5 int b; }; -struct test6 // BAD +struct test6 // $ Alert // BAD { char as[4]; long long b; diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/NonPortablePrintf/NonPortablePrintf.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/NonPortablePrintf/NonPortablePrintf.qlref index ee9f4a7debb7..7ba5352553d7 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/NonPortablePrintf/NonPortablePrintf.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/NonPortablePrintf/NonPortablePrintf.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/Padding/NonPortablePrintf.ql \ No newline at end of file +query: Likely Bugs/Memory Management/Padding/NonPortablePrintf.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/NonPortablePrintf/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/NonPortablePrintf/test.cpp index e197819ba10f..3ede8e9bf1ec 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/NonPortablePrintf/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/NonPortablePrintf/test.cpp @@ -7,10 +7,10 @@ void test1() void *ptr; printf("%ld\n", l); // GOOD - printf("%d\n", l); // BAD + printf("%d\n", l); // $ Alert // BAD printf("%p\n", ptr); // GOOD - printf("%d\n", ptr); // BAD - printf("%u\n", ptr); // BAD - printf("%x\n", ptr); // BAD + printf("%d\n", ptr); // $ Alert // BAD + printf("%u\n", ptr); // $ Alert // BAD + printf("%x\n", ptr); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/Suboptimal64BitType/Suboptimal64BitType.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/Suboptimal64BitType/Suboptimal64BitType.qlref index 3ad68ed8cec5..26c576ecaf97 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/Suboptimal64BitType/Suboptimal64BitType.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/Suboptimal64BitType/Suboptimal64BitType.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/Padding/Suboptimal64BitType.ql \ No newline at end of file +query: Likely Bugs/Memory Management/Padding/Suboptimal64BitType.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/Suboptimal64BitType/types.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/Suboptimal64BitType/types.c index e4f86df394e2..14533d574971 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/Suboptimal64BitType/types.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/Padding/Suboptimal64BitType/types.c @@ -8,7 +8,7 @@ // - 6 bytes: char d[6] // - 2 bytes: trailing padding // Optimal layout removes 8 bytes padding, leaves 2 bytes trailing padding. -typedef struct a { +typedef struct a { // $ Alert int a; double b; int c; diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/PointerOverflow.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/PointerOverflow.qlref index 2cad0c8bd7f7..b24ce18e5839 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/PointerOverflow.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/PointerOverflow.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/PointerOverflow.ql +query: Likely Bugs/Memory Management/PointerOverflow.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp index f4d3dbfe1814..6dae7b3102c7 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp @@ -3,7 +3,7 @@ bool check_pointer_overflow(P *ptr) { // x86-64 gcc 9.2 -O2: deleted // x86-64 clang 9.9.9 -O2: deleted // x64 msvc v19.22 /O2: not deleted - return ptr + 0x12345678 < ptr; // BAD + return ptr + 0x12345678 < ptr; // $ Alert // BAD } bool check_pointer_overflow(P *ptr, P *ptr_end) { // x86-64 gcc 9.2 -O2: not deleted @@ -30,7 +30,7 @@ typedef unsigned long size_t; bool not_in_range_bad(Q *ptr, Q *ptr_end, size_t a) { return ptr + a >= ptr_end || // GOOD (for the purpose of this test) - ptr + a < ptr; // BAD + ptr + a < ptr; // $ Alert // BAD } bool not_in_range_good(Q *ptr, Q *ptr_end, size_t a) { @@ -46,9 +46,9 @@ extern "C" void abort(void); #define MYASSERT(cond) if (cond) abort() void assert_not_in_range_bad(Q *ptr, Q *ptr_end, size_t a) { - MYASSERT(ptr + a >= ptr_end || ptr + a < ptr); // BAD + MYASSERT(ptr + a >= ptr_end || ptr + a < ptr); // $ Alert // BAD MYASSERT(ptr + a >= ptr_end); // GOOD (for the purpose of this test) - MYASSERT(ptr + a < ptr); // BAD + MYASSERT(ptr + a < ptr); // $ Alert // BAD } #define IS_LESS_THAN(lhs, rhs) ((lhs) < (rhs)) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString/ReturnCstrOfLocalStdString.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString/ReturnCstrOfLocalStdString.qlref index e8864277b4fd..1921529a00be 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString/ReturnCstrOfLocalStdString.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString/ReturnCstrOfLocalStdString.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/ReturnCstrOfLocalStdString.ql +query: Likely Bugs/Memory Management/ReturnCstrOfLocalStdString.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString/test.cpp index c27cb77b1d89..9d34364339d2 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString/test.cpp @@ -21,7 +21,7 @@ namespace std { const char* bad000() { std::string localStr("Test string"); - return localStr.c_str(); + return localStr.c_str(); // $ Alert } const char* good001(const std::string& p) { @@ -29,7 +29,7 @@ const char* good001(const std::string& p) { } const char* bad001() { - return std::string("Test string").c_str(); + return std::string("Test string").c_str(); // $ Alert } @@ -42,7 +42,7 @@ class _JNIEnv { jstring get_hello(_JNIEnv *env) { std::string hello = "Hello world"; - return env->NewStringUTF(hello.c_str()); + return env->NewStringUTF(hello.c_str()); // $ Alert } void good002_helper(std::string*); diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.qlref index 9ca456820068..f35aff41b04b 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql +query: Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp index 07e3520fa814..a663048f995c 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp @@ -14,15 +14,15 @@ MyClass *test1() { MyClass mc; - return &mc; // BAD + return &mc; // $ Alert // BAD } MyClass *test2() { MyClass mc; - MyClass *ptr = &mc; + MyClass *ptr = &mc; // $ Source - return ptr; // BAD + return ptr; // $ Alert // BAD } MyClass *test3() @@ -36,22 +36,22 @@ MyClass *test3() MyClass *test4() { MyClass mc; - MyClass &ref = mc; + MyClass &ref = mc; // $ Source - return &ref; // BAD + return &ref; // $ Alert // BAD } MyClass &test5() { MyClass mc; - return mc; // BAD + return mc; // $ Alert // BAD } int *test6() { MyClass mc; - return &(mc.a); // BAD + return &(mc.a); // $ Alert // BAD } MyClass test7() @@ -86,10 +86,10 @@ MyClass *test11() { MyClass mc; - ptr = &mc; + ptr = &mc; // $ Source } - return ptr; // BAD + return ptr; // $ Alert // BAD } MyClass *test12(MyClass *param) @@ -109,14 +109,14 @@ char *testArray1() { char arr[256]; - return arr; // BAD + return arr; // $ Alert // BAD } char *testArray2() { char arr[256]; - return &(arr[10]); // BAD + return &(arr[10]); // $ Alert // BAD } char testArray3() @@ -131,10 +131,10 @@ char *testArray4() char arr[256]; char *ptr; - ptr = arr + 1; + ptr = arr + 1; // $ Source ptr++; - return ptr; // BAD + return ptr; // $ Alert // BAD } char *testArray5() @@ -167,27 +167,27 @@ char *returnAfterCopy() { void *conversionBeforeDataFlow() { int myLocal; - void *pointerToLocal = (void *)&myLocal; // has conversion - return pointerToLocal; // BAD + void *pointerToLocal = (void *)&myLocal; // $ Source // has conversion + return pointerToLocal; // $ Alert // BAD } void *arrayConversionBeforeDataFlow() { int localArray[4]; - int *pointerToLocal = localArray; // has conversion - return pointerToLocal; // BAD + int *pointerToLocal = localArray; // $ Source // has conversion + return pointerToLocal; // $ Alert // BAD } int &dataFlowThroughReference() { int myLocal; - int &refToLocal = myLocal; // has conversion - return refToLocal; // BAD + int &refToLocal = myLocal; // $ Source // has conversion + return refToLocal; // $ Alert // BAD } int *&conversionInFlow() { int myLocal; int *p = &myLocal; - int *&pRef = p; // has conversion in the middle of data flow - return pRef; // BAD + int *&pRef = p; // $ Source // has conversion in the middle of data flow + return pRef; // $ Alert // BAD } namespace std { @@ -234,20 +234,20 @@ void f() { void *alloca(size_t); void* test_alloca() { - void* p = alloca(10); - return p; // BAD + void* p = alloca(10); // $ Source + return p; // $ Alert // BAD } char *strdupa(const char *); char *strndupa(const char *, size_t); char* test_strdupa(const char* s) { - return strdupa(s); // BAD + return strdupa(s); // $ Alert // BAD } void* test_strndupa(const char* s, size_t size) { - char* s2 = strndupa(s, size); - return s2; // BAD + char* s2 = strndupa(s, size); // $ Source + return s2; // $ Alert // BAD } int* f_rec(int *p) { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/StackAddressEscapes.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/StackAddressEscapes.qlref index 9442d89a36d5..c5fff4b22340 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/StackAddressEscapes.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/StackAddressEscapes.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/StackAddressEscapes.ql \ No newline at end of file +query: Likely Bugs/Memory Management/StackAddressEscapes.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/manager.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/manager.cpp index 8b73bffb04ab..29eb025b377f 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/manager.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/manager.cpp @@ -48,7 +48,7 @@ manager *test_managers() std::vector vs; a.set_strings(vs); // BAD: stack address `&vs` escapes [NOT DETECTED] - glob_man = &man; // BAD: stack address `&man` escapes + glob_man = &man; // $ Alert // BAD: stack address `&man` escapes return &man; // BAD: stack address `&man` escapes [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/test.cpp index 19cfd214e180..259c481bc53b 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/test.cpp @@ -19,7 +19,7 @@ int test101() { int x = 0; // BAD: local address is written to a static variable, which could // be unsafe. - s101.p = &x; + s101.p = &x; // $ Alert return x; } @@ -28,7 +28,7 @@ int test102() { static struct S100 s102; // BAD: local address is written to a local static variable, which could // be unsafe. - s102.p = &x; + s102.p = &x; // $ Alert return x; } @@ -36,7 +36,7 @@ void test103(int *p) { static struct S100 s103; // BAD: address is written to a local static variable, which could // be unsafe. - s103.p = p; + s103.p = p; // $ Alert } // Helper for test103. @@ -75,7 +75,7 @@ int test105() { p3++; // BAD: local address is written to a static variable, which could // be unsafe. - s101.p = p3; + s101.p = p3; // $ Alert return x; } @@ -86,7 +86,7 @@ void test106() { S100 s; // BAD: local address is written to a static variable, which could // be unsafe. - s106.p = &(s.i); + s106.p = &(s.i); // $ Alert } // Test for reference types. @@ -97,7 +97,7 @@ int test107() { r1++; // BAD: local address is written to a static variable, which could // be unsafe. - s101.p = &r1; + s101.p = &r1; // $ Alert return r1; } @@ -124,7 +124,7 @@ int test201() { int x = 0; // BAD: local address is written to a static variable, which could // be unsafe. - s201.p = &x; + s201.p = &x; // $ Alert return x; } @@ -133,7 +133,7 @@ int test202() { static struct S200 s202; // BAD: local address is written to a local static variable, which could // be unsafe. - s202.p = &x; + s202.p = &x; // $ Alert return x; } @@ -142,7 +142,7 @@ static const int* xptr; void example1() { int x = 0; - xptr = &x; // BAD: address of local variable stored in non-local memory. + xptr = &x; // $ Alert // BAD: address of local variable stored in non-local memory. } void example2() { @@ -166,27 +166,27 @@ void test301() { int b2[14][15]; int b3[13][14][15]; - s.p1 = b1; // BAD: address of local variable stored in non-local memory. - s.p1 = &b1[1]; // BAD: address of local variable stored in non-local memory. - - s.p2 = b2; // BAD: address of local variable stored in non-local memory. - s.p2 = &b2[1]; // BAD: address of local variable stored in non-local memory. - s.p1 = b2[1]; // BAD: address of local variable stored in non-local memory. - s.p1 = &b2[1][2]; // BAD: address of local variable stored in non-local memory. - - s.p3 = b3; // BAD: address of local variable stored in non-local memory. - s.p3 = &b3[1]; // BAD: address of local variable stored in non-local memory. - s.p2 = b3[1]; // BAD: address of local variable stored in non-local memory. - s.p2 = &b3[1][2]; // BAD: address of local variable stored in non-local memory. - s.p1 = b3[1][2]; // BAD: address of local variable stored in non-local memory. - s.p1 = &b3[1][2][3]; // BAD: address of local variable stored in non-local memory. - - s.pp[0] = b1; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &b1[1]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = b2[1]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &b2[1][2]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = b3[1][2]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &b3[1][2][3]; // BAD: address of local variable stored in non-local memory. + s.p1 = b1; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = &b1[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + + s.p2 = b2; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p2 = &b2[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = b2[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = &b2[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + + s.p3 = b3; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p3 = &b3[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p2 = b3[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p2 = &b3[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = b3[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = &b3[1][2][3]; // $ Alert // BAD: address of local variable stored in non-local memory. + + s.pp[0] = b1; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &b1[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = b2[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &b2[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = b3[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &b3[1][2][3]; // $ Alert // BAD: address of local variable stored in non-local memory. } void test302() { @@ -212,41 +212,41 @@ void test302() { // Even though s is local, we don't know that s.pp is local because // there is a pointer indirection involved. - s.pp[0] = b1; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &b1[1]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = b2[1]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &b2[1][2]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = b3[1][2]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &b3[1][2][3]; // BAD: address of local variable stored in non-local memory. + s.pp[0] = b1; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &b1[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = b2[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &b2[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = b3[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &b3[1][2][3]; // $ Alert // BAD: address of local variable stored in non-local memory. } void test303() { static S300 s; S300 x; - s.p1 = x.a1; // BAD: address of local variable stored in non-local memory. - s.p1 = &x.a1[1]; // BAD: address of local variable stored in non-local memory. + s.p1 = x.a1; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = &x.a1[1]; // $ Alert // BAD: address of local variable stored in non-local memory. - s.p2 = x.a2; // BAD: address of local variable stored in non-local memory. - s.p2 = &x.a2[1]; // BAD: address of local variable stored in non-local memory. - s.p1 = x.a2[1]; // BAD: address of local variable stored in non-local memory. - s.p1 = &x.a2[1][2]; // BAD: address of local variable stored in non-local memory. + s.p2 = x.a2; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p2 = &x.a2[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = x.a2[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = &x.a2[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. - s.p3 = x.a3; // BAD: address of local variable stored in non-local memory. - s.p3 = &x.a3[1]; // BAD: address of local variable stored in non-local memory. - s.p2 = x.a3[1]; // BAD: address of local variable stored in non-local memory. - s.p2 = &x.a3[1][2]; // BAD: address of local variable stored in non-local memory. - s.p1 = x.a3[1][2]; // BAD: address of local variable stored in non-local memory. - s.p1 = &x.a3[1][2][3]; // BAD: address of local variable stored in non-local memory. + s.p3 = x.a3; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p3 = &x.a3[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p2 = x.a3[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p2 = &x.a3[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = x.a3[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.p1 = &x.a3[1][2][3]; // $ Alert // BAD: address of local variable stored in non-local memory. // Even though s is local, we don't know that s.pp is local because // there is a pointer indirection involved. - s.pp[0] = x.a1; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &x.a1[1]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = x.a2[1]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &x.a2[1][2]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = x.a3[1][2]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &x.a3[1][2][3]; // BAD: address of local variable stored in non-local memory. + s.pp[0] = x.a1; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &x.a1[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = x.a2[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &x.a2[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = x.a3[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &x.a3[1][2][3]; // $ Alert // BAD: address of local variable stored in non-local memory. } void test304() { @@ -270,12 +270,12 @@ void test304() { // Even though s is local, we don't know that s.pp is local because // there is a pointer indirection involved. - s.pp[0] = x.a1; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &x.a1[1]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = x.a2[1]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &x.a2[1][2]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = x.a3[1][2]; // BAD: address of local variable stored in non-local memory. - s.pp[0] = &x.a3[1][2][3]; // BAD: address of local variable stored in non-local memory. + s.pp[0] = x.a1; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &x.a1[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = x.a2[1]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &x.a2[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = x.a3[1][2]; // $ Alert // BAD: address of local variable stored in non-local memory. + s.pp[0] = &x.a3[1][2][3]; // $ Alert // BAD: address of local variable stored in non-local memory. } struct S400 { @@ -309,11 +309,11 @@ int test400() { s.p0 = &x; // GOOD: s.p0 is on the stack. s.p1[1] = &x; // GOOD: s.p1 is on the stack. s.p2[1][2] = &x; // GOOD: s.p1 is on the stack. - s.q1[1] = &x; // BAD: pointer indirection to the heap. - s.q2[1][2] = &x; // BAD: pointer indirection to the heap. - s.q3[1][2][3] = &x; // BAD: pointer indirection to the heap. - s.r2[1][2] = &x; // BAD: pointer indirection to the heap. - s.r3[1][2][3] = &x; // BAD: pointer indirection to the heap. + s.q1[1] = &x; // $ Alert // BAD: pointer indirection to the heap. + s.q2[1][2] = &x; // $ Alert // BAD: pointer indirection to the heap. + s.q3[1][2][3] = &x; // $ Alert // BAD: pointer indirection to the heap. + s.r2[1][2] = &x; // $ Alert // BAD: pointer indirection to the heap. + s.r3[1][2][3] = &x; // $ Alert // BAD: pointer indirection to the heap. return x; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/StrncpyFlippedArgs.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/StrncpyFlippedArgs.qlref index bf0bf1ea7d05..3a2ef158d3d6 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/StrncpyFlippedArgs.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/StrncpyFlippedArgs.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/StrncpyFlippedArgs.ql \ No newline at end of file +query: Likely Bugs/Memory Management/StrncpyFlippedArgs.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.c index 2ed60b96315e..bba5318fc328 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.c @@ -19,7 +19,7 @@ void good0(char *arg) { void bad0(char *arg) { char buf[80]; // BAD: Checks size of source - strncpy(buf, arg, strlen(arg)); + strncpy(buf, arg, strlen(arg)); // $ Alert } @@ -30,6 +30,6 @@ void good1(const char *buf, char *arg) { void bad1(const char *buf, char *arg) { // BAD: Checks size of source - strncpy(buf, arg, strlen(arg)); + strncpy(buf, arg, strlen(arg)); // $ Alert } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp index ad2e39b748e2..93ddf132f9e2 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp @@ -18,9 +18,9 @@ void test1() const char *str = "01234567890123456789"; strncpy(buf1, str, sizeof(buf1)); - strncpy(buf1, str, strlen(str)); // BAD - strncpy(buf1, str, strlen(str) + 1); // BAD - strncpy(buf1, buf2, sizeof(buf2)); // BAD + strncpy(buf1, str, strlen(str)); // $ Alert // BAD + strncpy(buf1, str, strlen(str) + 1); // $ Alert // BAD + strncpy(buf1, buf2, sizeof(buf2)); // $ Alert // BAD } void test2() @@ -29,12 +29,12 @@ void test2() wchar_t buf2[20]; const wchar_t *str = L"01234567890123456789"; - wcsncpy(buf1, str, sizeof(buf1)); // (bad, but not a strncpyflippedargs bug) + wcsncpy(buf1, str, sizeof(buf1)); // $ Alert // (bad, but not a strncpyflippedargs bug) wcsncpy(buf1, str, sizeof(buf1) / sizeof(wchar_t)); - wcsncpy(buf1, str, wcslen(str)); // BAD - wcsncpy(buf1, str, wcslen(str) + 1); // BAD - wcsncpy(buf1, buf2, sizeof(buf2)); // BAD - wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // BAD [NOT DETECTED] + wcsncpy(buf1, str, wcslen(str)); // $ Alert // BAD + wcsncpy(buf1, str, wcslen(str) + 1); // $ Alert // BAD + wcsncpy(buf1, buf2, sizeof(buf2)); // $ Alert // BAD + wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // $ Alert // BAD [NOT DETECTED] } void test3() @@ -44,9 +44,9 @@ void test3() const char *str = "01234567890123456789"; strcpy_s(buf1, sizeof(buf1), str); - strcpy_s(buf1, strlen(str), str); // BAD - strcpy_s(buf1, strlen(str) + 1, str); // BAD - strcpy_s(buf1, sizeof(buf2), buf2); // BAD + strcpy_s(buf1, strlen(str), str); // $ Alert // BAD + strcpy_s(buf1, strlen(str) + 1, str); // $ Alert // BAD + strcpy_s(buf1, sizeof(buf2), buf2); // $ Alert // BAD } struct S { @@ -59,10 +59,10 @@ void test4(S *a, S *b) { strncpy(a->x, b->x, sizeof(a->x)); // GOOD strncpy(a->x, b->x, sizeof(b->x)); // GOOD (sizes match, so it's ok) - strncpy(a->x, b->z, sizeof(b->z)); // BAD + strncpy(a->x, b->z, sizeof(b->z)); // $ Alert // BAD strncpy(a->y, b->y, strlen(a->y) + 1); // GOOD - strncpy(a->y, b->y, strlen(b->y) + 1); // BAD + strncpy(a->y, b->y, strlen(b->y) + 1); // $ Alert // BAD } void test5(char *buf) @@ -78,10 +78,10 @@ void test6(T *a, T *b) { strncpy(a->s->x, b->s->x, sizeof(a->s->x)); // GOOD strncpy(a->s->x, b->s->x, sizeof(b->s->x)); // GOOD (sizes match, so it's ok) - strncpy(a->s->x, b->s->x, sizeof(b->s->z)); // BAD + strncpy(a->s->x, b->s->x, sizeof(b->s->z)); // $ Alert // BAD strncpy(a->s->y, b->s->y, strlen(a->s->y) + 1); // GOOD - strncpy(a->s->y, b->s->y, strlen(b->s->y) + 1); // BAD + strncpy(a->s->y, b->s->y, strlen(b->s->y) + 1); // $ Alert // BAD } void test7(char* x, char* y) { @@ -102,10 +102,10 @@ void test9() wchar_t buf2[20]; const wchar_t *str = L"01234567890123456789"; - wcsxfrm_l(buf1, str, sizeof(buf1), nullptr); // BAD (but not a StrncpyFlippedArgs bug) + wcsxfrm_l(buf1, str, sizeof(buf1), nullptr); // $ Alert // BAD (but not a StrncpyFlippedArgs bug) wcsxfrm_l(buf1, str, sizeof(buf1) / sizeof(wchar_t), nullptr); // GOOD - wcsxfrm_l(buf1, str, wcslen(str), nullptr); // BAD - wcsxfrm_l(buf1, str, wcslen(str) + 1, nullptr); // BAD - wcsxfrm_l(buf1, buf2, sizeof(buf2), nullptr); // BAD - wcsxfrm_l(buf1, buf2, sizeof(buf2) / sizeof(wchar_t), nullptr); // BAD + wcsxfrm_l(buf1, str, wcslen(str), nullptr); // $ Alert // BAD + wcsxfrm_l(buf1, str, wcslen(str) + 1, nullptr); // $ Alert // BAD + wcsxfrm_l(buf1, buf2, sizeof(buf2), nullptr); // $ Alert // BAD + wcsxfrm_l(buf1, buf2, sizeof(buf2) / sizeof(wchar_t), nullptr); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/SuspiciousCallToMemset.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/SuspiciousCallToMemset.qlref index ab987b824e42..8a03a49d34e3 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/SuspiciousCallToMemset.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/SuspiciousCallToMemset.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/SuspiciousCallToMemset.ql \ No newline at end of file +query: Likely Bugs/Memory Management/SuspiciousCallToMemset.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/doc_tests.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/doc_tests.c index 1acf9e8e566b..0c7fc0820298 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/doc_tests.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/doc_tests.c @@ -26,10 +26,10 @@ void tests() struct T *t2 = (struct T*)malloc(sizeof(struct T)); // the size of the struct is probably intended // but this takes the size of a pointer - memset(t2, 0, sizeof(t2)); // BAD + memset(t2, 0, sizeof(t2)); // $ Alert // BAD // correct but discouraged, use sizeof(struct T) instead memset(t1, 0, sizeof(*t2)); // GOOD // correct, but it is preferred to do a direct assignment, i.e., t = 0; memset(&t2, 0, sizeof(t2)); // GOOD -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp index 6a8c8f904a79..fcc6fd98c059 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp @@ -23,37 +23,37 @@ int main() memset(&ms, 0, sizeof(myStruct)); // GOOD memset(&ms, 0, sizeof(ms)); // GOOD memset(&ms, 0, 8); // BAD [NOT DETECTED] - memset(&ms, 0, sizeof(otherStruct)); // BAD - + memset(&ms, 0, sizeof(otherStruct)); // $ Alert // BAD + { myStruct *msPtr = &ms; void *vPtr = msPtr; - memset(&msPtr, 0, sizeof(myStruct)); // BAD + memset(&msPtr, 0, sizeof(myStruct)); // $ Alert // BAD memset(&msPtr, 0, sizeof(myStruct *)); // GOOD - memset(&msPtr, 0, sizeof(*msPtr)); // BAD + memset(&msPtr, 0, sizeof(*msPtr)); // $ Alert // BAD memset(&msPtr, 0, sizeof(msPtr)); // GOOD memset(msPtr, 0, sizeof(myStruct)); // GOOD - memset(msPtr, 0, sizeof(myStruct *)); // BAD + memset(msPtr, 0, sizeof(myStruct *)); // $ Alert // BAD memset(msPtr, 0, sizeof(*msPtr)); // GOOD - memset(msPtr, 0, sizeof(msPtr)); // BAD + memset(msPtr, 0, sizeof(msPtr)); // $ Alert // BAD memset(vPtr, 0, sizeof(myStruct)); // GOOD - memset(vPtr, 0, sizeof(myStruct *)); // BAD + memset(vPtr, 0, sizeof(myStruct *)); // $ Alert // BAD memset(vPtr, 0, sizeof(*msPtr)); // GOOD - memset(vPtr, 0, sizeof(msPtr)); // BAD + memset(vPtr, 0, sizeof(msPtr)); // $ Alert // BAD { myStruct **msPtrPtr = &msPtr; - memset(&msPtrPtr, 0, sizeof(myStruct)); // BAD - memset(&msPtrPtr, 0, sizeof(myStruct *)); // BAD + memset(&msPtrPtr, 0, sizeof(myStruct)); // $ Alert // BAD + memset(&msPtrPtr, 0, sizeof(myStruct *)); // $ Alert // BAD memset(&msPtrPtr, 0, sizeof(myStruct **)); // GOOD - memset(msPtrPtr, 0, sizeof(myStruct)); // BAD + memset(msPtrPtr, 0, sizeof(myStruct)); // $ Alert // BAD memset(msPtrPtr, 0, sizeof(myStruct *)); // GOOD - memset(msPtrPtr, 0, sizeof(myStruct **)); // BAD + memset(msPtrPtr, 0, sizeof(myStruct **)); // $ Alert // BAD memset(*msPtrPtr, 0, sizeof(myStruct)); // GOOD - memset(*msPtrPtr, 0, sizeof(myStruct *)); // BAD - memset(*msPtrPtr, 0, sizeof(myStruct **)); // BAD + memset(*msPtrPtr, 0, sizeof(myStruct *)); // $ Alert // BAD + memset(*msPtrPtr, 0, sizeof(myStruct **)); // $ Alert // BAD } } } @@ -65,40 +65,40 @@ int main() memset(&msArr, 0, sizeof(myStruct) * NUM); // GOOD memset(&msArr, 0, sizeof(msArr)); // GOOD memset(&msArr, 0, sizeof(myStruct[NUM])); // GOOD - memset(&msArr, 0, sizeof(myStruct *)); // BAD + memset(&msArr, 0, sizeof(myStruct *)); // $ Alert // BAD memset(msArr, 0, sizeof(myStruct) * NUM); // GOOD memset(msArr, 0, sizeof(msArr)); // GOOD memset(msArr, 0, sizeof(myStruct[NUM])); // GOOD - memset(msArr, 0, sizeof(myStruct *)); // BAD + memset(msArr, 0, sizeof(myStruct *)); // $ Alert // BAD memset(&(msArr[0]), 0, sizeof(myStruct) * NUM); // GOOD memset(&(msArr[0]), 0, sizeof(msArr)); // GOOD memset(&(msArr[0]), 0, sizeof(myStruct[NUM])); // GOOD - memset(&(msArr[0]), 0, sizeof(myStruct *)); // BAD + memset(&(msArr[0]), 0, sizeof(myStruct *)); // $ Alert // BAD memset(msPtr, 0, sizeof(myStruct) * NUM); // GOOD memset(msPtr, 0, sizeof(msArr)); // GOOD memset(msPtr, 0, sizeof(myStruct[NUM])); // GOOD - memset(msPtr, 0, sizeof(myStruct *)); // BAD + memset(msPtr, 0, sizeof(myStruct *)); // $ Alert // BAD } - + { myStructPtr msPtrArr[NUM]; - memset(&msPtrArr, 0, sizeof(myStruct) * NUM); // BAD + memset(&msPtrArr, 0, sizeof(myStruct) * NUM); // $ Alert // BAD memset(&msPtrArr, 0, sizeof(myStruct *) * NUM); // GOOD memset(&msPtrArr, 0, sizeof(myStructPtr) * NUM); // GOOD - memset(&msPtrArr, 0, sizeof(myStruct **) * NUM); // BAD + memset(&msPtrArr, 0, sizeof(myStruct **) * NUM); // $ Alert // BAD memset(msPtrArr, 0, sizeof(myStruct) * NUM); // BAD [NOT DETECTED] memset(msPtrArr, 0, sizeof(myStruct *) * NUM); // GOOD memset(msPtrArr, 0, sizeof(myStructPtr) * NUM); // GOOD - memset(msPtrArr, 0, sizeof(myStruct **) * NUM); // BAD - memset(&(msPtrArr[0]), 0, sizeof(myStruct) * NUM); // BAD + memset(msPtrArr, 0, sizeof(myStruct **) * NUM); // $ Alert // BAD + memset(&(msPtrArr[0]), 0, sizeof(myStruct) * NUM); // $ Alert // BAD memset(&(msPtrArr[0]), 0, sizeof(myStruct *) * NUM); // GOOD memset(&(msPtrArr[0]), 0, sizeof(myStructPtr) * NUM); // GOOD - memset(&(msPtrArr[0]), 0, sizeof(myStruct **) * NUM); // BAD + memset(&(msPtrArr[0]), 0, sizeof(myStruct **) * NUM); // $ Alert // BAD memset(msPtrArr[0], 0, sizeof(myStruct) * NUM); // GOOD - memset(msPtrArr[0], 0, sizeof(myStruct *) * NUM); // BAD - memset(msPtrArr[0], 0, sizeof(myStructPtr) * NUM); // BAD - memset(msPtrArr[0], 0, sizeof(myStruct **) * NUM); // BAD + memset(msPtrArr[0], 0, sizeof(myStruct *) * NUM); // $ Alert // BAD + memset(msPtrArr[0], 0, sizeof(myStructPtr) * NUM); // $ Alert // BAD + memset(msPtrArr[0], 0, sizeof(myStruct **) * NUM); // $ Alert // BAD } { @@ -119,20 +119,20 @@ int main() void myFunc(myStruct paramArray[80], myStruct &refStruct) { myStruct localArray[80]; - + memset(localArray, 0, sizeof(myStruct) * 80); // GOOD memset(localArray, 0, sizeof(localArray)); // GOOD memset(&localArray, 0, sizeof(myStruct) * 80); // GOOD memset(&localArray, 0, sizeof(localArray)); // GOOD memset(paramArray, 0, sizeof(myStruct) * 80); // GOOD - memset(paramArray, 0, sizeof(paramArray)); // GOOD [FALSE POSITIVE] - memset(¶mArray, 0, sizeof(myStruct) * 80); // BAD + memset(paramArray, 0, sizeof(paramArray)); // $ Alert // GOOD [FALSE POSITIVE] + memset(¶mArray, 0, sizeof(myStruct) * 80); // $ Alert // BAD memset(¶mArray, 0, sizeof(paramArray)); // BAD [NOT DETECTED] memset(&refStruct, 0, sizeof(myStruct)); // GOOD memset(&refStruct, 0, sizeof(refStruct)); // GOOD - memset(&refStruct, 0, sizeof(myStruct *)); // BAD + memset(&refStruct, 0, sizeof(myStruct *)); // $ Alert // BAD } class MyClass @@ -167,9 +167,9 @@ void more_tests_2() intArrayPointer iapa[88]; memset(iap, 0, sizeof(intArray)); // GOOD - memset(&iap, 0, sizeof(intArray)); // BAD + memset(&iap, 0, sizeof(intArray)); // $ Alert // BAD memset(iapa, 0, sizeof(iapa)); // GOOD - memset(iapa, 0, sizeof(intArrayPointer *)); // BAD + memset(iapa, 0, sizeof(intArrayPointer *)); // $ Alert // BAD } void more_tests_3() diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/SuspiciousCallToStrncat.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/SuspiciousCallToStrncat.qlref index 37583da5e482..ed09b7cd912d 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/SuspiciousCallToStrncat.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/SuspiciousCallToStrncat.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql +query: Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c index 13c18b75dbb4..03286e33f1b3 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c @@ -21,7 +21,7 @@ void good0(char *s) { void bad0(char *s) { char buf[80]; strcpy(buf, "s = "); - strncat(buf, s, sizeof(buf)); // BAD -- Forgot to allow for "s = " + strncat(buf, s, sizeof(buf)); // $ Alert // BAD -- Forgot to allow for "s = " strncat(buf, ".", 1); // BAD [NOT DETECTED] -- there might not be even 1 character of space } @@ -42,7 +42,7 @@ void bad1(char *s) { void strncat_test1(char *s) { char buf[80]; strncat(buf, s, sizeof(buf) - strlen(buf) - 1); // GOOD - strncat(buf, s, sizeof(buf) - strlen(buf)); // BAD + strncat(buf, s, sizeof(buf) - strlen(buf)); // $ Alert // BAD } void* malloc(size_t); @@ -64,7 +64,7 @@ void strncat_test3(char* s, struct buffers* buffers) { unsigned len_array = strlen(buffers->array); unsigned max_size = sizeof(buffers->array); unsigned free_size = max_size - len_array; - strncat(buffers->array, s, free_size); // BAD + strncat(buffers->array, s, free_size); // $ Alert // BAD } #define MAX_SIZE 80 @@ -72,8 +72,8 @@ void strncat_test3(char* s, struct buffers* buffers) { void strncat_test4(char *s) { char buf[MAX_SIZE]; strncat(buf, s, MAX_SIZE - strlen(buf) - 1); // GOOD - strncat(buf, s, MAX_SIZE - strlen(buf)); // BAD - strncat(buf, "...", MAX_SIZE - strlen(buf)); // BAD + strncat(buf, s, MAX_SIZE - strlen(buf)); // $ Alert // BAD + strncat(buf, "...", MAX_SIZE - strlen(buf)); // $ Alert // BAD } void strncat_test5(char *s) { @@ -88,7 +88,7 @@ void strncat_test6() { char dest[60]; dest[0] = '\0'; // Will write `dest[0 .. 5]` - strncat(dest, "small", sizeof(dest)); // GOOD [FALSE POSITIVE] + strncat(dest, "small", sizeof(dest)); // $ Alert // GOOD [FALSE POSITIVE] } { @@ -96,6 +96,6 @@ void strncat_test6() { memset(dest, 'a', sizeof(dest)); dest[54] = '\0'; // Will write `dest[54 .. 59]` - strncat(dest, "small", sizeof(dest)); // GOOD [FALSE POSITIVE] + strncat(dest, "small", sizeof(dest)); // $ Alert // GOOD [FALSE POSITIVE] } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousSizeof/SuspiciousSizeof.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousSizeof/SuspiciousSizeof.qlref index b31c76e45832..846e202a48ad 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousSizeof/SuspiciousSizeof.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousSizeof/SuspiciousSizeof.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/SuspiciousSizeof.ql \ No newline at end of file +query: Likely Bugs/Memory Management/SuspiciousSizeof.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousSizeof/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousSizeof/test.cpp index f782badb55ac..c66df06f2e7a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousSizeof/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousSizeof/test.cpp @@ -3,21 +3,21 @@ typedef unsigned int size_t; void *memcpy(void *destination, const void *source, size_t num); void f1(char s[]) { - int size = sizeof(s); // BAD - // s is now a char*, not an array. + int size = sizeof(s); // $ Alert // BAD + // s is now a char*, not an array. // sizeof(s) will evaluate to sizeof(char *) int size2 = sizeof(s[0]); // GOOD } void f2(char s[10]) { - int size = sizeof(s); // BAD + int size = sizeof(s); // $ Alert // BAD int size2 = sizeof(s[0]); // GOOD } typedef char myarray[10]; void f3(myarray s) { - int size = sizeof(s); // BAD + int size = sizeof(s); // $ Alert // BAD int size2 = sizeof(s[0]); // GOOD } @@ -28,26 +28,26 @@ struct container }; void f4(container *s) { - int size = sizeof(s); // (dubious) + int size = sizeof(s); // $ Alert // (dubious) int size3 = sizeof(s->ptr); // GOOD int size2 = sizeof(s->array); // GOOD } void f5(container *s) { container *t; - + memcpy(&t, &s, sizeof(s)); // GOOD } void f6(container *s) { container t; - - memcpy(&t, s, sizeof(s)); // BAD + + memcpy(&t, s, sizeof(s)); // $ Alert // BAD } void f7(container *s) { container t; - + memcpy(&t, s, sizeof(*s)); // GOOD } @@ -55,5 +55,5 @@ class myClass {}; typedef myClass *myClassPtr; void f8(const myClassPtr s[]) { - int size = sizeof(s); // BAD + int size = sizeof(s); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UnsafeUseOfStrcat/strcat.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UnsafeUseOfStrcat/strcat.c index ea723e1e0f55..bd04bdbda00b 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UnsafeUseOfStrcat/strcat.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UnsafeUseOfStrcat/strcat.c @@ -19,7 +19,6 @@ void f(void) { output4[0] = '\0'; strcat(output1, str1); strcat(output2, str1); - strcat(output3, str2); // Bad, as str2 gets reassigned - strcat(output4, str3); // Bad, as str3 gets fiddled with + strcat(output3, str2); // $ Alert // Bad, as str2 gets reassigned + strcat(output4, str3); // $ Alert // Bad, as str3 gets fiddled with } - diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UnsafeUseOfStrcat/strcat.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UnsafeUseOfStrcat/strcat.qlref index 9790cddebab5..7f1a1cf35f2d 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UnsafeUseOfStrcat/strcat.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UnsafeUseOfStrcat/strcat.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql +query: Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UsingExpiredStackAddress/UsingExpiredStackAddress.qlref b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UsingExpiredStackAddress/UsingExpiredStackAddress.qlref index ce6cdee0d867..4075c6c57983 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UsingExpiredStackAddress/UsingExpiredStackAddress.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UsingExpiredStackAddress/UsingExpiredStackAddress.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/UsingExpiredStackAddress.ql \ No newline at end of file +query: Likely Bugs/Memory Management/UsingExpiredStackAddress.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UsingExpiredStackAddress/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UsingExpiredStackAddress/test.cpp index 616305a8174d..250a2e3bdf7f 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UsingExpiredStackAddress/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/UsingExpiredStackAddress/test.cpp @@ -7,12 +7,12 @@ static struct S100 s101; void escape1() { int x; - s101.p = &x; + s101.p = &x; // $ Source } int simple_field_bad() { escape1(); - return *s101.p; // BAD + return *s101.p; // $ Alert // BAD } int simple_field_good() { @@ -21,7 +21,7 @@ int simple_field_good() { } int deref_p() { - return *s101.p; // BAD + return *s101.p; // $ Alert // BAD } int field_indirect_bad() { @@ -49,13 +49,13 @@ int store_argument_value() { } void store_address_of_argument(int y) { - s101.p = &y; + s101.p = &y; // $ Source } int store_argument_address() { int x; store_address_of_argument(x); - return *s101.p; // BAD + return *s101.p; // $ Alert // BAD } void address_escapes_through_pointer_arith() { @@ -65,12 +65,12 @@ void address_escapes_through_pointer_arith() { int* p2 = p1 - 1; int* p3 = 1 + p2; p3++; - s101.p = p3; + s101.p = p3; // $ Source } int test_pointer_arith_bad() { address_escapes_through_pointer_arith(); - return *s101.p; // BAD + return *s101.p; // $ Alert // BAD } int test_pointer_arith_good_1() { @@ -90,12 +90,12 @@ int test_pointer_arith_good_2(bool b) { void field_address_escapes() { S100 s; - s101.p = &s.i; + s101.p = &s.i; // $ Source } int test_field_address_escapes() { field_address_escapes(); - return s101.p[0]; // BAD + return s101.p[0]; // $ Alert // BAD } void escape_through_reference() { @@ -103,12 +103,12 @@ void escape_through_reference() { int& r0 = x; int& r1 = r0; r1++; - s101.p = &r1; + s101.p = &r1; // $ Source } int test_escapes_through_reference() { escape_through_reference(); - return *s101.p; // BAD + return *s101.p; // $ Alert // BAD } struct S300 { @@ -133,53 +133,53 @@ void escape_through_arrays() { int b2[14][15]; int b3[13][14][15]; - s1.p1 = b1; - s2.p1 = &b1[1]; + s1.p1 = b1; // $ Source + s2.p1 = &b1[1]; // $ Source - s1.p2 = b2; - s2.p2 = &b2[1]; - s3.p1 = b2[1]; - s4.p1 = &b2[1][2]; + s1.p2 = b2; // $ Source + s2.p2 = &b2[1]; // $ Source + s3.p1 = b2[1]; // $ Source + s4.p1 = &b2[1][2]; // $ Source - s1.p3 = b3; - s2.p3 = &b3[1]; - s3.p2 = b3[1]; - s4.p2 = &b3[1][2]; - s5.p1 = b3[1][2]; + s1.p3 = b3; // $ Source + s2.p3 = &b3[1]; // $ Source + s3.p2 = b3[1]; // $ Source + s4.p2 = &b3[1][2]; // $ Source + s5.p1 = b3[1][2]; // $ Source s6.p1 = &b3[1][2][3]; - s1.pp[0] = b1; - s2.pp[0] = &b1[1]; - s3.pp[0] = b2[1]; - s4.pp[0] = &b2[1][2]; - s5.pp[0] = b3[1][2]; - s6.pp[0] = &b3[1][2][3]; + s1.pp[0] = b1; // $ Source + s2.pp[0] = &b1[1]; // $ Source + s3.pp[0] = b2[1]; // $ Source + s4.pp[0] = &b2[1][2]; // $ Source + s5.pp[0] = b3[1][2]; // $ Source + s6.pp[0] = &b3[1][2][3]; // $ Source } void test_escape_through_arrays() { escape_through_arrays(); - int x1 = *s1.p1; // BAD - int x2 = *s2.p1; // BAD - - int* x3 = s1.p2[1]; // BAD - int x4 = *s1.p2[1]; // BAD - int* x5 = *s2.p2; // BAD - int* x6 = s3.p1; // BAD - int x7 = *&s4.p1[1]; // BAD - - int x8 = *s1.p3[1][2]; // BAD - int x9 = (*s2.p3[0])[0]; // BAD - int x10 = **s3.p2; // BAD - int x11 = **s4.p2; // BAD - int x12 = (*s4.p1); // BAD - int x13 = s5.p1[1]; // BAD - - int* x14 = s1.pp[0]; // BAD - int x15 = *s2.pp[0]; // BAD - int x16 = *s3.pp[0]; // BAD - int x17 = **s4.pp; // BAD - int x18 = s5.pp[0][0]; // BAD - int x19 = (*s6.pp)[0]; // BAD + int x1 = *s1.p1; // $ Alert // BAD + int x2 = *s2.p1; // $ Alert // BAD + + int* x3 = s1.p2[1]; // $ Alert // BAD + int x4 = *s1.p2[1]; // $ Alert // BAD + int* x5 = *s2.p2; // $ Alert // BAD + int* x6 = s3.p1; // $ Alert // BAD + int x7 = *&s4.p1[1]; // $ Alert // BAD + + int x8 = *s1.p3[1][2]; // $ Alert // BAD + int x9 = (*s2.p3[0])[0]; // $ Alert // BAD + int x10 = **s3.p2; // $ Alert // BAD + int x11 = **s4.p2; // $ Alert // BAD + int x12 = (*s4.p1); // $ Alert // BAD + int x13 = s5.p1[1]; // $ Alert // BAD + + int* x14 = s1.pp[0]; // $ Alert // BAD + int x15 = *s2.pp[0]; // $ Alert // BAD + int x16 = *s3.pp[0]; // $ Alert // BAD + int x17 = **s4.pp; // $ Alert // BAD + int x18 = s5.pp[0][0]; // $ Alert // BAD + int x19 = (*s6.pp)[0]; // $ Alert // BAD } void not_escape_through_arrays() { @@ -192,7 +192,7 @@ void not_escape_through_arrays() { void test_not_escape_through_array() { not_escape_through_arrays(); - + int x20 = s1.a1[0]; // GOOD int x21 = s1.a2[0][1]; // GOOD int* x22 = s1.a3[5][2]; // GOOD @@ -231,12 +231,12 @@ static struct S100 s103; void escape2() { int x; s103.p = nullptr; - s103.p = &x; + s103.p = &x; // $ Source } void calls_escape2() { escape2(); - int x = *s103.p; // BAD + int x = *s103.p; // $ Alert // BAD } bool unknown(); @@ -260,10 +260,10 @@ void escape3() { int x; s105.p = nullptr; if(unknown()) { } - s105.p = &x; + s105.p = &x; // $ Source } void calls_escape3() { escape3(); - int x = *s105.p; // BAD -} \ No newline at end of file + int x = *s105.p; // $ Alert // BAD +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/OO/IncorrectConstructorDelegation/IncorrectConstructorDelegation.qlref b/cpp/ql/test/query-tests/Likely Bugs/OO/IncorrectConstructorDelegation/IncorrectConstructorDelegation.qlref index 193c84e1ab2a..f29596941a18 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/OO/IncorrectConstructorDelegation/IncorrectConstructorDelegation.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/OO/IncorrectConstructorDelegation/IncorrectConstructorDelegation.qlref @@ -1 +1,2 @@ -Likely Bugs/OO/IncorrectConstructorDelegation.ql +query: Likely Bugs/OO/IncorrectConstructorDelegation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/OO/IncorrectConstructorDelegation/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/OO/IncorrectConstructorDelegation/test.cpp index ce652cabdace..d2d5c071778a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/OO/IncorrectConstructorDelegation/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/OO/IncorrectConstructorDelegation/test.cpp @@ -4,7 +4,7 @@ class MyRect public: MyRect() { - MyRect(100.0f, 100.0f); // BAD + MyRect(100.0f, 100.0f); // $ Alert // BAD } MyRect(float _width, float _height) : width(_width), height(_height) @@ -13,7 +13,7 @@ class MyRect MyRect(float _width) { - MyRect(_width, _width); // BAD + MyRect(_width, _width); // $ Alert // BAD } MyRect(int a) : MyRect(10.0f, 10.0f) // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/OO/NonVirtualDestructorInBaseClass/NonVirtualDestructorInBaseClass.cpp b/cpp/ql/test/query-tests/Likely Bugs/OO/NonVirtualDestructorInBaseClass/NonVirtualDestructorInBaseClass.cpp index 4b7b61de8cec..2555a6cb842e 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/OO/NonVirtualDestructorInBaseClass/NonVirtualDestructorInBaseClass.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/OO/NonVirtualDestructorInBaseClass/NonVirtualDestructorInBaseClass.cpp @@ -53,7 +53,7 @@ struct Base_Virtual_VirtualDtor virtual void VirtualFunction(); }; -struct Base_Virtual_NonVirtualDtor +struct Base_Virtual_NonVirtualDtor // $ Alert { ~Base_Virtual_NonVirtualDtor(); virtual void VirtualFunction(); @@ -65,7 +65,7 @@ struct Base_Virtual_ImplicitDtor virtual void VirtualFunction(); }; -struct Base_Virtual_NonVirtualDtorWithDefinition +struct Base_Virtual_NonVirtualDtorWithDefinition // $ Alert { ~Base_Virtual_NonVirtualDtorWithDefinition(); virtual void VirtualFunction(); @@ -75,7 +75,7 @@ Base_Virtual_NonVirtualDtorWithDefinition::~Base_Virtual_NonVirtualDtorWithDefin { } -struct Base_Virtual_NonVirtualDtorWithInlineDefinition +struct Base_Virtual_NonVirtualDtorWithInlineDefinition // $ Alert { ~Base_Virtual_NonVirtualDtorWithInlineDefinition() { diff --git a/cpp/ql/test/query-tests/Likely Bugs/OO/NonVirtualDestructorInBaseClass/NonVirtualDestructorInBaseClass.qlref b/cpp/ql/test/query-tests/Likely Bugs/OO/NonVirtualDestructorInBaseClass/NonVirtualDestructorInBaseClass.qlref index ff3cecfecc72..9ca3f49140ee 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/OO/NonVirtualDestructorInBaseClass/NonVirtualDestructorInBaseClass.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/OO/NonVirtualDestructorInBaseClass/NonVirtualDestructorInBaseClass.qlref @@ -1 +1,2 @@ -Likely Bugs/OO/NonVirtualDestructorInBaseClass.ql +query: Likely Bugs/OO/NonVirtualDestructorInBaseClass.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/OO/ThrowInDestructor/ThrowInDestructor.qlref b/cpp/ql/test/query-tests/Likely Bugs/OO/ThrowInDestructor/ThrowInDestructor.qlref index 2b0862fc362d..eee2e41916cd 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/OO/ThrowInDestructor/ThrowInDestructor.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/OO/ThrowInDestructor/ThrowInDestructor.qlref @@ -1 +1,2 @@ -Likely Bugs/OO/ThrowInDestructor.ql +query: Likely Bugs/OO/ThrowInDestructor.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/OO/ThrowInDestructor/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/OO/ThrowInDestructor/test.cpp index 247d6d801efd..6f9cf7a2e2b2 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/OO/ThrowInDestructor/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/OO/ThrowInDestructor/test.cpp @@ -10,7 +10,7 @@ struct ThrowsDirectly { ~ThrowsDirectly() noexcept(false) { if (i == 0) { - throw exception(); // BAD + throw exception(); // $ Alert // BAD } else if (i == 1) { try { @@ -45,14 +45,14 @@ struct ThrowsDirectly { } else if (i == 5) { try { if (i == 5) - throw exception(); // BAD + throw exception(); // $ Alert // BAD } catch (const specific_exception &) { } } else if (i == 6) { try { if (i == 6) - throw exception(); // BAD + throw exception(); // $ Alert // BAD } catch (const other_throwable &) { } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Protocols/TlsSettingsMisconfiguration.qlref b/cpp/ql/test/query-tests/Likely Bugs/Protocols/TlsSettingsMisconfiguration.qlref index 8c1c54ff9606..bc1be3c9bfb6 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Protocols/TlsSettingsMisconfiguration.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Protocols/TlsSettingsMisconfiguration.qlref @@ -1 +1,2 @@ -Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql \ No newline at end of file +query: Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocol.qlref b/cpp/ql/test/query-tests/Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocol.qlref index 2cef090faef4..b682f4aa2d55 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocol.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocol.qlref @@ -1 +1,2 @@ -Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocol.ql \ No newline at end of file +query: Likely Bugs/Protocols/UseOfDeprecatedHardcodedProtocol.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Protocols/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Protocols/test.cpp index 5c2c2d6e3574..9c9a6473105a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Protocols/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Protocols/test.cpp @@ -15,30 +15,30 @@ void TestProperConfiguration_inter_CorrectUsage01() void TestProperConfiguration_inter_CorrectUsage02() { boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); // GOOD - ctx.set_options(boost::asio::ssl::context::no_tlsv1 | - boost::asio::ssl::context::no_tlsv1_1 | + ctx.set_options(boost::asio::ssl::context::no_tlsv1 | + boost::asio::ssl::context::no_tlsv1_1 | boost::asio::ssl::context::no_sslv3); } void TestProperConfiguration_inter_IncorrectUsage01() { - boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); // BAD - missing disable SSLv3 + boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); // $ Alert[cpp/boost/tls-settings-misconfiguration] // BAD - missing disable SSLv3 SetOptionsNoOldTls(ctx); } void TestProperConfiguration_IncorrectUsage01() { - boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); // BAD + boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); // $ Alert[cpp/boost/tls-settings-misconfiguration] // BAD } void TestProperConfiguration_IncorrectUsage02() { - boost::asio::ssl::context ctx(boost::asio::ssl::context::tls); // BAD + boost::asio::ssl::context ctx(boost::asio::ssl::context::tls); // $ Alert[cpp/boost/tls-settings-misconfiguration] // BAD } void TestProperConfiguration_IncorrectUsage03() { - boost::asio::ssl::context ctx(boost::asio::ssl::context::tls); // BAD + boost::asio::ssl::context ctx(boost::asio::ssl::context::tls); // $ Alert[cpp/boost/tls-settings-misconfiguration] // BAD SetOptionsNoOldTls(ctx); ctx.set_options(boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_2 ); // BUG - disabling TLS 1.2 @@ -46,22 +46,22 @@ void TestProperConfiguration_IncorrectUsage03() void TestHardcodedProtocols() { - //////////////////////// Banned Hardcoded algorithms - boost::asio::ssl::context cxt_sslv2(boost::asio::ssl::context::sslv2); // BUG - boost::asio::ssl::context cxt_sslv2c(boost::asio::ssl::context::sslv2_client); // BUG - boost::asio::ssl::context cxt_sslv2s(boost::asio::ssl::context::sslv2_server); // BUG + //////////////////////// Banned Hardcoded algorithms + boost::asio::ssl::context cxt_sslv2(boost::asio::ssl::context::sslv2); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG + boost::asio::ssl::context cxt_sslv2c(boost::asio::ssl::context::sslv2_client); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG + boost::asio::ssl::context cxt_sslv2s(boost::asio::ssl::context::sslv2_server); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG - boost::asio::ssl::context cxt_sslv3(boost::asio::ssl::context::sslv3); // BUG - boost::asio::ssl::context cxt_sslv3c(boost::asio::ssl::context::sslv3_client); // BUG - boost::asio::ssl::context cxt_sslv3s(boost::asio::ssl::context::sslv3_server); // BUG + boost::asio::ssl::context cxt_sslv3(boost::asio::ssl::context::sslv3); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG + boost::asio::ssl::context cxt_sslv3c(boost::asio::ssl::context::sslv3_client); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG + boost::asio::ssl::context cxt_sslv3s(boost::asio::ssl::context::sslv3_server); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG - boost::asio::ssl::context cxt_tlsv1(boost::asio::ssl::context::tlsv1); // BUG - boost::asio::ssl::context cxt_tlsv1c(boost::asio::ssl::context::tlsv1_client); // BUG - boost::asio::ssl::context cxt_tlsv1s(boost::asio::ssl::context::tlsv1_server); // BUG + boost::asio::ssl::context cxt_tlsv1(boost::asio::ssl::context::tlsv1); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG + boost::asio::ssl::context cxt_tlsv1c(boost::asio::ssl::context::tlsv1_client); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG + boost::asio::ssl::context cxt_tlsv1s(boost::asio::ssl::context::tlsv1_server); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG - boost::asio::ssl::context cxt_tlsv11(boost::asio::ssl::context::tlsv11); // BUG - boost::asio::ssl::context cxt_tlsv11c(boost::asio::ssl::context::tlsv11_client); // BUG - boost::asio::ssl::context cxt_tlsv11s(boost::asio::ssl::context::tlsv11_server); // BUG + boost::asio::ssl::context cxt_tlsv11(boost::asio::ssl::context::tlsv11); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG + boost::asio::ssl::context cxt_tlsv11c(boost::asio::ssl::context::tlsv11_client); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG + boost::asio::ssl::context cxt_tlsv11s(boost::asio::ssl::context::tlsv11_server); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG ////////////////////// Hardcoded algorithms @@ -76,12 +76,12 @@ void TestHardcodedProtocols() void InterProceduralTest(boost::asio::ssl::context::method m) { - boost::asio::ssl::context cxt1(m); // BUG - Multiple hits (sink) + boost::asio::ssl::context cxt1(m); // $ Alert[cpp/boost/use-of-deprecated-hardcoded-security-protocol] // BUG - Multiple hits (sink) } void TestHardcodedProtocols_inter() { - //////////////////////// Banned Hardcoded algorithms + //////////////////////// Banned Hardcoded algorithms InterProceduralTest(boost::asio::ssl::context::sslv2); // BUG InterProceduralTest(boost::asio::ssl::context::sslv2_client); // BUG InterProceduralTest(boost::asio::ssl::context::sslv2_server); // BUG diff --git a/cpp/ql/test/query-tests/Likely Bugs/Protocols/test2.cpp b/cpp/ql/test/query-tests/Likely Bugs/Protocols/test2.cpp index 5679cee8b0f8..c7715ff24614 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Protocols/test2.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Protocols/test2.cpp @@ -12,7 +12,7 @@ void bad1() { // BAD: missing disable SSLv3 boost::asio::ssl::context::method m = boost::asio::ssl::context::sslv23; - boost::asio::ssl::context ctx(m); + boost::asio::ssl::context ctx(m); // $ Alert[cpp/boost/tls-settings-misconfiguration] ctx.set_options(boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1); } @@ -20,7 +20,7 @@ void good2() { // GOOD [FALSE POSITIVE x 3] boost::asio::ssl::context::options opts = boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1 | boost::asio::ssl::context::no_sslv3; - boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); + boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); // $ Alert[cpp/boost/tls-settings-misconfiguration] ctx.set_options(opts); } @@ -28,7 +28,7 @@ void bad2() { // BAD: missing disable SSLv3 [WITH FALSE POSITIVE x 2] boost::asio::ssl::context::options opts = boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1; - boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); + boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); // $ Alert[cpp/boost/tls-settings-misconfiguration] ctx.set_options(opts); } @@ -42,14 +42,14 @@ void good3() void bad3() { // BAD: missing disable SSLv3 - boost::asio::ssl::context *ctx = new boost::asio::ssl::context(boost::asio::ssl::context::sslv23); + boost::asio::ssl::context *ctx = new boost::asio::ssl::context(boost::asio::ssl::context::sslv23); // $ Alert[cpp/boost/tls-settings-misconfiguration] ctx->set_options(boost::asio::ssl::context::no_tlsv1 | boost::asio::ssl::context::no_tlsv1_1); } void bad4() { // BAD: missing disable SSLv3 - boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); + boost::asio::ssl::context ctx(boost::asio::ssl::context::sslv23); // $ Alert[cpp/boost/tls-settings-misconfiguration] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Protocols/test3.cpp b/cpp/ql/test/query-tests/Likely Bugs/Protocols/test3.cpp index c9932b31618d..88f204dcced9 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Protocols/test3.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Protocols/test3.cpp @@ -4,7 +4,7 @@ void useTLS_bad() { - boost::asio::ssl::context ctx(boost::asio::ssl::context::tls); + boost::asio::ssl::context ctx(boost::asio::ssl::context::tls); // $ Alert[cpp/boost/tls-settings-misconfiguration] ctx.set_options(boost::asio::ssl::context::no_tlsv1); // BAD: missing no_tlsv1_1 // ... diff --git a/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp b/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp index 2760dcb349c2..3036bc4b5e70 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp @@ -1,23 +1,23 @@ void test_simple_bad(int *p) { int x; - x = *p; - if (p == nullptr) { // BAD + x = *p; // $ Source + if (p == nullptr) { // $ Alert // BAD return; } } void test_not_same_basic_block(int *p) { - int x = *p; + int x = *p; // $ Source if (x > 100) return; - if (!p) // BAD + if (!p) // $ Alert // BAD return; } void test_indirect(int **p) { int x; - x = **p; - if (*p == nullptr) { // BAD + x = **p; // $ Source + if (*p == nullptr) { // $ Alert // BAD return; } } @@ -45,10 +45,10 @@ void test_no_single_dominator(int *p, bool b) { } int test_postdominator_same_bb(int *p) { - int b = (p == nullptr); // BAD + int b = (p == nullptr); // $ Alert // BAD // This dereference is a postdominator of the null check, meaning that all // paths from the check to the function exit will pass through it. - return *p + b; + return *p + b; // $ Source } int test_postdominator(int *p) { @@ -75,8 +75,8 @@ void test_indirect_local() { int *p = &a; int **pp = &p; int x; - x = **pp; - if (*pp == nullptr) { // BAD + x = **pp; // $ Source + if (*pp == nullptr) { // $ Alert // BAD return; } } @@ -89,8 +89,8 @@ void test_field_local(bool boolvar) { auto sp = &s; if (boolvar) { - int x = *sp->p; - if (sp->p == nullptr) { // BAD + int x = *sp->p; // $ Source + if (sp->p == nullptr) { // $ Alert // BAD return; } } else { diff --git a/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.qlref b/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.qlref index 2223e47c30d2..169150bbd516 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.qlref @@ -1 +1,2 @@ -Likely Bugs/RedundantNullCheckSimple.ql +query: Likely Bugs/RedundantNullCheckSimple.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/ReturnConstType.qlref b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/ReturnConstType.qlref index ee515afb200f..bf5203dd1230 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/ReturnConstType.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/ReturnConstType.qlref @@ -1 +1,2 @@ -Likely Bugs/ReturnConstType.ql +query: Likely Bugs/ReturnConstType.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp index 77c82fbb54cb..f52accf2126d 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp @@ -2,12 +2,12 @@ // --- examples from the qhelp --- // The leftmost const has no effect here. -const int square(const int x) { // BAD +const int square(const int x) { // $ Alert // BAD return x * x; } // The const has no effect here, and can easily be mistaken for const char*. -char* const id(char* s) { // BAD +char* const id(char* s) { // $ Alert // BAD return s; } @@ -15,9 +15,9 @@ char* const id(char* s) { // BAD const char *getAConstantString(); const char **getAConstantStringPointer(); -const char getAConstChar(); // BAD -const signed char getASignedConstChar(); // BAD -unsigned const char getAnUnsignedConstChar(); // BAD +const char getAConstChar(); // $ Alert // BAD +const signed char getASignedConstChar(); // $ Alert // BAD +unsigned const char getAnUnsignedConstChar(); // $ Alert // BAD char getAChar(); typedef const char mychar; @@ -43,10 +43,10 @@ template class myWrapper { myWrapper testTemplateClass{t: 'a'}; #define MYCHAR const char -MYCHAR getAMYCHAR(); // FALSE POSITIVE +MYCHAR getAMYCHAR(); // $ Alert // FALSE POSITIVE #define ID(T) T id_ (T x) {return x;} -ID(const char); // FALSE POSITIVE +ID(const char); // $ Alert // FALSE POSITIVE const float pi = 3.14159626f; const float &getPiRef() { return pi; } // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/ReturnConstTypeMember.qlref b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/ReturnConstTypeMember.qlref index 052b0cd2ad50..3dbe1d19bf1e 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/ReturnConstTypeMember.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/ReturnConstTypeMember.qlref @@ -1 +1,2 @@ -Likely Bugs/ReturnConstTypeMember.ql +query: Likely Bugs/ReturnConstTypeMember.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/templates.cpp b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/templates.cpp index 73d18c844d23..c36e5e9625eb 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/templates.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/templates.cpp @@ -10,7 +10,7 @@ class TC1 { template class TC2 { public: - T fun() const { + T fun() const { // $ Alert return 5; } }; diff --git a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/test.cpp index e568d0da1525..e8eb23d013e1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstTypeMember/test.cpp @@ -2,13 +2,13 @@ class myClass { int getAnInt() { return 0; } - const int getAConstInt() { + const int getAConstInt() { // $ Alert return 0; } int getAnIntConst() const { return 0; } - const int getAConstIntConst() const { + const int getAConstIntConst() const { // $ Alert return 0; } @@ -16,7 +16,7 @@ class myClass { return 0; } - static const int getAStaticConstInt() { + static const int getAStaticConstInt() { // $ Alert return 0; } }; diff --git a/cpp/ql/test/query-tests/Likely Bugs/ShortLoopVarName/ShortLoopVarName.cpp b/cpp/ql/test/query-tests/Likely Bugs/ShortLoopVarName/ShortLoopVarName.cpp index 7dd7855bacc5..7a073c4860f4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ShortLoopVarName/ShortLoopVarName.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/ShortLoopVarName/ShortLoopVarName.cpp @@ -3,7 +3,7 @@ void test1() { - int i, j, outer_loop_var, inner_loop_var; + int i, j, outer_loop_var, inner_loop_var; // $ Alert for (i = 0; i < 10; i++) // GOOD: no nested loop { @@ -27,7 +27,7 @@ void test1() void test2(char *str) { - for (char *a = str; *a != NULL; a++) // BAD: short name + for (char *a = str; *a != NULL; a++) // $ Alert // BAD: short name { char *b = a; // GOOD: not a loop variable @@ -70,7 +70,7 @@ void test3() } } - for (int y = 0; y < 256; y++) // BAD: x and y are not a co-ordinate pair + for (int y = 0; y < 256; y++) // $ Alert // BAD: x and y are not a co-ordinate pair { for (int x = 0; x < 256; x++) { @@ -78,7 +78,7 @@ void test3() array1d[y] = 0; } } - + for (int z = 0; z < 256; z++) // GOOD: x, y and z are co-ordinates { for (int y = 0; y < 256; y++) // GOOD: x, y and z are co-ordinates @@ -89,11 +89,11 @@ void test3() } } } - + { string strings[10]; - for (int i = 0; i < 10; i++) // BAD: x and y are not a co-ordinate pair + for (int i = 0; i < 10; i++) // $ Alert // BAD: x and y are not a co-ordinate pair { for (int j = 0; j < strings[i].strlen; j++) { diff --git a/cpp/ql/test/query-tests/Likely Bugs/ShortLoopVarName/ShortLoopVarName.qlref b/cpp/ql/test/query-tests/Likely Bugs/ShortLoopVarName/ShortLoopVarName.qlref index 6e4b506018f8..de5c76f3f6a8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ShortLoopVarName/ShortLoopVarName.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/ShortLoopVarName/ShortLoopVarName.qlref @@ -1 +1,2 @@ -Likely Bugs/ShortLoopVarName.ql +query: Likely Bugs/ShortLoopVarName.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qlref b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qlref index 38492f2a203c..d96192c760c3 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qlref @@ -1 +1,2 @@ -Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql \ No newline at end of file +query: Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.qlref index e61361d6bfee..56065d60fcee 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Underspecified Functions/MistypedFunctionArguments.ql +query: Likely Bugs/Underspecified Functions/MistypedFunctionArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/TooFewArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/TooFewArguments.qlref index 710092c54d85..c0c3166e8d55 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/TooFewArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/TooFewArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Underspecified Functions/TooFewArguments.ql +query: Likely Bugs/Underspecified Functions/TooFewArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/TooManyArguments.qlref b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/TooManyArguments.qlref index ca44af39c2bf..c78a44facd11 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/TooManyArguments.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/TooManyArguments.qlref @@ -1 +1,2 @@ -Likely Bugs/Underspecified Functions/TooManyArguments.ql +query: Likely Bugs/Underspecified Functions/TooManyArguments.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c index d77c16683ed6..3cdc534d424a 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c @@ -24,53 +24,53 @@ void test(int *argv[]) { declared_empty(1); // GOOD declared_void(); // GOOD declared_with(1); // GOOD - - undeclared(); // BAD (GOOD for everything except cpp/implicit-function-declaration) + + undeclared(); // $ Alert[cpp/implicit-function-declaration] // BAD (GOOD for everything except cpp/implicit-function-declaration) undeclared(1); // GOOD - - not_yet_declared1(1); // BAD (GOOD for everything except for cpp/implicit-function-declaration) - not_yet_declared2(1); // BAD (GOOD for everything except for cpp/implicit-function-declaration) - not_yet_declared2(ca); // BAD (GOOD for everything except for cpp/mistyped-function-arguments + + not_yet_declared1(1); // $ Alert[cpp/implicit-function-declaration] // BAD (GOOD for everything except for cpp/implicit-function-declaration) + not_yet_declared2(1); // $ Alert[cpp/implicit-function-declaration] // BAD (GOOD for everything except for cpp/implicit-function-declaration) + not_yet_declared2(ca); // $ Alert[cpp/mistyped-function-arguments] // BAD (GOOD for everything except for cpp/mistyped-function-arguments // and cpp/too-few-arguments. Not detected in the case of cpp/too-few-arguments.) not_yet_declared2(); // BAD [NOT DETECTED] (GOOD for everything except for cpp/too-few-arguments) - declared_empty_defined_with(); // BAD + declared_empty_defined_with(); // $ Alert[cpp/too-few-arguments] // BAD declared_empty_defined_with(1); // GOOD int x; - declared_empty_defined_with(&x); // BAD - declared_empty_defined_with(3, &x); // BAD + declared_empty_defined_with(&x); // $ Alert[cpp/mistyped-function-arguments] // BAD + declared_empty_defined_with(3, &x); // $ Alert[cpp/futile-params] // BAD - not_declared_defined_with(-1, 0, 2U); // BAD (GOOD for everything except for cpp/implicit-function-declaration) - not_declared_defined_with(4LL, 0, 2.5e9f); // BAD + not_declared_defined_with(-1, 0, 2U); // $ Alert[cpp/implicit-function-declaration] // BAD (GOOD for everything except for cpp/implicit-function-declaration) + not_declared_defined_with(4LL, 0, 2.5e9f); // $ Alert[cpp/mistyped-function-arguments] // BAD declared_with_pointers(pv, ca); // GOOD - declared_with_pointers(3.5e15, 0); // BAD + declared_with_pointers(3.5e15, 0); // $ Alert[cpp/mistyped-function-arguments] // BAD declared_with_array("Hello"); // GOOD - declared_with_array(&x); // BAD - - defined_with_float(2.f); // BAD - defined_with_float(2.0); // BAD - - defined_with_double(2.f); // BAD (GOOD for everything except for cpp/implicit-function-declaration) - defined_with_double('c'); // BAD - - defined_with_long_long('c'); // BAD - defined_with_long_long(3); // BAD - - defined_with_double(2LL); // BAD - defined_with_long_long(3.5e15); // BAD - + declared_with_array(&x); // $ Alert[cpp/mistyped-function-arguments] // BAD + + defined_with_float(2.f); // $ Alert[cpp/mistyped-function-arguments] // BAD + defined_with_float(2.0); // $ Alert[cpp/mistyped-function-arguments] // BAD + + defined_with_double(2.f); // $ Alert[cpp/implicit-function-declaration] // BAD (GOOD for everything except for cpp/implicit-function-declaration) + defined_with_double('c'); // $ Alert[cpp/mistyped-function-arguments] // BAD + + defined_with_long_long('c'); // $ Alert[cpp/mistyped-function-arguments] // BAD + defined_with_long_long(3); // $ Alert[cpp/mistyped-function-arguments] // BAD + + defined_with_double(2LL); // $ Alert[cpp/mistyped-function-arguments] // BAD + defined_with_long_long(3.5e15); // $ Alert[cpp/mistyped-function-arguments] // BAD + k_and_r_func(2.5, &s); // GOOD - + int (*parameterName)[2]; - defined_with_ptr_ptr(parameterName); // // BAD (GOOD for everything except for cpp/implicit-function-declaration) + defined_with_ptr_ptr(parameterName); // $ Alert[cpp/implicit-function-declaration] // // BAD (GOOD for everything except for cpp/implicit-function-declaration) defined_with_ptr_ptr(argv); // GOOD - defined_with_ptr_arr(parameterName); // // BAD (GOOD for everything except for cpp/implicit-function-declaration) + defined_with_ptr_arr(parameterName); // $ Alert[cpp/implicit-function-declaration] // // BAD (GOOD for everything except for cpp/implicit-function-declaration) defined_with_ptr_arr(argv); // GOOD declared_and_defined_empty(); // GOOD - declared_and_defined_empty(1); // BAD + declared_and_defined_empty(1); // $ Alert[cpp/futile-params] // BAD } void not_yet_declared1(); @@ -85,7 +85,7 @@ void not_declared_defined_with(int x, int y, int z) { int dereference(); int caller(void) { - return dereference(); // BAD + return dereference(); // $ Alert[cpp/too-few-arguments] // BAD } int dereference(int *x) { return *x; } @@ -130,10 +130,10 @@ extern int extern_definition(double, double*); void test_implicit_function_declaration(int x, double d) { int y; - implicit_declaration(1, 2); // BAD - implicit_declaration_k_and_r(1, 2); // BAD + implicit_declaration(1, 2); // $ Alert[cpp/implicit-function-declaration] // BAD + implicit_declaration_k_and_r(1, 2); // $ Alert[cpp/implicit-function-declaration] // BAD implicit_declaration(1, 2); // GOOD (no longer an implicit declaration) y = extern_definition(3.0f, &d); // GOOD -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/UseInOwnInitializer.qlref b/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/UseInOwnInitializer.qlref index 8242a3a6403b..f4ba94dd082f 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/UseInOwnInitializer.qlref +++ b/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/UseInOwnInitializer.qlref @@ -1 +1,2 @@ -Likely Bugs/UseInOwnInitializer.ql +query: Likely Bugs/UseInOwnInitializer.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp index 41dde27c5a09..8d0c09be66c0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp @@ -1,11 +1,11 @@ typedef long size_t; void test1() { - int x = x; // BAD + int x = x; // $ Alert // BAD } void test2() { - int x = x = 2; // BAD + int x = x = 2; // $ Alert // BAD } void test3() { @@ -54,11 +54,11 @@ void test9() { } void test10() { - int x = x + 1; // BAD: x is evaluated on the right hand side + int x = x + 1; // $ Alert // BAD: x is evaluated on the right hand side } void test11() { - int x = uninitialized(x) + 1; // BAD: x is evaluated on the right hand side + int x = uninitialized(x) + 1; // $ Alert // BAD: x is evaluated on the right hand side } #define self_initialize(t, x) t x = x diff --git a/cpp/ql/test/query-tests/Power of 10/Rule 2/BoundedLoopIterations.qlref b/cpp/ql/test/query-tests/Power of 10/Rule 2/BoundedLoopIterations.qlref index bd3a3b016916..28e3197a8f70 100644 --- a/cpp/ql/test/query-tests/Power of 10/Rule 2/BoundedLoopIterations.qlref +++ b/cpp/ql/test/query-tests/Power of 10/Rule 2/BoundedLoopIterations.qlref @@ -1 +1,2 @@ -Power of 10/Rule 2/BoundedLoopIterations.ql +query: Power of 10/Rule 2/BoundedLoopIterations.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Power of 10/Rule 2/loops.cpp b/cpp/ql/test/query-tests/Power of 10/Rule 2/loops.cpp index 29ca9fa1ccda..c0b5c09346cf 100644 --- a/cpp/ql/test/query-tests/Power of 10/Rule 2/loops.cpp +++ b/cpp/ql/test/query-tests/Power of 10/Rule 2/loops.cpp @@ -21,20 +21,20 @@ void f() { while (i < bound) { i++; } // Good: Bound not modified in loop. do { i++; } while (i < bound); // Good: Bound not modified in loop. - for (i = 0; i < 10; i--); // Bad: No increment. - while (i < 10) { } // Bad: No increment. - do { i += 2; } while (i > 10); // Bad: No decrement. - while (i > 10) { if (i < 5) i--; } // Bad: Conditional decrement. - while (i < bound) { i++; bound++; } // Bad: Bound modified in loop. - while (i < bound) { i++; bound >>= 1; } // Bad: Bound modified in loop. - while (i > bound) { i--; bound += 1; } // Bad: Bound modified in loop. - while (i > bound) { i--; bound = bound; } // Bad: Bound modified in loop. - for (; xs->next; xs = xs->next); // Bad: No bound. - while (i <= -i) {} // Bad: Hidden infinite loop. + for (i = 0; i < 10; i--); // $ Alert // Bad: No increment. + while (i < 10) { } // $ Alert // Bad: No increment. + do { i += 2; } while (i > 10); // $ Alert // Bad: No decrement. + while (i > 10) { if (i < 5) i--; } // $ Alert // Bad: Conditional decrement. + while (i < bound) { i++; bound++; } // $ Alert // Bad: Bound modified in loop. + while (i < bound) { i++; bound >>= 1; } // $ Alert // Bad: Bound modified in loop. + while (i > bound) { i--; bound += 1; } // $ Alert // Bad: Bound modified in loop. + while (i > bound) { i--; bound = bound; } // $ Alert // Bad: Bound modified in loop. + for (; xs->next; xs = xs->next); // $ Alert // Bad: No bound. + while (i <= -i) {} // $ Alert // Bad: Hidden infinite loop. while (i < 10) { i = i + 1; } // Good: Fixed bound. while (i > 10) { i = i - 1; } // Good: Fixed bound. - while (i < 10) { i = 0; } // Bad: increment outside loop - while (i > 10) { i = 0; } // Bad: decrement outside loop - while (i > 10) { i = 1 - i; } // Bad: Swapped operands to `-` + while (i < 10) { i = 0; } // $ Alert // Bad: increment outside loop + while (i > 10) { i = 0; } // $ Alert // Bad: decrement outside loop + while (i > 10) { i = 1 - i; } // $ Alert // Bad: Swapped operands to `-` } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-014/MemsetMayBeDeleted.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-014/MemsetMayBeDeleted.qlref index e81526fe6d9d..bc89bc58f77a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-014/MemsetMayBeDeleted.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-014/MemsetMayBeDeleted.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-014/MemsetMayBeDeleted.ql +query: Security/CWE/CWE-014/MemsetMayBeDeleted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp index 1e0ed7d70f00..d7228f50b2ec 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp @@ -42,10 +42,10 @@ char *func2(char buff[128], unsigned long long sz) { // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.22: deleted -void func3(unsigned long long sz) { +void func3(unsigned long long sz) { char buff[128]; gets(buff); - memset(buff, 0, PW_SIZE); // BAD + memset(buff, 0, PW_SIZE); // $ Alert // BAD } // x86-64 gcc 9.2: deleted @@ -76,15 +76,15 @@ void func5(unsigned long long sz) { void func6(unsigned long long sz) { struct mem m; gets(m.b); - memset(&m, 0, PW_SIZE); // BAD + memset(&m, 0, PW_SIZE); // $ Alert // BAD } // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.22: deleted -void func7(unsigned long long sz) { +void func7(unsigned long long sz) { struct mem m; - gets(m.b); + gets(m.b); memset(&m, 0, PW_SIZE); // BAD [NOT DETECTED] m.a = 15; } @@ -116,7 +116,7 @@ void func10(unsigned long long sz) { gets(m->b); memset(m, 0, PW_SIZE); // BAD [NOT DETECTED] m->a = sz; - m->c = m->a + 1; + m->c = m->a + 1; } // x86-64 gcc 9.2: deleted @@ -205,7 +205,7 @@ void badFunc0_0(){ for(int i = 0; i < PW_SIZE; i++) { buff1[i] = 13; } - memset(buff1, 0, PW_SIZE); // BAD + memset(buff1, 0, PW_SIZE); // $ Alert // BAD } void nobadFunc1_0() { @@ -222,7 +222,7 @@ void badFunc1_0(){ void badFunc1_1(){ unsigned char buff1[PW_SIZE]; for(int i = 0; i < PW_SIZE; i++) { - buff1[i] = 'a' + i; + buff1[i] = 'a' + i; } memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED] free(buff1); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp index 876584c51174..e0ad12c94688 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp @@ -52,7 +52,7 @@ void bad() if (FILENAME_MAX-dataLen > 1) { /* POTENTIAL FLAW: Read data from the console */ - if (fgets(data+dataLen, (int)(FILENAME_MAX-dataLen), stdin) != NULL) + if (fgets(data+dataLen, (int)(FILENAME_MAX-dataLen), stdin) != NULL) // $ Source { /* The next few lines remove the carriage return from the string that is * inserted by fgets() */ @@ -74,7 +74,7 @@ void bad() { FILE *pFile = NULL; /* POTENTIAL FLAW: Possibly opening a file without validating the file name or path */ - pFile = FOPEN(data, "wb+"); + pFile = FOPEN(data, "wb+"); // $ Alert if (pFile != NULL) { fclose(pFile); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.qlref index 1677939387da..399ff4f1909f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-022/TaintedPath.ql \ No newline at end of file +query: Security/CWE/CWE-022/TaintedPath.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/ExecTainted.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/ExecTainted.qlref index 9fe2347270f2..4e996a47ad54 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/ExecTainted.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/ExecTainted.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-078/ExecTainted.ql \ No newline at end of file +query: Security/CWE/CWE-078/ExecTainted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/tests.cpp index 80f8221d9033..c8918ffc45e2 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/tests.cpp @@ -30,7 +30,7 @@ static char * badSource(char * data) { /* Append input from an environment variable to data */ size_t dataLen = strlen(data); - char * environment = GETENV(ENV_VARIABLE); + char * environment = GETENV(ENV_VARIABLE); // $ Source /* If there is data in the environment variable */ if (environment != NULL) { @@ -50,7 +50,7 @@ void CWE78_OS_Command_Injection__char_environment_system_21_bad() badStatic = 1; /* true */ data = badSource(data); /* POTENTIAL FLAW: Execute command in data possibly leading to command injection [NOT DETECTED] */ - if (SYSTEM(data) != 0) + if (SYSTEM(data) != 0) // $ Alert { printLine("command execution failed!"); exit(1); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/ExecTainted.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/ExecTainted.qlref index 1de765a2fdf1..4e996a47ad54 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/ExecTainted.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/ExecTainted.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-078/ExecTainted.ql +query: Security/CWE/CWE-078/ExecTainted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/test.cpp index 8c7651f32756..2a1828c07c88 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/test.cpp @@ -12,7 +12,7 @@ extern void encodeShellString(char *shellStr, int maxChars, const char* cStr); #include "../../../../../../include/string.h" ///// Test code ///// -int main(int argc, char** argv) { +int main(int argc, char** argv) { // $ Source char *userName = argv[2]; { @@ -20,7 +20,7 @@ int main(int argc, char** argv) { // a command. char command1[1000] = {0}; sprintf(command1, "userinfo -v \"%s\"", userName); - system(command1); + system(command1); // $ Alert } { @@ -44,11 +44,11 @@ void test2(char* arg2) { void test3(char* arg1) { // GOOD?: the user string is a `$CFLAGS` environment variable - char *envCflags = getenv("CFLAGS"); + char *envCflags = getenv("CFLAGS"); // $ Source char command[1000]; sprintf(command, "%s %s", arg1, envCflags); - system(command); + system(command); // $ Alert } typedef unsigned long size_t; @@ -60,10 +60,10 @@ char *strncat(char *s1, const char *s2, size_t n); void test4(FILE *f) { // BAD: the user string is injected directly into a command char command[1000] = "mv ", filename[1000]; - fread(filename, 1, 1000, f); + fread(filename, 1, 1000, f); // $ Source strncat(command, filename, 1000); - system(command); + system(command); // $ Alert } void test5(FILE *f) { @@ -80,19 +80,19 @@ int execl(char *path, char *arg1, ...); void test6(FILE *f) { // BAD: the user string is injected directly into a command char command[1000] = "mv ", filename[1000]; - fread(filename, 1, 1000, f); + fread(filename, 1, 1000, f); // $ Source strncat(command, filename, 1000); - execl("/bin/sh", "sh", "-c", command); + execl("/bin/sh", "sh", "-c", command); // $ Alert } void test7(FILE *f) { // GOOD [FALSE POSITIVE]: the user string is a positional argument to a shell script char path[1000] = "/home/me/", filename[1000]; - fread(filename, 1, 1000, f); + fread(filename, 1, 1000, f); // $ Source strncat(path, filename, 1000); - execl("/bin/sh", "sh", "-c", "script.sh", path); + execl("/bin/sh", "sh", "-c", "script.sh", path); // $ Alert } void test8(char *arg2) { @@ -104,21 +104,21 @@ void test8(char *arg2) { void test9(FILE *f) { // BAD: the user string is injected directly into a command - std::string path(getenv("something")); + std::string path(getenv("something")); // $ Source std::string command = "mv " + path; - system(command.c_str()); + system(command.c_str()); // $ Alert } void test10(FILE *f) { // BAD: the user string is injected directly into a command - std::string path(getenv("something")); - system(("mv " + path).c_str()); + std::string path(getenv("something")); // $ Source + system(("mv " + path).c_str()); // $ Alert } void test11(FILE *f) { // BAD: the user string is injected directly into a command - std::string path(getenv("something")); - system(("mv " + path).data()); + std::string path(getenv("something")); // $ Source + system(("mv " + path).data()); // $ Alert } int atoi(char *); @@ -138,10 +138,10 @@ void test13(FILE *f) { char str[1000]; char command[1000]; - fread(str, 1, 1000, f); + fread(str, 1, 1000, f); // $ Source sprintf(command, "echo %s", str); - system(command); // BAD: the user string was printed into the command with the %s specifier + system(command); // $ Alert // BAD: the user string was printed into the command with the %s specifier } void test14(FILE *f) { @@ -172,7 +172,7 @@ void test15(FILE *f) { void test16(FILE *f, bool use_flags) { // BAD: the user string is injected directly into a command char command[1000] = "mv ", flags[1000] = "-R", filename[1000]; - fread(filename, 1, 1000, f); + fread(filename, 1, 1000, f); // $ Source if (use_flags) { strncat(flags, filename, 1000); @@ -181,7 +181,7 @@ void test16(FILE *f, bool use_flags) { strncat(command, filename, 1000); } - execl("/bin/sh", "sh", "-c", command); + execl("/bin/sh", "sh", "-c", command); // $ Alert } void concat(char *command, char *flags, char *filename) { @@ -192,11 +192,11 @@ void concat(char *command, char *flags, char *filename) { void test17(FILE *f) { // BAD: the user string is injected directly into a command char command[1000] = "mv ", flags[1000] = "-R", filename[1000]; - fread(filename, 1, 1000, f); + fread(filename, 1, 1000, f); // $ Source concat(command, flags, filename); - execl("/bin/sh", "sh", "-c", command); + execl("/bin/sh", "sh", "-c", command); // $ Alert } void test18() { @@ -216,11 +216,11 @@ void test18() { void test19(FILE *f) { // BAD: the user string is injected directly into a command char command[1000] = "mv ", filename[1000]; - fread(filename, 1, 1000, f); + fread(filename, 1, 1000, f); // $ Source CONCAT(command, filename) - execl("/bin/sh", "sh", "-c", command); + execl("/bin/sh", "sh", "-c", command); // $ Alert } void test20() { @@ -228,10 +228,10 @@ void test20() { char buffer[1024 * 4]; strncpy(buffer, getenv("var_a"), 1024); - strncat(buffer, getenv("var_b"), 1024); - strncat(buffer, getenv("var_c"), 1024); + strncat(buffer, getenv("var_b"), 1024); // $ Source + strncat(buffer, getenv("var_c"), 1024); // $ Source strncat(buffer, " ", 1024); - system(buffer); + system(buffer); // $ Alert } void test21() { @@ -240,13 +240,13 @@ void test21() { char buffer2[1024]; sprintf(buffer1, "%s %s", - getenv("var_a"), - getenv("var_b")); + getenv("var_a"), // $ Source + getenv("var_b")); // $ Source sprintf(buffer2, "%s %s %s", " ", buffer1, - getenv("var_c")); - system(buffer2); + getenv("var_c")); // $ Source + system(buffer2); // $ Alert } void test22() { @@ -256,9 +256,9 @@ void test22() { strncpy(buffer, "command ", 1024); for (i = 0; i < 10; i++) { - strncat(buffer, getenv("var_a"), 1024); + strncat(buffer, getenv("var_a"), 1024); // $ Source } - system(buffer); + system(buffer); // $ Alert } // open question: do we want to report certain sources even when they're the start of the string? diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.qlref index bd5e957761b3..1192c6d67f56 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-079/CgiXss.ql +query: Security/CWE/CWE-079/CgiXss.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/search.c b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/search.c index 9369d80fd913..830a5919eb3c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/search.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/search.c @@ -14,13 +14,13 @@ char* escape_html(char* raw); void bad_server1(char* query) { puts("

Query results for "); // BAD: Printing out an HTTP parameter with no escaping - puts(query); + puts(query); // $ Alert puts("\n

\n"); puts(do_search(query)); } void bad_server2(char* query) { - printf("

Query results for %s\n", query); + printf("

Query results for %s\n", query); // $ Alert // BAD: Printing out an HTTP parameter with no escaping puts("\n

"); puts(do_search(query)); @@ -59,12 +59,12 @@ void bad_server3(char* query) { puts("

Query results for "); // BAD: Printing out an HTTP parameter with no escaping - puts(query_text); + puts(query_text); // $ Alert puts("\n

\n"); } int main(int argc, char** argv) { - char* raw_query = getenv("QUERY_STRING"); + char* raw_query = getenv("QUERY_STRING"); // $ Source if (strcmp("good1", argv[0]) == 0) { good_server1(raw_query); } else if (strcmp("bad1", argv[0]) == 0) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-114/SAMATE/UncontrolledProcessOperation/UncontrolledProcessOperation.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-114/SAMATE/UncontrolledProcessOperation/UncontrolledProcessOperation.qlref index a9ca1db51997..57318b8ffeb2 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-114/SAMATE/UncontrolledProcessOperation/UncontrolledProcessOperation.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-114/SAMATE/UncontrolledProcessOperation/UncontrolledProcessOperation.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-114/UncontrolledProcessOperation.ql +query: Security/CWE/CWE-114/UncontrolledProcessOperation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-114/SAMATE/UncontrolledProcessOperation/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-114/SAMATE/UncontrolledProcessOperation/test.cpp index 299e0372d4ae..bae7e5fdf995 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-114/SAMATE/UncontrolledProcessOperation/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-114/SAMATE/UncontrolledProcessOperation/test.cpp @@ -40,7 +40,7 @@ void CWE114_Process_Control__w32_char_environment_82_bad::action(char * data) HMODULE hModule; /* POTENTIAL FLAW: If the path to the library is not specified, an attacker may be able to * replace his own file with the intended library */ - hModule = LoadLibraryA(data); + hModule = LoadLibraryA(data); // $ Alert if (hModule != NULL) { FreeLibrary(hModule); @@ -61,7 +61,7 @@ void bad() { /* Append input from an environment variable to data */ size_t dataLen = strlen(data); - char * environment = GETENV(ENV_VARIABLE); + char * environment = GETENV(ENV_VARIABLE); // $ Source /* If there is data in the environment variable */ if (environment != NULL) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.qlref index a9ca1db51997..57318b8ffeb2 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-114/UncontrolledProcessOperation.ql +query: Security/CWE/CWE-114/UncontrolledProcessOperation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp index ed3adcb8d809..8b6703dde800 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp @@ -23,12 +23,12 @@ class MyDerived : public MyBase void doCommand2(const char *command) { - system(command); // BAD (externally controlled string) + system(command); // $ Alert // BAD (externally controlled string) } void doCommand3(const char *command) { - system(command); // BAD (externally controlled string) + system(command); // $ Alert // BAD (externally controlled string) } }; @@ -39,8 +39,8 @@ void testMyDerived() MyBase *md3 = new MyDerived; // MyBase pointer to a MyDerived md1->doCommand1("fixed"); - md2->doCommand2(getenv("varname")); - md3->doCommand3(getenv("varname")); + md2->doCommand2(getenv("varname")); // $ Source + md3->doCommand3(getenv("varname")); // $ Source } // --- @@ -53,16 +53,16 @@ void testReferencePointer1() { char buffer[1024]; - if (fgets(buffer, 1024, stdin) != 0) + if (fgets(buffer, 1024, stdin) != 0) // $ Source { char *data = buffer; char *&dataref = data; char *data2 = dataref; - system(buffer); // BAD - system(data); // BAD - system(dataref); // BAD - system(data2); // BAD + system(buffer); // $ Alert // BAD + system(data); // $ Alert // BAD + system(dataref); // $ Alert // BAD + system(data2); // $ Alert // BAD } } @@ -73,9 +73,9 @@ void testReferencePointer2() char *&dataref = data; char *data2 = dataref; - if (fgets(buffer, 1024, stdin) != 0) + if (fgets(buffer, 1024, stdin) != 0) // $ Source { - system(buffer); // BAD + system(buffer); // $ Alert // BAD system(data); // BAD system(dataref); // BAD [NOT DETECTED] system(data2); // BAD [NOT DETECTED] @@ -95,21 +95,21 @@ void testAcceptRecv(int socket1, int socket2) { char buffer[1024]; - recv(socket1, buffer, 1024); - LoadLibrary(buffer); // BAD: using data from recv + recv(socket1, buffer, 1024); // $ Source + LoadLibrary(buffer); // $ Alert // BAD: using data from recv } - + { char buffer[1024]; accept(socket2, 0, 0); - recv(socket2, buffer, 1024); - LoadLibrary(buffer); // BAD: using data from recv + recv(socket2, buffer, 1024); // $ Source + LoadLibrary(buffer); // $ Alert // BAD: using data from recv } } void argumentUse(char *ptr, FILE *stream) { char buffer[80]; - ptr = fgets(buffer, sizeof(buffer), stream); - system(ptr); // BAD + ptr = fgets(buffer, sizeof(buffer), stream); // $ Source + system(ptr); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/BadlyBoundedWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/BadlyBoundedWrite.qlref index 9636c74d0a8f..76b6e5900218 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/BadlyBoundedWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/BadlyBoundedWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/BadlyBoundedWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/BadlyBoundedWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OffsetUseBeforeRangeCheck.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OffsetUseBeforeRangeCheck.qlref index d934901f174f..0e9b8f83382e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OffsetUseBeforeRangeCheck.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OffsetUseBeforeRangeCheck.qlref @@ -1 +1,2 @@ -Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql \ No newline at end of file +query: Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowBuffer.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowBuffer.qlref index 5c2bacec579f..bb308ea4b215 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowBuffer.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowBuffer.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-119/OverflowBuffer.ql \ No newline at end of file +query: Security/CWE/CWE-119/OverflowBuffer.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowDestination.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowDestination.qlref index a4213e22fcd7..0e0d1d3792de 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowDestination.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowDestination.qlref @@ -1 +1,2 @@ -Critical/OverflowDestination.ql \ No newline at end of file +query: Critical/OverflowDestination.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowStatic.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowStatic.qlref index 9ff1c3b33dc5..93d88e7802a0 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowStatic.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowStatic.qlref @@ -1 +1,2 @@ -Critical/OverflowStatic.ql \ No newline at end of file +query: Critical/OverflowStatic.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWrite.qlref index f6c962c1a7b4..18ae0f2a567b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/OverrunWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/OverrunWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteFloat.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteFloat.qlref index 757d1592e830..ba8f6a96a1fd 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteFloat.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteFloat.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/OverrunWriteFloat.ql \ No newline at end of file +query: Security/CWE/CWE-120/OverrunWriteFloat.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteProductFlow.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteProductFlow.qlref index 1a418e6abc6a..8ea70c432a1a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteProductFlow.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteProductFlow.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-119/OverrunWriteProductFlow.ql \ No newline at end of file +query: Security/CWE/CWE-119/OverrunWriteProductFlow.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/StrncpyFlippedArgs.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/StrncpyFlippedArgs.qlref index bf0bf1ea7d05..3a2ef158d3d6 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/StrncpyFlippedArgs.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/StrncpyFlippedArgs.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/StrncpyFlippedArgs.ql \ No newline at end of file +query: Likely Bugs/Memory Management/StrncpyFlippedArgs.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/UnboundedWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/UnboundedWrite.qlref index 767f2ea4db9d..36c47957d339 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/UnboundedWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/UnboundedWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/UnboundedWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/UnboundedWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/VeryLikelyOverrunWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/VeryLikelyOverrunWrite.qlref index 94b53951c4b7..8dcc2f70c2f6 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/VeryLikelyOverrunWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/VeryLikelyOverrunWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp index ca6ca9a5c5a8..52272d4dae32 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp @@ -15,7 +15,7 @@ typedef struct string_t *mk_string_t(int size) { string_t *str = (string_t *) malloc(sizeof(string_t)); - str->string = malloc(size); + str->string = malloc(size); // $ Source[cpp/overrun-write] str->size = size; return str; } @@ -39,7 +39,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) { string_t *str = mk_string_t(size); strncpy(str->string, buf, str->size); // GOOD - strncpy(str->string, buf, str->size + 1); // BAD + strncpy(str->string, buf, str->size + 1); // $ Alert[cpp/overrun-write] // BAD strncpy(str->string, buf, size); // GOOD strncpy(str->string, buf, size + 1); // BAD [NOT DETECTED] @@ -69,7 +69,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) { } if(anotherSize <= str->size + 1) { - strncpy(str->string, buf, anotherSize); // BAD + strncpy(str->string, buf, anotherSize); // $ Alert[cpp/overrun-write] // BAD } if(anotherSize <= size + 1) { @@ -77,7 +77,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) { } if(anotherSize <= str->size + 2) { - strncpy(str->string, buf, anotherSize); // BAD + strncpy(str->string, buf, anotherSize); // $ Alert[cpp/overrun-write] // BAD } if(anotherSize <= size + 2) { @@ -144,16 +144,16 @@ void test4(unsigned size, char *buf, unsigned anotherSize) { void test5(unsigned size, char *buf, unsigned anotherSize) { string_t *str = (string_t *) malloc(sizeof(string_t)); - str->string = malloc(size - 1); + str->string = malloc(size - 1); // $ Source[cpp/overrun-write] str->size = size - 1; strncpy(str->string, buf, str->size); // GOOD strncpy(str->string, buf, str->size - 1); // GOOD - strncpy(str->string, buf, str->size + 1); // BAD + strncpy(str->string, buf, str->size + 1); // $ Alert[cpp/overrun-write] // BAD - strncpy(str->string, buf, size); // BAD + strncpy(str->string, buf, size); // $ Alert[cpp/overrun-write] // BAD strncpy(str->string, buf, size - 1); // GOOD - strncpy(str->string, buf, size + 1); // BAD + strncpy(str->string, buf, size + 1); // $ Alert[cpp/overrun-write] // BAD if(anotherSize < str->size) { strncpy(str->string, buf, anotherSize); // GOOD @@ -172,7 +172,7 @@ void test5(unsigned size, char *buf, unsigned anotherSize) { } if(anotherSize <= size) { - strncpy(str->string, buf, anotherSize); // BAD + strncpy(str->string, buf, anotherSize); // $ Alert[cpp/overrun-write] // BAD } if(anotherSize <= size - 1) { @@ -184,7 +184,7 @@ void test5(unsigned size, char *buf, unsigned anotherSize) { } if(anotherSize < size + 1) { - strncpy(str->string, buf, anotherSize); // BAD + strncpy(str->string, buf, anotherSize); // $ Alert[cpp/overrun-write] // BAD } if(anotherSize < size - 1) { @@ -192,19 +192,19 @@ void test5(unsigned size, char *buf, unsigned anotherSize) { } if(anotherSize <= str->size + 1) { - strncpy(str->string, buf, anotherSize); // BAD + strncpy(str->string, buf, anotherSize); // $ Alert[cpp/overrun-write] // BAD } if(anotherSize <= size + 1) { - strncpy(str->string, buf, anotherSize); // BAD + strncpy(str->string, buf, anotherSize); // $ Alert[cpp/overrun-write] // BAD } if(anotherSize <= str->size + 2) { - strncpy(str->string, buf, anotherSize); // BAD + strncpy(str->string, buf, anotherSize); // $ Alert[cpp/overrun-write] // BAD } if(anotherSize <= size + 2) { - strncpy(str->string, buf, anotherSize); // BAD + strncpy(str->string, buf, anotherSize); // $ Alert[cpp/overrun-write] // BAD } } @@ -238,16 +238,16 @@ void set_string(string_t* p_str, char* buffer) { void test_flow_through_setter(unsigned size) { string_t str; - char* buffer = (char*)malloc(size); + char* buffer = (char*)malloc(size); // $ Source[cpp/overrun-write] set_string(&str, buffer); - memset(str.string, 0, size + 1); // BAD + memset(str.string, 0, size + 1); // $ Alert[cpp/overrun-write] // BAD } void* my_alloc(unsigned size); void foo(unsigned size) { - int* p = (int*)my_alloc(size); // BAD - memset(p, 0, size + 1); + int* p = (int*)my_alloc(size); // $ Source[cpp/overrun-write] // BAD + memset(p, 0, size + 1); // $ Alert[cpp/overrun-write] } void test6(unsigned long n, char *p) { @@ -259,11 +259,11 @@ void test6(unsigned long n, char *p) { } void test7(unsigned n) { - char* p = (char*)malloc(n); + char* p = (char*)malloc(n); // $ Source[cpp/overrun-write] if(!p) { p = (char*)malloc(++n); } - memset(p, 0, n); // GOOD [FALSE POSITIVE] + memset(p, 0, n); // $ Alert[cpp/overrun-write] // GOOD [FALSE POSITIVE] } void test8(unsigned size, unsigned src_pos) @@ -275,4 +275,4 @@ void test8(unsigned size, unsigned src_pos) if (src_pos < size - 1) { memset(xs, 0, src_pos + 1); // GOOD } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp index 61b69d951858..5df613f80006 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp @@ -168,8 +168,8 @@ void CWE122_Heap_Based_Buffer_Overflow__c_CWE805_char_memcpy_01_bad() memset(source, 'C', 100-1); /* fill with 'C's */ source[100-1] = '\0'; /* null terminate */ /* POTENTIAL FLAW: Possible buffer overflow if source is larger than data */ - memcpy(data, source, 100*sizeof(char)); - data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ + memcpy(data, source, 100*sizeof(char)); // $ Alert[cpp/overflow-buffer] + data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ // $ Alert[cpp/overflow-buffer] printLine(data); free(data); } @@ -189,8 +189,8 @@ void CWE121_Stack_Based_Buffer_Overflow__CWE805_char_declare_memcpy_01_bad() memset(source, 'C', 100-1); /* fill with 'C's */ source[100-1] = '\0'; /* null terminate */ /* POTENTIAL FLAW: Possible buffer overflow if the size of data is less than the length of source */ - memcpy(data, source, 100*sizeof(char)); - data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ + memcpy(data, source, 100*sizeof(char)); // $ Alert[cpp/overflow-buffer] + data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ // $ Alert[cpp/overflow-buffer] printLine(data); } } @@ -209,8 +209,8 @@ void CWE121_Stack_Based_Buffer_Overflow__CWE805_char_alloca_memcpy_01_bad() memset(source, 'C', 100-1); /* fill with 'C's */ source[100-1] = '\0'; /* null terminate */ /* POTENTIAL FLAW: Possible buffer overflow if the size of data is less than the length of source */ - memcpy(data, source, 100*sizeof(char)); - data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ + memcpy(data, source, 100*sizeof(char)); // $ Alert[cpp/overflow-buffer] + data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ // $ Alert[cpp/overflow-buffer] printLine(data); } } @@ -234,7 +234,7 @@ void CWE121_Stack_Based_Buffer_Overflow__CWE805_char_alloca_loop_01_bad() { data[i] = source[i]; } - data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ + data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ // $ Alert[cpp/overflow-buffer] printLine(data); } } @@ -258,7 +258,7 @@ void CWE121_Stack_Based_Buffer_Overflow__CWE805_char_declare_loop_01_bad() { data[i] = source[i]; } - data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ + data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */ // $ Alert[cpp/overflow-buffer] printLine(data); } } @@ -287,7 +287,7 @@ namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE193_wchar_t_ncpy_01 wchar_t source[10+1] = SRC_STRING; /* Copy length + 1 to include NUL terminator from source */ /* POTENTIAL FLAW: data may not have enough space to hold source */ - wcsncpy(data, source, wcslen(source) + 1); + wcsncpy(data, source, wcslen(source) + 1); // $ Alert[cpp/bad-strncpy-size] printWLine(data); delete [] data; } @@ -303,7 +303,7 @@ namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE193_wchar_t_ncpy_01 wchar_t source[10+1] = SRC_STRING; /* Copy length + 1 to include NUL terminator from source */ /* POTENTIAL FLAW: data may not have enough space to hold source */ - wcsncpy(data, source, wcslen(source) + 1); // [FALSE POSITIVE RESULT] (debatable) + wcsncpy(data, source, wcslen(source) + 1); // $ Alert[cpp/bad-strncpy-size] // [FALSE POSITIVE RESULT] (debatable) printWLine(data); delete [] data; } @@ -347,7 +347,7 @@ namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_char_ncat_01 memset(source, 'C', 100-1); /* fill with 'C's */ source[100-1] = '\0'; /* null terminate */ /* POTENTIAL FLAW: Possible buffer overflow if source is larger than sizeof(data)-strlen(data) */ - strncat(data, source, 100); + strncat(data, source, 100); // $ Alert[cpp/badly-bounded-write] printLine(data); delete [] data; } @@ -381,7 +381,7 @@ void CWE121_Stack_Based_Buffer_Overflow__CWE131_memcpy_01_bad() { int source[10] = {0}; /* POTENTIAL FLAW: Possible buffer overflow if data was not allocated correctly in the source */ - memcpy(data, source, 10*sizeof(int)); + memcpy(data, source, 10*sizeof(int)); // $ Alert[cpp/overflow-buffer] printIntLine(data[0]); } } @@ -431,7 +431,7 @@ void CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_loop_01_bad() { data[i] = source[i]; } - data[100-1] = L'\0'; /* Ensure the destination buffer is null terminated */ + data[100-1] = L'\0'; /* Ensure the destination buffer is null terminated */ // $ Alert[cpp/overflow-buffer] printWLine(data); delete [] data; } @@ -449,8 +449,8 @@ void CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_ncpy_01_bad() wmemset(source, L'C', 100-1); /* fill with L'C's */ source[100-1] = L'\0'; /* null terminate */ /* POTENTIAL FLAW: Possible buffer overflow if source is larger than data */ - wcsncpy(data, source, 100-1); - data[100-1] = L'\0'; /* Ensure the destination buffer is null terminated */ + wcsncpy(data, source, 100-1); // $ Alert[cpp/bad-strncpy-size] Alert[cpp/badly-bounded-write] + data[100-1] = L'\0'; /* Ensure the destination buffer is null terminated */ // $ Alert[cpp/overflow-buffer] printWLine(data); delete [] data; } @@ -478,7 +478,7 @@ void CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_snprintf_01_bad() wmemset(source, L'C', 100-1); /* fill with L'C's */ source[100-1] = L'\0'; /* null terminate */ /* POTENTIAL FLAW: Possible buffer overflow if source is larger than data */ - SNPRINTF(data, 100, L"%s", source); + SNPRINTF(data, 100, L"%s", source); // $ Alert[cpp/badly-bounded-write] printWLine(data); delete [] data; } @@ -627,7 +627,7 @@ void CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_snprintf_31_bad() wmemset(source, L'C', 100-1); /* fill with L'C's */ source[100-1] = L'\0'; /* null terminate */ /* POTENTIAL FLAW: Possible buffer overflow if source is larger than data */ - SNPRINTF(data, 100, L"%s", source); + SNPRINTF(data, 100, L"%s", source); // $ Alert[cpp/badly-bounded-write] printWLine(data); delete [] data; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/BadlyBoundedWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/BadlyBoundedWrite.qlref index 9636c74d0a8f..76b6e5900218 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/BadlyBoundedWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/BadlyBoundedWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/BadlyBoundedWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/BadlyBoundedWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OffsetUseBeforeRangeCheck.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OffsetUseBeforeRangeCheck.qlref index d934901f174f..0e9b8f83382e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OffsetUseBeforeRangeCheck.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OffsetUseBeforeRangeCheck.qlref @@ -1 +1,2 @@ -Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql \ No newline at end of file +query: Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.qlref index 5c2bacec579f..bb308ea4b215 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-119/OverflowBuffer.ql \ No newline at end of file +query: Security/CWE/CWE-119/OverflowBuffer.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.qlref index a4213e22fcd7..0e0d1d3792de 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.qlref @@ -1 +1,2 @@ -Critical/OverflowDestination.ql \ No newline at end of file +query: Critical/OverflowDestination.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowStatic.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowStatic.qlref index 9ff1c3b33dc5..93d88e7802a0 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowStatic.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowStatic.qlref @@ -1 +1,2 @@ -Critical/OverflowStatic.ql \ No newline at end of file +query: Critical/OverflowStatic.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverrunWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverrunWrite.qlref index f6c962c1a7b4..18ae0f2a567b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverrunWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverrunWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/OverrunWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/OverrunWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverrunWriteFloat.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverrunWriteFloat.qlref index 757d1592e830..ba8f6a96a1fd 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverrunWriteFloat.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverrunWriteFloat.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/OverrunWriteFloat.ql \ No newline at end of file +query: Security/CWE/CWE-120/OverrunWriteFloat.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/StrncpyFlippedArgs.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/StrncpyFlippedArgs.qlref index bf0bf1ea7d05..3a2ef158d3d6 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/StrncpyFlippedArgs.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/StrncpyFlippedArgs.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/StrncpyFlippedArgs.ql \ No newline at end of file +query: Likely Bugs/Memory Management/StrncpyFlippedArgs.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.qlref index 767f2ea4db9d..36c47957d339 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/UnboundedWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/UnboundedWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/VeryLikelyOverrunWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/VeryLikelyOverrunWrite.qlref index 94b53951c4b7..8dcc2f70c2f6 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/VeryLikelyOverrunWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/VeryLikelyOverrunWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/main.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/main.cpp index 78f94af22cfe..6f04206359cf 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/main.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/main.cpp @@ -3,7 +3,7 @@ int test_buffer_overrun_main(int argc, char **argv); int tests_restrict_main(int argc, char **argv); int tests_main(int argc, char **argv); -int main(int argc, char **argv) { +int main(int argc, char **argv) { // $ Source[cpp/overflow-destination] Source[cpp/unbounded-write] overflowdesination_main(argc, argv); test_buffer_overrun_main(argc, argv); tests_restrict_main(argc, argv); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/overflowdestination.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/overflowdestination.cpp index 8b785b5a6620..a87f14159fed 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/overflowdestination.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/overflowdestination.cpp @@ -27,7 +27,7 @@ int overflowdesination_main(int argc, char* argv[]) { arg1 = argv[1]; //wrong: only uses the size of the source (argv[1]) when using strncpy - strncpy(param, arg1, strlen(arg1)); + strncpy(param, arg1, strlen(arg1)); // $ Alert[cpp/bad-strncpy-size] Alert[cpp/overflow-destination] //correct: uses the size of the destination array as well strncpy(param, arg1, min(strlen(arg1), sizeof(param) -1)); @@ -40,17 +40,17 @@ void overflowdest_test1(FILE *f) char dest[64]; char src[128]; - fgets(src, 128, f); // GOOD (taints `src`) + fgets(src, 128, f); // $ Source[cpp/overflow-destination] // GOOD (taints `src`) memcpy(dest, src, sizeof(dest)); // GOOD - memcpy(dest, src, sizeof(src)); // BAD: size derived from the source buffer + memcpy(dest, src, sizeof(src)); // $ Alert[cpp/overflow-buffer] Alert[cpp/overflow-destination] Alert[cpp/static-buffer-overflow] // BAD: size derived from the source buffer memcpy(dest, dest, sizeof(dest)); // GOOD } void overflowdest_test2(FILE *f, char *dest, char *src) { memcpy(dest, src, strlen(dest) + 1); // GOOD - memcpy(dest, src, strlen(src) + 1); // BAD: size derived from the source buffer + memcpy(dest, src, strlen(src) + 1); // $ Alert[cpp/overflow-destination] // BAD: size derived from the source buffer memcpy(dest, dest, strlen(dest) + 1); // GOOD } @@ -61,7 +61,7 @@ void overflowdest_test3(FILE *f, char *dest, char *src) char *src3 = src; memcpy(dest2, src2, strlen(dest2) + 1); // GOOD - memcpy(dest2, src2, strlen(src2) + 1); // BAD: size derived from the source buffer + memcpy(dest2, src2, strlen(src2) + 1); // $ Alert[cpp/overflow-destination] // BAD: size derived from the source buffer memcpy(dest2, dest2, strlen(dest2) + 1); // GOOD } @@ -70,7 +70,7 @@ void overflowdest_test23_caller(FILE *f) char dest[64]; char src[128]; - fgets(src, 128, f); // GOOD (taints `src`) + fgets(src, 128, f); // $ Source[cpp/overflow-destination] // GOOD (taints `src`) overflowdest_test2(f, dest, src); overflowdest_test3(f, dest, src); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp index 603d868258a9..44b2bdae6e8b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp @@ -20,9 +20,9 @@ void test1() char bigbuffer[20]; memcpy(bigbuffer, smallbuffer, sizeof(smallbuffer)); // GOOD - memcpy(bigbuffer, smallbuffer, sizeof(bigbuffer)); // BAD: over-read + memcpy(bigbuffer, smallbuffer, sizeof(bigbuffer)); // $ Alert[cpp/overflow-buffer] // BAD: over-read memcpy(smallbuffer, bigbuffer, sizeof(smallbuffer)); // GOOD - memcpy(smallbuffer, bigbuffer, sizeof(bigbuffer)); // BAD: over-write + memcpy(smallbuffer, bigbuffer, sizeof(bigbuffer)); // $ Alert[cpp/overflow-buffer] Alert[cpp/static-buffer-overflow] // BAD: over-write } void test2() @@ -31,9 +31,9 @@ void test2() char *bigbuffer = (char *)malloc(sizeof(char) * 20); memcpy(bigbuffer, smallbuffer, sizeof(char) * 10); // GOOD - memcpy(bigbuffer, smallbuffer, sizeof(char) * 20); // BAD: over-read + memcpy(bigbuffer, smallbuffer, sizeof(char) * 20); // $ Alert[cpp/overflow-buffer] // BAD: over-read memcpy(smallbuffer, bigbuffer, sizeof(char) * 10); // GOOD - memcpy(smallbuffer, bigbuffer, sizeof(char) * 20); // BAD: over-write + memcpy(smallbuffer, bigbuffer, sizeof(char) * 20); // $ Alert[cpp/overflow-buffer] // BAD: over-write free(bigbuffer); free(smallbuffer); @@ -47,9 +47,9 @@ void test3() bigbuffer = new char[20]; memcpy(bigbuffer, smallbuffer, sizeof(char[10])); // GOOD - memcpy(bigbuffer, smallbuffer, sizeof(char[20])); // BAD: over-read + memcpy(bigbuffer, smallbuffer, sizeof(char[20])); // $ Alert[cpp/overflow-buffer] // BAD: over-read memcpy(smallbuffer, bigbuffer, sizeof(char[10])); // GOOD - memcpy(smallbuffer, bigbuffer, sizeof(char[20])); // BAD: over-write + memcpy(smallbuffer, bigbuffer, sizeof(char[20])); // $ Alert[cpp/overflow-buffer] // BAD: over-write delete [] bigbuffer; delete [] smallbuffer; @@ -160,8 +160,8 @@ void test6(bool cond) for (k = 0; k <= 100; k++) { - buffer[k] = 'x'; // BAD: over-write - ch = buffer[k]; // BAD: over-read + buffer[k] = 'x'; // $ Alert[cpp/static-buffer-overflow] // BAD: over-write + ch = buffer[k]; // $ Alert[cpp/static-buffer-overflow] // BAD: over-read } } @@ -169,11 +169,11 @@ void test7() { char *names[] = {"tom", "dick", "harry"}; - printf("name: %s\n", names[-1]); // BAD: under-read + printf("name: %s\n", names[-1]); // $ Alert[cpp/overflow-buffer] // BAD: under-read printf("name: %s\n", names[0]); // GOOD printf("name: %s\n", names[1]); // GOOD printf("name: %s\n", names[2]); // GOOD - printf("name: %s\n", names[3]); // BAD: over-read + printf("name: %s\n", names[3]); // $ Alert[cpp/overflow-buffer] // BAD: over-read } void test8(int unbounded) @@ -219,16 +219,16 @@ void test9(int param) buffer4 = buffer3; memset(buffer1, 0, 32); // GOOD - memset(buffer1, 0, 33); // BAD: overrun write of buffer1 + memset(buffer1, 0, 33); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of buffer1 memset(buffer2, 0, 32); // GOOD - memset(buffer2, 0, 33); // BAD: overrun write of buffer2 + memset(buffer2, 0, 33); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of buffer2 memset(buffer3, 0, 32); // GOOD - memset(buffer3, 0, 33); // BAD: overrun write of buffer3 + memset(buffer3, 0, 33); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of buffer3 memset(buffer4, 0, 32); // GOOD - memset(buffer4, 0, 33); // BAD: overrun write of buffer4 (buffer3) + memset(buffer4, 0, 33); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of buffer4 (buffer3) memcmp(buffer1, buffer2, 32); // GOOD - memcmp(buffer1, buffer2, 33); // BAD: overrun read of buffer1, buffer2 + memcmp(buffer1, buffer2, 33); // $ Alert[cpp/overflow-buffer] // BAD: overrun read of buffer1, buffer2 } { @@ -236,13 +236,13 @@ void test9(int param) char *str2 = "abcdefgh"; strncpy(str1, str2, strlen(str1) + 1); // GOOD - strncpy(str1, str2, strlen(str2) + 1); // BAD: overrun write of str1 - strncpy(str2, str1, strlen(str1) + 1); // DUBIOUS (detected) + strncpy(str1, str2, strlen(str2) + 1); // $ Alert[cpp/bad-strncpy-size] // BAD: overrun write of str1 + strncpy(str2, str1, strlen(str1) + 1); // $ Alert[cpp/bad-strncpy-size] // DUBIOUS (detected) strncpy(str2, str1, strlen(str2) + 1); // BAD: overrun read of str1 [NOT REPORTED] } - memmove(global_array_6, global_array_5, 6); // BAD: overrun read of global_array_5 - memmove(global_array_5, global_array_6, 6); // BAD: overrun write of global_array_5 + memmove(global_array_6, global_array_5, 6); // $ Alert[cpp/overflow-buffer] // BAD: overrun read of global_array_5 + memmove(global_array_5, global_array_6, 6); // $ Alert[cpp/overflow-buffer] Alert[cpp/static-buffer-overflow] // BAD: overrun write of global_array_5 if (param > 0) { @@ -262,8 +262,8 @@ void test10() wmemset(buffer1, 0, 32); // GOOD - wmemset(buffer1, 0, 33); // BAD: overrun write of buffer1 - wmemset((wchar_t *)buffer2, 0, 32); // BAD: overrun write of buffer2 + wmemset(buffer1, 0, 33); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of buffer1 + wmemset((wchar_t *)buffer2, 0, 32); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of buffer2 } void test11() @@ -272,7 +272,7 @@ void test11() char *string = "Hello, world!"; memset(string, 0, 14); // GOOD - memset(string, 0, 15); // BAD: overrun write of string + memset(string, 0, 15); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of string } { @@ -282,14 +282,14 @@ void test11() buffer = new char[64]; - memset(buffer, 0, 128); // BAD: overrun write of buffer + memset(buffer, 0, 128); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of buffer } { char array[10] = "123"; memset(array, 0, 10); // GOOD - memset(array, 0, 11); // BAD: overrun write of array + memset(array, 0, 11); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of array } } @@ -307,11 +307,11 @@ void test12() dbuf = new char[16]; memset(&myVar, 0, sizeof(myVar)); // GOOD - memset(&myVar, 0, sizeof(myVar) + 1); // BAD: overrun write of myVar + memset(&myVar, 0, sizeof(myVar) + 1); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of myVar memset(myVar.buffer, 0, 16); // GOOD memset(myVar.buffer, 0, 17); // DUBIOUS: overrun write of myVar.buffer, but not out of myVar itself [NOT DETECTED] memset(&(myVar.field), 0, sizeof(int)); // GOOD - memset(&(myVar.field), 0, sizeof(int) * 2); // BAD: overrun write of myVar.field + memset(&(myVar.field), 0, sizeof(int) * 2); // $ Alert[cpp/overflow-buffer] // BAD: overrun write of myVar.field memset(buf + 8, 0, 8); // GOOD memset(buf + 8, 0, 9); // BAD: overrun write of buf [NOT DETECTED] @@ -345,33 +345,33 @@ void test13(char *argArray) char *ptrArray = charArray; char *ptrArrayOffset = charArray + 1; - charArray[-1] = 1; // BAD: underrun write + charArray[-1] = 1; // $ Alert[cpp/overflow-buffer] // BAD: underrun write charArray[0] = 1; // GOOD charArray[9] = 1; // GOOD - charArray[10] = 1; // BAD: overrun write - charArray[5] = charArray[10]; // BAD: overrun read + charArray[10] = 1; // $ Alert[cpp/overflow-buffer] Alert[cpp/static-buffer-overflow] // BAD: overrun write + charArray[5] = charArray[10]; // $ Alert[cpp/overflow-buffer] Alert[cpp/static-buffer-overflow] // BAD: overrun read - intArray[-1] = 1; // BAD: underrun write + intArray[-1] = 1; // $ Alert[cpp/overflow-buffer] // BAD: underrun write intArray[0] = 1; // GOOD intArray[9] = 1; // GOOD - intArray[10] = 1; // BAD: overrun write - intArray[5] = intArray[10]; // BAD: overrun read + intArray[10] = 1; // $ Alert[cpp/overflow-buffer] // BAD: overrun write + intArray[5] = intArray[10]; // $ Alert[cpp/overflow-buffer] // BAD: overrun read - structArray[-1].field = 1; // BAD: underrun write + structArray[-1].field = 1; // $ Alert[cpp/overflow-buffer] // BAD: underrun write structArray[0].field = 1; // GOOD structArray[9].field = 1; // GOOD - structArray[10].field = 1; // BAD: overrun write - structArray[5].field = structArray[10].field; // BAD: overrun read + structArray[10].field = 1; // $ Alert[cpp/overflow-buffer] // BAD: overrun write + structArray[5].field = structArray[10].field; // $ Alert[cpp/overflow-buffer] // BAD: overrun read charArray[9] = (char)intArray[9]; // GOOD - charArray[9] = (char)intArray[10]; // BAD: overrun read + charArray[9] = (char)intArray[10]; // $ Alert[cpp/overflow-buffer] // BAD: overrun read - ptrArray[-2] = 1; // BAD: underrun write - ptrArray[-1] = 1; // BAD: underrun write + ptrArray[-2] = 1; // $ Alert[cpp/overflow-buffer] // BAD: underrun write + ptrArray[-1] = 1; // $ Alert[cpp/overflow-buffer] // BAD: underrun write ptrArray[0] = 1; // GOOD ptrArray[8] = 1; // GOOD ptrArray[9] = 1; // GOOD - ptrArray[10] = 1; // BAD: overrun write + ptrArray[10] = 1; // $ Alert[cpp/overflow-buffer] // BAD: overrun write ptrArrayOffset[-2] = 1; // BAD: underrun write [NOT DETECTED] ptrArrayOffset[-1] = 1; // GOOD (there is room for this) @@ -391,10 +391,10 @@ void test13(char *argArray) buffer1[0] = 0xFFFF; buffer1[49] = 0xFFFF; - buffer1[50] = 0xFFFF; // BAD: overrun write + buffer1[50] = 0xFFFF; // $ Alert[cpp/overflow-buffer] // BAD: overrun write buffer2[0] = 0xFFFF; buffer2[49] = 0xFFFF; - buffer2[50] = 0xFFFF; // BAD: overrun write + buffer2[50] = 0xFFFF; // $ Alert[cpp/overflow-buffer] // BAD: overrun write } } @@ -464,7 +464,7 @@ void test17(long long *longArray) { int intArray[5]; - ((char *)intArray)[-3] = 0; // BAD: underrun write + ((char *)intArray)[-3] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write } { @@ -472,14 +472,14 @@ void test17(long long *longArray) multi[5][5] = 0; // GOOD - multi[-5][5] = 0; // BAD: underrun write [INCORRECT MESSAGE] + multi[-5][5] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write [INCORRECT MESSAGE] multi[5][-5] = 0; // DUBIOUS: underrun write (this one is still within the bounds of the whole array) - multi[-5][-5] = 0; // BAD: underrun write [INCORRECT MESSAGE] + multi[-5][-5] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write [INCORRECT MESSAGE] multi[0][-5] = 0; // BAD: underrun write [NOT DETECTED] - multi[15][5] = 0; // BAD: overrun write + multi[15][5] = 0; // $ Alert[cpp/overflow-buffer] // BAD: overrun write multi[5][15] = 0; // DUBIOUS: overrun write (this one is still within the bounds of the whole array) - multi[15][15] = 0; // BAD: overrun write + multi[15][15] = 0; // $ Alert[cpp/overflow-buffer] // BAD: overrun write } } @@ -494,22 +494,22 @@ void test18() char *p4 = (char *)malloc(128); char *p5 = (char *)malloc(128); - p1[-1] = 0; // BAD: underrun write - p2[-1] = 0; // BAD: underrun write + p1[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write + p2[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write p2++; p2[-1] = 0; // GOOD - p3[-1] = 0; // BAD + p3[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD while (*p3 != 0) { p3 = update(p3); } p3[-1] = 0; // GOOD - p4[-1] = 0; // BAD: underrun write + p4[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write p4++; p4[-1] = 0; // GOOD - p5[-1] = 0; // BAD + p5[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD while (*p5 != 0) { p5 = update(p5); } @@ -537,7 +537,7 @@ void test19(bool b) if (b) { - memset(p1, 0, 20); // BAD + memset(p1, 0, 20); // $ Alert[cpp/overflow-buffer] // BAD memset(p2, 0, 20); // GOOD memset(p3, 0, 20); // GOOD } @@ -559,12 +559,12 @@ void test20() // ... } - if (fread(charBuffer, sizeof(char), 101, fileSource) > 0) // BAD + if (fread(charBuffer, sizeof(char), 101, fileSource) > 0) // $ Alert[cpp/overflow-buffer] // BAD { // ... } - if (fread(charBuffer, sizeof(int), 100, fileSource) > 0) // BAD + if (fread(charBuffer, sizeof(int), 100, fileSource) > 0) // $ Alert[cpp/overflow-buffer] // BAD { // ... } @@ -587,7 +587,7 @@ void test21(bool cond) char *ptr; int i; - if (buffer[-1] == 0) { return; } // BAD: accesses buffer[-1] + if (buffer[-1] == 0) { return; } // $ Alert[cpp/overflow-buffer] // BAD: accesses buffer[-1] ptr = buffer; if (cond) @@ -595,7 +595,7 @@ void test21(bool cond) ptr++; if (ptr[-1] == 0) { return; } // GOOD: accesses buffer[0] } else { - if (ptr[-1] == 0) { return; } // BAD: accesses buffer[-1] + if (ptr[-1] == 0) { return; } // $ Alert[cpp/overflow-buffer] // BAD: accesses buffer[-1] } if (ptr[-1] == 0) { return; } // BAD: accesses buffer[-1] or buffer[0] [NOT DETECTED] @@ -633,7 +633,7 @@ char* strcpy(char *, const char *); void test24(char* source) { char buffer[100]; - strcpy(buffer, source); // BAD + strcpy(buffer, source); // $ Alert[cpp/unbounded-write] // BAD } struct my_struct { @@ -646,7 +646,7 @@ void test25(char* source) { s.home = source; char buf[100]; - strcpy(buf, s.home); // BAD + strcpy(buf, s.home); // $ Alert[cpp/unbounded-write] // BAD } void test26(bool cond) @@ -655,7 +655,7 @@ void test26(bool cond) char *ptr; int i; - if (buffer[-1] == 0) { return; } // BAD: accesses buffer[-1] + if (buffer[-1] == 0) { return; } // $ Alert[cpp/overflow-buffer] // BAD: accesses buffer[-1] ptr = buffer; if (cond) @@ -663,7 +663,7 @@ void test26(bool cond) ptr += 1; if (ptr[-1] == 0) { return; } // GOOD: accesses buffer[0] } else { - if (ptr[-1] == 0) { return; } // BAD: accesses buffer[-1] + if (ptr[-1] == 0) { return; } // $ Alert[cpp/overflow-buffer] // BAD: accesses buffer[-1] } if (ptr[-1] == 0) { return; } // BAD: accesses buffer[-1] or buffer[0] [NOT DETECTED] @@ -726,15 +726,15 @@ struct HasSomeFields { }; void test32() { - memset(&c, 0, sizeof(HasSomeFields) - offsetof(HasSomeFields, a)); // BAD + memset(&c, 0, sizeof(HasSomeFields) - offsetof(HasSomeFields, a)); // $ Alert[cpp/overflow-buffer] // BAD }; void test33() { - memset(&c, 0, sizeof(HasSomeFields) - offsetof(HasSomeFields, b)); // BAD + memset(&c, 0, sizeof(HasSomeFields) - offsetof(HasSomeFields, b)); // $ Alert[cpp/overflow-buffer] // BAD }; void test34() { - memset(&b, 0, sizeof(HasSomeFields) - offsetof(HasSomeFields, a)); // BAD + memset(&b, 0, sizeof(HasSomeFields) - offsetof(HasSomeFields, a)); // $ Alert[cpp/overflow-buffer] // BAD }; void test35() { @@ -745,7 +745,7 @@ struct HasSomeFields { void test36() { HasSomeFields hsf; memset(&hsf.a, 0, sizeof(HasSomeFields) - offsetof(HasSomeFields, a)); // GOOD - memset(&hsf.c, 0, sizeof(HasSomeFields) - offsetof(HasSomeFields, a)); // BAD + memset(&hsf.c, 0, sizeof(HasSomeFields) - offsetof(HasSomeFields, a)); // $ Alert[cpp/overflow-buffer] // BAD } struct AnonUnionInStruct @@ -771,18 +771,18 @@ struct AnonUnionInStruct memset(&a_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_2)); // GOOD memset(&a_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, d)); // GOOD - memset(&b_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_1)); // BAD + memset(&b_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_1)); // $ Alert[cpp/overflow-buffer] // BAD memset(&b_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_1)); // GOOD memset(&b_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, c_1)); // GOOD - memset(&b_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_2)); // BAD + memset(&b_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_2)); // $ Alert[cpp/overflow-buffer] // BAD memset(&b_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_2)); // GOOD memset(&b_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, d)); // GOOD - memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_1)); // BAD - memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_1)); // BAD + memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_1)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_1)); // $ Alert[cpp/overflow-buffer] // BAD memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, c_1)); // GOOD - memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_2)); // BAD - memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_2)); // GOOD + memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_2)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_2)); // $ Alert[cpp/overflow-buffer] // GOOD memset(&c_1, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, d)); // GOOD memset(&a_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_1)); // GOOD @@ -792,10 +792,10 @@ struct AnonUnionInStruct memset(&a_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_2)); // GOOD memset(&a_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, d)); // GOOD - memset(&b_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_1)); // BAD + memset(&b_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_1)); // $ Alert[cpp/overflow-buffer] // BAD memset(&b_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_1)); // GOOD memset(&b_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, c_1)); // GOOD - memset(&b_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_2)); // BAD + memset(&b_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, a_2)); // $ Alert[cpp/overflow-buffer] // BAD memset(&b_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, b_2)); // GOOD memset(&b_2, 0, sizeof(AnonUnionInStruct) - offsetof(AnonUnionInStruct, d)); // GOOD }; @@ -813,7 +813,7 @@ struct UnionWithoutStruct void test37() { memset(&a, 0, sizeof(UnionWithoutStruct) - offsetof(UnionWithoutStruct, a)); // GOOD memset(&a, 0, sizeof(UnionWithoutStruct) - offsetof(UnionWithoutStruct, b)); // GOOD - memset(&b, 0, sizeof(UnionWithoutStruct) - offsetof(UnionWithoutStruct, a)); // BAD + memset(&b, 0, sizeof(UnionWithoutStruct) - offsetof(UnionWithoutStruct, a)); // $ Alert[cpp/overflow-buffer] // BAD }; }; @@ -840,20 +840,20 @@ struct S2 { memset(&f.inner.a, 0, sizeof(S2) - offsetof(S2, f)); // GOOD memset(&f.inner.a, 0, sizeof(S2) - offsetof(S2, u)); // GOOD - memset(&f.inner.b, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // BAD + memset(&f.inner.b, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // $ Alert[cpp/overflow-buffer] // BAD memset(&f.inner.b, 0, sizeof(S2) - offsetof(ThreeUInts, b)); // GOOD memset(&f.inner.b, 0, sizeof(S2) - offsetof(ThreeUInts, c)); // GOOD - memset(&f.inner.b, 0, sizeof(S2) - offsetof(FourUInts, inner)); // BAD + memset(&f.inner.b, 0, sizeof(S2) - offsetof(FourUInts, inner)); // $ Alert[cpp/overflow-buffer] // BAD memset(&f.inner.b, 0, sizeof(S2) - offsetof(FourUInts, x)); // GOOD - memset(&f.inner.b, 0, sizeof(S2) - offsetof(S2, f)); // BAD + memset(&f.inner.b, 0, sizeof(S2) - offsetof(S2, f)); // $ Alert[cpp/overflow-buffer] // BAD memset(&f.inner.b, 0, sizeof(S2) - offsetof(S2, u)); // GOOD - memset(&f.inner.c, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // BAD - memset(&f.inner.c, 0, sizeof(S2) - offsetof(ThreeUInts, b)); // BAD + memset(&f.inner.c, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&f.inner.c, 0, sizeof(S2) - offsetof(ThreeUInts, b)); // $ Alert[cpp/overflow-buffer] // BAD memset(&f.inner.c, 0, sizeof(S2) - offsetof(ThreeUInts, c)); // GOOD - memset(&f.inner.c, 0, sizeof(S2) - offsetof(FourUInts, inner)); // BAD + memset(&f.inner.c, 0, sizeof(S2) - offsetof(FourUInts, inner)); // $ Alert[cpp/overflow-buffer] // BAD memset(&f.inner.c, 0, sizeof(S2) - offsetof(FourUInts, x)); // GOOD - memset(&f.inner.c, 0, sizeof(S2) - offsetof(S2, f)); // BAD + memset(&f.inner.c, 0, sizeof(S2) - offsetof(S2, f)); // $ Alert[cpp/overflow-buffer] // BAD memset(&f.inner.c, 0, sizeof(S2) - offsetof(S2, u)); // GOOD memset(&f.inner, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // GOOD @@ -864,12 +864,12 @@ struct S2 { memset(&f.inner, 0, sizeof(S2) - offsetof(S2, f)); // GOOD memset(&f.inner, 0, sizeof(S2) - offsetof(S2, u)); // GOOD - memset(&f.x, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // BAD - memset(&f.x, 0, sizeof(S2) - offsetof(ThreeUInts, b)); // BAD - memset(&f.x, 0, sizeof(S2) - offsetof(ThreeUInts, c)); // BAD - memset(&f.x, 0, sizeof(S2) - offsetof(FourUInts, inner)); // BAD + memset(&f.x, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&f.x, 0, sizeof(S2) - offsetof(ThreeUInts, b)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&f.x, 0, sizeof(S2) - offsetof(ThreeUInts, c)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&f.x, 0, sizeof(S2) - offsetof(FourUInts, inner)); // $ Alert[cpp/overflow-buffer] // BAD memset(&f.x, 0, sizeof(S2) - offsetof(FourUInts, x)); // GOOD - memset(&f.x, 0, sizeof(S2) - offsetof(S2, f)); // GOOD + memset(&f.x, 0, sizeof(S2) - offsetof(S2, f)); // $ Alert[cpp/overflow-buffer] // GOOD memset(&f.x, 0, sizeof(S2) - offsetof(S2, u)); // GOOD memset(&f, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // GOOD @@ -880,12 +880,12 @@ struct S2 { memset(&f, 0, sizeof(S2) - offsetof(S2, f)); // GOOD memset(&f, 0, sizeof(S2) - offsetof(S2, u)); // GOOD - memset(&u, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // BAD - memset(&u, 0, sizeof(S2) - offsetof(ThreeUInts, b)); // BAD - memset(&u, 0, sizeof(S2) - offsetof(ThreeUInts, c)); // BAD - memset(&u, 0, sizeof(S2) - offsetof(FourUInts, inner)); // BAD - memset(&u, 0, sizeof(S2) - offsetof(FourUInts, x)); // BAD - memset(&u, 0, sizeof(S2) - offsetof(S2, f)); // BAD + memset(&u, 0, sizeof(S2) - offsetof(ThreeUInts, a)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&u, 0, sizeof(S2) - offsetof(ThreeUInts, b)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&u, 0, sizeof(S2) - offsetof(ThreeUInts, c)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&u, 0, sizeof(S2) - offsetof(FourUInts, inner)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&u, 0, sizeof(S2) - offsetof(FourUInts, x)); // $ Alert[cpp/overflow-buffer] // BAD + memset(&u, 0, sizeof(S2) - offsetof(S2, f)); // $ Alert[cpp/overflow-buffer] // BAD memset(&u, 0, sizeof(S2) - offsetof(S2, u)); // GOOD } }; @@ -981,24 +981,24 @@ void test28() { int arr[10]; int *ptr1 = arr; - ptr1[-1] = 0; // BAD: underrun write + ptr1[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write ptr1++; ptr1[-1] = 0; // GOOD int *ptr2 = arr; - ptr2[-1] = 0; // BAD: underrun write + ptr2[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write *ptr2++; ptr2[-1] = 0; // GOOD int *ptr3 = arr; - ptr3[-1] = 0; // BAD: underrun write + ptr3[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write if (cond()) { ptr3++; } ptr3[-1] = 0; // GOOD (depending what cond() does) int *ptr4 = arr; - ptr4[-1] = 0; // BAD: underrun write + ptr4[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write while (true) { ptr4++; if (cond()) break; @@ -1006,7 +1006,7 @@ void test28() { ptr4[-1] = 0; // GOOD int *ptr5 = arr; - ptr5[-1] = 0; // BAD: underrun write + ptr5[-1] = 0; // $ Alert[cpp/overflow-buffer] // BAD: underrun write while (true) { if (cond()) ptr5++; if (cond()) break; @@ -1028,7 +1028,7 @@ void test29() { memset(ptr->arr1, 0, sizeof(ptr->arr1) + sizeof(ptr->arr2)); // GOOD (overwrites arr1, arr2) memset(&(ptr->arr1[0]), 0, sizeof(ptr->arr1) + sizeof(ptr->arr2)); // GOOD (overwrites arr1, arr2) - memset(ptr->arr1, 0, sizeof(ptr->arr1) + sizeof(ptr->arr2) + 10); // BAD + memset(ptr->arr1, 0, sizeof(ptr->arr1) + sizeof(ptr->arr2) + 10); // $ Alert[cpp/overflow-buffer] // BAD } struct UnionStruct { @@ -1047,14 +1047,14 @@ void test30() { UnionStruct us; memset(us.buffer1, 0, sizeof(us.buffer1)); // GOOD - memset(us.buffer1, 0, sizeof(us)); // BAD + memset(us.buffer1, 0, sizeof(us)); // $ Alert[cpp/overflow-buffer] // BAD memset(us.buffer2, 0, sizeof(us.buffer2)); // GOOD - memset(us.buffer2, 0, sizeof(us)); // BAD + memset(us.buffer2, 0, sizeof(us)); // $ Alert[cpp/overflow-buffer] // BAD strncpy(us.buffer1, "", sizeof(us.buffer1) - 1); // GOOD - strncpy(us.buffer1, "", sizeof(us) - 1); // BAD + strncpy(us.buffer1, "", sizeof(us) - 1); // $ Alert[cpp/badly-bounded-write] Alert[cpp/overflow-buffer] Alert[cpp/static-buffer-overflow] // BAD strncpy(us.buffer2, "", sizeof(us.buffer2) - 1); // GOOD - strncpy(us.buffer2, "", sizeof(us) - 1); // BAD + strncpy(us.buffer2, "", sizeof(us) - 1); // $ Alert[cpp/badly-bounded-write] Alert[cpp/overflow-buffer] Alert[cpp/static-buffer-overflow] // BAD } struct S_Size16 { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests_restrict.c b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests_restrict.c index 96a5571bf657..095628590f4c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests_restrict.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests_restrict.c @@ -9,7 +9,7 @@ char smallbuf[1], largebuf[2]; void test1() { memcpy(largebuf, smallbuf, 1); // GOOD - memcpy(largebuf, smallbuf, 2); // BAD: source over-read + memcpy(largebuf, smallbuf, 2); // $ Alert[cpp/overflow-buffer] // BAD: source over-read } int tests_restrict_main(int argc, char *argv[]) diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/unions.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/unions.cpp index bac7abb5187c..e1c9c1ba503b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/unions.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/unions.cpp @@ -23,15 +23,15 @@ void myUnionTest() memset(&mu, 0, sizeof(mu)); memset(&mu, 0, sizeof(mu.small)); memset(&mu, 0, sizeof(mu.large)); - memset(&mu, 0, 200); // BAD + memset(&mu, 0, 200); // $ Alert[cpp/overflow-buffer] // BAD memset(&(mu.small), 0, sizeof(mu)); // (dubious) memset(&(mu.small), 0, sizeof(mu.small)); memset(&(mu.small), 0, sizeof(mu.large)); // (dubious) - memset(&(mu.small), 0, 200); // BAD + memset(&(mu.small), 0, 200); // $ Alert[cpp/overflow-buffer] // BAD memset(&(mu.large), 0, sizeof(mu)); memset(&(mu.large), 0, sizeof(mu.small)); // (dubious) memset(&(mu.large), 0, sizeof(mu.large)); - memset(&(mu.large), 0, 200); // BAD + memset(&(mu.large), 0, 200); // $ Alert[cpp/overflow-buffer] // BAD } // --- diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp index d4fe3da48bd9..20beffd578bf 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp @@ -68,9 +68,9 @@ void testVarStruct1() { vs1->amount = 1024; memset(vs1->data, 0, 1024); // GOOD - memset(vs1->data, 0, 1025); // BAD: buffer overflow + memset(vs1->data, 0, 1025); // $ Alert[cpp/overflow-buffer] // BAD: buffer overflow strncpy(vs1->data, "Hello, world!", 1024); // GOOD - strncpy(vs1->data, "Hello, world!", 1025); // BAD + strncpy(vs1->data, "Hello, world!", 1025); // $ Alert[cpp/badly-bounded-write] Alert[cpp/overflow-buffer] // BAD } struct varStruct2 { @@ -84,7 +84,7 @@ void testVarStruct2() { vs2->size = 16; vs2->elements[15] = 0; // GOOD - vs2->elements[16] = 0; // BAD: buffer overflow + vs2->elements[16] = 0; // $ Alert[cpp/overflow-buffer] // BAD: buffer overflow } struct notVarStruct1 { @@ -96,11 +96,11 @@ void testNotVarStruct1() { notVarStruct1 *nvs1 = (notVarStruct1 *)malloc(sizeof(notVarStruct1) * 2); memset(nvs1->str, 0, 128); // GOOD - memset(nvs1->str, 0, 129); // DUBIOUS: buffer overflow (overflows nvs1->str but not nvs1 overall) + memset(nvs1->str, 0, 129); // $ Alert[cpp/overflow-buffer] // DUBIOUS: buffer overflow (overflows nvs1->str but not nvs1 overall) memset(nvs1[1].str, 0, 128); // GOOD memset(nvs1[1].str, 0, 129); // BAD: buffer overflow [NOT DETECTED] strncpy(nvs1->str, "Hello, world!", 128); // GOOD - strncpy(nvs1->str, "Hello, world!", 129); // BAD + strncpy(nvs1->str, "Hello, world!", 129); // $ Alert[cpp/badly-bounded-write] Alert[cpp/overflow-buffer] Alert[cpp/static-buffer-overflow] // BAD } struct notVarStruct2 { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/UnsafeUseOfStrcat/UnsafeUseOfStrcat.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/UnsafeUseOfStrcat/UnsafeUseOfStrcat.qlref index 9790cddebab5..7f1a1cf35f2d 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/UnsafeUseOfStrcat/UnsafeUseOfStrcat.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/UnsafeUseOfStrcat/UnsafeUseOfStrcat.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql +query: Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/UnsafeUseOfStrcat/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/UnsafeUseOfStrcat/test.c index c670533f9aff..420100bce440 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/UnsafeUseOfStrcat/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/UnsafeUseOfStrcat/test.c @@ -17,7 +17,7 @@ void free(void *ptr); static void bad0(char *s) { char buf[80]; strcpy(buf, "s: "); - strcat(buf, s); // BAD -- s may be too long and overflow the buffer + strcat(buf, s); // $ Alert // BAD -- s may be too long and overflow the buffer } static void good0(char *s) { @@ -30,7 +30,7 @@ static void good0(char *s) { static void bad1(char *s, int len) { char *buf = malloc(len+4); strcpy(buf, "s: "); - strcat(buf, s); // BAD -- s may be too long and overflow the buffer + strcat(buf, s); // $ Alert // BAD -- s may be too long and overflow the buffer } static void good1(char *s, int len) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/BadlyBoundedWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/BadlyBoundedWrite.qlref index 9636c74d0a8f..76b6e5900218 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/BadlyBoundedWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/BadlyBoundedWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/BadlyBoundedWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/BadlyBoundedWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/OverrunWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/OverrunWrite.qlref index f6c962c1a7b4..18ae0f2a567b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/OverrunWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/OverrunWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/OverrunWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/OverrunWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/OverrunWriteFloat.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/OverrunWriteFloat.qlref index 757d1592e830..ba8f6a96a1fd 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/OverrunWriteFloat.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/OverrunWriteFloat.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/OverrunWriteFloat.ql \ No newline at end of file +query: Security/CWE/CWE-120/OverrunWriteFloat.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.qlref index 767f2ea4db9d..36c47957d339 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/UnboundedWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/UnboundedWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/VeryLikelyOverrunWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/VeryLikelyOverrunWrite.qlref index 94b53951c4b7..8dcc2f70c2f6 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/VeryLikelyOverrunWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/VeryLikelyOverrunWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests.c b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests.c index 5d37ff374ba3..a81351735b99 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests.c @@ -13,7 +13,7 @@ int sscanf(const char *s, const char *format, ...); //// Test code ///// -int main(int argc, char *argv[]) +int main(int argc, char *argv[]) // $ Source[cpp/unbounded-write] { if (argc < 1) { @@ -25,13 +25,13 @@ int main(int argc, char *argv[]) char buffer100[100]; int i; - sprintf(buffer100, argv[0]); // BAD: argv[0] could be more than 100 characters - sprintf(buffer100, "%s", argv[0]); // BAD: argv[0] could be more than 100 characters + sprintf(buffer100, argv[0]); // $ Alert[cpp/unbounded-write] // BAD: argv[0] could be more than 100 characters + sprintf(buffer100, "%s", argv[0]); // $ Alert[cpp/unbounded-write] // BAD: argv[0] could be more than 100 characters - scanf("%s", buffer100); // BAD: the input could be more than 100 characters + scanf("%s", buffer100); // $ Alert[cpp/unbounded-write] // BAD: the input could be more than 100 characters scanf("%i", i); // GOOD: no problems with non-strings - scanf("%i %s", i, buffer100); // BAD: second format parameter may overflow - sscanf(argv[0], "%s", buffer100); // BAD: argv[0] could be more than 100 characters + scanf("%i %s", i, buffer100); // $ Alert[cpp/unbounded-write] // BAD: second format parameter may overflow + sscanf(argv[0], "%s", buffer100); // $ Alert[cpp/unbounded-write] // BAD: argv[0] could be more than 100 characters } // Test cases for BadlyBoundedWrite.ql @@ -40,27 +40,27 @@ int main(int argc, char *argv[]) snprintf(buffer110, 109, argv[0]); // GOOD snprintf(buffer110, 110, argv[0]); // GOOD - snprintf(buffer110, 111, argv[0]); // BAD: this could still overrun the 110 character buffer + snprintf(buffer110, 111, argv[0]); // $ Alert[cpp/badly-bounded-write] // BAD: this could still overrun the 110 character buffer snprintf(buffer110, 109, "%s", argv[0]); // GOOD snprintf(buffer110, 110, "%s", argv[0]); // GOOD - snprintf(buffer110, 111, "%s", argv[0]); // BAD: this could still overrun the 110 character buffer + snprintf(buffer110, 111, "%s", argv[0]); // $ Alert[cpp/badly-bounded-write] // BAD: this could still overrun the 110 character buffer } - + // Test cases for OverrunWrite.ql { char buffer10[10]; sprintf(buffer10, "123456789"); // GOOD - sprintf(buffer10, "1234567890"); // BAD: the null terminator of this string overruns the buffer + sprintf(buffer10, "1234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: the null terminator of this string overruns the buffer sprintf(buffer10, "%.9s", "123456789"); // GOOD sprintf(buffer10, "%.9s", "1234567890"); // GOOD sprintf(buffer10, "%.10s", "123456789"); // GOOD - sprintf(buffer10, "%.10s", "1234567890"); // BAD: the precision specified is too large for this buffer + sprintf(buffer10, "%.10s", "1234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: the precision specified is too large for this buffer scanf("%8s", buffer10); // GOOD: restricted to 8 characters + null scanf("%9s", buffer10); // GOOD: restricted to 9 characters + null - scanf("%10s", buffer10); // BAD: null can overflow - scanf("%11s", buffer10); // BAD: string can overflow + scanf("%10s", buffer10); // $ Alert[cpp/very-likely-overrunning-write] // BAD: null can overflow + scanf("%11s", buffer10); // $ Alert[cpp/very-likely-overrunning-write] // BAD: string can overflow } // More complex tests for OverrunWrite.ql @@ -83,14 +83,14 @@ int main(int argc, char *argv[]) { str35 = "12345"; } - strcpy(buffer5, str35); // BAD: if str35 is "12345", it overflows the buffer + strcpy(buffer5, str35); // $ Alert[cpp/very-likely-overrunning-write] // BAD: if str35 is "12345", it overflows the buffer str35 = "abc"; strcpy(buffer5, str35); // GOOD: str35 is guaranteed to fit now strcpy(buffer5, (argc == 2) ? "1234" : "abcd"); // GOOD: both of the strings fit - strcpy(buffer5, (argc == 2) ? "1234" : "abcde"); // BAD: "abcde" overflows the buffer + strcpy(buffer5, (argc == 2) ? "1234" : "abcde"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: "abcde" overflows the buffer } // Test cases for OverrunWriteFloat.ql @@ -100,9 +100,9 @@ int main(int argc, char *argv[]) double bigval = 1e304; sprintf(buffer256, "%e", bigval); // GOOD - sprintf(buffer256, "%f", bigval); // BAD: this %f representation may need more than 256 characters + sprintf(buffer256, "%f", bigval); // $ Alert[cpp/overrunning-write-with-float] // BAD: this %f representation may need more than 256 characters sprintf(buffer256, "%g", bigval); // GOOD - sprintf(buffer256, "%e%f%g", bigval, bigval, bigval); // BAD: the %f representation may need more than 256 characters + sprintf(buffer256, "%e%f%g", bigval, bigval, bigval); // $ Alert[cpp/overrunning-write-with-float] // BAD: the %f representation may need more than 256 characters // GOOD: a 999 character buffer is sufficient in all of these cases sprintf(buffer999, "%e", bigval); // GOOD @@ -117,8 +117,8 @@ int main(int argc, char *argv[]) char buffer16[16]; char buffer17[17]; char buffer49[49]; - sprintf(buffer1, "%p", argv); // BAD - sprintf(buffer16, "%p", argv); // BAD + sprintf(buffer1, "%p", argv); // $ Alert[cpp/very-likely-overrunning-write] // BAD + sprintf(buffer16, "%p", argv); // $ Alert[cpp/very-likely-overrunning-write] // BAD sprintf(buffer17, "%p", argv); // GOOD sprintf(buffer49, "%p and then a few more words", argv); // GOOD } @@ -133,7 +133,7 @@ void test_fn2() MyCharArray myBuffer10; sprintf(myBuffer10, "%s", "123456789"); // GOOD - sprintf(myBuffer10, "%s", "1234567890"); // BAD: buffer overflow + sprintf(myBuffer10, "%s", "1234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow } // --- @@ -183,13 +183,13 @@ void tesHexBounds(int x) { } if (x < 16) { - sprintf(buffer2, "%x", x); // BAD: negative values + sprintf(buffer2, "%x", x); // $ Alert[cpp/very-likely-overrunning-write] // BAD: negative values } if (x <= 16 && x > 0) { - sprintf(buffer2, "%x", x); // BAD: bound too loose + sprintf(buffer2, "%x", x); // $ Alert[cpp/very-likely-overrunning-write] // BAD: bound too loose } if(x < 0x10000 && x > 0) { sprintf(buffer5, "%x", x); // GOOD: bounded by check } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp index c492e11f0b89..b9c3a7af36c4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp @@ -3,9 +3,9 @@ typedef unsigned long size_t; void *malloc(size_t size); void *realloc(void *ptr, size_t size); -void *calloc(size_t nmemb, size_t size); +void *calloc(size_t nmemb, size_t size); void free(void *ptr); -wchar_t *wcscpy(wchar_t *s1, const wchar_t *s2); +wchar_t *wcscpy(wchar_t *s1, const wchar_t *s2); int snprintf(char *s, size_t n, const char *format, ...); // --- Semmle tests --- @@ -15,36 +15,36 @@ void tests2() { buffer = (wchar_t *)malloc(2 * sizeof(wchar_t)); wcscpy(buffer, L"1"); // GOOD - wcscpy(buffer, L"12"); // BAD: buffer overflow + wcscpy(buffer, L"12"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow free(buffer); buffer = (wchar_t *)malloc(3 * sizeof(wchar_t)); wcscpy(buffer, L"12"); // GOOD - wcscpy(buffer, L"123"); // BAD: buffer overflow + wcscpy(buffer, L"123"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow free(buffer); buffer = (wchar_t *)realloc(0, 4 * sizeof(wchar_t)); wcscpy(buffer, L"123"); // GOOD - wcscpy(buffer, L"1234"); // BAD: buffer overflow + wcscpy(buffer, L"1234"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow buffer = (wchar_t *)realloc(buffer, 5 * sizeof(wchar_t)); wcscpy(buffer, L"1234"); // GOOD - wcscpy(buffer, L"12345"); // BAD: buffer overflow + wcscpy(buffer, L"12345"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow free(buffer); buffer = (wchar_t *)calloc(6, sizeof(wchar_t)); wcscpy(buffer, L"12345"); // GOOD - wcscpy(buffer, L"123456"); // BAD: buffer overflow + wcscpy(buffer, L"123456"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow free(buffer); buffer = (wchar_t *)calloc(sizeof(wchar_t), 7); wcscpy(buffer, L"123456"); // GOOD - wcscpy(buffer, L"1234567"); // BAD: buffer overflow + wcscpy(buffer, L"1234567"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow free(buffer); buffer = new wchar_t[8]; wcscpy(buffer, L"1234567"); // GOOD - wcscpy(buffer, L"12345678"); // BAD: buffer overflow + wcscpy(buffer, L"12345678"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow delete [] buffer; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c index 68c9aff9c2b5..ccfb730b2b96 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c @@ -6,7 +6,7 @@ ///// Library functions ////// typedef unsigned long long size_t; -char *strcpy(char *s1, const char *s2); +char *strcpy(char *s1, const char *s2); //// Test code ///// @@ -23,9 +23,9 @@ void unions_test(MyUnion *mu) strcpy(&(mu->ptr), "1234567890"); // GOOD (dubious) strcpy(&(mu->buffer), "1234567890"); // GOOD strcpy(mu, "12345678901234567890"); // BAD [NOT DETECTED] - strcpy(&(mu->ptr), "12345678901234567890"); // BAD - strcpy(&(mu->buffer), "12345678901234567890"); // BAD - + strcpy(&(mu->ptr), "12345678901234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD + strcpy(&(mu->buffer), "12345678901234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD + mu->ptr = buffer; strcpy(mu->ptr, "1234567890"); // GOOD strcpy(mu->ptr, "12345678901234567890"); // GOOD diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/var_size_struct.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/var_size_struct.cpp index 56036aa76ac7..02d0a6d3f117 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/var_size_struct.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/var_size_struct.cpp @@ -5,7 +5,7 @@ // library types, functions etc typedef unsigned long size_t; void *malloc(size_t size); -char *strcpy(char *s1, const char *s2); +char *strcpy(char *s1, const char *s2); // --- Semmle tests --- @@ -19,5 +19,5 @@ void testVarStruct() { vs->size = 9; strcpy(vs->data, "12345678"); // GOOD - strcpy(vs->data, "123456789"); // BAD: buffer overflow + strcpy(vs->data, "123456789"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/varbuffer.c b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/varbuffer.c index c4eed5068e5f..91dde1227c7c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/varbuffer.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/varbuffer.c @@ -12,16 +12,16 @@ void testMyVarStruct() MyVarStruct *ptr1 = (MyVarStruct*)malloc(sizeof(MyVarStruct)); ptr1->len = 0; strcpy(ptr1->buffer, ""); // GOOD - strcpy(ptr1->buffer, "1"); // BAD: length 2, but destination only has length 1 - strcpy(ptr1->buffer, "123456789"); // BAD: length 10, but destination only has length 1 + strcpy(ptr1->buffer, "1"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 2, but destination only has length 1 + strcpy(ptr1->buffer, "123456789"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 10, but destination only has length 1 // ... MyVarStruct *ptr2 = (MyVarStruct*)malloc(sizeof(MyVarStruct) + (sizeof(char) * 10)); ptr2->len = 10; strcpy(ptr2->buffer, "123456789"); // GOOD strcpy(ptr2->buffer, "1234567890"); // GOOD - strcpy(ptr2->buffer, "1234567890a"); // BAD: length 12, but destination only has length 11 - strcpy(ptr2->buffer, "1234567890abcdef"); // BAD: length 17, but destination only has length 11 + strcpy(ptr2->buffer, "1234567890a"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 12, but destination only has length 11 + strcpy(ptr2->buffer, "1234567890abcdef"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 17, but destination only has length 11 // ... } @@ -36,14 +36,14 @@ void testMyFixedStruct() ptr1->len = 1; strcpy(ptr1->buffer, ""); // GOOD strcpy(ptr1->buffer, "1"); // GOOD - strcpy(ptr1->buffer, "12"); // BAD: length 3, but destination only has length 2 - strcpy(ptr1->buffer, "123456789"); // BAD: length 10, but destination only has length 2 + strcpy(ptr1->buffer, "12"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 3, but destination only has length 2 + strcpy(ptr1->buffer, "123456789"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 10, but destination only has length 2 // ... MyFixedStruct1 *ptr2 = (MyFixedStruct1*)malloc(sizeof(MyFixedStruct1) + (sizeof(char) * 10)); ptr2->len = 11; - strcpy(ptr2->buffer, "123456789"); // BAD / DUBIOUS: length 10, but destination only has length 2 - strcpy(ptr2->buffer, "1234567890abcdef"); // BAD: length 17, but destination only has length 2 + strcpy(ptr2->buffer, "123456789"); // $ Alert[cpp/very-likely-overrunning-write] // BAD / DUBIOUS: length 10, but destination only has length 2 + strcpy(ptr2->buffer, "1234567890abcdef"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 17, but destination only has length 2 // ... } @@ -57,13 +57,13 @@ void testMyFixedStruct2() MyFixedStruct2 *ptr1 = (MyFixedStruct2 *)malloc(sizeof(MyFixedStruct2)); ptr1->len = 1; strcpy(ptr1->buffer, ""); // GOOD - strcpy(ptr1->buffer, "1"); // BAD: length 2, but destination only has length 1 - strcpy(ptr1->buffer, "123456789"); // BAD: length 10, but destination only has length 1 + strcpy(ptr1->buffer, "1"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 2, but destination only has length 1 + strcpy(ptr1->buffer, "123456789"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 10, but destination only has length 1 // ... MyFixedStruct2 *ptr2 = (MyFixedStruct2*)malloc(sizeof(MyFixedStruct2) + (sizeof(char) * 10)); ptr2->len = 11; strcpy(ptr2->buffer, "123456789"); // BAD: length 10, but destination only has length 1 [NOT DETECTED] - strcpy(ptr2->buffer, "1234567890abcdef"); // BAD: length 17, but destination only has length 1 + strcpy(ptr2->buffer, "1234567890abcdef"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: length 17, but destination only has length 1 // ... } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/UnterminatedVarargsCall.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/UnterminatedVarargsCall.qlref index 75497f34f937..c1cd5bb0da92 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/UnterminatedVarargsCall.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/UnterminatedVarargsCall.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-121/UnterminatedVarargsCall.ql \ No newline at end of file +query: Security/CWE/CWE-121/UnterminatedVarargsCall.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/more_tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/more_tests.cpp index d6c9a3915e7f..098d9438aea5 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/more_tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/more_tests.cpp @@ -22,7 +22,7 @@ int main() myFunction2(0, 1, -1); myFunction2(0, 1, 2, -1); myFunction2(0, 1, 2, 3, -1); - myFunction2(0, 1, 2, 3, 4); // BAD: missing terminator + myFunction2(0, 1, 2, 3, 4); // $ Alert // BAD: missing terminator myFunction3(-1); myFunction3(0, -1); @@ -36,7 +36,7 @@ int main() myFunction4(0, 0, 1, 1, 0); myFunction4(0, x, 1, 1, 1, 0); myFunction4(0, 0, 1, 1, 1, 1, 0); - myFunction4(x, 0, 1, 1, 1, 1, 1); // BAD: missing terminator + myFunction4(x, 0, 1, 1, 1, 1, 1); // $ Alert // BAD: missing terminator myFunction5('a', 'b', 'c', 0); // GOOD: ambiguous terminator myFunction5('a', 'b', 'c', 0); @@ -46,7 +46,7 @@ int main() myFunction5('a', 'b', 'c', -1); myFunction6(0.0); - myFunction6(1.0); // BAD: missing terminator + myFunction6(1.0); // $ Alert // BAD: missing terminator myFunction6(1.0, 2.0, 0.0); myFunction6(1.0, 2.0, 3.0, 0.0); myFunction6(1.0, 2.0, 3.0, 4.0, 0.0); @@ -61,8 +61,8 @@ int main() myFunction7("seven", "eight", "nine", 0); myFunction7("alpha", "beta", "gamma", 0); myFunction7("", 0); - myFunction7("yes", "no"); // BAD: missing terminator - myFunction7(); // BAD: missing terminator + myFunction7("yes", "no"); // $ Alert // BAD: missing terminator + myFunction7(); // $ Alert // BAD: missing terminator return 0; -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/tests.c b/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/tests.c index f89d19cf3c75..7c55f25d5202 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/tests.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-121/semmle/tests/tests.c @@ -31,7 +31,7 @@ void f7(char *format, ...) int main(int argc, char *argv[]) { - f1("", 1); // BAD: not terminated with 0 + f1("", 1); // $ Alert // BAD: not terminated with 0 f1("", 1, 0); f1("", 1, 1, 0); f1("", 1, 1, 1, 0); @@ -64,7 +64,7 @@ int main(int argc, char *argv[]) f5("", 0); f5("", 0); f5("", 10); - + f6("a", 3, 8, -1); f6("b", 7, 9, 10, -1); f6("c", 1, 22, 6, 17, 2, -1); @@ -75,13 +75,13 @@ int main(int argc, char *argv[]) f6("h", 5, -1); f6("i", 5, 6, -1); f6("j", 5, 6, 7, -1); - f6("k", 5, 6, argc); // BAD: not (necessarily) terminated with -1 - f6("l"); // BAD: not terminated with -1 + f6("k", 5, 6, argc); // $ Alert // BAD: not (necessarily) terminated with -1 + f6("l"); // $ Alert // BAD: not terminated with -1 f7("", 0); f7("", 0); f7("", 0); - f7(""); // BAD: not terminated with 0 + f7(""); // $ Alert // BAD: not terminated with 0 f7("", 0); f7("", 0); f7("", 0); @@ -93,4 +93,4 @@ int main(int argc, char *argv[]) f7("", 0); return 0; -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-129/SAMATE/ImproperArrayIndexValidation/CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01.c b/cpp/ql/test/query-tests/Security/CWE/CWE-129/SAMATE/ImproperArrayIndexValidation/CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01.c index 2092902b6658..97024d60eb34 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-129/SAMATE/ImproperArrayIndexValidation/CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-129/SAMATE/ImproperArrayIndexValidation/CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01.c @@ -27,7 +27,7 @@ void CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01_bad() { char inputBuffer[CHAR_ARRAY_SIZE] = ""; /* POTENTIAL FLAW: Read data from the console using fgets() */ - if (fgets(inputBuffer, CHAR_ARRAY_SIZE, stdin) != NULL) + if (fgets(inputBuffer, CHAR_ARRAY_SIZE, stdin) != NULL) // $ Source { /* Convert to int */ data = atoi(inputBuffer); @@ -49,7 +49,7 @@ void CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01_bad() * This code does check to see if the array index is negative */ if (data >= 0) { - buffer[data] = 1; + buffer[data] = 1; // $ Alert /* Print the array values */ for(i = 0; i < 10; i++) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-129/SAMATE/ImproperArrayIndexValidation/ImproperArrayIndexValidation.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-129/SAMATE/ImproperArrayIndexValidation/ImproperArrayIndexValidation.qlref index f1d46d8f8d64..71a6b5581453 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-129/SAMATE/ImproperArrayIndexValidation/ImproperArrayIndexValidation.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-129/SAMATE/ImproperArrayIndexValidation/ImproperArrayIndexValidation.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-129/ImproperArrayIndexValidation.ql \ No newline at end of file +query: Security/CWE/CWE-129/ImproperArrayIndexValidation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/ImproperArrayIndexValidation.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/ImproperArrayIndexValidation.qlref index f1d46d8f8d64..71a6b5581453 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/ImproperArrayIndexValidation.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/ImproperArrayIndexValidation.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-129/ImproperArrayIndexValidation.ql \ No newline at end of file +query: Security/CWE/CWE-129/ImproperArrayIndexValidation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/test1.c b/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/test1.c index 89619626de91..5c645b7dcddf 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/test1.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/test1.c @@ -4,7 +4,7 @@ void dosomething(char c); const char chr[26] = "abcdefghijklmnopqrstuvwxyz"; -int main(int argc, char *argv[]) { +int main(int argc, char *argv[]) { // $ Source int i = atoi(argv[1]); test1(i); test2(i); @@ -17,7 +17,7 @@ int main(int argc, char *argv[]) { void test1(int i) { // BAD: i has not been validated. - char c = chr[i]; + char c = chr[i]; // $ Alert dosomething(c); } @@ -32,7 +32,7 @@ void test2(int i) { int myArray[10]; void test3(int i) { - myArray[i] = 0; // BAD: i has not been validated + myArray[i] = 0; // $ Alert // BAD: i has not been validated i = 5; @@ -40,7 +40,7 @@ void test3(int i) { } void test4(int i) { - myArray[i] = 0; // BAD: i has not been validated + myArray[i] = 0; // $ Alert // BAD: i has not been validated if ((i < 0) || (i >= 10)) return; @@ -52,7 +52,7 @@ void test5(int i) { j = i; - j = myArray[j]; // BAD: j has not been validated + j = myArray[j]; // $ Alert // BAD: j has not been validated } extern int myTable[256]; @@ -76,4 +76,3 @@ void test7(FILE* fp) { myMaxCharTable[ch] = 0; // GOOD } } - diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/NoSpaceForZeroTerminator.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/NoSpaceForZeroTerminator.qlref index 53beb09ebd71..0459fddee60f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/NoSpaceForZeroTerminator.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/NoSpaceForZeroTerminator.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql +query: Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test.c index 551b2441a41c..15de6c31dec4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test.c @@ -13,7 +13,7 @@ char *strcpy(char *s1, const char *s2); static void bad0(char *str) { // BAD -- Not allocating space for '\0' terminator - char *buffer = malloc(strlen(str)); + char *buffer = malloc(strlen(str)); // $ Alert strcpy(buffer, str); free(buffer); } @@ -29,7 +29,7 @@ static void good0(char *str) { static void bad1(char *str) { int len = strlen(str); // BAD -- Not allocating space for '\0' terminator - char *buffer = malloc(len); + char *buffer = malloc(len); // $ Alert strcpy(buffer, str); free(buffer); } @@ -46,7 +46,7 @@ static void good1(char *str) { static void bad2(char *str) { int len = strlen(str); // BAD -- Not allocating space for '\0' terminator - char *buffer = malloc(len); + char *buffer = malloc(len); // $ Alert strcpy(buffer, str); free(buffer); } @@ -61,7 +61,7 @@ static void good2(char *str) { static void bad3(char *str) { // BAD -- Not allocating space for '\0' terminator - char *buffer = malloc(strlen(str) * sizeof(char)); + char *buffer = malloc(strlen(str) * sizeof(char)); // $ Alert strcpy(buffer, str); free(buffer); } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test.cpp index 24032a91ef15..f6c44301a682 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test.cpp @@ -21,14 +21,14 @@ int strcmp(const char *s1, const char *s2); static void bad1(wchar_t *wstr) { // BAD -- Not allocating space for '\0' terminator - wchar_t *wbuffer = (wchar_t *)malloc(wcslen(wstr)); + wchar_t *wbuffer = (wchar_t *)malloc(wcslen(wstr)); // $ Alert wcscpy(wbuffer, wstr); free(wbuffer); } static void bad2(wchar_t *wstr) { // BAD -- Not allocating space for '\0' terminator - wchar_t *wbuffer = (wchar_t *)malloc(wcslen(wstr) * sizeof(wchar_t)); + wchar_t *wbuffer = (wchar_t *)malloc(wcslen(wstr) * sizeof(wchar_t)); // $ Alert wcscpy(wbuffer, wstr); free(wbuffer); } @@ -42,7 +42,7 @@ static void good1(wchar_t *wstr) { static void bad3(char *str) { // BAD -- zero-termination proved by sprintf (as destination) - char *buffer = (char *)malloc(strlen(str)); + char *buffer = (char *)malloc(strlen(str)); // $ Alert sprintf(buffer, "%s", str); free(buffer); } @@ -52,7 +52,7 @@ void wdecode(wchar_t *dest, wchar_t *src); static void bad4(char *str) { // BAD -- zero-termination proved by wprintf (as parameter) - char *buffer = (char *)malloc(strlen(str)); + char *buffer = (char *)malloc(strlen(str)); // $ Alert decode(buffer, str); wprintf(L"%s", buffer); free(buffer); @@ -60,7 +60,7 @@ static void bad4(char *str) { static void bad5(char *str) { // BAD -- zero-termination proved by strcat (as destination) - char *buffer = (char *)malloc(strlen(str)); + char *buffer = (char *)malloc(strlen(str)); // $ Alert buffer[0] = 0; strcat(buffer, str); free(buffer); @@ -68,7 +68,7 @@ static void bad5(char *str) { static void bad6(char *str, char *dest) { // BAD -- zero-termination proved by strcat (as source) - char *buffer = (char *)malloc(strlen(str)); + char *buffer = (char *)malloc(strlen(str)); // $ Alert decode(buffer, str); strcat(dest, buffer); free(buffer); @@ -76,7 +76,7 @@ static void bad6(char *str, char *dest) { static void bad7(char *str, char *str2) { // BAD -- zero-termination proved by strcmp - char *buffer = (char *)malloc(strlen(str)); + char *buffer = (char *)malloc(strlen(str)); // $ Alert decode(buffer, str); if (strcmp(buffer, str2) == 0) { // ... @@ -86,7 +86,7 @@ static void bad7(char *str, char *str2) { static void bad8(wchar_t *str) { // BAD -- zero-termination proved by wcslen - wchar_t *wbuffer = (wchar_t *)malloc(wcslen(str)); + wchar_t *wbuffer = (wchar_t *)malloc(wcslen(str)); // $ Alert wdecode(wbuffer, str); if (wcslen(wbuffer) == 0) { // ... @@ -103,7 +103,7 @@ static void good2(char *str, char *dest) { static void bad9(wchar_t *wstr) { // BAD -- using new - wchar_t *wbuffer = new wchar_t[wcslen(wstr)]; + wchar_t *wbuffer = new wchar_t[wcslen(wstr)]; // $ Alert wcscpy(wbuffer, wstr); delete wbuffer; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp index 7c7f74066976..9e590d825122 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp @@ -5,7 +5,7 @@ typedef unsigned long size_t; void *malloc(size_t size); void *realloc(void *ptr, size_t size); -void *calloc(size_t nmemb, size_t size); +void *calloc(size_t nmemb, size_t size); void free(void *ptr); size_t strlen(const char *s); size_t wcslen(const wchar_t *s); @@ -21,14 +21,14 @@ namespace std allocator() throw(); typedef size_t size_type; }; - + template, class Allocator = allocator > class basic_string { public: typedef typename Allocator::size_type size_type; explicit basic_string(const Allocator& a = Allocator()); basic_string(const charT* s, const Allocator& a = Allocator()); - basic_string(const charT* s, size_type n, const Allocator& a = Allocator()); + basic_string(const charT* s, size_type n, const Allocator& a = Allocator()); const charT* c_str() const; }; @@ -61,32 +61,32 @@ static void bad2(wchar_t *str) { static void bad3(wchar_t *str) { // BAD -- Not allocating space for '\0' terminator - wchar_t *buffer = (wchar_t *)calloc(sizeof(wchar_t), wcslen(str)); + wchar_t *buffer = (wchar_t *)calloc(sizeof(wchar_t), wcslen(str)); // $ Alert wcscpy(buffer, str); free(buffer); } static void bad4(char *str) { // BAD -- Not allocating space for '\0' terminator - char *buffer = (char *)realloc(0, strlen(str)); + char *buffer = (char *)realloc(0, strlen(str)); // $ Alert strcpy(buffer, str); free(buffer); } // --- custom allocators --- - + void *MyMalloc1(size_t size) { return malloc(size); } void *MyMalloc2(size_t size); void customAllocatorTests(char *str) { { - char *buffer1 = (char *)MyMalloc1(strlen(str)); // BAD (no room for `\0` terminator) + char *buffer1 = (char *)MyMalloc1(strlen(str)); // $ Alert // BAD (no room for `\0` terminator) strcpy(buffer1, str); } { - char *buffer2 = (char *)MyMalloc2(strlen(str)); // BAD (no room for `\0` terminator) + char *buffer2 = (char *)MyMalloc2(strlen(str)); // $ Alert // BAD (no room for `\0` terminator) strcpy(buffer2, str); } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/UncontrolledFormatString.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/UncontrolledFormatString.qlref index 079e0c8a7c0e..9c363bfac55e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/UncontrolledFormatString.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/UncontrolledFormatString.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-134/UncontrolledFormatString.ql \ No newline at end of file +query: Security/CWE/CWE-134/UncontrolledFormatString.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_connect_socket_w32_vsnprintf_01_bad.c b/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_connect_socket_w32_vsnprintf_01_bad.c index ccba3e548403..9c177049c0fd 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_connect_socket_w32_vsnprintf_01_bad.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_connect_socket_w32_vsnprintf_01_bad.c @@ -91,7 +91,7 @@ void CWE134_Uncontrolled_Format_String__char_connect_socket_w32_vsnprintf_01_bad /* Abort on error or the connection was closed, make sure to recv one * less char than is in the recv_buf in order to append a terminator */ /* Abort on error or the connection was closed */ - recvResult = recv(connectSocket, (char *)(data + dataLen), sizeof(char) * (100 - dataLen - 1), 0); + recvResult = recv(connectSocket, (char *)(data + dataLen), sizeof(char) * (100 - dataLen - 1), 0); // $ Source if (recvResult == SOCKET_ERROR || recvResult == 0) { break; @@ -122,5 +122,5 @@ void CWE134_Uncontrolled_Format_String__char_connect_socket_w32_vsnprintf_01_bad } #endif } - badVaSink(data, data); + badVaSink(data, data); // $ Alert } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_console_fprintf_01_bad.c b/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_console_fprintf_01_bad.c index 1af281b9f422..493f9a5f7de5 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_console_fprintf_01_bad.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_console_fprintf_01_bad.c @@ -27,7 +27,7 @@ void CWE134_Uncontrolled_Format_String__char_console_fprintf_01_bad() /* POTENTIAL FLAW: Read data from the console */ if(100-data_len > 1) { - if (fgets(data+data_len, (int)(100-data_len), stdin) != NULL) + if (fgets(data+data_len, (int)(100-data_len), stdin) != NULL) // $ Source { /* The next 3 lines remove the carriage return from the string that is * inserted by fgets() */ @@ -46,7 +46,7 @@ void CWE134_Uncontrolled_Format_String__char_console_fprintf_01_bad() } } /* POTENTIAL FLAW: Do not specify the format allowing a possible format string vulnerability */ - fprintf(stdout, data); + fprintf(stdout, data); // $ Alert } /* goodG2B uses the GoodSource with the BadSink */ diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_environment_fprintf_01_bad.c b/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_environment_fprintf_01_bad.c index f759a9d8e61e..bc9f7e9f4a86 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_environment_fprintf_01_bad.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/char_environment_fprintf_01_bad.c @@ -24,7 +24,7 @@ void CWE134_Uncontrolled_Format_String__char_environment_fprintf_01_bad() { /* Append input from an environment variable to data */ size_t data_len = strlen(data); - char * environment = GETENV(ENV_VARIABLE); + char * environment = GETENV(ENV_VARIABLE); // $ Source /* If there is data in the environment variable */ if (environment != NULL) { @@ -33,7 +33,7 @@ void CWE134_Uncontrolled_Format_String__char_environment_fprintf_01_bad() } } /* POTENTIAL FLAW: Do not specify the format allowing a possible format string vulnerability */ - fprintf(stdout, data); + fprintf(stdout, data); // $ Alert } /* goodG2B uses the GoodSource with the BadSink */ diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.c b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.c index 5649c0e19b1c..4c6baf0d562e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.c @@ -10,7 +10,7 @@ void printWrapper(char *correct) { printf(correct); } -int main(int argc, char **argv) { +int main(int argc, char **argv) { // $ Source // GOOD: constant format printf("Correct"); printWrapper("Correct"); @@ -92,63 +92,63 @@ int main(int argc, char **argv) { printWrapper((char *) c10); // BAD: format comes from argv - printf(argv[1]); - printWrapper(argv[1]); + printf(argv[1]); // $ Alert + printWrapper(argv[1]); // $ Alert // BAD: i1 value comes from argv char *i1; i1 = argv[1]; - printf(i1); - printWrapper(i1); + printf(i1); // $ Alert + printWrapper(i1); // $ Alert // BAD: i2 value comes from argv char **i2 = argv; - printf(i2[0]); - printWrapper(i2[0]); + printf(i2[0]); // $ Alert + printWrapper(i2[0]); // $ Alert // BAD: i2 value comes from argv - printf(*i2); - printWrapper(*i2); + printf(*i2); // $ Alert + printWrapper(*i2); // $ Alert // BAD: i3 value comes from argv char i3[5012]; memcpy(i3, argv[1], 5012); - printf(i3); - printWrapper(i3); + printf(i3); // $ Alert + printWrapper(i3); // $ Alert // BAD: i4 value comes from argv char *i4 = i3; - printf(i4); - printWrapper(i4); + printf(i4); // $ Alert + printWrapper(i4); // $ Alert // BAD: i5 value comes from argv char i5[5012]; i5[0] = argv[1][0]; - printf(i5); - printWrapper(i5); + printf(i5); // $ Alert + printWrapper(i5); // $ Alert // BAD: i5 value comes from argv - printf(i5 + 1); - printWrapper(i5 + 1); + printf(i5 + 1); // $ Alert + printWrapper(i5 + 1); // $ Alert // BAD: i4 value comes from argv - printf(i4++); - printWrapper(--i4); + printf(i4++); // $ Alert + printWrapper(--i4); // $ Alert // BAD: i5 value comes from argv, so in some cases the format come from argv - printf(argv[1] ? "a" : i5); - printWrapper(argv[1] ? "a" : i5); + printf(argv[1] ? "a" : i5); // $ Alert + printWrapper(argv[1] ? "a" : i5); // $ Alert // BAD: i7 receives the value of i1, which comes from argv char *i7 = (argv[1] , i1); - printf(i7); - printWrapper(i7); + printf(i7); // $ Alert + printWrapper(i7); // $ Alert // BAD: i8 value comes from argv char *i8; *(&i8) = argv[1]; - printf(i8); - printWrapper(i8); + printf(i8); // $ Alert + printWrapper(i8); // $ Alert // BAD: i9 value comes from argv [NOT DETECTED] char i9buf[32]; diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.qlref index 079e0c8a7c0e..9c363bfac55e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-134/UncontrolledFormatString.ql \ No newline at end of file +query: Security/CWE/CWE-134/UncontrolledFormatString.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.qlref index 83622f12b4d9..cb71273232ca 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.qlref @@ -1 +1,2 @@ -Likely Bugs/Format/NonConstantFormat.ql \ No newline at end of file +query: Likely Bugs/Format/NonConstantFormat.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/consts.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/consts.cpp index 7242bedc133e..b3815dfd0b7c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/consts.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/consts.cpp @@ -82,65 +82,65 @@ void a() { // BAD: v1 value came from the user char v1[100]; - gets(v1); - printf(v1); + gets(v1); // $ Source + printf(v1); // $ Alert // BAD: v2 value came from the user char *v2; - v2 = gets(v1); - printf(v2); + v2 = gets(v1); // $ Source + printf(v2); // $ Alert // BAD: v3 value is copied from v1, which came from the user char *v3 = v1; - printf(v3); + printf(v3); // $ Alert // BAD: v4 value is copied from v1, which came from the user char *v4; v4 = v1; - printf(v4); + printf(v4); // $ Alert // BAD: varFunc() is not defined, so it may not be constant - printf(varFunc()); + printf(varFunc()); // $ Alert // BAD: varFunc() is not defined, so it may not be constant - char *v5 = varFunc(); - printf(v5); + char *v5 = varFunc(); // $ Source + printf(v5); // $ Alert // BAD: varFunc() is not defined, so it may not be constant char *v6; - v6 = varFunc(); - printf(v6); + v6 = varFunc(); // $ Source + printf(v6); // $ Alert // BAD: all elements of v7 came from the user char *v7[] = { v1, v2 }; - printf(v7[0]); + printf(v7[0]); // $ Alert // BAD: v8 started as constant, but changed to a value that came from the user char *v8 = "a"; v8 = v7[1]; - printf(v8); + printf(v8); // $ Alert gv1[1] = v1; // BAD: nonConstFuncToArray() always returns a value from gv1, which is started as constant but was changed to a value that came from the user - printf(nonConstFuncToArray(0)); + printf(nonConstFuncToArray(0)); // $ Alert // BAD: v9 value is copied from v1, which came from the user const char *v9 = v1; - printf(v9); + printf(v9); // $ Alert // BAD: v10 value is derived from values that are not constant char v10[10]; sprintf(v10, "%s", v1); - printf(v10); + printf(v10); // $ Alert // BAD: v11 is initialized via a pointer char *v11; - readString(&v11); - printf(v11); + readString(&v11); // $ Source + printf(v11); // $ Alert // BAD: v12 is initialized via a reference char *v12; - readStringRef(v12); - printf(v12); + readStringRef(v12); // $ Source + printf(v12); // $ Alert } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.c b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.c index d2b28baac236..23a05e1ec50a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.c @@ -13,8 +13,8 @@ FILE *f; int main(int argc, char **argv) { // BAD: i1 comes from the user char i1[1024]; - fread(i1, sizeof(char), 1024, f); - printf(i1); + fread(i1, sizeof(char), 1024, f); // $ Source + printf(i1); // $ Alert // GOOD: i2 comes from the user, but is not the format string here char i2[1024]; @@ -23,39 +23,39 @@ int main(int argc, char **argv) { // BAD: i3 comes from the user char i3[1024]; - fgets(i3, 1, 0); - printf(i3); + fgets(i3, 1, 0); // $ Source + printf(i3); // $ Alert // BAD: i4 comes from the user char i41[1024]; - char *i4 = fgets(i41, 1, f); - printf(i4); + char *i4 = fgets(i41, 1, f); // $ Source + printf(i4); // $ Alert // BAD: i5 comes from the user char i5[1024]; - gets(i5); - printf(i5); + gets(i5); // $ Source + printf(i5); // $ Alert // BAD: i6 comes from the user char i61[1024]; - char *i6 = gets(i61); - printf(i6); + char *i6 = gets(i61); // $ Source + printf(i6); // $ Alert // BAD: i7 comes from the user char **i7; - gets(*i7); - printf(*i7); + gets(*i7); // $ Source + printf(*i7); // $ Alert // BAD: i8 comes from the user char i81[1024]; char **i8; - *i8 = gets(i81); - printf(*i8); + *i8 = gets(i81); // $ Source + printf(*i8); // $ Alert // BAD: e1 comes from i1, which comes from the user char e1[1]; e1[0] = i1[0]; - printf(e1); + printf(e1); // $ Alert return 0; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.qlref index 079e0c8a7c0e..9c363bfac55e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-134/UncontrolledFormatString.ql \ No newline at end of file +query: Security/CWE/CWE-134/UncontrolledFormatString.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatString.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatString.qlref index 079e0c8a7c0e..9c363bfac55e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatString.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatString.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-134/UncontrolledFormatString.ql \ No newline at end of file +query: Security/CWE/CWE-134/UncontrolledFormatString.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/globalVars.c b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/globalVars.c index c36c708eab04..dedeade890aa 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/globalVars.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/globalVars.c @@ -20,14 +20,14 @@ void printWrapper(char *str) { printf(str); } -int main(int argc, char **argv) { +int main(int argc, char **argv) { // $ Source copyArgv(argv); // BAD: format comes from argv through copy - printf(copy); + printf(copy); // $ Alert // BAD: format comes from argv through copy - printWrapper(copy); + printWrapper(copy); // $ Alert // GOOD: constant format printf("%s", copy); @@ -35,10 +35,10 @@ int main(int argc, char **argv) { setCopy2(copy); // BAD: format comes from argv through copy2 (that is set to copy that is set to argv[1]) - printf(copy2); + printf(copy2); // $ Alert // BAD: format comes from argv through copy2 (that is set to copy that is set to argv[1]) - printWrapper(copy2); + printWrapper(copy2); // $ Alert // GOOD: constant format printf("%s", copy2); @@ -47,5 +47,5 @@ int main(int argc, char **argv) { // Should be GOOD because copy2 has value "asdf" // But we flag this case because once a global variable gets tainted we mark all usages as tainted - printf(copy2); + printf(copy2); // $ Alert } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.c b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.c index 3d15905d82d6..b7a8eca6e0f2 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.c @@ -13,7 +13,7 @@ int inv(int a) { return !a; } -int main(int argc, char **argv) { +int main(int argc, char **argv) { // $ Source int varZero = 0; int varOne = 1; @@ -59,69 +59,69 @@ int main(int argc, char **argv) { char *c7; if (globalZero) c7 = argv[1]; - printf(c7); + printf(c7); // $ Alert // GOOD: inv(1) returns 0 and it never goes inside the if // But we can't handle this case because currently we don't analyse arguments in function calls char *c8; if (inv(1)) c8 = argv[1]; - printf(c8); + printf(c8); // $ Alert // BAD: condition is true and it always goes inside the if char *i1; if (1) i1 = argv[1]; - printf(i1); + printf(i1); // $ Alert // BAD: condition is true and it always goes inside the if char *i2; if (0 == 0) i2 = argv[1]; - printf(i2); + printf(i2); // $ Alert // BAD: condition is true and it always goes inside the if char *i3; if (!0) i3 = argv[1]; - printf(i3); + printf(i3); // $ Alert // BAD: varOne is 1 so condition is true and it always goes inside the if char *i4; if (varOne) i4 = argv[1]; - printf(i4); + printf(i4); // $ Alert // BAD: varZero is 0 so condition is true and it always goes inside the if char *i5; if (!varZero) i5 = argv[1]; - printf(i5); + printf(i5); // $ Alert // BAD: condition is true and it always goes inside the if // But our analysis only handle booleans, so it isn't able the detect that both values are the same (we can handle only 0 == 0) char *i6; if (varOne == varOne) i6 = argv[1]; - printf(i6); + printf(i6); // $ Alert // BAD: globalOne is 1 so condition is true and it always goes inside the if char *i7; if (globalOne) i7 = argv[1]; - printf(i7); + printf(i7); // $ Alert // BAD: we don't know the value of globalUnknown so we have to assume it can be true char *i8; if (globalUnknown) i8 = argv[1]; - printf(i8); + printf(i8); // $ Alert // BAD: inv(0) returns 1 and it always goes inside the if char *i9; if (inv(0)) i9 = argv[1]; - printf(i9); + printf(i9); // $ Alert return 0; diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.qlref index 079e0c8a7c0e..9c363bfac55e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-134/UncontrolledFormatString.ql \ No newline at end of file +query: Security/CWE/CWE-134/UncontrolledFormatString.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticTainted.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticTainted.qlref index 3939653db1c3..d8fb26f7e023 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticTainted.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticTainted.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/ArithmeticTainted.ql +query: Security/CWE/CWE-190/ArithmeticTainted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticUncontrolled.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticUncontrolled.qlref index 1fcafc3ca1c8..e18d0e08a87f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticUncontrolled.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticUncontrolled.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/ArithmeticUncontrolled.ql +query: Security/CWE/CWE-190/ArithmeticUncontrolled.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticWithExtremeValues.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticWithExtremeValues.qlref index ab2c35ce59b2..0109cee57cf7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticWithExtremeValues.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/ArithmeticWithExtremeValues.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql +query: Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/IntegerOverflowTainted.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/IntegerOverflowTainted.qlref index df42008c632b..419ed80f3b9e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/IntegerOverflowTainted.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/IntegerOverflowTainted.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/IntegerOverflowTainted.ql +query: Security/CWE/CWE-190/IntegerOverflowTainted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/examples.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/examples.cpp index b2cdbbe7133f..3fab05fc20cb 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/examples.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/SAMATE/examples.cpp @@ -19,10 +19,10 @@ void CWE191_Integer_Underflow__unsigned_int_rand_sub_01_bad() unsigned int data; data = 0; /* POTENTIAL FLAW: Use a random value */ - data = (unsigned int)RAND32(); + data = (unsigned int)RAND32(); // $ Source[cpp/uncontrolled-arithmetic] { /* POTENTIAL FLAW: Subtracting 1 from data could cause an underflow */ - unsigned int result = data - 1; + unsigned int result = data - 1; // $ Alert[cpp/uncontrolled-arithmetic] printUnsignedLine(result); } } @@ -32,10 +32,10 @@ void CWE191_Integer_Underflow__unsigned_int_rand_postdec_01_bad() unsigned int data; data = 0; /* POTENTIAL FLAW: Use a random value */ - data = (unsigned int)RAND32(); + data = (unsigned int)RAND32(); // $ Source[cpp/uncontrolled-arithmetic] { /* POTENTIAL FLAW: Decrementing data could cause an underflow */ - data--; + data--; // $ Alert[cpp/uncontrolled-arithmetic] unsigned int result = data; printUnsignedLine(result); } @@ -60,10 +60,10 @@ void CWE191_Integer_Underflow__unsigned_int_fscanf_predec_01_bad() unsigned int data; data = 0; /* POTENTIAL FLAW: Use a value input from the console */ - fscanf (stdin, "%u", &data); + fscanf (stdin, "%u", &data); // $ Source[cpp/tainted-arithmetic] { /* POTENTIAL FLAW: Decrementing data could cause an underflow */ - --data; + --data; // $ Alert[cpp/integer-overflow-tainted] Alert[cpp/tainted-arithmetic] unsigned int result = data; printUnsignedLine(result); } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/ArithmeticUncontrolled.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/ArithmeticUncontrolled.qlref index 1fcafc3ca1c8..e18d0e08a87f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/ArithmeticUncontrolled.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/ArithmeticUncontrolled.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/ArithmeticUncontrolled.ql +query: Security/CWE/CWE-190/ArithmeticUncontrolled.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c index 691801a620a5..4c1ce290cf44 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c @@ -15,10 +15,10 @@ void add_100(int); void randomTester() { int i; for (i = 0; i < 1000; i++) { - int r = rand(); - - // BAD: The return from rand() is unbounded - trySlice(r, r+100); + int r = rand(); // $ Source + + // BAD: The return from rand() is unbounded + trySlice(r, r+100); // $ Alert } for (i = 0; i < 1000; i++) { @@ -31,8 +31,8 @@ void randomTester() { } { - int r = RAND(); - r += 100; // BAD: The return from RAND() is unbounded + int r = RAND(); // $ Source + r += 100; // $ Alert // BAD: The return from RAND() is unbounded } { @@ -41,27 +41,27 @@ void randomTester() { } { - int r = rand(); - r += 100; // BAD + int r = rand(); // $ Source + r += 100; // $ Alert // BAD } - + { int r = rand() / 10; r += 100; // GOOD } - + { int r = rand(); r = r / 10; r += 100; // GOOD } - + { int r = rand(); r /= 10; r += 100; // GOOD } - + { int r = rand() & 0xFF; r += 100; // GOOD @@ -72,15 +72,15 @@ void randomTester() { } { - int r = RAND2(); + int r = RAND2(); // $ Source - r = r + 100; // BAD + r = r + 100; // $ Alert // BAD } { - int r = (rand() ^ rand()); + int r = (rand() ^ rand()); // $ Source - r = r + 100; // BAD + r = r + 100; // $ Alert // BAD } { @@ -122,39 +122,39 @@ void randomTester2(int bound, int min, int max) { void moreTests() { { - int r = rand(); - - r = r * 100; // BAD + int r = rand(); // $ Source + + r = r * 100; // $ Alert // BAD } { - int r = rand(); - - r *= 100; // BAD + int r = rand(); // $ Source + + r *= 100; // $ Alert // BAD } { - int r = rand(); + int r = rand(); // $ Source int v = 100; - v *= r; // BAD + v *= r; // $ Alert // BAD } { int r = rand(); - + r <<= 8; // BAD [NOT DETECTED] } { int r = rand(); - + r = r - 100; // GOOD } { - unsigned int r = rand(); - - r = r - 100; // BAD + unsigned int r = rand(); // $ Source + + r = r - 100; // $ Alert // BAD } } @@ -164,4 +164,4 @@ void guarded_test(unsigned p) { return; } unsigned z = data - p; // GOOD -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp index f5e401c60cde..9f717ad670b4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp @@ -5,36 +5,36 @@ int rand(void); int get_rand() { - return rand(); + return rand(); // $ Source } void get_rand2(int *dest) { - *dest = rand(); + *dest = rand(); // $ Source } void get_rand3(int &dest) { - dest = rand(); + dest = rand(); // $ Source } void randomTester2() { { int r = get_rand(); - r = r + 100; // BAD + r = r + 100; // $ Alert // BAD } { int r; get_rand2(&r); - r = r + 100; // BAD + r = r + 100; // $ Alert // BAD } { int r; get_rand3(r); - r = r + 100; // BAD + r = r + 100; // $ Alert // BAD } } @@ -59,10 +59,10 @@ int test_remainder_subtract() unsigned int test_remainder_subtract_unsigned() { - unsigned int x = rand(); + unsigned int x = rand(); // $ Source unsigned int y = x % 100; // y <= x - return x - y; // GOOD (as y <= x) [FALSE POSITIVE] + return x - y; // $ Alert // GOOD (as y <= x) [FALSE POSITIVE] } typedef unsigned long size_t; @@ -83,11 +83,11 @@ int test_snprintf(char *buf, size_t buf_sz) int test_else_1() { - int x = rand(); + int x = rand(); // $ Source if (x > 100) { - return x * 10; // BAD + return x * 10; // $ Alert // BAD } else { return x * 10; // GOOD (as x <= 100) } @@ -95,11 +95,11 @@ int test_else_1() int test_else_2() { - int x = rand(); + int x = rand(); // $ Source if (x > 100) { - return x * 10; // BAD + return x * 10; // $ Alert // BAD } return x * 10; // GOOD (as x <= 100) @@ -128,13 +128,13 @@ int test_conditional_assignment_2() { y = x; } - + return y * 10; // GOOD (as y <= 100) } int test_conditional_assignment_3() { - int x = rand(); + int x = rand(); // $ Source int y = 100; int c = 10; @@ -142,16 +142,16 @@ int test_conditional_assignment_3() { y = x; } - - return y * c; // GOOD (as y <= 100) [FALSE POSITIVE] + + return y * c; // $ Alert // GOOD (as y <= 100) [FALSE POSITIVE] } int test_underflow() { - int x = rand(); + int x = rand(); // $ Source int a = -x; // GOOD int b = 10 - x; // GOOD - int c = b * 2; // BAD + int c = b * 2; // $ Alert // BAD } int test_cast() @@ -166,9 +166,9 @@ int test_cast() void test_float() { { - int x = rand(); + int x = rand(); // $ Source float y = x; // GOOD - int z = (int)y * 5; // BAD + int z = (int)y * 5; // $ Alert // BAD } { @@ -186,37 +186,37 @@ void test_float() void test_if_const_bounded() { - int x = rand(); - int y = rand(); + int x = rand(); // $ Source + int y = rand(); // $ Source int c = 10; if (x < 1000) { x = x * 2; // GOOD - x = x * c; // GOOD [FALSE POSITIVE] + x = x * c; // $ Alert // GOOD [FALSE POSITIVE] } else { - x = x * 2; // BAD - x = x * c; // BAD + x = x * 2; // $ Alert // BAD + x = x * c; // $ Alert // BAD } if (y > 1000) { - y = y * 2; // BAD - y = y * c; // BAD + y = y * 2; // $ Alert // BAD + y = y * c; // $ Alert // BAD } else { y = y * 2; // GOOD - y = y * c; // GOOD [FALSE POSITIVE] + y = y * c; // $ Alert // GOOD [FALSE POSITIVE] } } void test_mod_limit() { { - int x = rand(); + int x = rand(); // $ Source int y = 100; int z; - z = (x + y) % 1000; // BAD + z = (x + y) % 1000; // $ Alert // BAD } { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/ArithmeticWithExtremeValues.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/ArithmeticWithExtremeValues.qlref index ab2c35ce59b2..0109cee57cf7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/ArithmeticWithExtremeValues.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/ArithmeticWithExtremeValues.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql +query: Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c index 8760641c8e2d..79650a316f90 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c @@ -14,7 +14,7 @@ int len_last(int n, char** lines) { } // BAD: if the input array is empty, then max will still be INT_MAX - return min + 1; + return min + 1; // $ Alert } @@ -45,9 +45,9 @@ void test_crement() { sc1 = CHAR_MIN; sc1++; // GOOD sc2 = CHAR_MIN; - sc2--; // BAD + sc2--; // $ Alert // BAD sc3 = CHAR_MAX; - sc3++; // BAD + sc3++; // $ Alert // BAD sc4 = CHAR_MAX; sc4--; // GOOD @@ -56,11 +56,11 @@ void test_crement() { sc5++; // GOOD [FALSE POSITIVE] sc6 = CHAR_MAX; - sc6 += 1; // BAD + sc6 += 1; // $ Alert // BAD sc7 = CHAR_MAX; sc7 -= 1; // GOOD sc8 = CHAR_MIN; - sc8 -= 1; // BAD + sc8 -= 1; // $ Alert // BAD sc9 = CHAR_MIN; sc9 += 1; // GOOD @@ -121,5 +121,5 @@ void test_guards4(int cond) { if (x == 0) return; - return x + 1; // BAD + return x + 1; // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ComparisonWithWiderType/ComparisonWithWiderType.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ComparisonWithWiderType/ComparisonWithWiderType.qlref index 4a71f8aad4ca..f836a00c9c4e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ComparisonWithWiderType/ComparisonWithWiderType.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ComparisonWithWiderType/ComparisonWithWiderType.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/ComparisonWithWiderType.ql +query: Security/CWE/CWE-190/ComparisonWithWiderType.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ComparisonWithWiderType/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ComparisonWithWiderType/test.c index 8361ae3e31b5..ee2724684575 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ComparisonWithWiderType/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ComparisonWithWiderType/test.c @@ -1,17 +1,17 @@ void test1 (int x) { char c; - for (c = 0; c < x; c++) {} //BAD + for (c = 0; c < x; c++) {} // $ Alert //BAD } void test2 (int x) { char c; - for (c = 0; x > c; c++) {} // BAD + for (c = 0; x > c; c++) {} // $ Alert // BAD } void test3 (int x) { short s; - for (s = 0; s < x; s++) {} //BAD + for (s = 0; s < x; s++) {} // $ Alert //BAD } void runner() { // get range analysis to give large values to x in tests @@ -39,7 +39,7 @@ void test5 () { void test6() { short s1; - for (s1 = 0; s1 < 0x0000ffff; s1++) {} // BAD + for (s1 = 0; s1 < 0x0000ffff; s1++) {} // $ Alert // BAD } void test7(long long l) { @@ -62,7 +62,7 @@ void test9(int x) { void test10(int x) { short s; - for (s = 0; s < x; ) { // BAD + for (s = 0; s < x; ) { // $ Alert // BAD do { s++; @@ -84,27 +84,27 @@ void test12() { unsigned int x; x = get_a_uint(); - for (c = 0; c < x; c++) {} // BAD + for (c = 0; c < x; c++) {} // $ Alert // BAD x = get_a_uint(); for (c = 0; c < 0xFF; c++) {} // GOOD x = get_a_uint(); - for (c = 0; c < 0xFF00; c++) {} // BAD + for (c = 0; c < 0xFF00; c++) {} // $ Alert // BAD x = get_a_uint(); - for (c = 0; c < 0xFF0000; c++) {} // BAD + for (c = 0; c < 0xFF0000; c++) {} // $ Alert // BAD x = get_a_uint(); - for (c = 0; c < 0xFF000000; c++) {} // BAD + for (c = 0; c < 0xFF000000; c++) {} // $ Alert // BAD x = get_a_uint(); for (c = 0; c < (x & 0xFF); c++) {} // GOOD x = get_a_uint(); - for (c = 0; c < (x & 0xFF00); c++) {} // BAD + for (c = 0; c < (x & 0xFF00); c++) {} // $ Alert // BAD x = get_a_uint(); - for (c = 0; c < (x & 0xFF0000); c++) {} // BAD + for (c = 0; c < (x & 0xFF0000); c++) {} // $ Alert // BAD x = get_a_uint(); - for (c = 0; c < (x & 0xFF000000); c++) {} // BAD + for (c = 0; c < (x & 0xFF000000); c++) {} // $ Alert // BAD x = get_a_uint(); - for (c = 0; c < (x >> 8); c++) {} // BAD + for (c = 0; c < (x >> 8); c++) {} // $ Alert // BAD x = get_a_uint(); - for (c = 0; c < (x >> 16); c++) {} // BAD + for (c = 0; c < (x >> 16); c++) {} // $ Alert // BAD x = get_a_uint(); for (c = 0; c < (x >> 24); c++) {} // GOOD (assuming 32-bit ints) x = get_a_uint(); @@ -125,7 +125,7 @@ void test13() { ux = get_a_uint(); uy = get_a_uint(); sz = ux & uy; - for (uc = 0; uc < sz; uc++) {} // BAD + for (uc = 0; uc < sz; uc++) {} // $ Alert // BAD ux = get_a_uint(); uy = get_a_uint(); @@ -136,7 +136,7 @@ void test13() { sx = get_an_int(); sy = get_an_int(); sz = (unsigned)sx & (unsigned)sy; - for (uc = 0; uc < sz; uc++) {} // BAD + for (uc = 0; uc < sz; uc++) {} // $ Alert // BAD sx = get_an_int(); sy = get_an_int(); @@ -153,7 +153,7 @@ void test14() { // BAD: 's' is compared with a value of a wider type. // 's' overflows before reaching 'sx', // causing an infinite loop - while (s < sx) { + while (s < sx) { // $ Alert s += 1; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.qlref index df804c0942f4..2db07b995892 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/TaintedAllocationSize.ql +query: Security/CWE/CWE-190/TaintedAllocationSize.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp index e13c50a960b4..4251e7cfcf55 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp @@ -30,27 +30,27 @@ namespace std int getTainted() { int i; - + std::cin >> i; return i; } -int main(int argc, char **argv) { +int main(int argc, char **argv) { // $ Source int tainted = atoi(argv[1]); MyStruct *arr1 = (MyStruct *)malloc(sizeof(MyStruct)); // GOOD - MyStruct *arr2 = (MyStruct *)malloc(tainted); // BAD - MyStruct *arr3 = (MyStruct *)malloc(tainted * sizeof(MyStruct)); // BAD + MyStruct *arr2 = (MyStruct *)malloc(tainted); // $ Alert // BAD + MyStruct *arr3 = (MyStruct *)malloc(tainted * sizeof(MyStruct)); // $ Alert // BAD MyStruct *arr4 = (MyStruct *)malloc(getTainted() * sizeof(MyStruct)); // BAD [NOT DETECTED] - MyStruct *arr5 = (MyStruct *)malloc(sizeof(MyStruct) + tainted); // BAD + MyStruct *arr5 = (MyStruct *)malloc(sizeof(MyStruct) + tainted); // $ Alert // BAD int size = tainted * 8; - char *chars1 = (char *)malloc(size); // BAD - char *chars2 = new char[size]; // BAD + char *chars1 = (char *)malloc(size); // $ Alert // BAD + char *chars2 = new char[size]; // $ Alert // BAD char *chars3 = new char[8]; // GOOD - arr1 = (MyStruct *)realloc(arr1, sizeof(MyStruct) * tainted); // BAD + arr1 = (MyStruct *)realloc(arr1, sizeof(MyStruct) * tainted); // $ Alert // BAD size = 8; chars3 = new char[size]; // GOOD @@ -121,18 +121,18 @@ int bounded(int x, int limit) { } void open_file_bounded () { - int size = atoi(getenv("USER")); + int size = atoi(getenv("USER")); // $ Source int bounded_size = bounded(size, MAX_SIZE); - + int* a = (int*)malloc(bounded_size * sizeof(int)); // GOOD - int* b = (int*)malloc(size * sizeof(int)); // BAD + int* b = (int*)malloc(size * sizeof(int)); // $ Alert // BAD } void more_bounded_tests() { { - int size = atoi(getenv("USER")); + int size = atoi(getenv("USER")); // $ Source - malloc(size * sizeof(int)); // BAD + malloc(size * sizeof(int)); // $ Alert // BAD } { @@ -145,11 +145,11 @@ void more_bounded_tests() { } { - long size = atol(getenv("USER")); + long size = atol(getenv("USER")); // $ Source if (size > 0) { - malloc(size * sizeof(int)); // BAD + malloc(size * sizeof(int)); // $ Alert // BAD } } @@ -187,11 +187,11 @@ void more_bounded_tests() { } { - int size = atoi(getenv("USER")); + int size = atoi(getenv("USER")); // $ Source if (size % 100) { - malloc(size * sizeof(int)); // BAD + malloc(size * sizeof(int)); // $ Alert // BAD } } @@ -202,11 +202,11 @@ void more_bounded_tests() { } { - int size = atoi(getenv("USER")); + int size = atoi(getenv("USER")); // $ Source if (size & 7) { - malloc(size * sizeof(int)); // BAD + malloc(size * sizeof(int)); // $ Alert // BAD } } @@ -238,7 +238,7 @@ size_t get_untainted_size() size_t get_tainted_size() { - return atoi(getenv("USER")) * sizeof(int); + return atoi(getenv("USER")) * sizeof(int); // $ Source } size_t get_bounded_size() @@ -258,39 +258,39 @@ void *my_alloc(size_t s) { } void my_func(size_t s) { - void *ptr = malloc(s); // BAD + void *ptr = malloc(s); // $ Alert // BAD free(ptr); } void more_cases() { - int local_size = atoi(getenv("USER")) * sizeof(int); + int local_size = atoi(getenv("USER")) * sizeof(int); // $ Source - malloc(local_size); // BAD + malloc(local_size); // $ Alert // BAD malloc(get_untainted_size()); // GOOD - malloc(get_tainted_size()); // BAD + malloc(get_tainted_size()); // $ Alert // BAD malloc(get_bounded_size()); // GOOD my_alloc(100); // GOOD - my_alloc(local_size); // BAD + my_alloc(local_size); // $ Alert // BAD my_func(100); // GOOD my_func(local_size); // GOOD } bool get_size(int &out_size) { - out_size = atoi(getenv("USER")); - + out_size = atoi(getenv("USER")); // $ Source + return true; } void equality_cases() { { int size1 = atoi(getenv("USER")); - int size2 = atoi(getenv("USER")); + int size2 = atoi(getenv("USER")); // $ Source if (size1 == 100) { - malloc(size2 * sizeof(int)); // BAD + malloc(size2 * sizeof(int)); // $ Alert // BAD } if (size2 == 100) { @@ -318,7 +318,7 @@ void equality_cases() { if ((get_size(size)) && (size != 100)) { - malloc(size * sizeof(int)); // BAD + malloc(size * sizeof(int)); // $ Alert // BAD } } { @@ -335,7 +335,7 @@ void equality_cases() { if ((!get_size(size)) || (size == 100)) return; - malloc(size * sizeof(int)); // BAD + malloc(size * sizeof(int)); // $ Alert // BAD } { int size = atoi(getenv("USER")); @@ -360,7 +360,7 @@ char * strstr(char *, const char *); void ptr_diff_case() { char* user = getenv("USER"); char* admin_begin_pos = strstr(user, "ADMIN"); - int offset = admin_begin_pos ? user - admin_begin_pos : 0; + int offset = admin_begin_pos ? user - admin_begin_pos : 0; malloc(offset); // GOOD } @@ -374,14 +374,14 @@ void equality_barrier() { } // --- custom allocators --- - + void *MyMalloc1(size_t size) { return malloc(size); } void *MyMalloc2(size_t size); void customAllocatorTests() { - int size = atoi(getenv("USER")); + int size = atoi(getenv("USER")); // $ Source - char *chars1 = (char *)MyMalloc1(size); // BAD - char *chars2 = (char *)MyMalloc2(size); // BAD + char *chars1 = (char *)MyMalloc1(size); // $ Alert // BAD + char *chars2 = (char *)MyMalloc2(size); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.qlref index 3939653db1c3..d8fb26f7e023 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/ArithmeticTainted.ql +query: Security/CWE/CWE-190/ArithmeticTainted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.qlref index df42008c632b..419ed80f3b9e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/IntegerOverflowTainted.ql +query: Security/CWE/CWE-190/IntegerOverflowTainted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/main.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/main.cpp index 645b5893deaa..2a91b61f5fab 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/main.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/main.cpp @@ -4,7 +4,7 @@ int main3(int argc, char** argv); } int main4(int argc, char** argv); -int main(int argc, char** argv) { +int main(int argc, char** argv) { // $ Source[cpp/tainted-arithmetic] main1(argc, argv); main3(argc, argv); main4(argc, argv); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test.c index b39e54084ac3..b8d22476029a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test.c @@ -11,8 +11,8 @@ int main1(int argc, char** argv) { int maxConnections = atoi(argv[1]); // BAD: arithmetic on a user input without any validation - startServer(maxConnections * 1000); - + startServer(maxConnections * 1000); // $ Alert[cpp/integer-overflow-tainted] Alert[cpp/tainted-arithmetic] + // GOOD: check the user input first int maxConnections2 = atoi(argv[1]); if (maxConnections2 < 100) { @@ -41,7 +41,7 @@ int main1(int argc, char** argv) { len2 = atoi(argv[1]); while (len2) { - len2--; // BAD: can underflow, if len2 is initially negative. + len2--; // $ Alert[cpp/integer-overflow-tainted] Alert[cpp/tainted-arithmetic] // BAD: can underflow, if len2 is initially negative. } } @@ -51,7 +51,7 @@ int main1(int argc, char** argv) { len3 = atoi(argv[1]); while (len3 != 0) { - len3--; // BAD: can underflow, if len3 is initially negative. + len3--; // $ Alert[cpp/integer-overflow-tainted] Alert[cpp/tainted-arithmetic] // BAD: can underflow, if len3 is initially negative. } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test2.cpp index 1cf12a197f4d..2cfbef65916a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test2.cpp @@ -11,10 +11,10 @@ typedef struct _myStruct { void test2_sink(s64 v, MyStruct s, MyStruct &s_r, MyStruct *s_p) { - s64 v1 = v * 2; // bad - s64 v2 = s.val * 2; // bad - s64 v3 = s_r.val * 2; // bad - s64 v4 = s_p->val * 2; // bad + s64 v1 = v * 2; // $ Alert[cpp/integer-overflow-tainted] Alert[cpp/tainted-arithmetic] // bad + s64 v2 = s.val * 2; // $ Alert[cpp/integer-overflow-tainted] // bad + s64 v3 = s_r.val * 2; // $ Alert[cpp/integer-overflow-tainted] // bad + s64 v4 = s_p->val * 2; // $ Alert[cpp/integer-overflow-tainted] // bad } void test2_source() @@ -22,7 +22,7 @@ void test2_source() MyStruct ms; s64 v; - fscanf(stdin, "%i", &v); + fscanf(stdin, "%i", &v); // $ Source[cpp/tainted-arithmetic] ms.val = v; test2_sink(v, ms, ms, &ms); } @@ -33,9 +33,9 @@ int atoi(const char *); void test3() { char buffer[20]; - fgets(buffer, 20, stdin); + fgets(buffer, 20, stdin); // $ Source[cpp/tainted-arithmetic] int num = atoi(buffer); - num = num + 1000; // BAD - num += 1000; // BAD -} \ No newline at end of file + num = num + 1000; // $ Alert[cpp/integer-overflow-tainted] Alert[cpp/tainted-arithmetic] // BAD + num += 1000; // $ Alert[cpp/integer-overflow-tainted] Alert[cpp/tainted-arithmetic] // BAD +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test3.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test3.c index a8116e058530..a99b24cb9ac3 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test3.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test3.c @@ -9,8 +9,8 @@ // from a macro that is defined in a system header. int main3(int argc, char **argv) { char *cmd = argv[0]; - int x = (int)(unsigned char)*cmd; // BAD: overflow - int y = CAST(*cmd); // BAD: overflow in macro expansion (macro is not from a system header) + int x = (int)(unsigned char)*cmd; // $ Alert[cpp/integer-overflow-tainted] // BAD: overflow + int y = CAST(*cmd); // $ Alert[cpp/integer-overflow-tainted] // BAD: overflow in macro expansion (macro is not from a system header) int z = SYSTEM_CAST(*cmd); // GOOD: overflow in macro expansion (macro from a system header) return x + y + z; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test4.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test4.cpp index ad4cc80d30ac..94d8bfaf58e4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test4.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test4.cpp @@ -10,7 +10,7 @@ int main4(int argc, char **argv) { if (!p[0]) { // GOOD: cast to bool. return 1; } - if ((unsigned)p[1] == 0) { // BAD: cast to unsigned could overflow. + if ((unsigned)p[1] == 0) { // $ Alert[cpp/integer-overflow-tainted] // BAD: cast to unsigned could overflow. return 2; } if ((bool)p[2] != 0 || !p[3] == 1) { // GOOD: casts to bool. diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test5.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test5.cpp index 2ee675be6b57..84625f4f26b7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test5.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test5.cpp @@ -6,17 +6,17 @@ int getTaintedInt() { char buf[128]; - gets(buf); - return strtoul(buf, 0, 10); + gets(buf); // $ Source[cpp/tainted-arithmetic] + return strtoul(buf, 0, 10); // $ Alert[cpp/integer-overflow-tainted] } void useTaintedInt() { int x, y; - x = getTaintedInt() * 1024; // BAD: arithmetic on a tainted value + x = getTaintedInt() * 1024; // $ Alert[cpp/integer-overflow-tainted] Alert[cpp/tainted-arithmetic] // BAD: arithmetic on a tainted value y = getTaintedInt(); - y = y * 1024; // BAD: arithmetic on a tainted value + y = y * 1024; // $ Alert[cpp/integer-overflow-tainted] Alert[cpp/tainted-arithmetic] // BAD: arithmetic on a tainted value } typedef long long int intmax_t; @@ -39,4 +39,4 @@ void useTaintedIntWithGuardIntMaxMin() { if(imaxabs(tainted) <= INTMAX_MIN) { int product = tainted * tainted; // BAD: imaxabs(INTMAX_MIN) == INTMAX_MIN [NOT DETECTED] } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test6.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test6.cpp index c7034e6cd0ea..a2dbb1cc29c8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test6.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test6.cpp @@ -8,12 +8,12 @@ FILE *stdin; void docast1(u32 s) { - u16 c = (u16)s; // bad + u16 c = (u16)s; // $ Alert[cpp/integer-overflow-tainted] // bad } void docast2(u32 s) { - u16 c = (u16)s; // bad + u16 c = (u16)s; // $ Alert[cpp/integer-overflow-tainted] // bad } class MyBaseClass @@ -27,7 +27,7 @@ class MyDerivedClass : public MyBaseClass public: void docast(u32 s) { - u16 c = (u16)s; // bad + u16 c = (u16)s; // $ Alert[cpp/integer-overflow-tainted] // bad } }; @@ -41,7 +41,7 @@ void test6() docast1(s); { void (*docast2_ptr)(u32) = &docast2; - + docast2_ptr(s); } { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/UnsignedDifferenceExpressionComparedZero.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/UnsignedDifferenceExpressionComparedZero.qlref index 9681978c0ad1..ebdee8ed6310 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/UnsignedDifferenceExpressionComparedZero.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/UnsignedDifferenceExpressionComparedZero.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.ql +query: Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp index 37930f821291..234248610b0b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp @@ -3,11 +3,11 @@ int getAnInt(); bool cond(); void test(unsigned x, unsigned y, bool unknown) { - if(x - y > 0) { } // BAD + if(x - y > 0) { } // $ Alert // BAD unsigned total = getAnInt(); unsigned limit = getAnInt(); - while(limit - total > 0) { // BAD + while(limit - total > 0) { // $ Alert // BAD total += getAnInt(); } @@ -59,7 +59,7 @@ void test(unsigned x, unsigned y, bool unknown) { if(unknown) { ++y; } } - if(x - y > 0) { } // GOOD [FALSE POSITIVE] + if(x - y > 0) { } // $ Alert // GOOD [FALSE POSITIVE] x = y; while(cond()) { @@ -72,7 +72,7 @@ void test(unsigned x, unsigned y, bool unknown) { if (n > x - y) { n = x - y; } if (n > 0) { y += n; // NOTE: `n` is at most `x - y` at this point. - if (x - y > 0) {} // GOOD [FALSE POSITIVE] + if (x - y > 0) {} // $ Alert // GOOD [FALSE POSITIVE] } } @@ -98,7 +98,7 @@ void test4() { unsigned int a = getAnInt(); unsigned int b = a + 1; - if (a - b > 0) { // BAD + if (a - b > 0) { // $ Alert // BAD // ... } } @@ -125,7 +125,7 @@ void test7() { unsigned int b = getAnInt(); unsigned int a = b - 1; - if (a - b > 0) { // BAD + if (a - b > 0) { // $ Alert // BAD // ... } } @@ -134,7 +134,7 @@ void test8() { unsigned int a = getAnInt(); unsigned int b = getAnInt(); - if (a - b > 0) { // BAD + if (a - b > 0) { // $ Alert // BAD // ... } @@ -143,13 +143,13 @@ void test8() { // ... } } else { - if (a - b > 0) { // BAD + if (a - b > 0) { // $ Alert // BAD // ... } } if (b >= a) { // GOOD - if (a - b > 0) { // BAD + if (a - b > 0) { // $ Alert // BAD // ... } } else { @@ -179,7 +179,7 @@ void test9() { b = 0; } - if (a - b > 0) { // GOOD (as a >= b) [FALSE POSITIVE] + if (a - b > 0) { // $ Alert // GOOD (as a >= b) [FALSE POSITIVE] // ... } } @@ -205,7 +205,7 @@ void test11() { b = getAnInt(); - if (a - b > 0) { // BAD + if (a - b > 0) { // $ Alert // BAD // ... } } @@ -249,7 +249,7 @@ int test14() { return 0; } // b != 0 - return (a - b > 0); // BAD + return (a - b > 0); // $ Alert // BAD } struct Numbers @@ -263,7 +263,7 @@ int test15(Numbers *n) { return 0; } - return (n->a - n->b > 0); // BAD + return (n->a - n->b > 0); // $ Alert // BAD } int test16() { @@ -273,7 +273,7 @@ int test16() { if (!b) { return 0; } else { - return (a - b > 0); // BAD + return (a - b > 0); // $ Alert // BAD } } @@ -285,7 +285,7 @@ int test17() { return 0; } // b != 0 - return (a - b > 0); // BAD + return (a - b > 0); // $ Alert // BAD } int test18() { @@ -309,7 +309,7 @@ void test19() { uint32_t limit = get_limit(); uint32_t total = 0; - while (limit - total > 0) { // BAD: if `total` is greater than `limit` this will underflow and continue executing the loop. + while (limit - total > 0) { // $ Alert // BAD: if `total` is greater than `limit` this will underflow and continue executing the loop. total += get_data(); } @@ -359,7 +359,7 @@ void test21(unsigned long a) if(a - b > 0) { } // GOOD } int64_t b = (int64_t)a + c; - if(a - b > 0) { } // BAD + if(a - b > 0) { } // $ Alert // BAD } { @@ -374,4 +374,4 @@ void test21(unsigned long a) int b = a >> get_uint32(); if(a - b > 0) { } // GOOD } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.qlref index b899b6eeb205..d252615f6827 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-193/InvalidPointerDeref.ql +query: Security/CWE/CWE-193/InvalidPointerDeref.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp index db1017e233fe..f26d67738223 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp @@ -1,11 +1,11 @@ using size_t = decltype(sizeof 0); void* malloc(size_t size); void test1(int size) { - char* p = (char*)malloc(size); + char* p = (char*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r1 Source[cpp/invalid-pointer-deref]=r2 char* q = p + size; // $ alloc=L4 - char a = *q; // $ deref=L5->L6 // BAD + char a = *q; // $ deref=L5->L6 Alert[cpp/invalid-pointer-deref]=r1 // BAD char b = *(q - 1); // GOOD - char c = *(q + 1); // $ deref=L5->L8+1 // BAD + char c = *(q + 1); // $ deref=L5->L8+1 Alert[cpp/invalid-pointer-deref]=r2 // BAD char d = *(q + size); // BAD [NOT DETECTED] char e = *(q - size); // GOOD char f = *(q + size + 1); // BAD [NOT DETECTED] @@ -13,11 +13,11 @@ void test1(int size) { } void test2(int size) { - char* p = (char*)malloc(size); + char* p = (char*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r3 char* q = p + size - 1; // $ alloc=L16 char a = *q; // GOOD char b = *(q - 1); // GOOD - char c = *(q + 1); // $ deref=L17->L20 // BAD + char c = *(q + 1); // $ deref=L17->L20 Alert[cpp/invalid-pointer-deref]=r3 // BAD char d = *(q + size); // BAD [NOT DETECTED] char e = *(q - size); // GOOD char f = *(q + size + 1); // BAD [NOT DETECTED] @@ -25,11 +25,11 @@ void test2(int size) { } void test3(int size) { - char* p = (char*)malloc(size + 1); + char* p = (char*)malloc(size + 1); // $ Source[cpp/invalid-pointer-deref]=r4 Source[cpp/invalid-pointer-deref]=r5 char* q = p + (size + 1); // $ alloc=L28+1 - char a = *q; // $ deref=L29->L30 // BAD + char a = *q; // $ deref=L29->L30 Alert[cpp/invalid-pointer-deref]=r4 // BAD char b = *(q - 1); // GOOD - char c = *(q + 1); // $ deref=L29->L32+1 // BAD + char c = *(q + 1); // $ deref=L29->L32+1 Alert[cpp/invalid-pointer-deref]=r5 // BAD char d = *(q + size); // BAD [NOT DETECTED] char e = *(q - size); // GOOD char f = *(q + size + 1); // BAD [NOT DETECTED] @@ -49,7 +49,7 @@ void test4(int size) { } char* mk_array(int size, char** end) { - char* begin = (char*)malloc(size); + char* begin = (char*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r6 *end = begin + size; // $ alloc=L52 return begin; @@ -64,7 +64,7 @@ void test5(int size) { } for (char* p = begin; p <= end; ++p) { - *p = 0; // $ deref=L53->L62->L67 deref=L53->L66->L67 // BAD + *p = 0; // $ deref=L53->L62->L67 deref=L53->L66->L67 Alert[cpp/invalid-pointer-deref]=r6 // BAD } for (char* p = begin; p < end; ++p) { @@ -202,7 +202,7 @@ void test12(unsigned len, unsigned index) { } void test13(unsigned len, unsigned index) { - char* p = (char *)malloc(len); + char* p = (char *)malloc(len); // $ Source[cpp/invalid-pointer-deref]=r7 char* end = p + len; // $ alloc=L205 char* q = p + index; @@ -210,7 +210,7 @@ void test13(unsigned len, unsigned index) { return; } - *q = '\0'; // $ deref=L206->L213 // BAD + *q = '\0'; // $ deref=L206->L213 Alert[cpp/invalid-pointer-deref]=r7 // BAD } bool unknown(); @@ -257,21 +257,21 @@ void test17(unsigned *p, unsigned x, unsigned k) { void test17(unsigned len) { - int *xs = new int[len]; + int *xs = new int[len]; // $ Source[cpp/invalid-pointer-deref]=r8 int *end = xs + len; // $ alloc=L260 for (int *x = xs; x <= end; x++) { - int i = *x; // $ deref=L261->L264 // BAD + int i = *x; // $ deref=L261->L264 Alert[cpp/invalid-pointer-deref]=r8 // BAD } } void test18(unsigned len) { - int *xs = new int[len]; + int *xs = new int[len]; // $ Source[cpp/invalid-pointer-deref]=r9 int *end = xs + len; // $ alloc=L270 for (int *x = xs; x <= end; x++) { - *x = 0; // $ deref=L271->L274 // BAD + *x = 0; // $ deref=L271->L274 Alert[cpp/invalid-pointer-deref]=r9 // BAD } } @@ -352,11 +352,11 @@ void test24(unsigned size) { } void test25(unsigned size) { - char *xs = new char[size]; + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r10 Source[cpp/invalid-pointer-deref]=r11 char *end = xs + size; // $ alloc=L355 char *end_plus_one = end + 1; - int val1 = *end_plus_one; // $ deref=L356->L358+1 // BAD - int val2 = *(end_plus_one + 1); // $ deref=L356->L359+2 // BAD + int val1 = *end_plus_one; // $ deref=L356->L358+1 Alert[cpp/invalid-pointer-deref]=r10 // BAD + int val2 = *(end_plus_one + 1); // $ deref=L356->L359+2 Alert[cpp/invalid-pointer-deref]=r11 // BAD } void test26(unsigned size) { @@ -374,14 +374,14 @@ void test26(unsigned size) { } void test27(unsigned size, bool b) { - char *xs = new char[size]; + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r12 char *end = xs + size; // $ alloc=L377 if (b) { end++; } - int val = *end; // $ deref=L378->L384+1 // BAD + int val = *end; // $ deref=L378->L384+1 Alert[cpp/invalid-pointer-deref]=r12 // BAD } void test28(unsigned size) { @@ -407,47 +407,47 @@ void test28_simple(unsigned size) { } void test28_simple2(unsigned size) { - char *xs = new char[size]; + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r13 char *end = &xs[size]; // $ alloc=L410 if (xs < end) { xs++; if (xs < end + 1) { - xs[0] = 0; // $ deref=L411->L415 // BAD + xs[0] = 0; // $ deref=L411->L415 Alert[cpp/invalid-pointer-deref]=r13 // BAD } } } void test28_simple3(unsigned size) { - char *xs = new char[size]; + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r14 char *end = &xs[size]; // $ alloc=L421 if (xs < end) { xs++; if (xs - 1 < end) { - xs[0] = 0; // $ deref=L422->L426 // BAD + xs[0] = 0; // $ deref=L422->L426 Alert[cpp/invalid-pointer-deref]=r14 // BAD } } } void test28_simple4(unsigned size) { - char *xs = new char[size]; + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r15 char *end = &xs[size]; // $ alloc=L432 if (xs < end) { end++; xs++; if (xs < end) { - xs[0] = 0; // $ deref=L433->L438 // BAD + xs[0] = 0; // $ deref=L433->L438 Alert[cpp/invalid-pointer-deref]=r15 // BAD } } } void test28_simple5(unsigned size) { - char *xs = new char[size]; + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r16 char *end = &xs[size]; // $ alloc=L444 end++; if (xs < end) { xs++; if (xs < end) { - xs[0] = 0; // $ deref=L445->L450 // BAD + xs[0] = 0; // $ deref=L445->L450 Alert[cpp/invalid-pointer-deref]=r16 // BAD } } } @@ -477,13 +477,13 @@ void test28_simple7(unsigned size) { } void test28_simple8(unsigned size) { - char *xs = new char[size]; + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r17 char *end = &xs[size]; // $ alloc=L480 end += 500; if (xs < end) { xs++; if (xs < end - 1) { - xs[0] = 0; // $ deref=L481->L486+498 // BAD + xs[0] = 0; // $ deref=L481->L486+498 Alert[cpp/invalid-pointer-deref]=r17 // BAD } } } @@ -540,23 +540,23 @@ void test31_simple1(unsigned size, unsigned src_pos) void test31_simple2(unsigned size, unsigned src_pos) { - char *xs = new char[size]; + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r18 if (src_pos > size) { src_pos = size; } if (src_pos < size + 1) { - xs[src_pos] = 0; // $ alloc=L543 deref=L548 // BAD + xs[src_pos] = 0; // $ alloc=L543 deref=L548 Alert[cpp/invalid-pointer-deref]=r18 // BAD } } void test31_simple3(unsigned size, unsigned src_pos) { - char *xs = new char[size]; + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r19 if (src_pos > size) { src_pos = size; } if (src_pos - 1 < size) { - xs[src_pos] = 0; // $ alloc=L554 deref=L559 // BAD + xs[src_pos] = 0; // $ alloc=L554 deref=L559 Alert[cpp/invalid-pointer-deref]=r19 // BAD } } @@ -639,12 +639,12 @@ void test31_simple5_plus1(unsigned size, unsigned src_pos) void test31_simple1_sub1(unsigned size, unsigned src_pos) { - char *xs = new char[size - 1]; + char *xs = new char[size - 1]; // $ Source[cpp/invalid-pointer-deref]=r20 if (src_pos > size) { src_pos = size; } if (src_pos < size) { - xs[src_pos] = 0; // $ alloc=L642-1 deref=L647 // BAD + xs[src_pos] = 0; // $ alloc=L642-1 deref=L647 Alert[cpp/invalid-pointer-deref]=r20 // BAD } } @@ -727,10 +727,10 @@ void test21_simple(bool b) { } void test36(unsigned size, unsigned n) { - int* p = new int[size + 2]; + int* p = new int[size + 2]; // $ Source[cpp/invalid-pointer-deref]=r21 if(n < size + 1) { int* end = p + (n + 2); // $ alloc=L730+2 - *end = 0; // $ deref=L732->L733 // BAD + *end = 0; // $ deref=L732->L733 Alert[cpp/invalid-pointer-deref]=r21 // BAD } } @@ -751,7 +751,7 @@ void error(const char * msg) { } void test38(unsigned size) { - char * alloc = new char[size]; + char * alloc = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r22 Source[cpp/invalid-pointer-deref]=r23 Source[cpp/invalid-pointer-deref]=r24 Source[cpp/invalid-pointer-deref]=r25 unsigned pos = 0; while (pos < size) { @@ -764,12 +764,12 @@ void test38(unsigned size) { case '0': if (n != 1) error(""); - char x = alloc[pos + 1]; // $ alloc=L754 deref=L767 // GOOD [FALSE POSITIVE] + char x = alloc[pos + 1]; // $ alloc=L754 deref=L767 Alert[cpp/invalid-pointer-deref]=r22 Alert[cpp/invalid-pointer-deref]=r23 // GOOD [FALSE POSITIVE] break; case '1': if (n != 2) error(""); - char a = alloc[pos + 1]; // $ alloc=L754 deref=L772 // GOOD [FALSE POSITIVE] + char a = alloc[pos + 1]; // $ alloc=L754 deref=L772 Alert[cpp/invalid-pointer-deref]=r24 Alert[cpp/invalid-pointer-deref]=r25 // GOOD [FALSE POSITIVE] char b = alloc[pos + 2]; break; } @@ -778,19 +778,19 @@ void test38(unsigned size) { } void test38_simple(unsigned size, unsigned pos, unsigned numParams) { - char * p = new char[size]; + char * p = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r26 if (pos < size) { if (pos + numParams < size) { if (numParams == 1) { - char x = p[pos + 1]; // $ alloc=L781 deref=L786 // GOOD [FALSE POSITIVE] + char x = p[pos + 1]; // $ alloc=L781 deref=L786 Alert[cpp/invalid-pointer-deref]=r26 // GOOD [FALSE POSITIVE] } } } } void mk_array_no_field_flow(int size, char** begin, char** end) { - *begin = (char*)malloc(size); + *begin = (char*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r27 Source[cpp/invalid-pointer-deref]=r28 *end = *begin + size; // $ alloc=L793 } @@ -804,7 +804,7 @@ void test6_no_field_flow(int size) { } for (char* p = begin; p <= end; ++p) { - *p = 0; // $ deref=L794->L802->L807 deref=L794->L806->L807 // BAD + *p = 0; // $ deref=L794->L802->L807 deref=L794->L806->L807 Alert[cpp/invalid-pointer-deref]=r27 // BAD } for (char* p = begin; p < end; ++p) { @@ -818,7 +818,7 @@ void test7_callee_no_field_flow(char* begin, char* end) { } for (char* p = begin; p <= end; ++p) { - *p = 0; // $ deref=L794->L815->L821 deref=L794->L816->L821 deref=L794->L820->L821 // BAD + *p = 0; // $ deref=L794->L815->L821 deref=L794->L816->L821 deref=L794->L820->L821 Alert[cpp/invalid-pointer-deref]=r28 // BAD } for (char* p = begin; p < end; ++p) { @@ -838,26 +838,26 @@ void test15_with_malloc(size_t index) { if(size < index) { return; } - int* newname = (int*)malloc(size); - newname[index] = 0; // $ SPURIOUS: alloc=L841 deref=L842 // GOOD [FALSE POSITIVE] + int* newname = (int*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r29 + newname[index] = 0; // $ SPURIOUS: alloc=L841 deref=L842 Alert[cpp/invalid-pointer-deref]=r29 // GOOD [FALSE POSITIVE] } void test16_with_malloc(size_t index) { size_t size = index + 13; if(size >= index) { - int* newname = (int*)malloc(size); - newname[index] = 0; // $ SPURIOUS: alloc=L848 deref=L849 // GOOD [FALSE POSITIVE] + int* newname = (int*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r30 + newname[index] = 0; // $ SPURIOUS: alloc=L848 deref=L849 Alert[cpp/invalid-pointer-deref]=r30 // GOOD [FALSE POSITIVE] } } # define MyMalloc(size) malloc(((size) == 0 ? 1 : (size))) void test_regression(size_t size) { - int* p = (int*)MyMalloc(size + 1); + int* p = (int*)MyMalloc(size + 1); // $ Source[cpp/invalid-pointer-deref]=r31 int* chend = p + (size + 1); // $ alloc=L856+1 if(p <= chend) { - *p = 42; // $ deref=L857->L860 // BAD + *p = 42; // $ deref=L857->L860 Alert[cpp/invalid-pointer-deref]=r31 // BAD } } @@ -865,7 +865,7 @@ void test_regression(size_t size) { void* g_malloc(size_t size); void test17(int size) { - char* p = (char*)g_malloc(size); + char* p = (char*)g_malloc(size); // $ Source[cpp/invalid-pointer-deref]=r32 char* q = p + size; // $ alloc=L868 - char a = *q; // $ deref=L869->L870 // BAD -} \ No newline at end of file + char a = *q; // $ deref=L869->L870 Alert[cpp/invalid-pointer-deref]=r32 // BAD +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-197/SAMATE/IntegerOverflowTainted/IntegerOverflowTainted.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-197/SAMATE/IntegerOverflowTainted/IntegerOverflowTainted.qlref index 72ed7d536854..419ed80f3b9e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-197/SAMATE/IntegerOverflowTainted/IntegerOverflowTainted.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-197/SAMATE/IntegerOverflowTainted/IntegerOverflowTainted.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-190/IntegerOverflowTainted.ql \ No newline at end of file +query: Security/CWE/CWE-190/IntegerOverflowTainted.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-197/SAMATE/IntegerOverflowTainted/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-197/SAMATE/IntegerOverflowTainted/tests.cpp index 79f9a79c97fc..76d25fbe46c8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-197/SAMATE/IntegerOverflowTainted/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-197/SAMATE/IntegerOverflowTainted/tests.cpp @@ -35,7 +35,7 @@ void CWE197_Numeric_Truncation_Error__short_fscanf_82_bad::action(short data) { { /* POTENTIAL FLAW: Convert data to a char, possibly causing a truncation error */ - char charData = (char)data; + char charData = (char)data; // $ Alert printHexCharLine(charData); } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousFunctionOverflow.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousFunctionOverflow.qlref index e46499468514..41d5b35b3c97 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousFunctionOverflow.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousFunctionOverflow.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-676/DangerousFunctionOverflow.ql +query: Security/CWE/CWE-676/DangerousFunctionOverflow.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousUseOfCin.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousUseOfCin.qlref index 676e30536454..a5067fc5ee1a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousUseOfCin.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousUseOfCin.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-676/DangerousUseOfCin.ql \ No newline at end of file +query: Security/CWE/CWE-676/DangerousUseOfCin.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWrite.qlref index f6c962c1a7b4..18ae0f2a567b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/OverrunWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/OverrunWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWriteFloat.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWriteFloat.qlref index 757d1592e830..ba8f6a96a1fd 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWriteFloat.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWriteFloat.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/OverrunWriteFloat.ql \ No newline at end of file +query: Security/CWE/CWE-120/OverrunWriteFloat.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/VeryLikelyOverrunWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/VeryLikelyOverrunWrite.qlref index 94b53951c4b7..8dcc2f70c2f6 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/VeryLikelyOverrunWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/VeryLikelyOverrunWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql \ No newline at end of file +query: Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/tests.cpp index 8bb6dfdd996c..0f099c86b2bb 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/tests.cpp @@ -24,7 +24,7 @@ namespace std class basic_string { public: explicit basic_string(const Allocator& a = Allocator()); - basic_string(const charT* s, const Allocator& a = Allocator()); + basic_string(const charT* s, const Allocator& a = Allocator()); }; // std::string @@ -109,7 +109,7 @@ char *test1() { static char buffer[1024]; - return gets(buffer); // BAD: use of gets + return gets(buffer); // $ Alert[cpp/dangerous-function-overflow] // BAD: use of gets } typedef char MYCHAR; @@ -126,17 +126,17 @@ void test2() char *buffer4 = buffer1; std::istream &input = std::cin; - std::cin >> buffer1; // BAD: use of operator>> into a statically-allocated character array - std::cin >> buffer2; // BAD: use of operator>> into a statically-allocated character array - std::cin >> buffer3; // BAD: use of operator>> into a statically-allocated character array - std::cin >> buffer4; // BAD: use of operator>> into a statically-allocated character array + std::cin >> buffer1; // $ Alert[cpp/dangerous-cin] // BAD: use of operator>> into a statically-allocated character array + std::cin >> buffer2; // $ Alert[cpp/dangerous-cin] // BAD: use of operator>> into a statically-allocated character array + std::cin >> buffer3; // $ Alert[cpp/dangerous-cin] // BAD: use of operator>> into a statically-allocated character array + std::cin >> buffer4; // $ Alert[cpp/dangerous-cin] // BAD: use of operator>> into a statically-allocated character array input >> buffer1; // BAD: use of operator>> into a statically-allocated character array (NOT DETECTED) } { std::string str; int i; - + std::cin >> i; // GOOD: destination is not a character array std::cin >> str; // GOOD: destination is not statically sized } @@ -148,22 +148,22 @@ void test2() ss.str("Hello, world!"); ss >> buffer; // GOOD: input has known length } - + { char buffer[100]; int i, j, k; std::cin >> i >> j >> k; // GOOD: destinations are not character arrays - std::cin >> i >> buffer >> k; // BAD: use of operator>> into a statically-allocated character array - + std::cin >> i >> buffer >> k; // $ Alert[cpp/dangerous-cin] // BAD: use of operator>> into a statically-allocated character array + } - + { static wchar_t wbuf[1024]; static char buf[1024]; static int i; - std::wcin >> wbuf; // BAD: use of operator>> into a statically-allocated character array + std::wcin >> wbuf; // $ Alert[cpp/dangerous-cin] // BAD: use of operator>> into a statically-allocated character array std::wcin >> i; // GOOD: destination is not a character array } @@ -174,12 +174,12 @@ void test2() char buf[4096]; int i; - my_ifstream >> buf; // BAD: use of operator>> into a statically-allocated character array + my_ifstream >> buf; // $ Alert[cpp/dangerous-cin] // BAD: use of operator>> into a statically-allocated character array my_ifstream >> i; // GOOD: destination is not a character array - my_wifstream >> wbuf; // BAD: use of operator>> into a statically-allocated character array + my_wifstream >> wbuf; // $ Alert[cpp/dangerous-cin] // BAD: use of operator>> into a statically-allocated character array my_wifstream >> i; // GOOD: destination is not a character array } - + { wchar_t wbuf[10]; char buf1[10], buf2[10]; @@ -187,54 +187,54 @@ void test2() std::cin.width(10); std::cin >> buf1; // GOOD: controlled by width() - std::cin >> buf2; // BAD: uncontrolled by width() + std::cin >> buf2; // $ Alert[cpp/dangerous-cin] // BAD: uncontrolled by width() std::cin.width(10); - std::cin >> buf1 >> buf2; // BAD: buf2 is uncontrolled by width() + std::cin >> buf1 >> buf2; // $ Alert[cpp/dangerous-cin] // BAD: buf2 is uncontrolled by width() std::cin.width(10); std::cin >> i; // GOOD: destination is not a character array std::cin >> buf1; // GOOD: controlled by width() - + std::cin.width(10); std::cin >> i >> buf1; // GOOD: controlled by width() std::cin.width(20); - std::cin >> buf1; // BAD: specified width is too large + std::cin >> buf1; // $ Alert[cpp/dangerous-cin] // BAD: specified width is too large std::cin.width(int_func()); std::cin >> buf1; // GOOD: controlled by width() std::wcin.width(10); - std::cin >> buf2; // BAD: uncontrolled by width() + std::cin >> buf2; // $ Alert[cpp/dangerous-cin] // BAD: uncontrolled by width() std::wcin >> wbuf; // GOOD: controlled by width() std::cin >> std::setw(10) >> buf1; // GOOD: controlled by setw - std::cin >> std::setw(10) >> buf1 >> buf2; // BAD: buf2 is uncontrolled - std::cin >> std::setw(20) >> buf1; // BAD: specified width is too large - + std::cin >> std::setw(10) >> buf1 >> buf2; // $ Alert[cpp/dangerous-cin] // BAD: buf2 is uncontrolled + std::cin >> std::setw(20) >> buf1; // $ Alert[cpp/dangerous-cin] // BAD: specified width is too large + std::cin.width(20); std::cin.width(10); std::cin >> buf2; // GOOD: controlled by width() } - + { char buf[10]; int i; - (std::cin >> i) >> buf; // BAD: use of operator>> into a statically-allocated character array - + (std::cin >> i) >> buf; // $ Alert[cpp/dangerous-cin] // BAD: use of operator>> into a statically-allocated character array + (std::cin >> i).width(10); std::cin >> buf; // GOOD: controlled by width() - + ((std::cin >> i) >> std::setw(10)) >> buf; // GOOD: controlled by setw() } - + { char buf[10]; std::string str; - std::cin >> std::setw(10) >> str >> buf; // BAD: buf is uncontrolled + std::cin >> std::setw(10) >> str >> buf; // $ Alert[cpp/dangerous-cin] // BAD: buf is uncontrolled } } @@ -246,8 +246,8 @@ void test3(char c, int val, char *str) char buffer10[10]; MyCharArray myBuffer10; - gets(buffer10); // BAD: use of gets - gets(myBuffer10); // BAD: use of gets + gets(buffer10); // $ Alert[cpp/dangerous-function-overflow] // BAD: use of gets + gets(myBuffer10); // $ Alert[cpp/dangerous-function-overflow] // BAD: use of gets sprintf(buffer10, "%c", c); // GOOD sprintf(myBuffer10, "%c", c); // GOOD @@ -255,8 +255,8 @@ void test3(char c, int val, char *str) sprintf(buffer10, "%s", str); // BAD: potential buffer overflow [NOT DETECTED] sprintf(myBuffer10, "%s", str); // BAD: potential buffer overflow [NOT DETECTED] - sprintf(buffer10, "val: %i", val); // BAD: potential buffer overflow - sprintf(myBuffer10, "val: %i", val); // BAD: potential buffer overflow + sprintf(buffer10, "val: %i", val); // $ Alert[cpp/overrunning-write] // BAD: potential buffer overflow + sprintf(myBuffer10, "val: %i", val); // $ Alert[cpp/overrunning-write] // BAD: potential buffer overflow } void test3_caller() @@ -269,8 +269,8 @@ void test4() char buffer8[8]; char *buffer8_ptr = buffer8; - sprintf(buffer8, "12345678"); // BAD: buffer overflow - sprintf(buffer8_ptr, "12345678"); // BAD: buffer overflow + sprintf(buffer8, "12345678"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow + sprintf(buffer8_ptr, "12345678"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow } typedef void *va_list; @@ -284,7 +284,7 @@ void test5(va_list args, float f) vsprintf(buffer10, "123456789", args); // GOOD vsprintf(buffer10, "1234567890", args); // BAD: buffer overflow [NOT DETECTED] - sprintf(buffer64, "%f", f); // BAD: potential buffer overflow + sprintf(buffer64, "%f", f); // $ Alert[cpp/overrunning-write-with-float] // BAD: potential buffer overflow vsprintf(buffer4, "123", args); // GOOD vsprintf(buffer4, "1234", args); // BAD: buffer overflow [NOT DETECTED] @@ -305,28 +305,28 @@ namespace custom_sprintf_impl { void regression_test1() { char buffer8[8]; - sprintf(buffer8, "12345678"); // BAD: potential buffer overflow + sprintf(buffer8, "12345678"); // $ Alert[cpp/very-likely-overrunning-write] // BAD: potential buffer overflow } } void test6(unsigned unsigned_value, int value) { char buffer2[2], buffer3[3], buffer4[4], buffer5[5]; - - sprintf(buffer4, "%u", unsigned_value); // BAD: buffer overflow - sprintf(buffer4, "%d", unsigned_value); // BAD: buffer overflow + + sprintf(buffer4, "%u", unsigned_value); // $ Alert[cpp/overrunning-write] // BAD: buffer overflow + sprintf(buffer4, "%d", unsigned_value); // $ Alert[cpp/overrunning-write] // BAD: buffer overflow if (unsigned_value < 1000) { sprintf(buffer4, "%u", unsigned_value); // GOOD } - sprintf(buffer4, "%u", -100); // BAD: buffer overflow + sprintf(buffer4, "%u", -100); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow if(unsigned_value == (unsigned)-100) { - sprintf(buffer4, "%u", unsigned_value); // BAD: buffer overflow + sprintf(buffer4, "%u", unsigned_value); // $ Alert[cpp/very-likely-overrunning-write] // BAD: buffer overflow } - sprintf(buffer4, "%d", value); // BAD: buffer overflow + sprintf(buffer4, "%d", value); // $ Alert[cpp/overrunning-write] // BAD: buffer overflow if (value < 1000) { - sprintf(buffer4, "%d", value); // BAD: buffer overflow + sprintf(buffer4, "%d", value); // $ Alert[cpp/overrunning-write] // BAD: buffer overflow if(value > -100) { sprintf(buffer4, "%d", value); // GOOD @@ -338,28 +338,28 @@ void test6(unsigned unsigned_value, int value) { sprintf(buffer2, "%u", 5); // GOOD sprintf(buffer2, "%d", 5); // GOOD - sprintf(buffer2, "%d", -1); // BAD + sprintf(buffer2, "%d", -1); // $ Alert[cpp/very-likely-overrunning-write] // BAD sprintf(buffer2, "%d", 9); // GOOD - sprintf(buffer2, "%d", 10); // BAD + sprintf(buffer2, "%d", 10); // $ Alert[cpp/very-likely-overrunning-write] // BAD - sprintf(buffer2, "%u", -1); // BAD + sprintf(buffer2, "%u", -1); // $ Alert[cpp/very-likely-overrunning-write] // BAD sprintf(buffer2, "%u", 9); // GOOD - sprintf(buffer2, "%u", 10); // BAD + sprintf(buffer2, "%u", 10); // $ Alert[cpp/very-likely-overrunning-write] // BAD unsigned char unsigned_char = unsigned_value; - sprintf(buffer3, "%u", (unsigned)unsigned_char); // BAD + sprintf(buffer3, "%u", (unsigned)unsigned_char); // $ Alert[cpp/overrunning-write] // BAD sprintf(buffer4, "%u", (unsigned)unsigned_char); // GOOD: 0..255 fits unsigned small = unsigned_value >> (sizeof(unsigned_value) * 8 - 9); // in range 0..511 - sprintf(buffer3, "%u", small); // BAD + sprintf(buffer3, "%u", small); // $ Alert[cpp/very-likely-overrunning-write] // BAD sprintf(buffer4, "%u", small); // GOOD small = unsigned_value & ((1u << 9) - 1); // in range 0..511 - sprintf(buffer3, "%u", small); // BAD + sprintf(buffer3, "%u", small); // $ Alert[cpp/very-likely-overrunning-write] // BAD sprintf(buffer4, "%u", small); // GOOD: 0..511 fits char c = value; - sprintf(buffer4, "%d", (int)c); // BAD: e.g. -127 does not fit + sprintf(buffer4, "%d", (int)c); // $ Alert[cpp/overrunning-write] // BAD: e.g. -127 does not fit sprintf(buffer5, "%d", (int)c); // GOOD: -127..128 fits -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.c b/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.c index 732fd5f0f443..8dd7840e6d1c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.c @@ -39,22 +39,22 @@ bool BoolFunction2() HRESULT IncorrectHresultFunction() { - return BoolFunction(); // BUG + return BoolFunction(); // $ Alert // BUG } HRESULT IncorrectHresultFunction2() { - return BoolFunction2(); // BUG + return BoolFunction2(); // $ Alert // BUG } void IncorrectTypeConversionTest() { HRESULT hr = HresultFunction(); - if ((BOOL)hr) // BUG + if ((BOOL)hr) // $ Alert // BUG { // ... } - if ((bool)hr) // BUG + if ((bool)hr) // $ Alert // BUG { // ... } @@ -63,11 +63,11 @@ void IncorrectTypeConversionTest() { // ... } - if (SUCCEEDED(BoolFunction())) // BUG + if (SUCCEEDED(BoolFunction())) // $ Alert // BUG { // ... } - if (SUCCEEDED(BoolFunction2())) // BUG + if (SUCCEEDED(BoolFunction2())) // $ Alert // BUG { // ... } @@ -75,11 +75,11 @@ void IncorrectTypeConversionTest() { { // ... } - BOOL b = IncorrectHresultFunction(); // BUG - bool b2 = IncorrectHresultFunction(); // BUG + BOOL b = IncorrectHresultFunction(); // $ Alert // BUG + bool b2 = IncorrectHresultFunction(); // $ Alert // BUG hr = E_UNEXPECTED; - if (!hr) // BUG + if (!hr) // $ Alert // BUG { // ... } @@ -89,7 +89,7 @@ void IncorrectTypeConversionTest() { } hr = S_FALSE; - if (hr) // BUG + if (hr) // $ Alert // BUG { // ... } @@ -103,7 +103,7 @@ void IncorrectTypeConversionTest() { // ... } - while (!HresultFunction()) {}; // BUG + while (!HresultFunction()) {}; // $ Alert // BUG while (FAILED(HresultFunction())) {}; // Correct Usage switch(hr) // Correct Usage @@ -119,4 +119,4 @@ void IncorrectTypeConversionTest() { // ... } break; } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.cpp index d2857226bfaa..5c82199dbd23 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.cpp @@ -1,11 +1,11 @@ // semmle-extractor-options: --microsoft // winnt.h -typedef long HRESULT; +typedef long HRESULT; #define SUCCEEDED(hr) (((HRESULT)(hr)) >= 0) #define FAILED(hr) (((HRESULT)(hr)) < 0) // minwindef.h -typedef int BOOL; +typedef int BOOL; #ifndef FALSE #define FALSE 0 #endif @@ -36,22 +36,22 @@ bool BoolFunction2() HRESULT IncorrectHresultFunction() { - return BoolFunction(); // BUG + return BoolFunction(); // $ Alert // BUG } HRESULT IncorrectHresultFunction2() { - return BoolFunction2(); // BUG + return BoolFunction2(); // $ Alert // BUG } void IncorrectTypeConversionTest() { HRESULT hr = HresultFunction(); - if ((BOOL)hr) // BUG + if ((BOOL)hr) // $ Alert // BUG { // ... } - if ((bool)hr) // BUG + if ((bool)hr) // $ Alert // BUG { // ... } @@ -60,11 +60,11 @@ void IncorrectTypeConversionTest() { // ... } - if (SUCCEEDED(BoolFunction())) // BUG + if (SUCCEEDED(BoolFunction())) // $ Alert // BUG { // ... } - if (SUCCEEDED(BoolFunction2())) // BUG + if (SUCCEEDED(BoolFunction2())) // $ Alert // BUG { // ... } @@ -72,11 +72,11 @@ void IncorrectTypeConversionTest() { { // ... } - BOOL b = IncorrectHresultFunction(); // BUG - bool b2 = IncorrectHresultFunction(); // BUG + BOOL b = IncorrectHresultFunction(); // $ Alert // BUG + bool b2 = IncorrectHresultFunction(); // $ Alert // BUG hr = E_UNEXPECTED; - if (!hr) // BUG + if (!hr) // $ Alert // BUG { // ... } @@ -86,7 +86,7 @@ void IncorrectTypeConversionTest() { } hr = S_FALSE; - if (hr) // BUG + if (hr) // $ Alert // BUG { // ... } @@ -100,7 +100,7 @@ void IncorrectTypeConversionTest() { // ... } - while (!HresultFunction()) {}; // BUG + while (!HresultFunction()) {}; // $ Alert // BUG while (FAILED(HresultFunction())) {}; // Correct Usage switch(hr) // Correct Usage @@ -116,4 +116,4 @@ void IncorrectTypeConversionTest() { // ... } break; } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.qlref index a345e5c6dfb3..101c0a1e3e2e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-253/HResultBooleanConversion.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-253/HResultBooleanConversion.ql \ No newline at end of file +query: Security/CWE/CWE-253/HResultBooleanConversion.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.qlref index cf3c4b27d278..3e4f219f5233 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/AuthenticationBypass.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-290/AuthenticationBypass.ql \ No newline at end of file +query: Security/CWE/CWE-290/AuthenticationBypass.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/test.cpp index 72b9155cb841..3db528faf85f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-290/semmle/AuthenticationBypass/test.cpp @@ -11,53 +11,53 @@ extern char *getenv(const char *name); int isServer; -void processRequest1() +void processRequest1() { - const char *address = getenv("SERVERIP"); + const char *address = getenv("SERVERIP"); // $ Source // BAD: the address is controllable by the user, so it // could be spoofed to bypass the security check. - if (strcmp(address, "127.0.0.1")) { + if (strcmp(address, "127.0.0.1")) { // $ Alert isServer = 1; } } -void processRequest2() +void processRequest2() { - const char *address = getenv("SERVERIP"); + const char *address = getenv("SERVERIP"); // $ Source // BAD: the address is controllable by the user, so it // could be spoofed to bypass the security check. - if (strcmp(address, "www.mycompany.com")) { + if (strcmp(address, "www.mycompany.com")) { // $ Alert isServer = 1; } } -void processRequest3() +void processRequest3() { - const char *address = getenv("SERVERIP"); + const char *address = getenv("SERVERIP"); // $ Source // BAD: the address is controllable by the user, so it // could be spoofed to bypass the security check. - if (strcmp(address, "www.mycompany.co.uk")) { + if (strcmp(address, "www.mycompany.co.uk")) { // $ Alert isServer = 1; } } -void processRequest4() +void processRequest4() { - const char *address = getenv("SERVERIP"); + const char *address = getenv("SERVERIP"); // $ Source bool cond = false; - if (strcmp(address, "127.0.0.1")) { cond = true; } // BAD + if (strcmp(address, "127.0.0.1")) { cond = true; } // $ Alert // BAD if (strcmp(address, "127_0_0_1")) { cond = true; } // GOOD (not an IP) if (strcmp(address, "127.0.0")) { cond = true; } // GOOD (not an IP) if (strcmp(address, "127.0.0.0.1")) { cond = true; } // GOOD (not an IP) - if (strcmp(address, "http://mycompany")) { cond = true; } // BAD + if (strcmp(address, "http://mycompany")) { cond = true; } // $ Alert // BAD if (strcmp(address, "http_//mycompany")) { cond = true; } // GOOD (not an address) if (strcmp(address, "htt://mycompany")) { cond = true; } // GOOD (not an address) if (strcmp(address, "httpp://mycompany")) { cond = true; } // GOOD (not an address) - if (strcmp(address, "mycompany.com")) { cond = true; } // BAD + if (strcmp(address, "mycompany.com")) { cond = true; } // $ Alert // BAD if (strcmp(address, "mycompany_com")) { cond = true; } // GOOD (not an address) if (strcmp(address, "mycompany.c")) { cond = true; } // GOOD (not an address) if (strcmp(address, "mycompany.comm")) { cond = true; } // GOOD (not an address) @@ -66,4 +66,3 @@ void processRequest4() isServer = 1; } } - diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-295/SSLResultConflation.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-295/SSLResultConflation.qlref index 493b42eeae1f..116b386747b9 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-295/SSLResultConflation.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-295/SSLResultConflation.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-295/SSLResultConflation.ql \ No newline at end of file +query: Security/CWE/CWE-295/SSLResultConflation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-295/SSLResultNotChecked.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-295/SSLResultNotChecked.qlref index f019c08b357a..fc0209620fec 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-295/SSLResultNotChecked.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-295/SSLResultNotChecked.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-295/SSLResultNotChecked.ql \ No newline at end of file +query: Security/CWE/CWE-295/SSLResultNotChecked.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp index 74f00600a506..d93fffc71d64 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp @@ -15,7 +15,7 @@ bool is_ok(int result) bool is_maybe_ok(int result) { - return (result == 0) || (result == 1); // BAD (conflates OK and a non-OK codes) + return (result == 0) || (result == 1); // $ Alert[cpp/certificate-result-conflation] // BAD (conflates OK and a non-OK codes) } void test1_1(SSL *ssl) @@ -35,7 +35,7 @@ void test1_1(SSL *ssl) { int result = SSL_get_verify_result(ssl); - if ((result == 0) || (result == 1)) // BAD (conflates OK and a non-OK codes) + if ((result == 0) || (result == 1)) // $ Alert[cpp/certificate-result-conflation] // BAD (conflates OK and a non-OK codes) { } } @@ -51,7 +51,7 @@ void test1_1(SSL *ssl) { int result = SSL_get_verify_result(ssl); - if ((result == 0) || (false) || (result == 2)) // BAD (conflates OK and a non-OK codes) + if ((result == 0) || (false) || (result == 2)) // $ Alert[cpp/certificate-result-conflation] // BAD (conflates OK and a non-OK codes) { } } @@ -59,7 +59,7 @@ void test1_1(SSL *ssl) { int result = SSL_get_verify_result(ssl); - if ((0 == result) || (1 == result)) // BAD (conflates OK and a non-OK codes) + if ((0 == result) || (1 == result)) // $ Alert[cpp/certificate-result-conflation] // BAD (conflates OK and a non-OK codes) { } } @@ -67,7 +67,7 @@ void test1_1(SSL *ssl) { int result = SSL_get_verify_result(ssl); - if ((result != 0) && (result != 1)) // BAD (conflates OK and a non-OK codes) + if ((result != 0) && (result != 1)) // $ Alert[cpp/certificate-result-conflation] // BAD (conflates OK and a non-OK codes) { } else { // conflation occurs here @@ -80,14 +80,14 @@ void test1_1(SSL *ssl) int result2 = get_verify_result_indirect(ssl); int result3 = something_else(ssl); - if ((result == 0) || (result_cpy == 1)) // BAD (conflates OK and a non-OK codes) + if ((result == 0) || (result_cpy == 1)) // $ Alert[cpp/certificate-result-conflation] // BAD (conflates OK and a non-OK codes) { } - - if ((result2 == 0) || (result2 == 1)) // BAD (conflates OK and a non-OK codes) + + if ((result2 == 0) || (result2 == 1)) // $ Alert[cpp/certificate-result-conflation] // BAD (conflates OK and a non-OK codes) { } - + if ((result3 == 0) || (result3 == 1)) // GOOD (not an SSL result) { } @@ -104,9 +104,9 @@ void test1_1(SSL *ssl) { int result = SSL_get_verify_result(ssl); - bool ok = (result == 0) || (result == 1); // BAD (conflates OK and a non-OK codes) - - if (ok) { + bool ok = (result == 0) || (result == 1); // $ Alert[cpp/certificate-result-conflation] // BAD (conflates OK and a non-OK codes) + + if (ok) { // $ Alert[cpp/certificate-result-conflation] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-295/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-295/test2.cpp index ed6e3989f2b0..9f123b117466 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-295/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-295/test2.cpp @@ -10,7 +10,7 @@ bool maybe(); bool test2_1(SSL *ssl) { - int cert = SSL_get_peer_certificate(ssl); // BAD (SSL_get_verify_result is never called) + int cert = SSL_get_peer_certificate(ssl); // $ Alert[cpp/certificate-not-checked] // BAD (SSL_get_verify_result is never called) return true; } @@ -25,7 +25,7 @@ bool test2_2(SSL *ssl) bool test2_3(SSL *ssl) { - int cert = SSL_get_peer_certificate(ssl); // BAD (SSL_get_verify_result may not be called) + int cert = SSL_get_peer_certificate(ssl); // $ Alert[cpp/certificate-not-checked] // BAD (SSL_get_verify_result may not be called) if (maybe()) { @@ -58,7 +58,7 @@ bool test2_5(SSL *ssl) { int cert, result; - cert = SSL_get_peer_certificate(ssl); // BAD (SSL_get_verify_result is not used reliably) + cert = SSL_get_peer_certificate(ssl); // $ Alert[cpp/certificate-not-checked] // BAD (SSL_get_verify_result is not used reliably) if ((cert != 0) && (maybe())) { result = SSL_get_verify_result(ssl); @@ -86,7 +86,7 @@ bool test2_7(SSL *ssl) { int cert; - cert = SSL_get_peer_certificate(ssl); // BAD (SSL_get_verify_result is only called when there is not a cert) + cert = SSL_get_peer_certificate(ssl); // $ Alert[cpp/certificate-not-checked] // BAD (SSL_get_verify_result is only called when there is not a cert) if (cert != 0) return false; if (SSL_get_verify_result(ssl) != 0) return false; diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.qlref index 6c83c30d549e..05046b6a5d53 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextBufferWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-311/CleartextBufferWrite.ql \ No newline at end of file +query: Security/CWE/CWE-311/CleartextBufferWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextFileWrite.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextFileWrite.qlref index f047858d8808..9469736d8c77 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextFileWrite.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextFileWrite.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-311/CleartextFileWrite.ql \ No newline at end of file +query: Security/CWE/CWE-311/CleartextFileWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.qlref index bb3fc66f1f10..5388c41bed6f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-311/CleartextTransmission.ql \ No newline at end of file +query: Security/CWE/CWE-311/CleartextTransmission.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test.cpp index f7be37b6c9f7..e7eecffb4871 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test.cpp @@ -42,7 +42,7 @@ void file() { FILE *file; // BAD: write password to file in cleartext - fputs(thePassword, file); + fputs(thePassword, file); // $ Alert[cpp/cleartext-storage-file] // GOOD: encrypt first char *encrypted = encrypt(thePassword); @@ -50,12 +50,12 @@ void file() { } // test for CleartextBufferWrite -int main(int argc, char** argv) { +int main(int argc, char** argv) { // $ Source[cpp/cleartext-storage-buffer] char *input = argv[2]; char *passwd; // BAD: write password to buffer in cleartext - sprintf(passwd, "%s", input); + sprintf(passwd, "%s", input); // $ Alert[cpp/cleartext-storage-buffer] // GOOD: encrypt first sprintf(passwd, "%s", encrypt(input)); @@ -67,10 +67,10 @@ void stream() { ofstream mystream; // BAD: write password to file in cleartext - mystream << "the password is: " << thePassword; + mystream << "the password is: " << thePassword; // $ Alert[cpp/cleartext-storage-file] Source[cpp/cleartext-storage-file] // BAD: write password to file in cleartext - (mystream << "the password is: ").write(thePassword, strlen(thePassword)); + (mystream << "the password is: ").write(thePassword, strlen(thePassword)); // $ Alert[cpp/cleartext-storage-file] // GOOD: encrypt first char *encrypted = encrypt(thePassword); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test2.cpp index ff10fba761b3..9399a81274ee 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test2.cpp @@ -40,38 +40,38 @@ int getPasswordMaxChars(); void tests(FILE *log, myStruct &s) { - fprintf(log, "password = %s\n", s.password); // BAD - fprintf(log, "thepasswd = %s\n", s.thepasswd); // BAD - fprintf(log, "accountkey = %s\n", s.accountkey); // BAD + fprintf(log, "password = %s\n", s.password); // $ Alert[cpp/cleartext-storage-file] // BAD + fprintf(log, "thepasswd = %s\n", s.thepasswd); // $ Alert[cpp/cleartext-storage-file] // BAD + fprintf(log, "accountkey = %s\n", s.accountkey); // $ Alert[cpp/cleartext-storage-file] // BAD fprintf(log, "password_hash = %s\n", s.password_hash); // GOOD fprintf(log, "encrypted_passwd = %s\n", s.encrypted_passwd); // GOOD fprintf(log, "password_file = %s\n", s.password_file); // GOOD fprintf(log, "password_path = %s\n", s.password_path); // GOOD - fprintf(log, "passwd_config = %s\n", s.passwd_config); // DUBIOUS [REPORTED] + fprintf(log, "passwd_config = %s\n", s.passwd_config); // $ Alert[cpp/cleartext-storage-file] // DUBIOUS [REPORTED] fprintf(log, "num_passwords = %i\n", s.num_passwords); // GOOD fprintf(log, "password_tries = %i\n", *(s.password_tries)); // GOOD fprintf(log, "have_passwd = %i\n", s.have_passwd); // GOOD - fprintf(log, "widepassword = %ls\n", s.widepassword); // BAD - fprintf(log, "widepassword = %S\n", s.widepassword); // BAD + fprintf(log, "widepassword = %ls\n", s.widepassword); // $ Alert[cpp/cleartext-storage-file] // BAD + fprintf(log, "widepassword = %S\n", s.widepassword); // $ Alert[cpp/cleartext-storage-file] // BAD - fprintf(log, "getPassword() = %s\n", getPassword()); // BAD + fprintf(log, "getPassword() = %s\n", getPassword()); // $ Alert[cpp/cleartext-storage-file] // BAD fprintf(log, "getPasswordHash() = %s\n", getPasswordHash()); // GOOD fprintf(log, "getPasswordMaxChars() = %i\n", getPasswordMaxChars()); // GOOD { - char *cpy1 = s.password; + char *cpy1 = s.password; // $ Source[cpp/cleartext-storage-file] char *cpy2 = crypt(s.password); - fprintf(log, "cpy1 = %s\n", cpy1); // BAD + fprintf(log, "cpy1 = %s\n", cpy1); // $ Alert[cpp/cleartext-storage-file] // BAD fprintf(log, "cpy2 = %s\n", cpy2); // GOOD } { char buf[1024]; - strcpy(buf, s.password); - fprintf(log, "buf = %s\n", buf); // BAD - + strcpy(buf, s.password); // $ Source[cpp/cleartext-storage-file] + fprintf(log, "buf = %s\n", buf); // $ Alert[cpp/cleartext-storage-file] // BAD + strcpy(buf, s.password_hash); fprintf(log, "buf = %s\n", buf); // GOOD } @@ -95,8 +95,8 @@ void tests(FILE *log, myStruct &s) { char buffer[1024]; - snprintf(buffer, 1024, "password = %s", s.password); - fprintf(log, "log: %s", buffer); // BAD + snprintf(buffer, 1024, "password = %s", s.password); // $ Source[cpp/cleartext-storage-file] + fprintf(log, "log: %s", buffer); // $ Alert[cpp/cleartext-storage-file] // BAD } } @@ -107,6 +107,6 @@ void test_gets() { char password[1024]; - gets(password); // BAD + gets(password); // $ Alert[cpp/cleartext-storage-buffer] // BAD } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp index 35700d229e75..0f79301cded9 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp @@ -19,11 +19,11 @@ void test_send(const char *password1, const char *password2, const char *passwor { LogonUserA(val(), val(), password1, val(), val(), val()); // proof `password1` is plaintext - send(val(), password1, strlen(password1), val()); // BAD: `password1` is sent plaintext (certainly) + send(val(), password1, strlen(password1), val()); // $ Alert[cpp/cleartext-transmission] // BAD: `password1` is sent plaintext (certainly) } { - send(val(), password2, strlen(password2), val()); // BAD: `password2` is sent plaintext (probably) + send(val(), password2, strlen(password2), val()); // $ Alert[cpp/cleartext-transmission] // BAD: `password2` is sent plaintext (probably) } { @@ -44,7 +44,7 @@ void test_receive() { char password[256]; - recv(val(), password, 256, val()); // BAD: `password` is received plaintext (certainly) + recv(val(), password, 256, val()); // $ Alert[cpp/cleartext-transmission] // BAD: `password` is received plaintext (certainly) LogonUserA(val(), val(), password, val(), val(), val()); // (proof `password` is plaintext) } @@ -52,7 +52,7 @@ void test_receive() { char password[256]; - recv(val(), password, 256, val()); // BAD: `password` is received plaintext (probably) + recv(val(), password, 256, val()); // $ Alert[cpp/cleartext-transmission] // BAD: `password` is received plaintext (probably) } { @@ -71,16 +71,16 @@ void test_receive() void test_dataflow(const char *password1) { { - const char *ptr = password1; + const char *ptr = password1; // $ Source[cpp/cleartext-transmission] - send(val(), ptr, strlen(ptr), val()); // BAD: `password` is sent plaintext + send(val(), ptr, strlen(ptr), val()); // $ Alert[cpp/cleartext-transmission] // BAD: `password` is sent plaintext } { char password[256]; - char *ptr = password; + char *ptr = password; // $ Source[cpp/cleartext-transmission] - recv(val(), ptr, 256, val()); // BAD: `password` is received plaintext + recv(val(), ptr, 256, val()); // $ Alert[cpp/cleartext-transmission] // BAD: `password` is received plaintext } { @@ -98,7 +98,7 @@ void test_read() char password[256]; int fd = val(); - read(fd, password, 256); // BAD: `password` is received plaintext + read(fd, password, 256); // $ Alert[cpp/cleartext-transmission] // BAD: `password` is received plaintext } { @@ -111,7 +111,7 @@ void test_read() void my_recv(char *buffer, size_t bufferSize) { - recv(val(), buffer, bufferSize, val()); + recv(val(), buffer, bufferSize, val()); // $ Alert[cpp/cleartext-transmission] } const char *id(const char *buffer) @@ -123,7 +123,7 @@ char *global_password; char *get_global_str() { - return global_password; + return global_password; // $ Source[cpp/cleartext-transmission] } void test_interprocedural(const char *password1) @@ -131,19 +131,19 @@ void test_interprocedural(const char *password1) { char password[256]; - my_recv(password, 256); // BAD: `password` is received plaintext [detected in `my_recv`] + my_recv(password, 256); // $ Source[cpp/cleartext-transmission] // BAD: `password` is received plaintext [detected in `my_recv`] } { - const char *ptr = id(password1); + const char *ptr = id(password1); // $ Source[cpp/cleartext-transmission] - send(val(), ptr, strlen(ptr), val()); // BAD: `password1` is sent plaintext + send(val(), ptr, strlen(ptr), val()); // $ Alert[cpp/cleartext-transmission] // BAD: `password1` is sent plaintext } { char *data = get_global_str(); - send(val(), data, strlen(data), val()); // BAD: `global_password` is sent plaintext + send(val(), data, strlen(data), val()); // $ Alert[cpp/cleartext-transmission] // BAD: `global_password` is sent plaintext } } @@ -154,9 +154,9 @@ void test_taint(const char *password) { char buffer[16]; - strncpy(buffer, password, 16); + strncpy(buffer, password, 16); // $ Source[cpp/cleartext-transmission] buffer[15] = 0; - send(val(), buffer, 16, val()); // BAD: `password` is (partially) sent plaintext + send(val(), buffer, 16, val()); // $ Alert[cpp/cleartext-transmission] // BAD: `password` is (partially) sent plaintext } } @@ -225,7 +225,7 @@ int get_socket(int from); void test_more_stdio(const char *password) { send(get_socket(1), password, 128, val()); // GOOD: `getsocket(1)` is probably standard output - send(get_socket(val()), password, 128, val()); // BAD + send(get_socket(val()), password, 128, val()); // $ Alert[cpp/cleartext-transmission] // BAD } typedef struct {} FILE; @@ -238,7 +238,7 @@ void test_fgets(FILE *stream) { char password[128]; - fgets(password, 128, stream); // BAD + fgets(password, 128, stream); // $ Alert[cpp/cleartext-transmission] // BAD fgets(password, 128, STDIN_STREAM); // GOOD: `STDIN_STREAM` is probably standard input } @@ -267,9 +267,9 @@ void test_crypt_more() { char data[256], password[256]; - strcpy(data, password); // not proof of anything + strcpy(data, password); // $ Source[cpp/cleartext-transmission] // not proof of anything - send(val(), data, strlen(data), val()); // BAD: password is sent plaintext + send(val(), data, strlen(data), val()); // $ Alert[cpp/cleartext-transmission] // BAD: password is sent plaintext } } @@ -287,17 +287,17 @@ void target2(char *data) void target3(char *data) { - send(val(), data, strlen(data), val()); // BAD: data is a plaintext password + send(val(), data, strlen(data), val()); // $ Alert[cpp/cleartext-transmission] // BAD: data is a plaintext password } void target4(char *data) { - send(val(), data, strlen(data), val()); // BAD: data is a plaintext password + send(val(), data, strlen(data), val()); // $ Alert[cpp/cleartext-transmission] // BAD: data is a plaintext password } void target5(char *data) { - send(val(), data, strlen(data), val()); // BAD: from one source this is a plaintext password + send(val(), data, strlen(data), val()); // $ Alert[cpp/cleartext-transmission] // BAD: from one source this is a plaintext password } void target6(char *data) @@ -314,12 +314,12 @@ void test_multiple_sources_source(char *password1, char *password2) target2(password1); } else { target2(password1); - target3(password1); + target3(password1); // $ Source[cpp/cleartext-transmission] } if (cond()) { - char *data = password2; + char *data = password2; // $ Source[cpp/cleartext-transmission] target4(data); target5(data); @@ -338,8 +338,8 @@ void test_loops() { char password[256]; - recv(val(), password, 256, val()); // BAD: not encrypted - + recv(val(), password, 256, val()); // $ Alert[cpp/cleartext-transmission] // BAD: not encrypted + // ... } } @@ -351,7 +351,7 @@ void test_loops() recv(val(), password, 256, val()); // GOOD: password is encrypted decrypt_inplace(password); // proof that `password` was in fact encrypted - + // ... } } @@ -385,7 +385,7 @@ void test_more_clues() { char password[256]; - recv(val(), password, 256, val()); // BAD: not encrypted + recv(val(), password, 256, val()); // $ Alert[cpp/cleartext-transmission] // BAD: not encrypted } { @@ -411,13 +411,13 @@ void test_member_password() { packet p; - recv(val(), p.password, 256, val()); // BAD: not encrypted + recv(val(), p.password, 256, val()); // $ Alert[cpp/cleartext-transmission] // BAD: not encrypted } { packet p; - recv(val(), p.password, 256, val()); // GOOD: password is encrypted [FALSE POSITIVE] + recv(val(), p.password, 256, val()); // $ Alert[cpp/cleartext-transmission] // GOOD: password is encrypted [FALSE POSITIVE] decrypt_inplace(p.password); // proof that `password` was in fact encrypted } } @@ -428,7 +428,7 @@ void test_stdin_param(FILE *stream) { char password[128]; - fgets(password, 128, stream); // GOOD: from standard input (see call below) [FALSE POSITIVE] + fgets(password, 128, stream); // $ Alert[cpp/cleartext-transmission] // GOOD: from standard input (see call below) [FALSE POSITIVE] } void test_stdin() @@ -504,18 +504,18 @@ struct person_info void tests2(person_info *pi) { // direct cases - send(val(), pi->social_security_number, strlen(pi->social_security_number), val()); // BAD - send(val(), pi->socialSecurityNo, strlen(pi->socialSecurityNo), val()); // BAD - send(val(), pi->homePostCode, strlen(pi->homePostCode), val()); // BAD - send(val(), pi->my_zip_code, strlen(pi->my_zip_code), val()); // BAD - send(val(), pi->telephone, strlen(pi->telephone), val()); // BAD - send(val(), pi->mobile_phone_number, strlen(pi->mobile_phone_number), val()); // BAD - send(val(), pi->email, strlen(pi->email), val()); // BAD - send(val(), pi->my_credit_card_number, strlen(pi->my_credit_card_number), val()); // BAD - send(val(), pi->my_bank_account_no, strlen(pi->my_bank_account_no), val()); // BAD - send(val(), pi->employerName, strlen(pi->employerName), val()); // BAD - send(val(), pi->medical_info, strlen(pi->medical_info), val()); // BAD - send(val(), pi->license_key, strlen(pi->license_key), val()); // BAD + send(val(), pi->social_security_number, strlen(pi->social_security_number), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->socialSecurityNo, strlen(pi->socialSecurityNo), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->homePostCode, strlen(pi->homePostCode), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->my_zip_code, strlen(pi->my_zip_code), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->telephone, strlen(pi->telephone), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->mobile_phone_number, strlen(pi->mobile_phone_number), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->email, strlen(pi->email), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->my_credit_card_number, strlen(pi->my_credit_card_number), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->my_bank_account_no, strlen(pi->my_bank_account_no), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->employerName, strlen(pi->employerName), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->medical_info, strlen(pi->medical_info), val()); // $ Alert[cpp/cleartext-transmission] // BAD + send(val(), pi->license_key, strlen(pi->license_key), val()); // $ Alert[cpp/cleartext-transmission] // BAD send(val(), pi->license_key_hash, strlen(pi->license_key_hash), val()); // GOOD send(val(), pi->my_zip_file, strlen(pi->my_zip_file), val()); // GOOD @@ -523,14 +523,14 @@ void tests2(person_info *pi) { char buffer[1024]; - snprintf(buffer, 1024, "lat = %f\n", pi->my_latitude); - send(val(), buffer, strlen(buffer), val()); // BAD + snprintf(buffer, 1024, "lat = %f\n", pi->my_latitude); // $ Source[cpp/cleartext-transmission] + send(val(), buffer, strlen(buffer), val()); // $ Alert[cpp/cleartext-transmission] // BAD } { char buffer[1024]; - snprintf(buffer, 1024, "long = %f\n", pi->home_longitude); - send(val(), buffer, strlen(buffer), val()); // BAD + snprintf(buffer, 1024, "long = %f\n", pi->home_longitude); // $ Source[cpp/cleartext-transmission] + send(val(), buffer, strlen(buffer), val()); // $ Alert[cpp/cleartext-transmission] // BAD } { char buffer[1024]; @@ -548,15 +548,15 @@ void tests2(person_info *pi) { char buffer[1024]; - snprintf(buffer, 1024, "salary = %s\n", pi->salaryString); - send(val(), buffer, strlen(buffer), val()); // BAD + snprintf(buffer, 1024, "salary = %s\n", pi->salaryString); // $ Source[cpp/cleartext-transmission] + send(val(), buffer, strlen(buffer), val()); // $ Alert[cpp/cleartext-transmission] // BAD } { char buffer[1024]; - char *sal = pi->salaryString; + char *sal = pi->salaryString; // $ Source[cpp/cleartext-transmission] snprintf(buffer, 1024, "salary = %s\n", sal); - send(val(), buffer, strlen(buffer), val()); // BAD + send(val(), buffer, strlen(buffer), val()); // $ Alert[cpp/cleartext-transmission] // BAD } } @@ -568,14 +568,14 @@ void tests3() { const char *str; - str = get_home_phone(); - send(val(), str, strlen(str), val()); // BAD + str = get_home_phone(); // $ Source[cpp/cleartext-transmission] + send(val(), str, strlen(str), val()); // $ Alert[cpp/cleartext-transmission] // BAD str = get_home(); send(val(), str, strlen(str), val()); // GOOD (probably not personal info) - str = get_home_address(); - send(val(), str, strlen(str), val()); // BAD + str = get_home_address(); // $ Source[cpp/cleartext-transmission] + send(val(), str, strlen(str), val()); // $ Alert[cpp/cleartext-transmission] // BAD } int fscanf(FILE* stream, const char* format, ... ); @@ -583,4 +583,4 @@ int fscanf(FILE* stream, const char* format, ... ); void test_scanf() { char password[256]; fscanf(stdin, "%255s", password); // GOOD: this is not a remote source -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-319/UseOfHttp/UseOfHttp.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-319/UseOfHttp/UseOfHttp.qlref index c9c917ad0456..5a18a73768b9 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-319/UseOfHttp/UseOfHttp.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-319/UseOfHttp/UseOfHttp.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-319/UseOfHttp.ql \ No newline at end of file +query: Security/CWE/CWE-319/UseOfHttp.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-319/UseOfHttp/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-319/UseOfHttp/test.cpp index 573e021979d7..8b187fd7fec8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-319/UseOfHttp/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-319/UseOfHttp/test.cpp @@ -12,7 +12,7 @@ void openUrl(const char *url) { // ... - host myHost = gethostbyname(url); + host myHost = gethostbyname(url); // $ Sink // ... } @@ -21,19 +21,19 @@ void doNothing(char *url) { } -const char *url_g = "http://example.com"; // BAD +const char *url_g = "http://example.com"; // $ Alert // BAD void test() { - openUrl("http://example.com"); // BAD + openUrl("http://example.com"); // $ Alert // BAD openUrl("https://example.com"); // GOOD (https) openUrl("http://localhost/example"); // GOOD (localhost) openUrl("https://localhost/example"); // GOOD (https, localhost) doNothing("http://example.com"); // GOOD (URL not used) { - const char *url_l = "http://example.com"; // BAD - const char *urls[] = { "http://example.com" }; // BAD + const char *url_l = "http://example.com"; // $ Alert // BAD + const char *urls[] = { "http://example.com" }; // $ Alert // BAD openUrl(url_g); openUrl(url_l); @@ -43,7 +43,7 @@ void test() { char buffer[1024]; - strcpy(buffer, "http://"); // BAD + strcpy(buffer, "http://"); // $ Alert // BAD strcat(buffer, "example.com"); openUrl(buffer); @@ -107,7 +107,7 @@ void test4(char *url) void test5() { - char *url_string = "http://example.com"; // BAD + char *url_string = "http://example.com"; // $ Alert // BAD char *ptr; ptr = strstr(url_string, "https://"); // GOOD (https) diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-326/InsufficientKeySize.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-326/InsufficientKeySize.qlref index e869f87150a8..790ce8b27187 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-326/InsufficientKeySize.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-326/InsufficientKeySize.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-326/InsufficientKeySize.ql \ No newline at end of file +query: Security/CWE/CWE-326/InsufficientKeySize.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-326/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-326/test.cpp index 18780fc05c0f..5e606f46baf4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-326/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-326/test.cpp @@ -31,8 +31,8 @@ void test1(EVP_PKEY_CTX *ctx) { EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 2048); // low key sizes - EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx, 1024); - EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, 1024); + EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx, 1024); // $ Alert + EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, 1024); // $ Alert // RSA sets bits per-key rather than with parameters - EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 1024); + EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 1024); // $ Alert } \ No newline at end of file diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qlref index 8424dee1a9b6..ead42dd0386b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql \ No newline at end of file +query: Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp index 91af0f7eede2..c71170513736 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp @@ -35,7 +35,7 @@ void my_implementation6(const char *str); void test_macros(void *data, size_t amount, const char *str) { - ENCRYPT_WITH_DES(data, amount); // BAD + ENCRYPT_WITH_DES(data, amount); // $ Alert // BAD ENCRYPT_WITH_RC2(data, amount); // BAD ENCRYPT_WITH_AES(data, amount); // GOOD (good algorithm) ENCRYPT_WITH_3DES(data, amount); // BAD @@ -120,6 +120,6 @@ void test_macros2() { INIT_ENCRYPT_WITH_DES(); // BAD [NOT DETECTED] INIT_ENCRYPT_WITH_AES(); // GOOD (good algorithm) - + // ... -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp index 95fc532c842d..49bbbf1b25e0 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp @@ -46,7 +46,7 @@ void encrypt_bad(char *data, size_t amount, keytype key, int algo) { case ALGO_DES: { - my_des_implementation(data, amount, key); // BAD + my_des_implementation(data, amount, key); // $ Alert // BAD } break; case ALGO_AES: diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/TOCTOUFilesystemRace.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/TOCTOUFilesystemRace.qlref index c7d2e9c45f4b..cbced86ff2e2 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/TOCTOUFilesystemRace.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/TOCTOUFilesystemRace.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-367/TOCTOUFilesystemRace.ql \ No newline at end of file +query: Security/CWE/CWE-367/TOCTOUFilesystemRace.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp index 96425debc7c2..febab29186a0 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp @@ -66,7 +66,7 @@ void test2_1(const char *path) if (stat(path, &buf)) { - f = fopen(path, "r"); // BAD + f = fopen(path, "r"); // $ Alert // BAD } // ... @@ -80,7 +80,7 @@ void test2_2(const char *path) stat(path, &buf); if (buf.foo > 0) { - f = fopen(path, "r"); // BAD + f = fopen(path, "r"); // $ Alert // BAD } // ... @@ -95,7 +95,7 @@ void test2_3(const char *path) stat(path, buf_ptr); if (buf_ptr->foo > 0) { - f = fopen(path, "r"); // BAD + f = fopen(path, "r"); // $ Alert // BAD } // ... @@ -112,7 +112,7 @@ void test2_4(const char *path) stat(path, &buf); if (stat_condition(&buf)) { - f = fopen(path, "r"); // BAD + f = fopen(path, "r"); // $ Alert // BAD } // ... @@ -127,7 +127,7 @@ void test2_5(const char *path) stat(path, buf_ptr); if (stat_condition(buf_ptr)) { - f = fopen(path, "r"); // BAD + f = fopen(path, "r"); // $ Alert // BAD } // ... @@ -154,7 +154,7 @@ void test2_7(const char *path, int arg) if (stat(path, &buf)) { - f = open(path, arg); // BAD + f = open(path, arg); // $ Alert // BAD } // ... @@ -167,7 +167,7 @@ void test2_8(const char *path, int arg) if (lstat(path, &buf)) { - f = open(path, arg); // BAD + f = open(path, arg); // $ Alert // BAD } // ... @@ -206,7 +206,7 @@ void test2_11(const char *path, int arg) if (stat(path, &buf)) { - f = open(path, arg); // GOOD (here stat is just a redundant check that the file exists / path is valid, confirmed by the return value of open) [FALSE POSITIVE] + f = open(path, arg); // $ Alert // GOOD (here stat is just a redundant check that the file exists / path is valid, confirmed by the return value of open) [FALSE POSITIVE] if (f == -1) { // handle error @@ -225,7 +225,7 @@ void test2_12(const char *path, int arg) { if (buf.foo == 11) // check a property of the file { - f = open(path, arg); // BAD + f = open(path, arg); // $ Alert // BAD if (f == -1) { // handle error @@ -246,7 +246,7 @@ void test2_13(const char *path, int arg) return; } - f = fopen(path, "wt"); // BAD + f = fopen(path, "wt"); // $ Alert // BAD // ... } @@ -294,7 +294,7 @@ void test4_1(const char *path) fclose(f); - chmod(path, 0); // BAD + chmod(path, 0); // $ Alert // BAD } } @@ -326,7 +326,7 @@ void test6_1(const char *path) if (access(path)) { - f = fopen(path, "r"); // BAD + f = fopen(path, "r"); // $ Alert // BAD // ... } @@ -352,7 +352,7 @@ void test6_3(const char *path) if (!access(path)) { - f = fopen(path, "r"); // BAD + f = fopen(path, "r"); // $ Alert // BAD // ... } @@ -366,7 +366,7 @@ void test6_4(const char *path) { // ... } else { - f = fopen(path, "r"); // BAD + f = fopen(path, "r"); // $ Alert // BAD // ... } @@ -394,10 +394,10 @@ void test7_1(const char *path) if (f != 0) { // ... - + fclose(f); - chmod(path, 1234); // BAD + chmod(path, 1234); // $ Alert // BAD } } @@ -405,7 +405,7 @@ void test7_1(const char *path1, const char *path2) { if (!rename(path1, path2)) { - chmod(path2, 1234); // BAD + chmod(path2, 1234); // $ Alert // BAD } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/IteratorToExpiredContainer.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/IteratorToExpiredContainer.qlref index fb2d78f87dfe..b0ce57b346f8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/IteratorToExpiredContainer.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/IteratorToExpiredContainer.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-416/IteratorToExpiredContainer.ql +query: Security/CWE/CWE-416/IteratorToExpiredContainer.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp index d4e3c5b269ae..1a671983761e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp @@ -192,7 +192,7 @@ namespace std basic_string& append(const basic_string& str); basic_string& append(const charT* s); basic_string& append(size_type n, charT c); - template basic_string& append(InputIterator first, InputIterator last); + template basic_string& append(InputIterator first, InputIterator last); basic_string& assign(const basic_string& str); basic_string& assign(size_type n, charT c); template basic_string& assign(InputIterator first, InputIterator last); @@ -200,7 +200,7 @@ namespace std basic_string& insert(size_type pos, size_type n, charT c); basic_string& insert(size_type pos, const charT* s); iterator insert(const_iterator p, size_type n, charT c); - template iterator insert(const_iterator p, InputIterator first, InputIterator last); + template iterator insert(const_iterator p, InputIterator first, InputIterator last); basic_string& replace(size_type pos1, size_type n1, const basic_string& str); basic_string& replace(size_type pos1, size_type n1, size_type n2, charT c); size_type copy(charT* s, size_type n, size_type pos = 0) const; @@ -241,7 +241,7 @@ namespace std }; template basic_istream& operator>>(basic_istream&, charT*); - template basic_istream& operator>>(basic_istream& is, basic_string& str); + template basic_istream& operator>>(basic_istream& is, basic_string& str); template basic_istream& getline(basic_istream& is, basic_string& str, charT delim); template basic_istream& getline(basic_istream& is, basic_string& str); @@ -259,7 +259,7 @@ namespace std }; template basic_ostream& operator<<(basic_ostream&, const charT*); - template basic_ostream& operator<<(basic_ostream& os, const basic_string& str); + template basic_ostream& operator<<(basic_ostream& os, const basic_string& str); template> class basic_iostream : public basic_istream, public basic_ostream { @@ -294,11 +294,11 @@ namespace std namespace std { template> - class vector { + class vector { public: using value_type = T; using reference = value_type&; - using const_reference = const value_type&; + using const_reference = const value_type&; using size_type = unsigned int; using iterator = std::iterator; using const_iterator = std::iterator; @@ -518,7 +518,7 @@ namespace std { mapped_type& operator[](key_type&& k); mapped_type& at(const key_type& k); const mapped_type& at(const key_type& k) const; - + template pair emplace(Args&&... args); template iterator emplace_hint(const_iterator position, Args&&... args); @@ -571,7 +571,7 @@ namespace std { set(set&& x); template set(InputIterator first, InputIterator last/*, const Compare& comp = Compare(), const Allocator& = Allocator()*/); ~set(); - + set& operator=(const set& x); set& operator=(set&& x) noexcept/*(allocator_traits::is_always_equal::value && is_nothrow_move_assignable_v)*/; @@ -586,11 +586,11 @@ namespace std { pair insert(value_type&& x); iterator insert(const_iterator position, const value_type& x); iterator insert(const_iterator position, value_type&& x); - template void insert(InputIterator first, InputIterator last); - + template void insert(InputIterator first, InputIterator last); + iterator erase(iterator position); iterator erase(const_iterator position); - iterator erase(const_iterator first, const_iterator last); + iterator erase(const_iterator first, const_iterator last); void swap(set&) noexcept/*(allocator_traits::is_always_equal::value && is_nothrow_swappable_v)*/; void clear() noexcept; @@ -599,7 +599,7 @@ namespace std { iterator find(const key_type& x); const_iterator find(const key_type& x) const; - + iterator lower_bound(const key_type& x); const_iterator lower_bound(const key_type& x) const; iterator upper_bound(const key_type& x); @@ -609,7 +609,7 @@ namespace std { }; template, class Pred = equal_to, class Allocator = allocator> - class unordered_set { + class unordered_set { public: using key_type = Key; using value_type = Key; @@ -628,7 +628,7 @@ namespace std { unordered_set& operator=(const unordered_set&); unordered_set& operator=(unordered_set&&) noexcept/*(allocator_traits::is_always_equal::value && is_nothrow_move_assignable_v && is_nothrow_move_assignable_v)*/; - + iterator begin() noexcept; const_iterator begin() const noexcept; iterator end() noexcept; @@ -640,7 +640,7 @@ namespace std { pair insert(value_type&& obj); iterator insert(const_iterator hint, const value_type& obj); iterator insert(const_iterator hint, value_type&& obj); - template void insert(InputIterator first, InputIterator last); + template void insert(InputIterator first, InputIterator last); iterator erase(iterator position); iterator erase(const_iterator position); @@ -677,10 +677,10 @@ std::vector> return_self_by_value(const std::vector& v) { } std::vector& ref_to_first_in_returnValue_1() { - return returnValue()[0]; // BAD + return returnValue()[0]; // $ Alert // BAD } std::vector& ref_to_first_in_returnValue_2() { @@ -732,7 +732,7 @@ std::vector& ref_to_first_in_returnValue_2() { } std::vector& ref_to_first_in_returnValue_3() { - return returnValue()[0]; // BAD + return returnValue()[0]; // $ Alert // BAD } std::vector first_in_returnValue_1() { @@ -854,7 +854,7 @@ struct PlusPlusReturnByValueIterator void test7() { PlusPlusReturnByValueIterator it; - it.operator++(); // GOOD [FALSE POSITIVE] + it.operator++(); // $ Alert // GOOD [FALSE POSITIVE] it.begin(); -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/UseAfterFree.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/UseAfterFree.qlref index c0ef8616cdc1..096090964894 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/UseAfterFree.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/UseAfterFree.qlref @@ -1 +1,2 @@ -Critical/UseAfterFree.ql +query: Critical/UseAfterFree.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp index deac38663362..fde729331ce5 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp @@ -36,9 +36,9 @@ void test1() char* data; data = (char *)malloc(100*sizeof(char)); use_if_nonzero(data); // GOOD - free(data); + free(data); // $ Source use_if_nonzero(data); // BAD [NOT DETECTED] - use(data); // BAD + use(data); // $ Alert // BAD } void test2() @@ -72,11 +72,11 @@ void test4() { char* data; data = (char *)malloc(100*sizeof(char)); - free(data); + free(data); // $ Source if (data) { use_if_nonzero(data); // BAD [NOT DETECTED] - use(data); // BAD + use(data); // $ Alert // BAD } } @@ -103,9 +103,9 @@ void test6() char *data, *data2; data = (char *)malloc(100*sizeof(char)); data2 = data; - free(data); + free(data); // $ Source use_if_nonzero(data2); // BAD [NOT DETECTED] - use(data); // BAD + use(data); // $ Alert // BAD } void test7() @@ -113,10 +113,10 @@ void test7() char *data, *data2; data = (char *)malloc(100*sizeof(char)); data2 = data; - free(data); + free(data); // $ Source data2 = NULL; use_if_nonzero(data); // BAD [NOT DETECTED] - use(data); // BAD + use(data); // $ Alert // BAD } void test8() @@ -124,10 +124,10 @@ void test8() char *data, *data2; data2 = (char *)malloc(100*sizeof(char)); data = data2; - free(data); + free(data); // $ Source data2 = NULL; use_if_nonzero(data); // BAD [NOT DETECTED] - use(data); // BAD + use(data); // $ Alert // BAD } void noReturnWrapper() { noReturn(); } @@ -161,9 +161,9 @@ class myClass void test11() { myClass* c = new myClass(); - delete(c); - c->myMethod(); // BAD - (*c).myMethod(); // BAD + delete(c); // $ Source + c->myMethod(); // $ Alert // BAD + (*c).myMethod(); // $ Alert // BAD } template T test() @@ -178,43 +178,43 @@ template T test() void test12(int count) { char* data = NULL; - free(data); + free(data); // $ Source for (int i = 0; i < count; i++) { data = NULL; } - use(data); // BAD + use(data); // $ Alert // BAD } void test13() { char* data = NULL; - free(data); + free(data); // $ Source for (int i = 0; i < 2; i++) { data = NULL; } - use(data); // GOOD [FALSE POSITIVE] + use(data); // $ Alert // GOOD [FALSE POSITIVE] } void test14() { char* data = NULL; - free(data); + free(data); // $ Source for (int i = 0; i < 2; i++) { data = NULL; - free(data); + free(data); // $ Source } - use(data); // BAD + use(data); // $ Alert // BAD } template T test15() { T* x; use(x); // GOOD - delete x; - use(x); // BAD [NOT DETECTED] + delete x; // $ Source + use(x); // $ Alert // BAD [NOT DETECTED] } void test15runner(void) { @@ -240,17 +240,17 @@ struct myStruct { }; void malloc_after_free(myStruct *s) { - free(s->i1.data); + free(s->i1.data); // $ Source s->i1.data = (char *)malloc(100*sizeof(char)); if (s->i1.data == 0) { return; } - use(s->i1.data); // GOOD [FALSE POSITIVE] + use(s->i1.data); // $ Alert // GOOD [FALSE POSITIVE] - free(s->i2->data); + free(s->i2->data); // $ Source s->i2->data = (char *)malloc(100*sizeof(char)); if (s->i2->data == 0) { return; } - use(s->i2->data); // GOOD [FALSE POSITIVE] + use(s->i2->data); // $ Alert // GOOD [FALSE POSITIVE] } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfStringAfterLifetimeEnds/UseOfStringAfterLifetimeEnds.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfStringAfterLifetimeEnds/UseOfStringAfterLifetimeEnds.qlref index a69a1a7f4e57..a367b49f59d6 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfStringAfterLifetimeEnds/UseOfStringAfterLifetimeEnds.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfStringAfterLifetimeEnds/UseOfStringAfterLifetimeEnds.qlref @@ -1,2 +1,2 @@ - -Security/CWE/CWE-416/UseOfStringAfterLifetimeEnds.ql \ No newline at end of file +query: Security/CWE/CWE-416/UseOfStringAfterLifetimeEnds.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfStringAfterLifetimeEnds/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfStringAfterLifetimeEnds/test.cpp index 4b3d934088d7..a7ed902936c9 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfStringAfterLifetimeEnds/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfStringAfterLifetimeEnds/test.cpp @@ -108,7 +108,7 @@ namespace std basic_string& insert(size_type pos, size_type n, charT c); basic_string& insert(size_type pos, const charT* s); iterator insert(const_iterator p, size_type n, charT c); - template iterator insert(const_iterator p, InputIterator first, InputIterator last); + template iterator insert(const_iterator p, InputIterator first, InputIterator last); basic_string& replace(size_type pos1, size_type n1, const basic_string& str); basic_string& replace(size_type pos1, size_type n1, size_type n2, charT c); }; @@ -123,11 +123,11 @@ namespace std namespace std { template> - class vector { + class vector { public: using value_type = T; using reference = value_type&; - using const_reference = const value_type&; + using const_reference = const value_type&; using size_type = unsigned int; using iterator = std::iterator; using const_iterator = std::iterator; @@ -162,11 +162,11 @@ void call_by_cref(const S&); void call(const char*); const char* test1(bool b1, bool b2) { - auto s1 = std::string("hello").c_str(); // BAD - auto s2 = b1 ? std::string("hello").c_str() : ""; // BAD - auto s3 = b2 ? "" : std::string("hello").c_str(); // BAD + auto s1 = std::string("hello").c_str(); // $ Alert // BAD + auto s2 = b1 ? std::string("hello").c_str() : ""; // $ Alert // BAD + auto s3 = b2 ? "" : std::string("hello").c_str(); // $ Alert // BAD const char* s4; - s4 = std::string("hello").c_str(); // BAD + s4 = std::string("hello").c_str(); // $ Alert // BAD call(std::string("hello").c_str()); // GOOD call(b1 ? std::string("hello").c_str() : ""); // GOOD @@ -175,24 +175,24 @@ const char* test1(bool b1, bool b2) { call_by_cref({ std::string("hello").c_str() }); // GOOD std::vector v1; - v1.push_back(std::string("hello").c_str()); // BAD + v1.push_back(std::string("hello").c_str()); // $ Alert // BAD std::vector v2; - v2.push_back({ std::string("hello").c_str() }); // BAD + v2.push_back({ std::string("hello").c_str() }); // $ Alert // BAD - S s5[] = { { std::string("hello").c_str() } }; // BAD + S s5[] = { { std::string("hello").c_str() } }; // $ Alert // BAD char c = std::string("hello").c_str()[0]; // GOOD - auto s6 = std::string("hello").data(); // BAD - auto s7 = b1 ? std::string("hello").data() : ""; // BAD - auto s8 = b2 ? "" : std::string("hello").data(); // BAD + auto s6 = std::string("hello").data(); // $ Alert // BAD + auto s7 = b1 ? std::string("hello").data() : ""; // $ Alert // BAD + auto s8 = b2 ? "" : std::string("hello").data(); // $ Alert // BAD char* s9; - s9 = std::string("hello").data(); // BAD + s9 = std::string("hello").data(); // $ Alert // BAD - const char* s13 = b1 ? std::string("hello").c_str() : s1; // BAD + const char* s13 = b1 ? std::string("hello").c_str() : s1; // $ Alert // BAD - return std::string("hello").c_str(); // BAD + return std::string("hello").c_str(); // $ Alert // BAD } void test2(bool b1, bool b2) { @@ -218,4 +218,4 @@ void test2(bool b1, bool b2) { auto s11 = b2 ? "" : sRefRef.c_str(); // GOOD const char* s12; s12 = sRefRef.c_str(); // GOOD -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfUniquePtrAfterLifetimeEnds/UseOfUniquePointerAfterLifetimeEnds.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfUniquePtrAfterLifetimeEnds/UseOfUniquePointerAfterLifetimeEnds.qlref index 4c613e5c5acc..c2d7ade08561 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfUniquePtrAfterLifetimeEnds/UseOfUniquePointerAfterLifetimeEnds.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfUniquePtrAfterLifetimeEnds/UseOfUniquePointerAfterLifetimeEnds.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-416/UseOfUniquePointerAfterLifetimeEnds.ql \ No newline at end of file +query: Security/CWE/CWE-416/UseOfUniquePointerAfterLifetimeEnds.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfUniquePtrAfterLifetimeEnds/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfUniquePtrAfterLifetimeEnds/test.cpp index 18cc66b83675..8a031314ab8c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfUniquePtrAfterLifetimeEnds/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseOfUniquePtrAfterLifetimeEnds/test.cpp @@ -86,7 +86,7 @@ namespace std unique_ptr& operator=(unique_ptr&& u) noexcept; unique_ptr& operator=(std::nullptr_t) noexcept; template unique_ptr& operator=(unique_ptr&& u) noexcept; - + ~unique_ptr(); pointer get() const noexcept; @@ -111,11 +111,11 @@ namespace std { }; template> - class vector { + class vector { public: using value_type = T; using reference = value_type&; - using const_reference = const value_type&; + using const_reference = const value_type&; using size_type = unsigned int; using iterator = std::iterator; using const_iterator = std::iterator; @@ -153,14 +153,14 @@ std::unique_ptr get_unique_ptr(); const S* test1(bool b1, bool b2) { auto s1 = *get_unique_ptr(); // GOOD - auto s1a = &*get_unique_ptr(); // BAD - auto s1b = get_unique_ptr().get(); // BAD + auto s1a = &*get_unique_ptr(); // $ Alert // BAD + auto s1b = get_unique_ptr().get(); // $ Alert // BAD auto s1c = get_unique_ptr()->s; // GOOD - auto s1d = &(get_unique_ptr()->s); // BAD - auto s2 = b1 ? get_unique_ptr().get() : nullptr; // BAD - auto s3 = b2 ? nullptr :get_unique_ptr().get(); // BAD + auto s1d = &(get_unique_ptr()->s); // $ Alert // BAD + auto s2 = b1 ? get_unique_ptr().get() : nullptr; // $ Alert // BAD + auto s3 = b2 ? nullptr :get_unique_ptr().get(); // $ Alert // BAD const S* s4; - s4 = get_unique_ptr().get(); // BAD + s4 = get_unique_ptr().get(); // $ Alert // BAD call(get_unique_ptr().get()); // GOOD call(b1 ? get_unique_ptr().get() : nullptr); // GOOD @@ -169,18 +169,18 @@ const S* test1(bool b1, bool b2) { call_by_ref(*get_unique_ptr()); // GOOD std::vector v1; - v1.push_back(get_unique_ptr().get()); // BAD + v1.push_back(get_unique_ptr().get()); // $ Alert // BAD - S* s5[] = { get_unique_ptr().get() }; // BAD + S* s5[] = { get_unique_ptr().get() }; // $ Alert // BAD S s6 = b1 ? *get_unique_ptr() : *get_unique_ptr(); // GOOD - S& s7 = b1 ? *get_unique_ptr() : *get_unique_ptr(); // BAD + S& s7 = b1 ? *get_unique_ptr() : *get_unique_ptr(); // $ Alert // BAD - return &*get_unique_ptr(); // BAD + return &*get_unique_ptr(); // $ Alert // BAD } void test2(bool b1, bool b2) { - + std::unique_ptr s = get_unique_ptr(); auto s1 = s.get(); // GOOD auto s2 = b1 ? s.get() : nullptr; // GOOD @@ -211,4 +211,4 @@ void test_convert_to_bool() { if(get_unique_ptr().get()) { // GOOD } -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-428/UnsafeCreateProcessCall.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-428/UnsafeCreateProcessCall.cpp index 547237c2bea7..a1fd6f2f462c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-428/UnsafeCreateProcessCall.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-428/UnsafeCreateProcessCall.cpp @@ -100,31 +100,31 @@ void positiveTestCases() wchar_t* lpApplicationName = NULL; // CreateProcessA - CreateProcessA( //BUG + CreateProcessA( // $ Alert //BUG NULL, (char*)"C:\\Program Files\\MyApp", NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); // CreateProcessW - CreateProcessW( //BUG + CreateProcessW( // $ Alert //BUG NULL, (wchar_t*)L"C:\\Program Files\\MyApp", NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); - + // CreateProcess - CreateProcess( //BUG + CreateProcess( // $ Alert //BUG NULL, (wchar_t*)L"C:\\Program Files\\MyApp", NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); // lpCommandLine as hardcoded variable - CreateProcess( //BUG + CreateProcess( // $ Alert //BUG NULL, (wchar_t*)lpCommandLine, NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); // CreateProcessWithTokenW - CreateProcessWithTokenW( //BUG + CreateProcessWithTokenW( // $ Alert //BUG h, LOGON_WITH_PROFILE, NULL, @@ -132,7 +132,7 @@ void positiveTestCases() 0, NULL, NULL, NULL, NULL); // CreateProcessWithLogonW - CreateProcessWithLogonW( //BUG + CreateProcessWithLogonW( // $ Alert //BUG (const wchar_t*)L"UserName", (const wchar_t*)L"CONTOSO", (const wchar_t*)L"", @@ -142,21 +142,21 @@ void positiveTestCases() 0, NULL, NULL, NULL, NULL); // CreateProcessAsUserA - CreateProcessAsUserA( //BUG + CreateProcessAsUserA( // $ Alert //BUG h, NULL, (char*)"C:\\Program Files\\MyApp", NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); // CreateProcessAsUserW - CreateProcessAsUserW( //BUG + CreateProcessAsUserW( // $ Alert //BUG h, NULL, (wchar_t*)L"C:\\Program Files\\MyApp", NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); // CreateProcessAsUser - CreateProcessAsUser( //BUG + CreateProcessAsUser( // $ Alert //BUG h, NULL, (wchar_t*)L"C:\\Program Files\\MyApp", @@ -164,7 +164,7 @@ void positiveTestCases() // CreateProcess with a hardcoded variable for application Name (NULL) // Variation: tab instead of space - CreateProcess( //BUG + CreateProcess( // $ Alert //BUG lpApplicationName, (wchar_t*)L"C:\\Program\tFiles\\MyApp", NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); @@ -173,7 +173,7 @@ void positiveTestCases() void PositiveTestCasesWithCmdLineParameter(wchar_t* lpCommandLine) { // lpCommandLine as variable - CreateProcess( //BUG - Depends on the caller + CreateProcess( // $ Alert //BUG - Depends on the caller NULL, lpCommandLine, NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); @@ -199,14 +199,14 @@ void FalseNegativeTestCasesWithCmdLineParameter_caller() { // No bug - escaped command line // But compare with "PositiveTestCasesWithCmdLineParameter" - FalseNegativeTestCasesWithCmdLineParameter((wchar_t*)L"\"C:\\Program Files\\MyApp\""); + FalseNegativeTestCasesWithCmdLineParameter((wchar_t*)L"\"C:\\Program Files\\MyApp\""); } void PositiveTestCasesWithAppNameParameter(wchar_t* lpApplicationName) { void* h = 0; - CreateProcessWithTokenW( //BUG - Depends on the caller. In this case the caller sends NULL + CreateProcessWithTokenW( // $ Alert //BUG - Depends on the caller. In this case the caller sends NULL h, LOGON_WITH_PROFILE, lpApplicationName, @@ -255,7 +255,7 @@ void TestCaseProbablyBug() lpApplicationName = (const wchar_t*)L"app.exe"; } - CreateProcessWithLogonW( // BUG (Probably - depends on a condition that may be false) + CreateProcessWithLogonW( // $ Alert // BUG (Probably - depends on a condition that may be false) (const wchar_t*)L"UserName", (const wchar_t*)L"CONTOSO", (const wchar_t*)L"", @@ -289,13 +289,13 @@ void negativeTestCases_quotedCommandLine() NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); // CreateProcess - CreateProcess( + CreateProcess( NULL, (wchar_t*)L"\"C:\\Program Files\\MyApp\"", NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); // lpCommandLine as hardcoded variable - CreateProcess( + CreateProcess( NULL, (wchar_t*)lpCommandLine, NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); @@ -340,7 +340,7 @@ void negativeTestCases_quotedCommandLine() NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); // CreateProcess with a hardcoded variable for application Name (NULL) - CreateProcess( + CreateProcess( lpApplicationName, (wchar_t*)L"\"C:\\Program Files\\MyApp\"", NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-428/UnsafeCreateProcessCall.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-428/UnsafeCreateProcessCall.qlref index f2012f0c678d..75d4eecadc1d 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-428/UnsafeCreateProcessCall.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-428/UnsafeCreateProcessCall.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-428/UnsafeCreateProcessCall.ql \ No newline at end of file +query: Security/CWE/CWE-428/UnsafeCreateProcessCall.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.qlref index 5150d627257c..81d04da795eb 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql +query: Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/examples.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/examples.cpp index ccb15904d025..b895621db06e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/examples.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/examples.cpp @@ -35,7 +35,7 @@ void notifyGood(int deviceNumber) { int notifyBad(int deviceNumber) { DeviceConfig config; - initDeviceConfig(&config, deviceNumber); + initDeviceConfig(&config, deviceNumber); // $ Alert // BAD: Using config without checking the status code that is returned if (config.isEnabled) { notifyChannel(config.channel); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp index a3c9b0a24aaa..6990bf23109f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp @@ -19,14 +19,14 @@ void test1() int a, b, c, d, e, f; int result1, result2; - maybeInitialize1(&a); // BAD (initialization not checked) + maybeInitialize1(&a); // $ Alert // BAD (initialization not checked) use(a); - + if (maybeInitialize1(&b) == 1) // GOOD { use(b); } - + if (maybeInitialize1(&c) == 0) // BAD (initialization check is wrong) [NOT DETECTED] { use(c); @@ -65,9 +65,9 @@ void test2() { int a, b; - maybeInitialize2(&a); // BAD (initialization not checked) + maybeInitialize2(&a); // $ Alert // BAD (initialization not checked) use(a); - + if (maybeInitialize2(&b)) // GOOD { use(b); @@ -88,7 +88,7 @@ void test3() alwaysInitialize(&a); // GOOD (initialization never fails) use(a); - + if (alwaysInitialize(&b) == 1) // GOOD { use(b); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/UninitializedLocal.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/UninitializedLocal.qlref index 834d9576ddc2..402ebbae6eb1 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/UninitializedLocal.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/UninitializedLocal.qlref @@ -1 +1,2 @@ -Likely Bugs/Memory Management/UninitializedLocal.ql +query: Likely Bugs/Memory Management/UninitializedLocal.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/errors.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/errors.cpp index 07bb61f943ed..9c58e9520194 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/errors.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/errors.cpp @@ -10,6 +10,6 @@ void * operator new(unsigned long, bool); void operator delete(void*, bool); int f2() { - int x; - new(true) int (x); // BAD, ignore implicit error expression + int x; // $ Source Sink + new(true) int (x); // $ Alert // BAD, ignore implicit error expression } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp index 14c00675545b..4a8e734e2b62 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp @@ -8,8 +8,8 @@ void test1() { } void test2() { - int foo; - use(foo); // BAD + int foo; // $ Source Sink + use(foo); // $ Alert // BAD } void test3(bool b) { @@ -108,9 +108,9 @@ void test12() { } void test13() { - int foo; + int foo; // $ Source Sink &foo; - use(foo); // BAD + use(foo); // $ Alert // BAD } void init(int* p) { *p = 1; } @@ -223,8 +223,8 @@ void test19() { void test20() { - int x; - x += 0; // BAD + int x; // $ Source Sink + x += 0; // $ Alert // BAD use(x); } @@ -246,9 +246,9 @@ void test21() MyValue v1(1); MyValue v2; MyValue v3; - int i; + int i; // $ Source Sink - v3 = v1 >> i; // BAD: i is not initialized + v3 = v1 >> i; // $ Alert // BAD: i is not initialized v3 = v2 >> 1; // BAD: v2 is not initialized [NOT DETECTED] } @@ -338,10 +338,10 @@ int test28() { } int test29() { - bool a, b = true, c = true; + bool a, b = true, c = true; // $ Source Sink int val; - while ((a && b) || c) // BAD (a is uninitialized) + while ((a && b) || c) // $ Alert // BAD (a is uninitialized) { val = 1; b = false; @@ -363,8 +363,8 @@ int test30() { int test31() { bool loop = true; bool stop = false; - bool a, b = true, c = true; - int val; + bool a, b = true, c = true; // $ Source Sink + int val; // $ Source Sink while (loop || false) { @@ -374,7 +374,7 @@ int test31() { { stop = true; } - while ((a && b) || c) // BAD (a is uninitialized) + while ((a && b) || c) // $ Alert // BAD (a is uninitialized) { b = false; c = false; @@ -383,7 +383,7 @@ int test31() { { } while (false); - return val; // BAD + return val; // $ Alert // BAD } int test32() { @@ -419,10 +419,10 @@ int test34() { } int test35() { - int i, j; + int i, j; // $ Source Sink for (int i = 0; i < 10; i++, j = 1) { - return j; // BAD + return j; // $ Alert // BAD } } @@ -436,12 +436,12 @@ int test36() { } int test38() { - int i, j; + int i, j; // $ Source Sink for (int i = 0; false; i++, j = 1) { } - return j; // BAD + return j; // $ Alert // BAD } void test39() { @@ -457,29 +457,29 @@ void test40() { } void test41() { - int x; + int x; // $ Source Sink - x++; // BAD + x++; // $ Alert // BAD } void test42() { - int x; + int x; // $ Source Sink - void(x++); // BAD + void(x++); // $ Alert // BAD } void test43() { - int x; + int x; // $ Source Sink int y = 1; - x + y; // BAD + x + y; // $ Alert // BAD } void test44() { - int x; + int x; // $ Source Sink int y = 1; - void(x + y); // BAD + void(x + y); // $ Alert // BAD } enum class State { StateA, StateB, StateC }; @@ -600,4 +600,4 @@ void test47() { int quo; std::remquo(x, y, &quo); use(quo); // GOOD -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScaling.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScaling.qlref index 2a673380ba16..1c96d9e4607e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScaling.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScaling.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-468/IncorrectPointerScaling.ql \ No newline at end of file +query: Security/CWE/CWE-468/IncorrectPointerScaling.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScalingChar.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScalingChar.qlref index d14a9ca77f22..bc325696a764 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScalingChar.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScalingChar.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-468/IncorrectPointerScalingChar.ql +query: Security/CWE/CWE-468/IncorrectPointerScalingChar.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScalingVoid.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScalingVoid.qlref index 46650070ece4..1627ede63028 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScalingVoid.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScalingVoid.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql +query: Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/test.cpp index a4d42f4521f2..9f6b046a90bd 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/test.cpp @@ -10,7 +10,7 @@ int test2(int i) { char *charPointer = (char *)intArray; // BAD [FALSE NEGATIVE of IncorrectPointerScaling.ql]: the pointer arithmetic // uses type char*, so the offset is not scaled by sizeof(int). - return *(int *)(charPointer + i); + return *(int *)(charPointer + i); // $ Alert[cpp/incorrect-pointer-scaling-char] } int test3(int i) { @@ -47,7 +47,7 @@ char* test7( int *p = (int*)x; // BAD: the type of x is double*, but it has been cast to int* // so the pointer add is scaled by sizeof(int). - return (char *)(p + 1); + return (char *)(p + 1); // $ Alert[cpp/suspicious-pointer-scaling] } char* test8( @@ -74,7 +74,7 @@ char* test10(int* x) { // only part of an integer is architecture-dependent. If the pointer returned // from this function is dereferenced, the result will depend on int size and // endianness regardless of whether the offset is scaled by sizeof(int). - return (char*)x + 1; + return (char*)x + 1; // $ Alert[cpp/incorrect-pointer-scaling-char] } char* test10b(int* x) { @@ -91,7 +91,7 @@ short* test10c(int* x) { // from this function is dereferenced, the result will depend on int size and // endianness regardless of whether the offset is scaled by (sizeof(int) / // sizeof(short)). - return (short*)x + 1; + return (short*)x + 1; // $ Alert[cpp/suspicious-pointer-scaling] } int test11(int* x, int* y) { @@ -116,7 +116,7 @@ int test13(mystruct *p) { // computes the byte offset of a member. Code like this is commonly seen in // projects that use C/C++ for their low-level control over memory. int offset = (char *)&p->int_field - (char *)p; - return *(int *)((char*)p + offset); + return *(int *)((char*)p + offset); // $ Alert[cpp/incorrect-pointer-scaling-char] } int test14(int arr[12][12]) { @@ -127,22 +127,22 @@ int test14(int arr[12][12]) { int test15(int arr[12][12]) { // BAD: the type of the pointer is int but it has been scaled by sizeof(short) - return *(int*)((short*) arr + 1); + return *(int*)((short*) arr + 1); // $ Alert[cpp/suspicious-pointer-scaling] } void* test16(int* x) { // BAD: void pointer arithmetic is not portable across compilers - return (void*)x + 1; + return (void*)x + 1; // $ Alert[cpp/suspicious-pointer-scaling-void] } void* test17(int* x) { // BAD: void pointer arithmetic is not portable across compilers - return (void*)x + sizeof(int); + return (void*)x + sizeof(int); // $ Alert[cpp/suspicious-pointer-scaling-void] } int test18(int i) { int intArray[2][2] = { {1, 2}, {3, 4} }; char *charPointer = (char *)intArray; // BAD: the pointer arithmetic uses type char*, so the offset is not scaled by sizeof(int). - return *(int *)(charPointer + i); + return *(int *)(charPointer + i); // $ Alert[cpp/incorrect-pointer-scaling-char] } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/SuspiciousAddWithSizeof.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/SuspiciousAddWithSizeof.qlref index 8c2dec10e170..bcea0a075987 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/SuspiciousAddWithSizeof.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/SuspiciousAddWithSizeof.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql \ No newline at end of file +query: Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp index b0b590fba699..cd0c9492dde2 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp @@ -2,8 +2,8 @@ void test_buildless(const char *p_c, const short *p_short, const int *p_int, const uint8_t *p_8, const uint16_t *p_16, const uint32_t *p_32) { *(p_c + sizeof(int)); // GOOD (`sizeof(char)` is 1) - *(p_short + sizeof(int)); // BAD - *(p_int + sizeof(int)); // BAD + *(p_short + sizeof(int)); // $ Alert // BAD + *(p_int + sizeof(int)); // $ Alert // BAD *(p_8 + sizeof(int)); // GOOD (`sizeof(uint8_t)` is 1, but there's an error in the type) *(p_16 + sizeof(int)); // BAD [NOT DETECTED] *(p_32 + sizeof(int)); // BAD [NOT DETECTED] diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/test.cpp index fa2bd934cca2..de34b58f05db 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/test.cpp @@ -3,7 +3,7 @@ int test1(int i) { int *intPointer = intArray; // BAD: the offset is already automatically scaled by sizeof(int), // so this code will compute the wrong offset. - return *(intPointer + (i * sizeof(int))); + return *(intPointer + (i * sizeof(int))); // $ Alert } int test2(int i) { @@ -11,7 +11,7 @@ int test2(int i) { int *intPointer = intArray; // BAD: the offset is already automatically scaled by sizeof(int), // so this code will compute the wrong offset. - return *(intPointer - (i * sizeof(int))); + return *(intPointer - (i * sizeof(int))); // $ Alert } int test3(int i) { @@ -19,7 +19,7 @@ int test3(int i) { int *intPointer = intArray; // BAD: the offset is already automatically scaled by sizeof(int), // so this code will compute the wrong offset. - return *(intPointer + sizeof(int)); + return *(intPointer + sizeof(int)); // $ Alert } int test4(int i) { @@ -27,7 +27,7 @@ int test4(int i) { int *intPointer = intArray; // BAD: the offset is already automatically scaled by sizeof(int), // so this code will compute the wrong offset. - return *(intPointer - sizeof(int)); + return *(intPointer - sizeof(int)); // $ Alert } int test5(int i, int j) { @@ -35,7 +35,7 @@ int test5(int i, int j) { int *intPointer = intArray; // BAD: the offset is already automatically scaled by sizeof(int), // so this code will compute the wrong offset. - return *(intPointer + (i * sizeof(int) * j)); + return *(intPointer + (i * sizeof(int) * j)); // $ Alert } void test6(int i) { @@ -58,7 +58,7 @@ void test7(int i) { int v; v = *(intPointer + i); // GOOD - v = *(intPointer + (i * sizeof(int))); // BAD: scaled twice by sizeof(int) + v = *(intPointer + (i * sizeof(int))); // $ Alert // BAD: scaled twice by sizeof(int) v = *(charPointer + i); // GOOD (actually rather dubious, but this could be correct code) v = *(charPointer + (i * sizeof(int))); // GOOD v = *(int *)(voidPointer + i); // GOOD (actually rather dubious, but this could be correct code) @@ -86,7 +86,7 @@ class MyTest8Class myIntsPointer((myInt *)malloc(sizeof(MyABC) * 2)) { myChar *secondPtr = myCharsPointer + sizeof(MyABC); // GOOD - myInt *secondPtrInt = myIntsPointer + sizeof(MyABC); // BAD + myInt *secondPtrInt = myIntsPointer + sizeof(MyABC); // $ Alert // BAD } private: diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/ExposedSystemData.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/ExposedSystemData.qlref index 0c88835bf1fc..0cb5a0a34d75 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/ExposedSystemData.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/ExposedSystemData.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-497/ExposedSystemData.ql \ No newline at end of file +query: Security/CWE/CWE-497/ExposedSystemData.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/PotentiallyExposedSystemData.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/PotentiallyExposedSystemData.qlref index 4f7305ce6970..fd804eefffa8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/PotentiallyExposedSystemData.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/PotentiallyExposedSystemData.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-497/PotentiallyExposedSystemData.ql \ No newline at end of file +query: Security/CWE/CWE-497/PotentiallyExposedSystemData.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/tests.c b/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/tests.c index 4b1df2a96e1d..b12215c1cb7c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/tests.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/SAMATE/tests.c @@ -54,7 +54,7 @@ void CWE535_Info_Exposure_Shell_Error__w32_char_01_bad() if (LogonUserA( username, domain, - password, + password, // $ Source[cpp/potential-system-data-exposure] LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &pHandle) != 0) @@ -67,6 +67,6 @@ void CWE535_Info_Exposure_Shell_Error__w32_char_01_bad() printLine("Unable to login."); } /* FLAW: Write sensitive data to stderr */ - fprintf(stderr, "User attempted access with password: %s\n", password); + fprintf(stderr, "User attempted access with password: %s\n", password); // $ Alert[cpp/potential-system-data-exposure] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/PotentiallyExposedSystemData.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/PotentiallyExposedSystemData.qlref index 4f7305ce6970..fd804eefffa8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/PotentiallyExposedSystemData.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/PotentiallyExposedSystemData.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-497/PotentiallyExposedSystemData.ql \ No newline at end of file +query: Security/CWE/CWE-497/PotentiallyExposedSystemData.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests.cpp index 25a071bee467..bd318cecca69 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests.cpp @@ -45,21 +45,21 @@ void test1() { std::ostream cout_copy = std::cout; - std::cout << getenv("SECRET_TOKEN"); // BAD: outputs SECRET_TOKEN environment variable - std::cerr << getenv("SECRET_TOKEN"); // BAD: outputs SECRET_TOKEN environment variable - std::clog << getenv("SECRET_TOKEN"); // BAD: outputs SECRET_TOKEN environment variable + std::cout << getenv("SECRET_TOKEN"); // $ Alert[cpp/potential-system-data-exposure] // BAD: outputs SECRET_TOKEN environment variable + std::cerr << getenv("SECRET_TOKEN"); // $ Alert[cpp/potential-system-data-exposure] // BAD: outputs SECRET_TOKEN environment variable + std::clog << getenv("SECRET_TOKEN"); // $ Alert[cpp/potential-system-data-exposure] // BAD: outputs SECRET_TOKEN environment variable someotherostream << getenv("SECRET_TOKEN"); // GOOD: not output cout_copy << getenv("SECRET_TOKEN"); // BAD: outputs SECRET_TOKEN environment variable [NOT DETECTED] std::cout << getenv("USERPROFILE"); // BAD: outputs PATH environment variable [NOT DETECTED] std::cout << getenv("PATH"); // BAD: outputs PATH environment variable [NOT DETECTED] - std::cout.write(getenv("SECRET_TOKEN"), strlen(getenv("SECRET_TOKEN"))); // BAD: outputs SECRET_TOKEN environment variable - (std::cout << "SECRET_TOKEN = ").write(getenv("SECRET_TOKEN"), strlen(getenv("SECRET_TOKEN"))); // BAD: outputs SECRET_TOKEN environment variable - std::cout.write("SECRET_TOKEN = ", 7) << getenv("SECRET_TOKEN"); // BAD: outputs SECRET_TOKEN environment variable + std::cout.write(getenv("SECRET_TOKEN"), strlen(getenv("SECRET_TOKEN"))); // $ Alert[cpp/potential-system-data-exposure] // BAD: outputs SECRET_TOKEN environment variable + (std::cout << "SECRET_TOKEN = ").write(getenv("SECRET_TOKEN"), strlen(getenv("SECRET_TOKEN"))); // $ Alert[cpp/potential-system-data-exposure] // BAD: outputs SECRET_TOKEN environment variable + std::cout.write("SECRET_TOKEN = ", 7) << getenv("SECRET_TOKEN"); // $ Alert[cpp/potential-system-data-exposure] // BAD: outputs SECRET_TOKEN environment variable } -char *global_token = getenv("SECRET_TOKEN"); +char *global_token = getenv("SECRET_TOKEN"); // $ Source[cpp/potential-system-data-exposure] char *global_other = "Hello, world!"; void test2(bool cond) @@ -67,10 +67,10 @@ void test2(bool cond) char *maybe; maybe = cond ? global_token : global_other; - - printf("token = '%s'\n", global_token); // BAD: outputs SECRET_TOKEN environment variable + + printf("token = '%s'\n", global_token); // $ Alert[cpp/potential-system-data-exposure] // BAD: outputs SECRET_TOKEN environment variable printf("other = '%s'\n", global_other); - printf("maybe = '%s'\n", maybe); // BAD: may output SECRET_TOKEN environment variable + printf("maybe = '%s'\n", maybe); // $ Alert[cpp/potential-system-data-exposure] // BAD: may output SECRET_TOKEN environment variable } void test3() @@ -85,7 +85,7 @@ void test3() void myOutputFn(const char *msg) { - printf("%s", msg); + printf("%s", msg); // $ Alert[cpp/potential-system-data-exposure] } void myOtherFn(const char *msg) @@ -94,7 +94,7 @@ void myOtherFn(const char *msg) void test4() { - myOutputFn(getenv("SECRET_TOKEN")); // BAD: outputs the SECRET_TOKEN environment variable + myOutputFn(getenv("SECRET_TOKEN")); // $ Alert[cpp/potential-system-data-exposure] Source[cpp/potential-system-data-exposure] // BAD: outputs the SECRET_TOKEN environment variable myOtherFn(getenv("SECRET_TOKEN")); // GOOD: does not output anything. } @@ -108,7 +108,7 @@ void myOutputFn3(const char *msg) { const char *tmp = msg; - printf("%s", tmp); + printf("%s", tmp); // $ Alert[cpp/potential-system-data-exposure] } void myOutputFn4(const char *msg) @@ -116,29 +116,29 @@ void myOutputFn4(const char *msg) char buffer[4096]; sprintf(buffer, "log: %s\n", msg); - puts(buffer); + puts(buffer); // $ Alert[cpp/potential-system-data-exposure] } void myOutputFn5(const char *msg) { - printf("%s", msg); + printf("%s", msg); // $ Alert[cpp/potential-system-data-exposure] msg = ""; } void test5() { myOutputFn2(getenv("SECRET_TOKEN")); // GOOD: myOutputFn2 doesn't actually output the parameter - myOutputFn3(getenv("SECRET_TOKEN")); // BAD: outputs the SECRET_TOKEN environment variable - myOutputFn4(getenv("SECRET_TOKEN")); // BAD: outputs the SECRET_TOKEN environment variable - myOutputFn5(getenv("SECRET_TOKEN")); // BAD: outputs the SECRET_TOKEN environment variable + myOutputFn3(getenv("SECRET_TOKEN")); // $ Source[cpp/potential-system-data-exposure] // BAD: outputs the SECRET_TOKEN environment variable + myOutputFn4(getenv("SECRET_TOKEN")); // $ Source[cpp/potential-system-data-exposure] // BAD: outputs the SECRET_TOKEN environment variable + myOutputFn5(getenv("SECRET_TOKEN")); // $ Alert[cpp/potential-system-data-exposure] Source[cpp/potential-system-data-exposure] // BAD: outputs the SECRET_TOKEN environment variable } void RtlZeroMemory(void* dst, size_t len); void test_clear_memory(char *username) { - char* secret = getenv("SECRET_TOKEN"); + char* secret = getenv("SECRET_TOKEN"); // $ Source[cpp/potential-system-data-exposure] - printf("%s", secret); // BAD + printf("%s", secret); // $ Alert[cpp/potential-system-data-exposure] // BAD RtlZeroMemory(secret, 1024); printf("%s", secret); // GOOD -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests2.cpp index 4167f6903af4..473d5c9dcd1b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests2.cpp @@ -47,7 +47,7 @@ int val(); // --- test cases --- -const char *global1 = mysql_get_client_info(); // $ Source +const char *global1 = mysql_get_client_info(); // $ Source[cpp/system-data-exposure] const char *global2 = "abc"; void test7() @@ -55,15 +55,15 @@ void test7() int sock = socket(val(), val(), val()); // tests for a strict implementation of CWE-497 - std::cout << getenv("HOME"); // $ MISSING: Alert // outputs HOME environment variable - std::cout << "PATH = " << getenv("PATH") << "."; // $ MISSING: Alert // outputs PATH environment variable + std::cout << getenv("HOME"); // $ MISSING: Alert[cpp/system-data-exposure] // outputs HOME environment variable + std::cout << "PATH = " << getenv("PATH") << "."; // $ MISSING: Alert[cpp/system-data-exposure] // outputs PATH environment variable std::cout << "PATHPATHPATH"; // GOOD: not system data // tests for a more pragmatic implementation of CWE-497 - send(sock, getenv("HOME"), val(), val()); // $ Alert - send(sock, getenv("PATH"), val(), val()); // $ Alert - send(sock, getenv("USERNAME"), val(), val()); // $ Alert - send(sock, getenv("APP_PASSWORD"), val(), val()); // $ Alert + send(sock, getenv("HOME"), val(), val()); // $ Alert[cpp/system-data-exposure] + send(sock, getenv("PATH"), val(), val()); // $ Alert[cpp/system-data-exposure] + send(sock, getenv("USERNAME"), val(), val()); // $ Alert[cpp/system-data-exposure] + send(sock, getenv("APP_PASSWORD"), val(), val()); // $ Alert[cpp/system-data-exposure] send(sock, getenv("HARMLESS"), val(), val()); // GOOD: harmless information send(sock, "HOME", val(), val()); // GOOD: not system data send(sock, "PATH", val(), val()); // GOOD: not system data @@ -75,11 +75,11 @@ void test7() { char buffer[256]; - strcpy(buffer, mysql_get_client_info()); // $ Source + strcpy(buffer, mysql_get_client_info()); // $ Source[cpp/system-data-exposure] - send(sock, mysql_get_client_info(), val(), val()); // $ Alert - send(sock, buffer, val(), val()); // $ Alert - send(sock, global1, val(), val()); // $ Alert + send(sock, mysql_get_client_info(), val(), val()); // $ Alert[cpp/system-data-exposure] + send(sock, buffer, val(), val()); // $ Alert[cpp/system-data-exposure] + send(sock, global1, val(), val()); // $ Alert[cpp/system-data-exposure] send(sock, global2, val(), val()); // GOOD: not system data } @@ -88,9 +88,9 @@ void test7() const char *str1 = "123456"; const char *str2 = "abcdef"; - mysql_real_connect(sock, val(), val(), str1, val(), val(), val(), val()); // $ Source + mysql_real_connect(sock, val(), val(), str1, val(), val(), val(), val()); // $ Source[cpp/system-data-exposure] - send(sock, str1, val(), val()); // $ Alert + send(sock, str1, val(), val()); // $ Alert[cpp/system-data-exposure] send(sock, str2, val(), val()); // GOOD: not system data } @@ -98,17 +98,17 @@ void test7() { passwd *pw; - pw = getpwuid(val()); // $ Source - send(sock, pw->pw_passwd, val(), val()); // $ Alert + pw = getpwuid(val()); // $ Source[cpp/system-data-exposure] + send(sock, pw->pw_passwd, val(), val()); // $ Alert[cpp/system-data-exposure] } // tests for containers { container c1, c2; - c1.ptr = getenv("MY_SECRET_TOKEN"); // $ Source + c1.ptr = getenv("MY_SECRET_TOKEN"); // $ Source[cpp/system-data-exposure] c2.ptr = ""; - send(sock, c1.ptr, val(), val()); // $ Alert + send(sock, c1.ptr, val(), val()); // $ Alert[cpp/system-data-exposure] send(sock, c2.ptr, val(), val()); // GOOD: not system data } } @@ -131,20 +131,20 @@ void test_zmq(void *remoteSocket) size_t message_len; // prepare data - message_data = getenv("HOME"); // $ Source + message_data = getenv("HOME"); // $ Source[cpp/system-data-exposure] message_len = strlen(message_data) + 1; // send as data - if (zmq_send(socket, message_data, message_len, 0) >= 0) { // $ Alert: outputs HOME environment variable + if (zmq_send(socket, message_data, message_len, 0) >= 0) { // $ Alert[cpp/system-data-exposure]: outputs HOME environment variable // ... } // send as message if (zmq_msg_init_data(&message, message_data, message_len, 0, 0)) { - if (zmq_sendmsg(remoteSocket, &message, message_len)) { // $ Alert: outputs HOME environment variable + if (zmq_sendmsg(remoteSocket, &message, message_len)) { // $ Alert[cpp/system-data-exposure]: outputs HOME environment variable // ... } - if (zmq_msg_send(&message, remoteSocket, message_len)) { // $ Alert: outputs HOME environment variable + if (zmq_msg_send(&message, remoteSocket, message_len)) { // $ Alert[cpp/system-data-exposure]: outputs HOME environment variable // ... } } @@ -152,10 +152,10 @@ void test_zmq(void *remoteSocket) // send as message (alternative path) if (zmq_msg_init_size(&message, message_len) == 0) { memcpy(zmq_msg_data(&message), message_data, message_len); - if (zmq_sendmsg(remoteSocket,&message, message_len)) { // $ Alert: outputs HOME environment variable + if (zmq_sendmsg(remoteSocket,&message, message_len)) { // $ Alert[cpp/system-data-exposure]: outputs HOME environment variable // ... } - if (zmq_msg_send(&message, remoteSocket, message_len)) { // $ Alert: outputs HOME environment variable + if (zmq_msg_send(&message, remoteSocket, message_len)) { // $ Alert[cpp/system-data-exposure]: outputs HOME environment variable // ... } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_passwd.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_passwd.cpp index 6de8ed84d061..013536020869 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_passwd.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_passwd.cpp @@ -13,9 +13,9 @@ void test6(char *username) { passwd *pwd; - pwd = getpwnam(username); + pwd = getpwnam(username); // $ Source[cpp/potential-system-data-exposure] - printf("pw_passwd = %s\n", pwd->pw_passwd); // BAD - printf("pw_dir = %s\n", pwd->pw_dir); // BAD + printf("pw_passwd = %s\n", pwd->pw_passwd); // $ Alert[cpp/potential-system-data-exposure] // BAD + printf("pw_dir = %s\n", pwd->pw_dir); // $ Alert[cpp/potential-system-data-exposure] // BAD printf("sizeof(passwd) = %i\n", sizeof(passwd)); // GOOD } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_sockets.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_sockets.cpp index f5c47f1a9e6e..ec5ac3c0f010 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_sockets.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_sockets.cpp @@ -23,7 +23,7 @@ void test_sockets1() int sockfd; sockaddr addr_remote; char *msg = "Hello, world!"; - char *path = getenv("PATH"); // $ Source + char *path = getenv("PATH"); // $ Source[cpp/system-data-exposure] // create socket sockfd = socket(AF_INET, SOCK_STREAM, 0); @@ -36,11 +36,11 @@ void test_sockets1() // send something using 'send' if (send(sockfd, msg, strlen(msg) + 1, 0) < 0) return; // GOOD - if (send(sockfd, path, strlen(path) + 1, 0) < 0) return; // $ Alert + if (send(sockfd, path, strlen(path) + 1, 0) < 0) return; // $ Alert[cpp/system-data-exposure] // send something using 'write' if (write(sockfd, msg, strlen(msg) + 1) < 0) return; // GOOD - if (write(sockfd, path, strlen(path) + 1) < 0) return; // $ Alert + if (write(sockfd, path, strlen(path) + 1) < 0) return; // $ Alert[cpp/system-data-exposure] // clean up // ... @@ -60,7 +60,7 @@ void test_sockets2() int sockfd; sockaddr addr_remote; char *msg = "Hello, world!"; - char *path = getenv("PATH"); // $ Source + char *path = getenv("PATH"); // $ Source[cpp/system-data-exposure] // create socket sockfd = mksocket(); @@ -73,11 +73,11 @@ void test_sockets2() // send something using 'send' if (send(sockfd, msg, strlen(msg) + 1, 0) < 0) return; // GOOD - if (send(sockfd, path, strlen(path) + 1, 0) < 0) return; // $ Alert + if (send(sockfd, path, strlen(path) + 1, 0) < 0) return; // $ Alert[cpp/system-data-exposure] // send something using 'write' if (write(sockfd, msg, strlen(msg) + 1) < 0) return; // GOOD - if (write(sockfd, path, strlen(path) + 1) < 0) return; // $ Alert + if (write(sockfd, path, strlen(path) + 1) < 0) return; // $ Alert[cpp/system-data-exposure] // clean up // ... diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_sysconf.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_sysconf.cpp index e0b4e7dc291f..00682ae4e6a4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_sysconf.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/tests_sysconf.cpp @@ -21,7 +21,7 @@ void test_sc_1() int value = sysconf(_SC_CHILD_MAX); printf("_SC_CHILD_MAX = %i\n", _SC_CHILD_MAX); // GOOD - printf("_SC_CHILD_MAX = %i\n", value); // $ MISSING: Alert + printf("_SC_CHILD_MAX = %i\n", value); // $ MISSING: Alert[cpp/system-data-exposure] } void test_sc_2() @@ -33,9 +33,9 @@ void test_sc_2() pathbuf = (char *)malloc(n); if (pathbuf != NULL) { - confstr(_CS_PATH, pathbuf, n); // $ Source + confstr(_CS_PATH, pathbuf, n); // $ Source[cpp/system-data-exposure] - printf("path: %s", pathbuf); // $ MISSING: Alert - write(get_fd(), pathbuf, strlen(pathbuf)); // $ Alert + printf("path: %s", pathbuf); // $ MISSING: Alert[cpp/system-data-exposure] + write(get_fd(), pathbuf, strlen(pathbuf)); // $ Alert[cpp/system-data-exposure] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.qlref index fe4bb214bb47..10f5cbc30be5 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-570/IncorrectAllocationErrorHandling.ql +query: Security/CWE/CWE-570/IncorrectAllocationErrorHandling.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-570/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-570/test.cpp index 9df901ca5a9f..75ad6fb8d311 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-570/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-570/test.cpp @@ -18,7 +18,7 @@ void *operator new(std::size_t, const std::nothrow_t &) noexcept; void *operator new[](std::size_t, const std::nothrow_t &) noexcept; void bad_new_in_condition() { - if (!(new int)) { // BAD + if (!(new int)) { // $ Alert // BAD return; } } @@ -26,53 +26,53 @@ void bad_new_in_condition() { void foo(int**); void bad_new_missing_exception_handling() { - int *p1 = new int[100]; // BAD + int *p1 = new int[100]; // $ Alert // BAD if (p1 == 0) return; - int *p2 = new int[100]; // BAD + int *p2 = new int[100]; // $ Alert // BAD if (!p2) return; - int *p3 = new int[100]; // BAD + int *p3 = new int[100]; // $ Alert // BAD if (p3 == NULL) return; - int *p4 = new int[100]; // BAD + int *p4 = new int[100]; // $ Alert // BAD if (p4 == nullptr) return; - int *p5 = new int[100]; // BAD + int *p5 = new int[100]; // $ Alert // BAD if (p5) {} else return; int *p6; - p6 = new int[100]; // BAD + p6 = new int[100]; // $ Alert // BAD if (p6 == 0) return; int *p7; - p7 = new int[100]; // BAD + p7 = new int[100]; // $ Alert // BAD if (!p7) return; int *p8; - p8 = new int[100]; // BAD + p8 = new int[100]; // $ Alert // BAD if (p8 == NULL) return; int *p9; - p9 = new int[100]; // BAD + p9 = new int[100]; // $ Alert // BAD if (p9 != nullptr) { } else return; int *p10; - p10 = new int[100]; // BAD + p10 = new int[100]; // $ Alert // BAD if (p10 != 0) { } int *p11; do { - p11 = new int[100]; // BAD + p11 = new int[100]; // $ Alert // BAD } while (!p11); int* p12 = new int[100]; @@ -89,11 +89,11 @@ void bad_new_missing_exception_handling() { void bad_new_nothrow_in_exception_body() { try { - new (std::nothrow) int[100]; // BAD - int *p1 = new (std::nothrow) int[100]; // BAD + new (std::nothrow) int[100]; // $ Alert // BAD + int *p1 = new (std::nothrow) int[100]; // $ Alert // BAD int *p2; - p2 = new (std::nothrow) int[100]; // BAD + p2 = new (std::nothrow) int[100]; // $ Alert // BAD } catch (const std::bad_alloc &) { } } @@ -157,7 +157,7 @@ struct Bar { void bad_placement_new_with_exception_handling() { char buffer[1024]; - try { new (buffer) Foo; } // BAD (placement new should not fail) + try { new (buffer) Foo; } // $ Alert // BAD (placement new should not fail) catch (...) { } } @@ -226,7 +226,7 @@ void good_new_with_throwing_call() { void bad_new_with_nonthrowing_call() { try { - int* p1 = new(std::nothrow) int; // BAD + int* p1 = new(std::nothrow) int; // $ Alert // BAD calls_non_throwing(p1); } catch(...) { } @@ -239,7 +239,7 @@ void bad_new_with_nonthrowing_call() { void bad_new_catch_baseclass_of_bad_alloc() { try { - int* p = new(std::nothrow) int; // BAD + int* p = new(std::nothrow) int; // $ Alert // BAD } catch(const std::exception&) { } } @@ -273,7 +273,7 @@ namespace qhelp { // BAD: the allocation will throw an unhandled exception // instead of returning a null pointer. void bad1(std::size_t length) noexcept { - int* dest = new int[length]; + int* dest = new int[length]; // $ Alert if(!dest) { return; } @@ -285,7 +285,7 @@ namespace qhelp { // instead return a null pointer. void bad2(std::size_t length) noexcept { try { - int* dest = new(std::nothrow) int[length]; + int* dest = new(std::nothrow) int[length]; // $ Alert std::memset(dest, 0, length); // ... } catch(std::bad_alloc&) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.qlref index 866f8697cafe..185788f319dd 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/XXE.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-611/XXE.ql +query: Security/CWE/CWE-611/XXE.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp index 51ae57f54d9d..c6253a56bdf4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp @@ -12,9 +12,9 @@ class XercesDOMParser: public AbstractDOMParser { // --- void test1(InputSource &data) { - XercesDOMParser *p = new XercesDOMParser(); + XercesDOMParser *p = new XercesDOMParser(); // $ Source - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test2(InputSource &data) { @@ -25,18 +25,18 @@ void test2(InputSource &data) { } void test3(InputSource &data) { - XercesDOMParser *p = new XercesDOMParser(); + XercesDOMParser *p = new XercesDOMParser(); // $ Source p->setDisableDefaultEntityResolution(false); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test4(InputSource &data) { - XercesDOMParser *p = new XercesDOMParser(); + XercesDOMParser *p = new XercesDOMParser(); // $ Source p->setDisableDefaultEntityResolution(true); p->setCreateEntityReferenceNodes(false); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test5(InputSource &data) { @@ -48,44 +48,44 @@ void test5(InputSource &data) { } void test6(InputSource &data) { - XercesDOMParser *p = new XercesDOMParser(); + XercesDOMParser *p = new XercesDOMParser(); // $ Source p->setDisableDefaultEntityResolution(true); p->parse(data); // GOOD p->setDisableDefaultEntityResolution(false); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) p->setDisableDefaultEntityResolution(true); p->parse(data); // GOOD p->setCreateEntityReferenceNodes(false); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) p->setCreateEntityReferenceNodes(true); p->parse(data); // GOOD } void test7(InputSource &data, bool cond) { - XercesDOMParser *p = new XercesDOMParser(); + XercesDOMParser *p = new XercesDOMParser(); // $ Source p->setDisableDefaultEntityResolution(cond); - p->parse(data); // BAD (parser may not be correctly configured) + p->parse(data); // $ Alert // BAD (parser may not be correctly configured) } void test8(InputSource &data, bool cond) { - XercesDOMParser *p = new XercesDOMParser(); + XercesDOMParser *p = new XercesDOMParser(); // $ Source if (cond) { p->setDisableDefaultEntityResolution(true); } - p->parse(data); // BAD (parser may not be correctly configured) + p->parse(data); // $ Alert // BAD (parser may not be correctly configured) } void test9(InputSource &data) { { - XercesDOMParser *p = new XercesDOMParser(); + XercesDOMParser *p = new XercesDOMParser(); // $ Source XercesDOMParser &q = *p; - q.parse(data); // BAD (parser not correctly configured) + q.parse(data); // $ Alert // BAD (parser not correctly configured) } { @@ -97,11 +97,11 @@ void test9(InputSource &data) { } { - XercesDOMParser *p = new XercesDOMParser(); + XercesDOMParser *p = new XercesDOMParser(); // $ Source XercesDOMParser &q = *p; p->setDisableDefaultEntityResolution(true); - q.parse(data); // GOOD [FALSE POSITIVE] + q.parse(data); // $ Alert // GOOD [FALSE POSITIVE] } } @@ -110,16 +110,16 @@ void test10_doParseA(XercesDOMParser *p, InputSource &data) { } void test10_doParseB(XercesDOMParser *p, InputSource &data) { - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test10_doParseC(XercesDOMParser *p, InputSource &data) { - p->parse(data); // BAD (parser may not be correctly configured) + p->parse(data); // $ Alert // BAD (parser may not be correctly configured) } void test10(InputSource &data) { XercesDOMParser *p = new XercesDOMParser(); - XercesDOMParser *q = new XercesDOMParser(); + XercesDOMParser *q = new XercesDOMParser(); // $ Source p->setDisableDefaultEntityResolution(true); test10_doParseA(p, data); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests2.cpp index 8154536fd952..86462e9cefb4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests2.cpp @@ -17,9 +17,9 @@ class SAXParser // --- void test2_1(InputSource &data) { - SAXParser *p = new SAXParser(); + SAXParser *p = new SAXParser(); // $ Source - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test2_2(InputSource &data) { @@ -30,11 +30,11 @@ void test2_2(InputSource &data) { } void test2_3(InputSource &data) { - SAXParser *p = new SAXParser(); + SAXParser *p = new SAXParser(); // $ Source bool v = false; p->setDisableDefaultEntityResolution(v); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test2_4(InputSource &data) { @@ -46,9 +46,9 @@ void test2_4(InputSource &data) { } void test2_5(InputSource &data) { - SAXParser p; + SAXParser p; // $ Source - p.parse(data); // BAD (parser not correctly configured) + p.parse(data); // $ Alert // BAD (parser not correctly configured) } void test2_6(InputSource &data) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp index 064eadac4fa4..9c3911dde7bf 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp @@ -20,9 +20,9 @@ class XMLReaderFactory // --- void test3_1(InputSource &data) { - SAX2XMLReader *p = XMLReaderFactory::createXMLReader(); + SAX2XMLReader *p = XMLReaderFactory::createXMLReader(); // $ Source - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test3_2(InputSource &data) { @@ -32,10 +32,10 @@ void test3_2(InputSource &data) { p->parse(data); // GOOD } -SAX2XMLReader *p_3_3 = XMLReaderFactory::createXMLReader(); +SAX2XMLReader *p_3_3 = XMLReaderFactory::createXMLReader(); // $ Source void test3_3(InputSource &data) { - p_3_3->parse(data); // BAD (parser not correctly configured) + p_3_3->parse(data); // $ Alert // BAD (parser not correctly configured) } SAX2XMLReader *p_3_4 = XMLReaderFactory::createXMLReader(); @@ -45,7 +45,7 @@ void test3_4(InputSource &data) { p_3_4->parse(data); // GOOD } -SAX2XMLReader *p_3_5 = XMLReaderFactory::createXMLReader(); +SAX2XMLReader *p_3_5 = XMLReaderFactory::createXMLReader(); // $ Source void test3_5_init() { p_3_5->setFeature(XMLUni::fgXercesDisableDefaultEntityResolution, true); @@ -53,21 +53,21 @@ void test3_5_init() { void test3_5(InputSource &data) { test3_5_init(); - p_3_5->parse(data); // GOOD [FALSE POSITIVE] + p_3_5->parse(data); // $ Alert // GOOD [FALSE POSITIVE] } void test3_6(InputSource &data) { - SAX2XMLReader *p = XMLReaderFactory::createXMLReader(); + SAX2XMLReader *p = XMLReaderFactory::createXMLReader(); // $ Source p->setFeature(XMLUni::fgXercesDisableDefaultEntityResolution, false); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test3_7(InputSource &data) { - SAX2XMLReader *p = XMLReaderFactory::createXMLReader(); + SAX2XMLReader *p = XMLReaderFactory::createXMLReader(); // $ Source p->setFeature(XMLUni::fgXercesHarmlessOption, true); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test3_8(InputSource &data) { @@ -77,6 +77,3 @@ void test3_8(InputSource &data) { p->setFeature(feature, true); p->parse(data); // GOOD } - - - diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp index 642c1866629b..d08c77d630b5 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp @@ -23,7 +23,7 @@ void xmlFreeDoc(xmlDoc *ptr); void test4_1(const char *fileName) { xmlDoc *p; - p = xmlReadFile(fileName, NULL, XML_PARSE_NOENT); // BAD (parser not correctly configured) + p = xmlReadFile(fileName, NULL, XML_PARSE_NOENT); // $ Alert // BAD (parser not correctly configured) if (p != NULL) { xmlFreeDoc(p); @@ -33,7 +33,7 @@ void test4_1(const char *fileName) { void test4_2(const char *fileName) { xmlDoc *p; - p = xmlReadFile(fileName, NULL, XML_PARSE_DTDLOAD); // BAD (parser not correctly configured) + p = xmlReadFile(fileName, NULL, XML_PARSE_DTDLOAD); // $ Alert // BAD (parser not correctly configured) if (p != NULL) { xmlFreeDoc(p); @@ -43,7 +43,7 @@ void test4_2(const char *fileName) { void test4_3(const char *fileName) { xmlDoc *p; - p = xmlReadFile(fileName, NULL, XML_PARSE_NOENT | XML_PARSE_DTDLOAD); // BAD (parser not correctly configured) + p = xmlReadFile(fileName, NULL, XML_PARSE_NOENT | XML_PARSE_DTDLOAD); // $ Alert // BAD (parser not correctly configured) if (p != NULL) { xmlFreeDoc(p); @@ -74,7 +74,7 @@ void test4_6(const char *fileName) { xmlDoc *p; int flags = XML_PARSE_NOENT; - p = xmlReadFile(fileName, NULL, flags); // BAD (parser not correctly configured) + p = xmlReadFile(fileName, NULL, flags); // $ Alert // BAD (parser not correctly configured) if (p != NULL) { xmlFreeDoc(p); @@ -127,7 +127,7 @@ void test4_10(const char *ptr, int sz) { void test4_11(const char *ptr, int sz) { xmlDoc *p; - p = xmlReadMemory(ptr, sz, "", NULL, XML_PARSE_DTDLOAD); // BAD (parser not correctly configured) + p = xmlReadMemory(ptr, sz, "", NULL, XML_PARSE_DTDLOAD); // $ Alert // BAD (parser not correctly configured) if (p != NULL) { xmlFreeDoc(p); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp index 063c47b025e4..1c945a6a6b34 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp @@ -24,9 +24,9 @@ class DOMImplementationLS { // --- void test5_1(DOMImplementationLS *impl, InputSource &data) { - DOMLSParser *p = impl->createLSParser(); + DOMLSParser *p = impl->createLSParser(); // $ Source - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test5_2(DOMImplementationLS *impl, InputSource &data) { @@ -37,10 +37,10 @@ void test5_2(DOMImplementationLS *impl, InputSource &data) { } void test5_3(DOMImplementationLS *impl, InputSource &data) { - DOMLSParser *p = impl->createLSParser(); + DOMLSParser *p = impl->createLSParser(); // $ Source p->getDomConfig()->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test5_4(DOMImplementationLS *impl, InputSource &data) { @@ -52,11 +52,11 @@ void test5_4(DOMImplementationLS *impl, InputSource &data) { } void test5_5(DOMImplementationLS *impl, InputSource &data) { - DOMLSParser *p = impl->createLSParser(); + DOMLSParser *p = impl->createLSParser(); // $ Source DOMConfiguration *cfg = p->getDomConfig(); cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } DOMImplementationLS *g_impl; @@ -67,26 +67,26 @@ void test5_6_init() { g_p1 = g_impl->createLSParser(); g_p1->getDomConfig()->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, true); - g_p2 = g_impl->createLSParser(); + g_p2 = g_impl->createLSParser(); // $ Source } void test5_6() { test5_6_init(); g_p1->parse(*g_data); // GOOD - g_p2->parse(*g_data); // BAD (parser not correctly configured) + g_p2->parse(*g_data); // $ Alert // BAD (parser not correctly configured) } void test5_7(DOMImplementationLS *impl, InputSource &data) { - DOMLSParser *p = impl->createLSParser(); + DOMLSParser *p = impl->createLSParser(); // $ Source - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) p->getDomConfig()->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, true); p->parse(data); // GOOD p->getDomConfig()->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false); - p->parse(data); // BAD (parser not correctly configured) + p->parse(data); // $ Alert // BAD (parser not correctly configured) } void test5_8(DOMImplementationLS *impl, InputSource &data) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-676/SAMATE/DangerousUseOfCin/DangerousUseOfCin.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-676/SAMATE/DangerousUseOfCin/DangerousUseOfCin.qlref index 5a35bf81fd99..a5067fc5ee1a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-676/SAMATE/DangerousUseOfCin/DangerousUseOfCin.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-676/SAMATE/DangerousUseOfCin/DangerousUseOfCin.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-676/DangerousUseOfCin.ql +query: Security/CWE/CWE-676/DangerousUseOfCin.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-676/SAMATE/DangerousUseOfCin/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-676/SAMATE/DangerousUseOfCin/test.cpp index 704c2a87b3f3..12a3e056b3a2 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-676/SAMATE/DangerousUseOfCin/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-676/SAMATE/DangerousUseOfCin/test.cpp @@ -56,7 +56,7 @@ void CWE676_Use_of_Potentially_Dangerous_Function__basic_17_bad() char charBuffer[CHAR_BUFFER_SIZE]; /* FLAW: using cin in an inherently dangerous fashion */ /* INCIDENTAL CWE120 Buffer Overflow since cin extraction is unbounded. */ - cin >> charBuffer; // BAD + cin >> charBuffer; // $ Alert // BAD charBuffer[CHAR_BUFFER_SIZE-1] = '\0'; printLine(charBuffer); } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/DangerousUseOfCin/DangerousUseOfCin.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/DangerousUseOfCin/DangerousUseOfCin.qlref index 5a35bf81fd99..a5067fc5ee1a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/DangerousUseOfCin/DangerousUseOfCin.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/DangerousUseOfCin/DangerousUseOfCin.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-676/DangerousUseOfCin.ql +query: Security/CWE/CWE-676/DangerousUseOfCin.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/DangerousUseOfCin/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/DangerousUseOfCin/test.cpp index 4c5d4bb99bf7..75248ba1e978 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/DangerousUseOfCin/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/DangerousUseOfCin/test.cpp @@ -49,7 +49,7 @@ void bad() { char buffer[BUFFER_SIZE]; // BAD: Use of 'cin' without specifying the length of the input. - cin >> buffer; + cin >> buffer; // $ Alert buffer[BUFFER_SIZE-1] = '\0'; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/DangerousFunctionOverflow.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/DangerousFunctionOverflow.qlref index e46499468514..41d5b35b3c97 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/DangerousFunctionOverflow.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/DangerousFunctionOverflow.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-676/DangerousFunctionOverflow.ql +query: Security/CWE/CWE-676/DangerousFunctionOverflow.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/PotentiallyDangerousFunction.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/PotentiallyDangerousFunction.qlref index 45388d46e2e3..8fb8f0fceafa 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/PotentiallyDangerousFunction.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/PotentiallyDangerousFunction.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-676/PotentiallyDangerousFunction.ql +query: Security/CWE/CWE-676/PotentiallyDangerousFunction.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/test.c index 34ca23748c84..0dfe8e6fd79d 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/test.c @@ -28,7 +28,7 @@ char *asctime(const struct tm *timeptr); // Code under test int is_morning() { - struct tm *now = gmtime(time(NULL)); // BAD: gmtime uses shared state + struct tm *now = gmtime(time(NULL)); // $ Alert[cpp/potentially-dangerous-function] // BAD: gmtime uses shared state return (now->tm_hour < 12); } @@ -39,13 +39,13 @@ void testGets() { char *buf2 = malloc(1024); char *s; - gets(buf1); // BAD: use of gets - s = gets(buf2); // BAD: use of gets + gets(buf1); // $ Alert[cpp/dangerous-function-overflow] // BAD: use of gets + s = gets(buf2); // $ Alert[cpp/dangerous-function-overflow] // BAD: use of gets } void testTime() { - struct tm *now = localtime(time(NULL)); // BAD: localtime uses shared state - char *time_string = ctime(time(NULL)); // BAD: localtime uses shared state - char *time_string2 = asctime(now); // BAD: localtime uses shared state + struct tm *now = localtime(time(NULL)); // $ Alert[cpp/potentially-dangerous-function] // BAD: localtime uses shared state + char *time_string = ctime(time(NULL)); // $ Alert[cpp/potentially-dangerous-function] // BAD: localtime uses shared state + char *time_string2 = asctime(now); // $ Alert[cpp/potentially-dangerous-function] // BAD: localtime uses shared state } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.c b/cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.c index 61243f3db1a9..574152388e9e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.c @@ -17,13 +17,13 @@ void test_open() { open(a_file, O_NONBLOCK); // GOOD open(a_file, O_RDWR | O_CLOEXEC); // GOOD open(a_file, O_APPEND); // GOOD - open(a_file, O_CREAT); // BAD + open(a_file, O_CREAT); // $ Alert[cpp/open-call-with-mode-argument] // BAD open(a_file, O_CREAT, 0); // GOOD - open(a_file, O_TMPFILE); // BAD + open(a_file, O_TMPFILE); // $ Alert[cpp/open-call-with-mode-argument] // BAD open(a_file, O_TMPFILE, 0); // GOOD openat(0, a_file, O_APPEND); // GOOD - openat(0, a_file, O_CREAT); // BAD + openat(0, a_file, O_CREAT); // $ Alert[cpp/open-call-with-mode-argument] // BAD openat(0, a_file, O_CREAT, 0); // GOOD - openat(0, a_file, O_TMPFILE); // BAD + openat(0, a_file, O_TMPFILE); // $ Alert[cpp/open-call-with-mode-argument] // BAD openat(0, a_file, O_TMPFILE, 0); // GOOD } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.qlref index 68198ec2a3b1..e1ff489c2430 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-732/OpenCallMissingModeArgument.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-732/OpenCallMissingModeArgument.ql \ No newline at end of file +query: Security/CWE/CWE-732/OpenCallMissingModeArgument.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.cpp index f2f7d80e44a2..09a32989a5ac 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.cpp @@ -67,13 +67,13 @@ void Test() { PSECURITY_DESCRIPTOR pSecurityDescriptor; BOOL b; - b = SetSecurityDescriptorDacl(pSecurityDescriptor, + b = SetSecurityDescriptorDacl(pSecurityDescriptor, // $ Alert[cpp/unsafe-dacl-security-descriptor] TRUE, // Dacl Present NULL, // NULL pointer to DACL == BUG FALSE); PACL pDacl = NULL; - b = SetSecurityDescriptorDacl(pSecurityDescriptor, + b = SetSecurityDescriptorDacl(pSecurityDescriptor, // $ Alert[cpp/unsafe-dacl-security-descriptor] TRUE, // Dacl Present pDacl, // NULL pointer to DACL == BUG FALSE); @@ -117,7 +117,7 @@ void Test2() FALSE); PACL pDacl2 = returnNull(); - SetSecurityDescriptorDacl( + SetSecurityDescriptorDacl( // $ Alert[cpp/unsafe-dacl-security-descriptor] pSecurityDescriptor, TRUE, // Dacl Present pDacl2, // NULL pointer to DACL == BUG diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.qlref index 6d8a0fc40192..3484b0b876b5 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.ql \ No newline at end of file +query: Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/DiningPhilosophers.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/DiningPhilosophers.cpp index de7ff6183f5d..72ca3bf6fb8e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/DiningPhilosophers.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/DiningPhilosophers.cpp @@ -20,11 +20,11 @@ namespace std template void unlock (Mutex1& a, Mutex2& b, Mutexes&... cde); } -std::mutex fork1; -std::mutex fork2; -std::mutex fork3; -std::mutex fork4; -std::mutex fork5; +std::mutex fork1; // $ Alert[cpp/lock-order-cycle] +std::mutex fork2; // $ Alert[cpp/lock-order-cycle] +std::mutex fork3; // $ Alert[cpp/lock-order-cycle] +std::mutex fork4; // $ Alert[cpp/lock-order-cycle] +std::mutex fork5; // $ Alert[cpp/lock-order-cycle] void eat(int ph); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/LockOrderCycle.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/LockOrderCycle.qlref index 0c60fed4501b..fadfcb8e1229 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/LockOrderCycle.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/LockOrderCycle.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-764/LockOrderCycle.ql +query: Security/CWE/CWE-764/LockOrderCycle.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/TwiceLocked.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/TwiceLocked.qlref index 95a3396b1997..a7e200494031 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/TwiceLocked.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/TwiceLocked.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-764/TwiceLocked.ql +query: Security/CWE/CWE-764/TwiceLocked.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/UnreleasedLock.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/UnreleasedLock.qlref index 4ea1070113d9..ca770b8b4a58 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/UnreleasedLock.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/UnreleasedLock.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-764/UnreleasedLock.ql +query: Security/CWE/CWE-764/UnreleasedLock.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp index 9114e545fd5e..4d0f833c4eb8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp @@ -22,8 +22,8 @@ namespace std void test_1() { std::mutex mtx; - mtx.lock(); - mtx.lock(); + mtx.lock(); // $ Alert[cpp/unreleased-lock] + mtx.lock(); // $ Alert[cpp/twice-locked] Alert[cpp/unreleased-lock] mtx.unlock(); } @@ -32,7 +32,7 @@ void test_2() { std::mutex mtx; mtx.lock(); - mtx.lock(); + mtx.lock(); // $ Alert[cpp/twice-locked] mtx.unlock(); mtx.unlock(); } @@ -51,7 +51,7 @@ void test_3() void test_4(bool something) { std::mutex mtx; - mtx.lock(); + mtx.lock(); // $ Alert[cpp/unreleased-lock] if (something) { mtx.unlock(); } else { @@ -85,8 +85,8 @@ void test_7() { std::mutex mtx1; std::mutex mtx2; - mtx1.lock(); - mtx2.lock(); + mtx1.lock(); // $ Alert[cpp/unreleased-lock] + mtx2.lock(); // $ Alert[cpp/unreleased-lock] std::unlock(mtx1, mtx2); } @@ -105,7 +105,7 @@ void test_8() void test_9() { std::mutex mtx; - if (mtx.try_lock()) { + if (mtx.try_lock()) { // $ Alert[cpp/unreleased-lock] return; } mtx.unlock(); @@ -134,7 +134,7 @@ std::mutex static_mtx02; // Helper function for testing the inter-procedural analysis. void set02() { - static_mtx02.lock(); + static_mtx02.lock(); // $ Alert[cpp/twice-locked] } // Helper function for testing the inter-procedural analysis. @@ -153,7 +153,7 @@ std::mutex static_mtx03; // Helper function for testing the inter-procedural analysis. void set03() { - static_mtx03.lock(); + static_mtx03.lock(); // $ Alert[cpp/twice-locked] } // Helper function for testing the inter-procedural analysis. @@ -174,7 +174,7 @@ void interproc_test_03(int n) { // BAD. void interproc_test_04(int n) { static std::mutex mtx; - mtx.lock(); + mtx.lock(); // $ Alert[cpp/twice-locked] if (n < 10) { // BAD: recursive call will attempt to lock the mutex again. interproc_test_04(n+1); @@ -215,7 +215,7 @@ void interproc_test_06() { void interproc_test_07() { std::mutex mtx; set(mtx); - set(mtx); + set(mtx); // $ Alert[cpp/twice-locked] unset(mtx); } @@ -224,7 +224,7 @@ void interproc_test_08(std::mutex &mtx, int n) { set(mtx); if (n < 10) { // BAD: recursive call will attempt to lock the mutex again. - interproc_test_08(mtx, n+1); + interproc_test_08(mtx, n+1); // $ Alert[cpp/twice-locked] } unset(mtx); } @@ -300,7 +300,7 @@ void interproc_test_09() { void test_10() { std::mutex mtx; - if (!mtx.try_lock()) { // [FALSE POSITIVE] + if (!mtx.try_lock()) { // $ Alert[cpp/unreleased-lock] // [FALSE POSITIVE] } else { mtx.unlock(); } @@ -310,10 +310,10 @@ void test_10() void test_11() { std::mutex mtx; - if (!mtx.try_lock()) { // [FALSE POSITIVE] + if (!mtx.try_lock()) { // $ Alert[cpp/unreleased-lock] // [FALSE POSITIVE] return; } - + mtx.unlock(); } @@ -336,7 +336,7 @@ void unlock_lock(std::mutex &mtx) void interproc_test_10() { std::mutex mtx; - + mtx.lock(); unlock_lock(mtx); mtx.unlock(); @@ -346,7 +346,7 @@ void interproc_test_10() void interproc_test_11() { std::mutex mtx; - + mtx.lock(); unlock_lock(mtx); // [NOT REPORTED] } @@ -355,9 +355,9 @@ void interproc_test_11() void twice_locked_1() { std::mutex mtx; - - mtx.lock(); + mtx.lock(); + mtx.lock(); // $ Alert[cpp/twice-locked] mtx.unlock(); mtx.unlock(); } @@ -366,7 +366,7 @@ void twice_locked_1() void twice_locked_2() { std::mutex mtx; - + mtx.lock(); mtx.unlock(); mtx.lock(); @@ -380,13 +380,13 @@ void twice_locked_3() if (mtx.try_lock()) { - mtx.lock(); + mtx.lock(); // $ Alert[cpp/twice-locked] mtx.unlock(); mtx.unlock(); } } -std::mutex static_mtx_01a, static_mtx_01b; +std::mutex static_mtx_01a, static_mtx_01b; // $ Alert[cpp/lock-order-cycle] // BAD void lock_order_1(int cond) @@ -395,7 +395,7 @@ void lock_order_1(int cond) static_mtx_01b.lock(); static_mtx_01b.unlock(); static_mtx_01a.unlock(); - + static_mtx_01b.lock(); static_mtx_01a.lock(); static_mtx_01a.unlock(); @@ -413,7 +413,7 @@ void lock_order_2(int cond) static_mtx_02b.lock(); static_mtx_02b.unlock(); static_mtx_02a.unlock(); - + static_mtx_02a.lock(); static_mtx_02b.lock(); static_mtx_02b.unlock(); @@ -439,7 +439,7 @@ struct data_t { bool test_mutex(data_t *data) { - CHECK(mutex_lock(&(data->mutex))); // GOOD [FALSE POSITIVE] + CHECK(mutex_lock(&(data->mutex))); // $ Alert[cpp/unreleased-lock] // GOOD [FALSE POSITIVE] data->val = 1; CHECK(mutex_unlock(&(data->mutex))); @@ -467,7 +467,7 @@ bool maybe(); int test_MyClass_good(MyClass *obj) { pthread_mutex_lock(&obj->lock); - + if (maybe()) { pthread_mutex_unlock(&obj->lock); return -1; // GOOD @@ -479,7 +479,7 @@ int test_MyClass_good(MyClass *obj) int test_MyClass_bad(MyClass *obj) { - pthread_mutex_lock(&obj->lock); + pthread_mutex_lock(&obj->lock); // $ Alert[cpp/unreleased-lock] if (maybe()) { return -1; // BAD diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/FileMayNotBeClosed.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/FileMayNotBeClosed.qlref index fd711c007f04..8d189be099bf 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/FileMayNotBeClosed.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/FileMayNotBeClosed.qlref @@ -1 +1,2 @@ -Critical/FileMayNotBeClosed.ql \ No newline at end of file +query: Critical/FileMayNotBeClosed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/FileNeverClosed.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/FileNeverClosed.qlref index 825ac26f500c..25b57b1736d7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/FileNeverClosed.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/FileNeverClosed.qlref @@ -1 +1,2 @@ -Critical/FileNeverClosed.ql +query: Critical/FileNeverClosed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/MemoryMayNotBeFreed.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/MemoryMayNotBeFreed.qlref index 33da8e296e22..84fd18014db0 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/MemoryMayNotBeFreed.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/MemoryMayNotBeFreed.qlref @@ -1 +1,2 @@ -Critical/MemoryMayNotBeFreed.ql \ No newline at end of file +query: Critical/MemoryMayNotBeFreed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/MemoryNeverFreed.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/MemoryNeverFreed.qlref index 2d1336a55ebf..108a872987d7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/MemoryNeverFreed.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/MemoryNeverFreed.qlref @@ -1 +1,2 @@ -Critical/MemoryNeverFreed.ql \ No newline at end of file +query: Critical/MemoryNeverFreed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/tests.cpp index e7b889deb08c..0ba5c266fdbd 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/SAMATE/tests.cpp @@ -68,7 +68,7 @@ namespace CWE401_Memory_Leak__new_int_17 for(i = 0; i < 1; i++) { /* POTENTIAL FLAW: Allocate memory on the heap */ - data = new int; // BAD + data = new int; // $ Alert[cpp/memory-never-freed] // BAD /* Initialize and make use of data */ *data = 5; printIntLine(*data); @@ -133,7 +133,7 @@ void CWE401_Memory_Leak__char_malloc_32_bad() { char * data = *dataPtr1; /* POTENTIAL FLAW: Allocate memory on the heap */ - data = (char *)malloc(100*sizeof(char)); // BAD + data = (char *)malloc(100*sizeof(char)); // $ Alert[cpp/memory-never-freed] // BAD /* Initialize and make use of data */ strcpy(data, "A String"); printLine(data); @@ -195,7 +195,7 @@ static void CWE401_Memory_Leak__char_malloc_32_goodB2G() void CWE401_Memory_Leak__malloc_realloc_char_01_bad() { { - char * data = (char *)malloc(100*sizeof(char)); // BAD + char * data = (char *)malloc(100*sizeof(char)); // $ Alert[cpp/memory-may-not-be-freed] // BAD /* Initialize and make use of data */ strcpy(data, "A String"); printLine(data); @@ -217,7 +217,7 @@ void CWE775_Missing_Release_of_File_Descriptor_or_Handle__fopen_no_close_17_bad( FILE * data; data = NULL; /* POTENTIAL FLAW: Open a file without closing it */ - data = fopen("BadSource_fopen.txt", "w+"); // BAD + data = fopen("BadSource_fopen.txt", "w+"); // $ Alert[cpp/file-never-closed] // BAD for(j = 0; j < 1; j++) { /* FLAW: No attempt to close the file */ @@ -249,7 +249,7 @@ void CWE775_Missing_Release_of_File_Descriptor_or_Handle__open_no_close_01_bad() /* Initialize data */ data = -1; /* POTENTIAL FLAW: Open a file without closing it */ - data = OPEN("BadSource_open.txt", O_RDWR|O_CREAT, S_IREAD|S_IWRITE); // BAD + data = OPEN("BadSource_open.txt", O_RDWR|O_CREAT, S_IREAD|S_IWRITE); // $ Alert[cpp/file-never-closed] // BAD /* FLAW: No attempt to close the file */ ; /* empty statement needed for some flow variants */ } @@ -275,7 +275,7 @@ void CWE775_Missing_Release_of_File_Descriptor_or_Handle__w32CreateFile_no_close /* Initialize data */ data = INVALID_HANDLE_VALUE; /* POTENTIAL FLAW: Open a file without closing it */ - data = CreateFile("BadSource_w32CreateFile.txt", // BAD + data = CreateFile("BadSource_w32CreateFile.txt", // $ Alert[cpp/file-never-closed] // BAD (GENERIC_WRITE|GENERIC_READ), 0, NULL, @@ -322,7 +322,7 @@ void CWE401_Memory_Leak__twoIntsStruct_realloc_01_bad() twoIntsStruct * data; data = NULL; /* POTENTIAL FLAW: Allocate memory on the heap */ - data = (twoIntsStruct *)realloc(data, 100*sizeof(twoIntsStruct)); + data = (twoIntsStruct *)realloc(data, 100*sizeof(twoIntsStruct)); // $ Alert[cpp/memory-may-not-be-freed] if (data == NULL) {exit(-1);} /* Initialize and make use of data */ data[0].intOne = 0; diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/FileMayNotBeClosed.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/FileMayNotBeClosed.qlref index fd711c007f04..8d189be099bf 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/FileMayNotBeClosed.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/FileMayNotBeClosed.qlref @@ -1 +1,2 @@ -Critical/FileMayNotBeClosed.ql \ No newline at end of file +query: Critical/FileMayNotBeClosed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/FileNeverClosed.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/FileNeverClosed.qlref index 825ac26f500c..25b57b1736d7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/FileNeverClosed.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/FileNeverClosed.qlref @@ -1 +1,2 @@ -Critical/FileNeverClosed.ql +query: Critical/FileNeverClosed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/test.cpp index 1e24ded49f53..83d9ede9fd5b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-file/test.cpp @@ -10,7 +10,7 @@ char *fgets(char *s, int n, FILE *stream); void test1() { FILE *f; - + // fopen, always fclose (GOOD) f = fopen("myFile.txt", "wt"); fclose(f); @@ -21,7 +21,7 @@ void test2(int cond) FILE *f; // fopen, always fclose, but with two paths (GOOD) - + f = fopen("myFile1.bin", "rb"); if (cond > 0) { @@ -37,7 +37,7 @@ void test3() FILE *f, *g; // fopen, always fclose, but via assignment (GOOD) - + f = fopen("myFile1.bin", "rb"); g = f; fclose(g); @@ -48,7 +48,7 @@ void test4() FILE *f; // fopen, never fclose (BAD: f is never closed) - f = fopen("myFile.txt", "wt"); + f = fopen("myFile.txt", "wt"); // $ Alert[cpp/file-never-closed] } void test5(int cond) @@ -56,7 +56,7 @@ void test5(int cond) FILE *f; // fopen, sometimes fclose (BAD: f is not always closed) - f = fopen("myFile.txt", "wt"); + f = fopen("myFile.txt", "wt"); // $ Alert[cpp/file-may-not-be-closed] if (cond == 0) { fclose(f); @@ -66,13 +66,13 @@ void test5(int cond) void test6(int cond) { // fopen, sometimes fclose (BAD: f is not always closed) - FILE *f = fopen("myFile.txt", "wt"); + FILE *f = fopen("myFile.txt", "wt"); // $ Alert[cpp/file-may-not-be-closed] if (cond == 0) { return; } - + fclose(f); } @@ -82,7 +82,7 @@ void test7() // fopen, assign, close f twice (BAD: g is never closed) f = fopen("myFile.txt", "wt"); - g = fopen("myFile.txt", "wt"); + g = fopen("myFile.txt", "wt"); // $ Alert[cpp/file-may-not-be-closed] g = f; fclose(g); fclose(f); @@ -110,12 +110,12 @@ void test8(int cond) // ... test8_close(f); - + // fopen, don't close (BAD: g is never closed) - g = test8_open(); - + g = test8_open(); // $ Alert[cpp/file-may-not-be-closed] + // fopen, sometimes fclose (BAD: h is not always closed) - h = test8_open(); + h = test8_open(); // $ Alert[cpp/file-may-not-be-closed] if (cond == 0) { return; @@ -130,9 +130,9 @@ class myClass9 { a = fopen("myFile1.txt", "rt"); // closed in destructor (GOOD) b = fopen("myFile2.txt", "rt"); // unreliably closed in destructor (BAD) [NOT REPORTED] - c = fopen("myFile3.txt", "rt"); // never closed in destructor (BAD) + c = fopen("myFile3.txt", "rt"); // $ Alert[cpp/file-never-closed] // never closed in destructor (BAD) } - + void myOpenMethod(const char *filename) { if (d != NULL) @@ -165,7 +165,7 @@ class myClass9 void test9() { myClass9 mc9; - + mc9.myOpenMethod("myFile4.txt"); mc9.myOpenMethod("myFile5.txt"); } @@ -181,7 +181,7 @@ void test11() FILE *f, *g; // fopen, assign, but do not close (BAD) - f = fopen("myFile1.bin", "rb"); + f = fopen("myFile1.bin", "rb"); // $ Alert[cpp/file-never-closed] g = f; } @@ -218,7 +218,7 @@ void test13(int cond) void test14() { - FILE *f = fopen("f.txt", "rt"); // fopen, forget, don't close (BAD) + FILE *f = fopen("f.txt", "rt"); // $ Alert[cpp/file-may-not-be-closed] // fopen, forget, don't close (BAD) f = 0; fclose(f); @@ -237,7 +237,7 @@ void test15() void test16() { FILE *f = fopen("f.txt", "rt"); // fopen, always close in loop (GOOD) - FILE *g = fopen("g.txt", "rt"); // fopen, don't close in loop (BAD) + FILE *g = fopen("g.txt", "rt"); // $ Alert[cpp/file-may-not-be-closed] // fopen, don't close in loop (BAD) int i; for (i = 0; i < 1; i++) @@ -250,7 +250,7 @@ void test16() void test17() { - FILE *f = fopen("f.txt", "rt"); // fopen, don't close in loop (BAD) + FILE *f = fopen("f.txt", "rt"); // $ Alert[cpp/file-may-not-be-closed] // fopen, don't close in loop (BAD) int i; for (i = 0; i < 0; i++) @@ -273,7 +273,7 @@ void test18() void test19() { - FILE *f = fopen("f.txt", "rt"); // fopen, return in loop, don't close (BAD) + FILE *f = fopen("f.txt", "rt"); // $ Alert[cpp/file-may-not-be-closed] // fopen, return in loop, don't close (BAD) int i; for (i = 0; i < 1; i++) @@ -296,7 +296,7 @@ void test20() void test21() { - FILE *f = fopen("f.txt", "rt"); // fopen, don't close in loop increment (BAD) + FILE *f = fopen("f.txt", "rt"); // $ Alert[cpp/file-may-not-be-closed] // fopen, don't close in loop increment (BAD) int i; for (i = 0; i < 0; fclose(f)) @@ -307,7 +307,7 @@ void test21() void test22() { FILE *f = fopen("f.txt", "rt"); // fopen, close in condition inside loop (GOOD) - FILE *g = fopen("g.txt", "rt"); // fopen, don't close in condition inside loop (BAD) + FILE *g = fopen("g.txt", "rt"); // $ Alert[cpp/file-may-not-be-closed] // fopen, don't close in condition inside loop (BAD) bool b = true; while (b) @@ -317,7 +317,7 @@ void test22() } else { fclose(g); } - + b = false; } } @@ -353,7 +353,7 @@ void test24() void test25() { - FILE *f = fopen("f.txt", "rt"); // fopen, don't close in nested loops (BAD) + FILE *f = fopen("f.txt", "rt"); // $ Alert[cpp/file-may-not-be-closed] // fopen, don't close in nested loops (BAD) int i, j, k; for (i = 0; i < 1; i++) @@ -381,7 +381,7 @@ void test26() void test27() { - FILE *f = fopen("f.txt", "rt"); // fopen, don't close after loop (BAD) + FILE *f = fopen("f.txt", "rt"); // $ Alert[cpp/file-may-not-be-closed] // fopen, don't close after loop (BAD) int i; for (i = 0; i < 10; i++) @@ -418,7 +418,7 @@ test28_struct *test28_open() // open, call function to put in a struct, return it (GOOD) f = fopen("a.txt", "rt"); s = mk_test28(f); - + return s; } @@ -460,7 +460,7 @@ void test29() void test30() { // cases that do not involve a variable - fopen("myFile.txt", "wt"); // BAD: not closed + fopen("myFile.txt", "wt"); // $ Alert[cpp/file-never-closed] // BAD: not closed fclose(fopen("myFile.txt", "wt")); // GOOD } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/MemoryMayNotBeFreed.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/MemoryMayNotBeFreed.qlref index 33da8e296e22..84fd18014db0 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/MemoryMayNotBeFreed.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/MemoryMayNotBeFreed.qlref @@ -1 +1,2 @@ -Critical/MemoryMayNotBeFreed.ql \ No newline at end of file +query: Critical/MemoryMayNotBeFreed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/MemoryNeverFreed.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/MemoryNeverFreed.qlref index 2d1336a55ebf..108a872987d7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/MemoryNeverFreed.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/MemoryNeverFreed.qlref @@ -1 +1,2 @@ -Critical/MemoryNeverFreed.ql \ No newline at end of file +query: Critical/MemoryNeverFreed.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/test.cpp index 29b5709b9654..3b3073b3a581 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-772/semmle/tests-memory/test.cpp @@ -36,7 +36,7 @@ void test3() { return; } - + free(ptr); } @@ -59,7 +59,7 @@ void test5(int cond) // malloc, sometimes free void *ptr; - ptr = malloc(sizeof(char) * 1024); // BAD: not always freed + ptr = malloc(sizeof(char) * 1024); // $ Alert[cpp/memory-may-not-be-freed] // BAD: not always freed if (cond == 0) { free(ptr); @@ -71,12 +71,12 @@ void test6(int cond) // malloc, sometimes free void *ptr; - ptr = malloc(sizeof(char) * 1024); // BAD: not always freed + ptr = malloc(sizeof(char) * 1024); // $ Alert[cpp/memory-may-not-be-freed] // BAD: not always freed if (cond == 0) { return; } - + free(ptr); } @@ -95,7 +95,7 @@ void test8() // malloc, reassign, don't free char *a, *b; - a = (char *)malloc(10); // BAD: a is not freed + a = (char *)malloc(10); // $ Alert[cpp/memory-never-freed] // BAD: a is not freed b = a; } @@ -104,7 +104,7 @@ void test9() // malloc, overwrite, don't free char *a; - a = (char *)malloc(10); // BAD: not freed + a = (char *)malloc(10); // $ Alert[cpp/memory-may-not-be-freed] // BAD: not freed a = (char *)malloc(20); free(a); } @@ -131,12 +131,12 @@ void test10(int cond) // ... test10_free(a); - + // alloc, don't free b - b = test10_alloc(); // BAD: b is never freed - + b = test10_alloc(); // $ Alert[cpp/memory-may-not-be-freed] // BAD: b is never freed + // alloc, sometimes free c - c = test10_alloc(); // BAD: c is not always freed + c = test10_alloc(); // $ Alert[cpp/memory-may-not-be-freed] // BAD: c is not always freed if (cond == 0) { return; @@ -151,9 +151,9 @@ class myClass11 { a = (char *)malloc(1); // freed in destructor (GOOD) b = (char *)malloc(1); // unreliably freed in destructor (BAD) [NOT REPORTED] - c = (char *)malloc(1); // never freed in destructor (BAD) + c = (char *)malloc(1); // $ Alert[cpp/memory-never-freed] // never freed in destructor (BAD) } - + void myAllocMethod(int amount) { if (d != NULL) @@ -186,7 +186,7 @@ class myClass11 void test11() { myClass11 mc11; - + mc11.myAllocMethod(1); mc11.myAllocMethod(1); } @@ -196,9 +196,9 @@ void test13() void *a = new int; // new, delete (GOOD) void *b = new char[10]; // new, delete (GOOD) char *c = new char[20]; // new, delete (GOOD) - void *d = new int; // new, don't delete (BAD) - void *e = new char[10]; // new, don't delete (BAD) - char *f = new char[20]; // new, don't delete (BAD) + void *d = new int; // $ Alert[cpp/memory-never-freed] // new, don't delete (BAD) + void *e = new char[10]; // $ Alert[cpp/memory-never-freed] // new, don't delete (BAD) + char *f = new char[20]; // $ Alert[cpp/memory-never-freed] // new, don't delete (BAD) delete (int *)a; delete [] (int *)b; @@ -223,7 +223,7 @@ void test14() alloc_func *af = NULL; free_func *ff = NULL; void *a, *b; - + af = &test14_alloc; ff = &test14_free; @@ -232,32 +232,32 @@ void test14() ff(a); // alloc, don't free via function pointer (BAD) - b = af(2000); + b = af(2000); // $ Alert[cpp/memory-may-not-be-freed] } void test15() { void *ptr1, *ptr2, *ptr3; - ptr1 = realloc(NULL, 10); // alloc 10 bytes (BAD - not freed if the next realloc fails) + ptr1 = realloc(NULL, 10); // $ Alert[cpp/memory-may-not-be-freed] // alloc 10 bytes (BAD - not freed if the next realloc fails) ptr1 = realloc(ptr1, 20); // realloc 20 bytes (GOOD) ptr1 = realloc(ptr1, 0); // free (GOOD) - - ptr2 = realloc(NULL, 10); // alloc 10 bytes (BAD - only freed if the call below succeeds) - ptr2 = realloc(ptr2, 20); // realloc 20 bytes, never free (BAD) - - ptr3 = realloc(NULL, 10); // alloc 10 bytes, never free (BAD) + + ptr2 = realloc(NULL, 10); // $ Alert[cpp/memory-may-not-be-freed] // alloc 10 bytes (BAD - only freed if the call below succeeds) + ptr2 = realloc(ptr2, 20); // $ Alert[cpp/memory-may-not-be-freed] // realloc 20 bytes, never free (BAD) + + ptr3 = realloc(NULL, 10); // $ Alert[cpp/memory-never-freed] // alloc 10 bytes, never free (BAD) } void test16(int cond) { - void *ptr = malloc(1024); // not always freed (BAD) + void *ptr = malloc(1024); // $ Alert[cpp/memory-may-not-be-freed] // not always freed (BAD) if (ptr) { if (cond) { // ... - + free(ptr); return; } else { @@ -271,7 +271,7 @@ void test16(int cond) void test17(int cond) { // malloc, sometimes free (BAD: ptr is not always freed) - void *ptr = malloc(1024); + void *ptr = malloc(1024); // $ Alert[cpp/memory-may-not-be-freed] if (cond == 0) { @@ -284,7 +284,7 @@ void test17(int cond) void test18(int cond) { // malloc, sometimes free (BAD: ptr is not always freed) - void *ptr = malloc(1024); + void *ptr = malloc(1024); // $ Alert[cpp/memory-may-not-be-freed] if (cond == 0) { @@ -310,7 +310,7 @@ void test20() { // malloc, free (GOOD) int x, y, z; - + { void *a; @@ -352,12 +352,12 @@ void test22(int cond) { // new, don't delete (BAD) - Vector3 *myVector2 = new Vector3(1.0f, 2.0f, 3.0f); + Vector3 *myVector2 = new Vector3(1.0f, 2.0f, 3.0f); // $ Alert[cpp/memory-never-freed] } { // new, sometimes delete (BAD) - Vector3 *myVector3 = new Vector3(1.0f, 2.0f, 3.0f); + Vector3 *myVector3 = new Vector3(1.0f, 2.0f, 3.0f); // $ Alert[cpp/memory-may-not-be-freed] if (cond) { delete myVector3; @@ -379,7 +379,7 @@ void test23() { { // malloc, free incorrectly (BAD) - char *buffer = (char *)malloc(100); + char *buffer = (char *)malloc(100); // $ Alert[cpp/memory-may-not-be-freed] free(buffer + 10); } @@ -394,7 +394,7 @@ void test23() { // new, delete incorrectly - container *c = new container; // BAD: not deleted + container *c = new container; // $ Alert[cpp/memory-never-freed] // BAD: not deleted c->thingPtr = new thing; delete c->thingPtr; @@ -447,17 +447,17 @@ void test25() free(ptr1); } realloc(ptr2, 0); // equivalent to free(ptr2) (GOOD) - - ptr3 = realloc(NULL, 10); // alloc 10 bytes (BAD - not freed if next realloc fails) + + ptr3 = realloc(NULL, 10); // $ Alert[cpp/memory-may-not-be-freed] // alloc 10 bytes (BAD - not freed if next realloc fails) ptr4 = realloc(ptr3, 20); // realloc 20 bytes (GOOD) if (ptr4 != NULL) // (this checks for success instead of failure!) { // clean up still allocated ptr3 free(ptr3); } - realloc(ptr4, 0); // equivalent to free(ptr4) (GOOD) + realloc(ptr4, 0); // equivalent to free(ptr4) (GOOD) - ptr5 = realloc(NULL, 10); // alloc 10 bytes (BAD - not freed if the next realloc fails) + ptr5 = realloc(NULL, 10); // $ Alert[cpp/memory-may-not-be-freed] // alloc 10 bytes (BAD - not freed if the next realloc fails) ptr6 = realloc(ptr5, 20); // realloc 20 bytes (GOOD) ptr7 = realloc(ptr6, 0); // free (GOOD) } @@ -519,10 +519,10 @@ void test27() { void *ptr = NULL; - ptr = realloc(ptr, 10); // BAD (not freed if the second realloc fails) + ptr = realloc(ptr, 10); // $ Alert[cpp/memory-may-not-be-freed] // BAD (not freed if the second realloc fails) if (ptr != NULL) { - ptr = realloc(ptr, 20); // BAD (not freed) + ptr = realloc(ptr, 20); // $ Alert[cpp/memory-may-not-be-freed] // BAD (not freed) if (ptr != NULL) { dostuff(); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.qlref index bb8c6c324a30..b12367abe280 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-807/TaintedCondition.ql \ No newline at end of file +query: Security/CWE/CWE-807/TaintedCondition.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp index 641cbaa7be7d..2f7eaa12ccad 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp @@ -17,11 +17,11 @@ const char *currentUser; void processRequest() { - const char *userName = getenv("USER_NAME"); + const char *userName = getenv("USER_NAME"); // $ Source // BAD: the condition is controllable by the user, and // the body of the if makes a security decision. - if (!strcmp(userName, "admin")) { + if (!strcmp(userName, "admin")) { // $ Alert adminPrivileges = 1; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-835/semmle/InfiniteLoopWithUnsatisfiableExitCondition/InfiniteLoopWithUnsatisfiableExitCondition.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-835/semmle/InfiniteLoopWithUnsatisfiableExitCondition/InfiniteLoopWithUnsatisfiableExitCondition.qlref index cef3e6686eac..e734453a5d94 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-835/semmle/InfiniteLoopWithUnsatisfiableExitCondition/InfiniteLoopWithUnsatisfiableExitCondition.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-835/semmle/InfiniteLoopWithUnsatisfiableExitCondition/InfiniteLoopWithUnsatisfiableExitCondition.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-835/InfiniteLoopWithUnsatisfiableExitCondition.ql \ No newline at end of file +query: Security/CWE/CWE-835/InfiniteLoopWithUnsatisfiableExitCondition.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-835/semmle/InfiniteLoopWithUnsatisfiableExitCondition/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-835/semmle/InfiniteLoopWithUnsatisfiableExitCondition/test.cpp index 4ff375910036..e8ed6123eb42 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-835/semmle/InfiniteLoopWithUnsatisfiableExitCondition/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-835/semmle/InfiniteLoopWithUnsatisfiableExitCondition/test.cpp @@ -5,7 +5,7 @@ void test00(int n) { } while (1) { // BAD: condition is never true, so loop will not terminate. - if (i == n) { + if (i == n) { // $ Alert break; } } @@ -18,7 +18,7 @@ void test01(int n) { } for (;;) { // BAD: condition is never true, so loop will not terminate. - if (i == n) { + if (i == n) { // $ Alert break; } } @@ -59,7 +59,7 @@ int test05() { int result = 0; // BAD: loop condition is always true. - for (i = 0; i >= 0; i = (i + 1) % 256) + for (i = 0; i >= 0; i = (i + 1) % 256) // $ Alert { result++; } @@ -108,7 +108,7 @@ void test08(int n) { for (i = 0;;) { // BAD: condition is never true, so loop will not terminate. - if (i == n) { + if (i == n) { // $ Alert break; } @@ -124,7 +124,7 @@ void test09(char *str) { { c = *(str++); - if (c < 'a' && c > 'z') // BAD: this condition is always false. + if (c < 'a' && c > 'z') // $ Alert // BAD: this condition is always false. return; } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref index 53b17f1e1fda..b0034e45821a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.qlref @@ -1 +1,2 @@ -Security/CWE/CWE-843/TypeConfusion.ql \ No newline at end of file +query: Security/CWE/CWE-843/TypeConfusion.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp index 982496218ffa..632deabecab7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp @@ -24,13 +24,13 @@ void test2() { } void test3() { - void* p = new S1; - Not_S1_wrapper* s1w = static_cast(p); // BAD + void* p = new S1; // $ Source + Not_S1_wrapper* s1w = static_cast(p); // $ Alert // BAD } void test4() { - void* p = new Not_S1_wrapper; - S1* s1 = static_cast(p); // BAD + void* p = new Not_S1_wrapper; // $ Source + S1* s1 = static_cast(p); // $ Alert // BAD } struct HasBitFields { @@ -63,8 +63,8 @@ struct Dog : public Animal { }; void test6() { - Animal* a = new Cat; - Dog* d = static_cast(a); // BAD + Animal* a = new Cat; // $ Source + Dog* d = static_cast(a); // $ Alert // BAD } void test7() { @@ -124,8 +124,8 @@ struct Not_S2_prefix { }; void test11() { - S2* s2 = new S2; - Not_S2_prefix* s2p = reinterpret_cast(s2); // BAD + S2* s2 = new S2; // $ Source + Not_S2_prefix* s2p = reinterpret_cast(s2); // $ Alert // BAD } struct HasSomeBitFields { @@ -140,9 +140,9 @@ void test12() { S1* s1 = new S1; HasBitFields* hbf = reinterpret_cast(s1); // BAD [NOT DETECTED] - S1* s1_2 = new S1; + S1* s1_2 = new S1; // $ Source // This one has a non-bitfield members. So we detect the problem - HasSomeBitFields* hbf2 = reinterpret_cast(s1_2); // BAD + HasSomeBitFields* hbf2 = reinterpret_cast(s1_2); // $ Alert // BAD } void test13(bool b, Cat* c) { @@ -150,13 +150,13 @@ void test13(bool b, Cat* c) { if(b) { a = c; } else { - a = new Dog; + a = new Dog; // $ Source } // This FP happens despite the `not GoodFlow::flowTo(sinkNode)` condition in the query // because we don't find a flow path from `a = c` to `static_cast(a)` because // the "source" (i.e., `a = c`) doesn't have an allocation. if(b) { - Cat* d = static_cast(a); // GOOD [FALSE POSITIVE] + Cat* d = static_cast(a); // $ Alert // GOOD [FALSE POSITIVE] } } @@ -184,9 +184,9 @@ void test14() { struct UInt8_with_more { UInt8 u8; void* p; }; void test15() { - void* u64 = new UInt64; + void* u64 = new UInt64; // $ Source // ... - UInt8_with_more* u8 = (UInt8_with_more*)u64; // BAD + UInt8_with_more* u8 = (UInt8_with_more*)u64; // $ Alert // BAD } struct SingleInt { @@ -214,8 +214,8 @@ struct UnrelatedStructSize { }; void test17() { - void* p = new S1; - UnrelatedStructSize* uss = static_cast(p); // BAD + void* p = new S1; // $ Source + UnrelatedStructSize* uss = static_cast(p); // $ Alert // BAD } struct TooLargeBufferSize { @@ -223,8 +223,8 @@ struct TooLargeBufferSize { }; void test18() { - void* p = new S1; - TooLargeBufferSize* uss = static_cast(p); // BAD + void* p = new S1; // $ Source + TooLargeBufferSize* uss = static_cast(p); // $ Alert // BAD } -// semmle-extractor-options: --gcc -std=c++11 \ No newline at end of file +// semmle-extractor-options: --gcc -std=c++11 diff --git a/cpp/ql/test/query-tests/jsf/3.02 Code Size and Complexity/AV Rule 1/AV Rule 1.c b/cpp/ql/test/query-tests/jsf/3.02 Code Size and Complexity/AV Rule 1/AV Rule 1.c index ff4e5ad15a47..1d63e5531a52 100644 --- a/cpp/ql/test/query-tests/jsf/3.02 Code Size and Complexity/AV Rule 1/AV Rule 1.c +++ b/cpp/ql/test/query-tests/jsf/3.02 Code Size and Complexity/AV Rule 1/AV Rule 1.c @@ -408,7 +408,7 @@ void justStillGood(int x) { justStillGood(199); } -void bad(int x) { +void bad(int x) { // $ Alert bad(2); bad(3); bad(4); diff --git a/cpp/ql/test/query-tests/jsf/3.02 Code Size and Complexity/AV Rule 1/AV Rule 1.qlref b/cpp/ql/test/query-tests/jsf/3.02 Code Size and Complexity/AV Rule 1/AV Rule 1.qlref index e2fb899048e0..e3c6654bd843 100644 --- a/cpp/ql/test/query-tests/jsf/3.02 Code Size and Complexity/AV Rule 1/AV Rule 1.qlref +++ b/cpp/ql/test/query-tests/jsf/3.02 Code Size and Complexity/AV Rule 1/AV Rule 1.qlref @@ -1 +1,2 @@ -jsf/3.02 Code Size and Complexity/AV Rule 1.ql +query: jsf/3.02 Code Size and Complexity/AV Rule 1.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.04 Environment/AV Rule 13/AV Rule 13.qlref b/cpp/ql/test/query-tests/jsf/4.04 Environment/AV Rule 13/AV Rule 13.qlref index b3267de7b8a9..36002b9e0459 100644 --- a/cpp/ql/test/query-tests/jsf/4.04 Environment/AV Rule 13/AV Rule 13.qlref +++ b/cpp/ql/test/query-tests/jsf/4.04 Environment/AV Rule 13/AV Rule 13.qlref @@ -1 +1,2 @@ -jsf/4.04 Environment/AV Rule 13.ql +query: jsf/4.04 Environment/AV Rule 13.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.04 Environment/AV Rule 13/test.cpp b/cpp/ql/test/query-tests/jsf/4.04 Environment/AV Rule 13/test.cpp index cd11861c4ec6..9a16fde112cc 100644 --- a/cpp/ql/test/query-tests/jsf/4.04 Environment/AV Rule 13/test.cpp +++ b/cpp/ql/test/query-tests/jsf/4.04 Environment/AV Rule 13/test.cpp @@ -2,9 +2,9 @@ int main() { const char *const_str = ""; - const wchar_t *const_wstr = L""; // BAD + const wchar_t *const_wstr = L""; // $ Alert // BAD char c = 'c'; - wchar_t wc = L'c'; // BAD + wchar_t wc = L'c'; // $ Alert // BAD return 0; } diff --git a/cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/AV Rule 32.qlref b/cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/AV Rule 32.qlref index 5ae78414335a..e06ec8cac8b6 100644 --- a/cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/AV Rule 32.qlref +++ b/cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/AV Rule 32.qlref @@ -1 +1,2 @@ -jsf/4.06 Pre-Processing Directives/AV Rule 32.ql +query: jsf/4.06 Pre-Processing Directives/AV Rule 32.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/test.c b/cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/test.c index 1c4bb4a99133..7859da4bb0a8 100644 --- a/cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/test.c +++ b/cpp/ql/test/query-tests/jsf/4.06 Pre-Processing Directives/AV Rule 32/test.c @@ -1,4 +1,4 @@ #include "test.H" // GOOD #include "test.xpm" // GOOD -#include "test2.c" // BAD +#include "test2.c" // $ Alert // BAD #include "test.def" // GOOD diff --git a/cpp/ql/test/query-tests/jsf/4.09 Style/AV Rule 53 54/AV Rule 53.1.qlref b/cpp/ql/test/query-tests/jsf/4.09 Style/AV Rule 53 54/AV Rule 53.1.qlref index a39a710f34e2..e7c382bff878 100644 --- a/cpp/ql/test/query-tests/jsf/4.09 Style/AV Rule 53 54/AV Rule 53.1.qlref +++ b/cpp/ql/test/query-tests/jsf/4.09 Style/AV Rule 53 54/AV Rule 53.1.qlref @@ -1 +1,2 @@ -jsf/4.09 Style/AV Rule 53.1.ql +query: jsf/4.09 Style/AV Rule 53.1.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.09 Style/AV Rule 53 54/test.c b/cpp/ql/test/query-tests/jsf/4.09 Style/AV Rule 53 54/test.c index 47c2408c2fb9..1985c5ad67b8 100644 --- a/cpp/ql/test/query-tests/jsf/4.09 Style/AV Rule 53 54/test.c +++ b/cpp/ql/test/query-tests/jsf/4.09 Style/AV Rule 53 54/test.c @@ -1,4 +1,4 @@ #include "test" #include "test.abc" #include "test.H" -#include "test'.h" +#include "test'.h" // $ Alert[cpp/jsf/av-rule-53-1] diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/AV Rule 73.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/AV Rule 73.cpp index bc21219cab82..493b0ac7f3a4 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/AV Rule 73.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/AV Rule 73.cpp @@ -1,7 +1,7 @@ class MyClass1 { public: - MyClass1() { // BAD + MyClass1() { // $ Alert // BAD x = 1; } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/AV Rule 73.qlref b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/AV Rule 73.qlref index 6ed93402c8b4..60e5fd779888 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/AV Rule 73.qlref +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/AV Rule 73.qlref @@ -1 +1,2 @@ -jsf/4.10 Classes/AV Rule 73.ql +query: jsf/4.10 Classes/AV Rule 73.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp index 5c86702e2c26..f5a6afd7e1dc 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp @@ -11,7 +11,7 @@ class Bad int cmp(const Bad& that); }; -Bad::Bad() : key(-1) // non-compliant +Bad::Bad() : key(-1) // $ Alert // non-compliant { } @@ -73,7 +73,7 @@ class AlsoGood char getChar(); }; -AlsoGood::AlsoGood() // compliant [FALSE POSITIVE] +AlsoGood::AlsoGood() // $ Alert // compliant [FALSE POSITIVE] { cp = 0; } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 76/AV Rule 76.qlref b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 76/AV Rule 76.qlref index a878bda77997..d314f74ada73 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 76/AV Rule 76.qlref +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 76/AV Rule 76.qlref @@ -1 +1,2 @@ -jsf/4.10 Classes/AV Rule 76.ql +query: jsf/4.10 Classes/AV Rule 76.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 76/test.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 76/test.cpp index 0c5e40e7b912..4e13759b9255 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 76/test.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 76/test.cpp @@ -2,7 +2,7 @@ class Class1 // good: no pointer members, default assignment operator and copy c { }; -class Class2 // bad: pointer members, default assignment operator and copy constructor +class Class2 // $ Alert // bad: pointer members, default assignment operator and copy constructor { private: int* _a; @@ -13,7 +13,7 @@ class Class2 // bad: pointer members, default assignment operator and copy const } }; -class Class3 // bad: pointer members, custom assignment operator and default copy constructor +class Class3 // $ Alert // bad: pointer members, custom assignment operator and default copy constructor { private: int* _a; @@ -30,7 +30,7 @@ class Class3 // bad: pointer members, custom assignment operator and default cop } }; -class Class4 // bad: pointer members, default assignment operator and custom copy constructor +class Class4 // $ Alert // bad: pointer members, default assignment operator and custom copy constructor { private: int* _a; @@ -93,4 +93,4 @@ class Class7 // good: pointer members, disallowed assignment operator and copy c private: Class7& operator=(const Class7& rhs); // no implementation to get linker error! Class7(const Class7& rhs); // no implementation to get linker error! -}; \ No newline at end of file +}; diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 77.1/AV Rule 77.1.qlref b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 77.1/AV Rule 77.1.qlref index 5fe2b71b701b..7ccb2e198843 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 77.1/AV Rule 77.1.qlref +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 77.1/AV Rule 77.1.qlref @@ -1 +1,2 @@ -jsf/4.10 Classes/AV Rule 77.1.ql +query: jsf/4.10 Classes/AV Rule 77.1.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 77.1/test.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 77.1/test.cpp index e9e917c840fb..de67a6ffa005 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 77.1/test.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 77.1/test.cpp @@ -7,7 +7,7 @@ class C2 { }; class C3 { - C3(const C3& c, int i = 1); // error + C3(const C3& c, int i = 1); // $ Alert // error }; namespace templates { diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 78/AV Rule 78.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 78/AV Rule 78.cpp index 7612ac07c8ce..e2b79ae37bf0 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 78/AV Rule 78.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 78/AV Rule 78.cpp @@ -53,7 +53,7 @@ struct Base_Virtual_VirtualDtor virtual void VirtualFunction(); }; -struct Base_Virtual_NonVirtualDtor +struct Base_Virtual_NonVirtualDtor // $ Alert { ~Base_Virtual_NonVirtualDtor(); virtual void VirtualFunction(); @@ -65,7 +65,7 @@ struct Base_Virtual_ImplicitDtor virtual void VirtualFunction(); }; -struct Base_Virtual_NonVirtualDtorWithDefinition +struct Base_Virtual_NonVirtualDtorWithDefinition // $ Alert { ~Base_Virtual_NonVirtualDtorWithDefinition(); virtual void VirtualFunction(); @@ -75,7 +75,7 @@ Base_Virtual_NonVirtualDtorWithDefinition::~Base_Virtual_NonVirtualDtorWithDefin { } -struct Base_Virtual_NonVirtualDtorWithInlineDefinition +struct Base_Virtual_NonVirtualDtorWithInlineDefinition // $ Alert { ~Base_Virtual_NonVirtualDtorWithInlineDefinition() { diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 78/AV Rule 78.qlref b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 78/AV Rule 78.qlref index 419d3f69cc58..6c416c54edfe 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 78/AV Rule 78.qlref +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 78/AV Rule 78.qlref @@ -1 +1,2 @@ -jsf/4.10 Classes/AV Rule 78.ql +query: jsf/4.10 Classes/AV Rule 78.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.cpp index 6fb9815dd742..fdc3f4d2fe3c 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.cpp @@ -2,7 +2,7 @@ // library typedef unsigned int size_t; void *malloc(size_t size); -void *calloc(size_t nmemb, size_t size); +void *calloc(size_t nmemb, size_t size); void *realloc(void *ptr, size_t size); void free(void* ptr); @@ -43,25 +43,25 @@ class MyClass MyClass() { myPtr1 = new int; // GOOD - myPtr2 = new int; // BAD: not deleted in destructor + myPtr2 = new int; // $ Alert // BAD: not deleted in destructor myPtr3 = (int *)malloc(sizeof(int)); // GOOD - myPtr4 = (int *)malloc(sizeof(int)); // BAD: not freed in destructor - myPtr5 = new int; // BAD: deleted in close but not in destructor - myPtr6 = (int *)malloc(sizeof(int)); // BAD: freed in close but not in destructor + myPtr4 = (int *)malloc(sizeof(int)); // $ Alert // BAD: not freed in destructor + myPtr5 = new int; // $ Alert // BAD: deleted in close but not in destructor + myPtr6 = (int *)malloc(sizeof(int)); // $ Alert // BAD: freed in close but not in destructor myAutoPtr = new int; // GOOD myFile1 = fopen("file1.txt", "rt"); // GOOD - myFile2 = fopen("file2.txt", "rt"); // BAD: not closed in destructor + myFile2 = fopen("file2.txt", "rt"); // $ Alert // BAD: not closed in destructor - myArray1 = (int *)calloc(100, sizeof(int)); // BAD: not freed in destructor - myArray2 = new int[100]; // BAD: not deleted in destructor + myArray1 = (int *)calloc(100, sizeof(int)); // $ Alert // BAD: not freed in destructor + myArray2 = new int[100]; // $ Alert // BAD: not deleted in destructor myArray3 = new int[100]; // GOOD: deleted in destructor myPtr7 = (int*)realloc(0, sizeof(int)); // GOOD: freed below (assuming the realloc succeeds) - myPtr8 = (int*)realloc(myPtr7, sizeof(int)); // BAD: not freed in destructor + myPtr8 = (int*)realloc(myPtr7, sizeof(int)); // $ Alert // BAD: not freed in destructor } - + ~MyClass() { delete myPtr1; diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.qlref b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.qlref index 34b54bccd467..23a70aede929 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.qlref +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.qlref @@ -1 +1,2 @@ -jsf/4.10 Classes/AV Rule 79.ql +query: jsf/4.10 Classes/AV Rule 79.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Container2.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Container2.cpp index 6961a8d35526..a9149681cad3 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Container2.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Container2.cpp @@ -18,7 +18,7 @@ class Container2 void Alloc() { ptr2 = new T(); // GOOD - ptr3 = new T(); // BAD: not deleted in destructor + ptr3 = new T(); // $ Alert // BAD: not deleted in destructor } void Free() diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp index fc7ad7de26d3..7b8ef36945b1 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp @@ -31,12 +31,12 @@ class MyClass2 { (*this).Release(); } - + void DeleteOther(MyClass2 *other) { delete other; } - + void ReleaseOther(MyClass2 *other) { other->Release(); @@ -53,15 +53,15 @@ class MyClass3 ptr3 = new MyClass2(); // GOOD ptr4 = new MyClass2(); // GOOD ptr5 = new MyClass2(); // GOOD - ptr10 = new MyClass2(); // BAD: not deleted in destructor + ptr10 = new MyClass2(); // $ Alert // BAD: not deleted in destructor ptr11 = new MyClass2(); // GOOD - ptr12 = new MyClass2(); // BAD: not deleted in destructor + ptr12 = new MyClass2(); // $ Alert // BAD: not deleted in destructor ptr13 = new MyClass2(); // GOOD - ptr14 = new MyClass2(); // BAD: not deleted in destructor + ptr14 = new MyClass2(); // $ Alert // BAD: not deleted in destructor ptr15 = new MyClass2(); // GOOD ptr20 = new MyClass2(); // GOOD } - + ~MyClass3() { delete ptr1; @@ -124,7 +124,7 @@ class MyClass9 b = new MyClass5(); // GOOD c = new MyClass6(); // GOOD - d = new MyClass7(); // BAD + d = new MyClass7(); // $ Alert // BAD e = new MyClass7(); // BAD [NOT DETECTED] f = new MyClass8(); // BAD [NOT DETECTED] } @@ -136,7 +136,7 @@ class MyClass9 d->Release(); // MyClass7::Release() e->Release(); // MyClass7::Release() - f->Release(); // MyClass7::Release() + f->Release(); // MyClass7::Release() } MyClass5 *a; MyClass4 *b; diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ExternalOwners.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ExternalOwners.cpp index bdec96f30df4..d6755a14fbee 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ExternalOwners.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ExternalOwners.cpp @@ -46,7 +46,7 @@ class MyScreen public: MyScreen() { - a = new MyWidget(); // BAD (not deleted) + a = new MyWidget(); // $ Alert // BAD (not deleted) b = new MyWidget(); // GOOD (deleted in widgets destructor) widgets.add(b); @@ -67,7 +67,7 @@ void externalOwnersMain() // do stuff { MyScreen myScreen; - + // ... } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Lambda.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Lambda.cpp index 1b3233c52718..81780dfc8b32 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Lambda.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Lambda.cpp @@ -19,9 +19,9 @@ class testLambda auto deleter3 = [&r = r3]() { delete [] r; }; - deleter3(); + deleter3(); - r4 = new char[4096]; // BAD + r4 = new char[4096]; // $ Alert // BAD r5 = new char[4096]; // GOOD deleter5 = &deleter_for_r5; diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp index bbea9da6f430..31686ad60e62 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp @@ -18,7 +18,7 @@ class MyThingColection { public: MyThingColection() { - first = new MyThing; // GOOD (all deleted in destructor) [FALSE POSITIVE] + first = new MyThing; // $ Alert // GOOD (all deleted in destructor) [FALSE POSITIVE] first->next = new MyThing; // GOOD (all deleted in destructor) @@ -27,7 +27,7 @@ class MyThingColection add(y = new MyThing); // GOOD (all deleted in destructor) } - + ~MyThingColection() { MyThing *to_delete; diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/NoDestructor.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/NoDestructor.cpp index f5d2b02efaa8..7313452f2517 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/NoDestructor.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/NoDestructor.cpp @@ -7,7 +7,7 @@ class MyNumber MyNumber() : value(0) { } - + MyNumber(int _value) : value(_value) { } @@ -20,7 +20,7 @@ class MyClass5 public: MyClass5() { - n = new MyNumber(); // BAD: not deleted + n = new MyNumber(); // $ Alert // BAD: not deleted } private: @@ -44,7 +44,7 @@ class MyClass7Base MyClass7Base() { } - + virtual ~MyClass7Base() { if (n != NULL) diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/PlacementNew.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/PlacementNew.cpp index c7794857cb94..d97df1adc435 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/PlacementNew.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/PlacementNew.cpp @@ -33,7 +33,7 @@ class MyTestForPlacementNew { void *buffer_ptr = buffer; - p1 = new MyClassForPlacementNew(1); // BAD: not released + p1 = new MyClassForPlacementNew(1); // $ Alert // BAD: not released p2 = new (std::nothrow) MyClassForPlacementNew(2); // BAD: not released [NOT DETECTED] p3 = new (buffer_ptr) MyClassForPlacementNew(3); // GOOD: placement new, not an allocation } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/SelfRegistering.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/SelfRegistering.cpp index 75ad7f4d1fa0..70f7207e4713 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/SelfRegistering.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/SelfRegistering.cpp @@ -22,7 +22,7 @@ class MyOwner bottom = new MyElement(); // GOOD bottom->bind(this); - side = new MyElement(); // BAD (never released) + side = new MyElement(); // $ Alert // BAD (never released) side->donothing(123); } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp index 7727a038248d..3b49556e37db 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp @@ -7,7 +7,7 @@ void *realloc(void *ptr, size_t size); void free(void* ptr); char *strdup(const char *s1); -int *ID(int *x) +int *ID(int *x) { return x; } @@ -23,10 +23,10 @@ class MyClass4 c = d = new int; // GOOD (d is deleted) e = local = new int; // BAD (e is not deleted) [NOT REPORTED] - f = new int; // GOOD (ID(f) is deleted) [FALSE POSITIVE] + f = new int; // $ Alert // GOOD (ID(f) is deleted) [FALSE POSITIVE] g = ID(new int); // GOOD (g is deleted) } - + ~MyClass4() { delete a; @@ -48,7 +48,7 @@ class MyClass5 c = (int *)realloc(0, 10 * sizeof(int)); // GOOD d = strdup("string"); } - + ~MyClass5() { delete [] a; @@ -66,12 +66,12 @@ class MyClass6 public: MyClass6() { - a = new int[10]; // BAD - b = (int *)calloc(10, sizeof(int)); // BAD - c = (int *)realloc(0, 10 * sizeof(int)); // BAD - d = strdup("string"); // BAD + a = new int[10]; // $ Alert // BAD + b = (int *)calloc(10, sizeof(int)); // $ Alert // BAD + c = (int *)realloc(0, 10 * sizeof(int)); // $ Alert // BAD + d = strdup("string"); // $ Alert // BAD } - + ~MyClass6() { } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Wrapped.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Wrapped.cpp index 6b0eb79f41cb..e3529035ac45 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Wrapped.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Wrapped.cpp @@ -43,7 +43,7 @@ class Wrapped2 public: Wrapped2(int len) { ptr1 = new char[len]; // GOOD - ptr2 = new char[len]; // BAD: not released in destructor + ptr2 = new char[len]; // $ Alert // BAD: not released in destructor Init(len); } @@ -56,7 +56,7 @@ class Wrapped2 void Init(int len) { ptr3 = new char[len]; // GOOD - ptr4 = new char[len]; // BAD: not released in destructor + ptr4 = new char[len]; // $ Alert // BAD: not released in destructor } void Shutdown() diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 82/AV Rule 82.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 82/AV Rule 82.cpp index 411902ac32d2..80d71195696f 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 82/AV Rule 82.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 82/AV Rule 82.cpp @@ -3,7 +3,7 @@ struct Obj { this->val = other.val; return *this; // GOOD (common case) } - + private: int val; }; @@ -15,13 +15,13 @@ class Container { }; struct Bad1 { - Bad1& operator=(const Bad1& other) { + Bad1& operator=(const Bad1& other) { // $ Alert return const_cast(other); // BAD (does not return a reference to *this) } }; struct Bad2 { - Bad2 operator=(const Bad2& other) { + Bad2 operator=(const Bad2& other) { // $ Alert return *this; // BAD (return type is not a reference) } }; @@ -60,7 +60,7 @@ class TemplateReturnAssignment { return *this = TemplateReturnAssignment(_val); // GOOD (calls above `operator=`) } - TemplateReturnAssignment &operator=(bool b) { + TemplateReturnAssignment &operator=(bool b) { // $ Alert return *(new TemplateReturnAssignment(0)); // BAD (does not return a reference to *this) } @@ -196,7 +196,7 @@ struct TemplatedAssignmentGood { struct TemplatedAssignmentBad { template - typename second::type operator=(T val) { // BAD (missing &) + typename second::type operator=(T val) { // $ Alert // BAD (missing &) return *this; } }; diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 82/AV Rule 82.qlref b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 82/AV Rule 82.qlref index 3e47acb20c8e..260d6a99c420 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 82/AV Rule 82.qlref +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 82/AV Rule 82.qlref @@ -1 +1,2 @@ -jsf/4.10 Classes/AV Rule 82.ql +query: jsf/4.10 Classes/AV Rule 82.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 85/AV Rule 85.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 85/AV Rule 85.cpp index 292b8857cb97..18b56dd0d0b8 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 85/AV Rule 85.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 85/AV Rule 85.cpp @@ -1,12 +1,12 @@ -class MyClass1 { +class MyClass1 { // $ Alert public: int i; bool operator< (const MyClass1 &rhs){ return i < rhs.i; } // BAD: operator>= missing }; -class MyClass2 { +class MyClass2 { // $ Alert public: int i; bool operator< (const MyClass2 &rhs){ return i < rhs.i; } @@ -22,7 +22,7 @@ class MyClass3 { // GOOD }; -class MyClass4 { +class MyClass4 { // $ Alert public: int i; bool operator< (const MyClass4 &rhs){ return i < rhs.i; } @@ -76,7 +76,7 @@ class MyClass7 { MyClass7 myClass7; template -class MyClass8 { +class MyClass8 { // $ Alert public: int i; template @@ -100,7 +100,7 @@ void f8(void) { } template -class MyClass9 { +class MyClass9 { // $ Alert public: int i; template diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 85/AV Rule 85.qlref b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 85/AV Rule 85.qlref index 2608ffff47cb..72f5094881b6 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 85/AV Rule 85.qlref +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 85/AV Rule 85.qlref @@ -1 +1,2 @@ -jsf/4.10 Classes/AV Rule 85.ql +query: jsf/4.10 Classes/AV Rule 85.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 97/AV Rule 97.qlref b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 97/AV Rule 97.qlref index c08b4c966198..953d90e70be7 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 97/AV Rule 97.qlref +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 97/AV Rule 97.qlref @@ -1 +1,2 @@ -jsf/4.10 Classes/AV Rule 97.ql \ No newline at end of file +query: jsf/4.10 Classes/AV Rule 97.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 97/jsf97.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 97/jsf97.cpp index df00f154480a..8e8b7ab6ba7e 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 97/jsf97.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 97/jsf97.cpp @@ -3,22 +3,22 @@ typedef int jmp_buf[16]; class C { public: -static int bad1(char xs[10]) +static int bad1(char xs[10]) // $ Alert { return sizeof(xs); } -static int bad2(char xs[]) +static int bad2(char xs[]) // $ Alert { return sizeof(xs); } -static int bad3(chars xs) +static int bad3(chars xs) // $ Alert { return sizeof(xs); } -static int bad4(chars const xs) +static int bad4(chars const xs) // $ Alert { return sizeof(xs); } @@ -37,7 +37,7 @@ static void good_longjmp(jmp_buf j) { } -static void bad_longjmp(int j[16]) +static void bad_longjmp(int j[16]) // $ Alert { } diff --git a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 107/AV Rule 107.qlref b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 107/AV Rule 107.qlref index 57f35c3bcf2d..e24890cc9a86 100644 --- a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 107/AV Rule 107.qlref +++ b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 107/AV Rule 107.qlref @@ -1 +1,2 @@ -jsf/4.13 Functions/AV Rule 107.ql +query: jsf/4.13 Functions/AV Rule 107.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 107/test.c b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 107/test.c index 975d9e196daa..8335065b6166 100644 --- a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 107/test.c +++ b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 107/test.c @@ -8,14 +8,14 @@ void test1() { - void inner1(); // BAD - extern int inner2(); // BAD + void inner1(); // $ Alert // BAD + extern int inner2(); // $ Alert // BAD void inner3() {}; // GOOD (this isn't a declaration, it's a GCC nested function) MY_FUNCTION_1(); // GOOD (in a macro) MY_FUNCTION_2(); // GOOD (in a macro) - MYTYPE inner4(); // BAD (function declaration is not in the macro) - void inner5(MYTYPE p); // BAD (function declaration is not in the macro) + MYTYPE inner4(); // $ Alert // BAD (function declaration is not in the macro) + void inner5(MYTYPE p); // $ Alert // BAD (function declaration is not in the macro) } #define STATICASSERT(cond) void staticAssert(int arg[(cond) ? (1) : (-1)]) diff --git a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/AV Rule 114.qlref b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/AV Rule 114.qlref index fbffe346bcfc..16716eca98f9 100644 --- a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/AV Rule 114.qlref +++ b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/AV Rule 114.qlref @@ -1 +1,2 @@ -jsf/4.13 Functions/AV Rule 114.ql +query: jsf/4.13 Functions/AV Rule 114.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/complex.c b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/complex.c index fc190eb518cd..23574ea59de3 100644 --- a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/complex.c +++ b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/complex.c @@ -1,10 +1,10 @@ _Complex double complexTest1(float a, float b) { - _Complex double x = __builtin_complex(a, b); // BAD + _Complex double x = __builtin_complex(a, b); // $ Alert // BAD } _Complex double complexTest2(float a, float b) { - auto x = __builtin_complex(a, b) * 2.0f; // BAD + auto x = __builtin_complex(a, b) * 2.0f; // $ Alert // BAD } _Complex double complexTest3(float a, float b) { diff --git a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.c b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.c index f0b2dff13308..021e9e5d2d7b 100644 --- a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.c +++ b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.c @@ -5,7 +5,7 @@ int f1(void) { } int f2(void) { - int x = 1; + int x = 1; // $ Alert } // BAD int f3(int b) { @@ -22,7 +22,7 @@ int f3(int b) { int f4(int b) { int x; if (b) { - x = 1; + x = 1; // $ Alert } else { x = 3; return 4; @@ -36,7 +36,7 @@ int f5(void) { int f6(int b) { int x; if (b) { - x = 1; + x = 1; // $ Alert } else { __builtin_unreachable(); } diff --git a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp index 0c7e02ce9ac0..6101e4ca1037 100644 --- a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp +++ b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp @@ -15,7 +15,7 @@ MyValue g1() MyValue g2() { // BAD -} +} // $ Alert MyValue g3() { @@ -49,7 +49,7 @@ MyValue g7(bool c) DONOTHING DONOTHING // BAD -} +} // $ Alert typedef void MYVOID; MYVOID g8() @@ -73,7 +73,7 @@ TypePair::first g9() TypePair::second g10() { // BAD (the return type amounts to int) -} +} // $ Alert template typename TypePair::first g11() @@ -85,7 +85,7 @@ template typename TypePair::second g12() { // BAD (the return type amounts to T / int) -} +} // $ Alert void instantiate() { @@ -109,7 +109,7 @@ int g14(int x) { myThrow("fail"); // BAD (doesn't always throw) } -} +} // $ Alert int g15(int x) { @@ -131,14 +131,14 @@ void myConditionalThrow(bool condition, const char *error) int g16(int x) { - myConditionalThrow(x < 10, "fail"); // BAD (doesn't always throw) + myConditionalThrow(x < 10, "fail"); // $ Alert // BAD (doesn't always throw) } int g17(int x) { try { - myConditionalThrow(x < 10, "fail"); + myConditionalThrow(x < 10, "fail"); // $ Alert } catch (...) { return x; // BAD (doesn't always reach this return) } @@ -181,12 +181,12 @@ class Aborting { int g22() { Aborting x; - + x.a(); // GOOD } int g23() { - Aborting().a(); // GOOD [FALSE POSITIVE] + Aborting().a(); // $ Alert // GOOD [FALSE POSITIVE] } [[__noreturn__]] diff --git a/cpp/ql/test/query-tests/jsf/4.16 Initialization/AV Rule 145/AV Rule 145.qlref b/cpp/ql/test/query-tests/jsf/4.16 Initialization/AV Rule 145/AV Rule 145.qlref index 27a18956b402..6bc33e6e8de0 100644 --- a/cpp/ql/test/query-tests/jsf/4.16 Initialization/AV Rule 145/AV Rule 145.qlref +++ b/cpp/ql/test/query-tests/jsf/4.16 Initialization/AV Rule 145/AV Rule 145.qlref @@ -1 +1,2 @@ -jsf/4.16 Initialization/AV Rule 145.ql +query: jsf/4.16 Initialization/AV Rule 145.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.16 Initialization/AV Rule 145/test.c b/cpp/ql/test/query-tests/jsf/4.16 Initialization/AV Rule 145/test.c index cd7b56779096..11a8f3593290 100644 --- a/cpp/ql/test/query-tests/jsf/4.16 Initialization/AV Rule 145/test.c +++ b/cpp/ql/test/query-tests/jsf/4.16 Initialization/AV Rule 145/test.c @@ -5,7 +5,7 @@ enum { E1C }; -enum { +enum { // $ Alert E2A = 1, E2B, E2C, @@ -13,7 +13,7 @@ enum { E2E }; -enum { +enum { // $ Alert E3A = 1, E3B = 2, E3C = 10, @@ -35,7 +35,7 @@ enum { E5C }; -enum { +enum { // $ Alert E6A, E6B, E6C = 10, diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 157/AV Rule 157.qlref b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 157/AV Rule 157.qlref index be23cb77df59..4a9a7d359f80 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 157/AV Rule 157.qlref +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 157/AV Rule 157.qlref @@ -1 +1,2 @@ -jsf/4.21 Operators/AV Rule 157.ql +query: jsf/4.21 Operators/AV Rule 157.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 157/test.c b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 157/test.c index 69656806dd94..594ffff2eea3 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 157/test.c +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 157/test.c @@ -17,19 +17,19 @@ void f(int x, int y) { if (x && y) x++; - if (x && y++) + if (x && y++) // $ Alert x++; if (x && pureFun()) x++; - if (x && imPureFun()) + if (x && imPureFun()) // $ Alert x++; if (x && strcmp("foo", "bar")) x++; - if (x && unknownFun("foo", "bar")) + if (x && unknownFun("foo", "bar")) // $ Alert x++; } diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/AV Rule 164.qlref b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/AV Rule 164.qlref index d6afaadc5957..637a63fa173b 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/AV Rule 164.qlref +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/AV Rule 164.qlref @@ -1 +1,2 @@ -jsf/4.21 Operators/AV Rule 164.ql +query: jsf/4.21 Operators/AV Rule 164.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c index 99cc6bd7db7d..0a7a9d28c1bb 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c @@ -1,28 +1,27 @@ void f(unsigned char uc, signed char sc, int i) { - uc >> -1; // BAD + uc >> -1; // $ Alert // BAD uc >> 0; uc >> 7; - uc >> 8; // BAD + uc >> 8; // $ Alert // BAD - uc << -1; // BAD + uc << -1; // $ Alert // BAD uc << 0; uc << 7; - uc << 8; // BAD - + uc << 8; // $ Alert // BAD + uc >>= -1; // BAD [NOT DETECTED] uc >>= 0; // BAD [NOT DETECTED] uc >>= 7; uc >>= 8; // BAD [NOT DETECTED] - sc >> -1; // BAD + sc >> -1; // $ Alert // BAD sc >> 0; sc >> 7; - sc >> 8; // BAD + sc >> 8; // $ Alert // BAD - ((unsigned char)i) >> -1; // BAD + ((unsigned char)i) >> -1; // $ Alert // BAD ((unsigned char)i) >> 0; ((unsigned char)i) >> 7; - ((unsigned char)i) >> 8; // BAD + ((unsigned char)i) >> 8; // $ Alert // BAD } - diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/AV Rule 165.qlref b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/AV Rule 165.qlref index a6ee879dfe95..d80a910b428d 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/AV Rule 165.qlref +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/AV Rule 165.qlref @@ -1 +1,2 @@ -jsf/4.21 Operators/AV Rule 165.ql +query: jsf/4.21 Operators/AV Rule 165.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c index 26d53e5a0c35..8fa1ef8173bd 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c @@ -3,25 +3,25 @@ typedef unsigned int TUI; void f(int i, unsigned int ui, signed int si, TUI tui, volatile unsigned int vui, unsigned u, unsigned short us) { i = -i; - i = -ui; // BAD + i = -ui; // $ Alert // BAD i = -si; ui = -i; - ui = -ui; // BAD + ui = -ui; // $ Alert // BAD ui = -si; si = -i; - si = -ui; // BAD + si = -ui; // $ Alert // BAD si = -si; i = -(int)i; - i = -(unsigned int)i; // BAD + i = -(unsigned int)i; // $ Alert // BAD i = -(signed int)i; ui = -(int)ui; - ui = -(unsigned int)ui; // BAD + ui = -(unsigned int)ui; // $ Alert // BAD ui = -(signed int)ui; - tui = -tui; // BAD - vui = -vui; // BAD - u = -u; // BAD - us = -us; // BAD + tui = -tui; // $ Alert // BAD + vui = -vui; // $ Alert // BAD + u = -u; // $ Alert // BAD + us = -us; // $ Alert // BAD ui = -(5U); // BAD [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 166/AV Rule 166.qlref b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 166/AV Rule 166.qlref index 956118bf8c59..bccd03161582 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 166/AV Rule 166.qlref +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 166/AV Rule 166.qlref @@ -1 +1,2 @@ -jsf/4.21 Operators/AV Rule 166.ql +query: jsf/4.21 Operators/AV Rule 166.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 166/test.c b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 166/test.c index e272214215d5..5af0c3c70526 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 166/test.c +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 166/test.c @@ -19,8 +19,8 @@ void f(void) { sizeof(vi); sizeof(*ip); sizeof(*vip); - sizeof(global++); + sizeof(global++); // $ Alert sizeof(pure()); - sizeof(impure()); + sizeof(impure()); // $ Alert } diff --git a/cpp/ql/test/query-tests/jsf/4.22 Pointers and References/AV Rule 176/176.cpp b/cpp/ql/test/query-tests/jsf/4.22 Pointers and References/AV Rule 176/176.cpp index 36c5d9a84fad..e263b8f89a09 100644 --- a/cpp/ql/test/query-tests/jsf/4.22 Pointers and References/AV Rule 176/176.cpp +++ b/cpp/ql/test/query-tests/jsf/4.22 Pointers and References/AV Rule 176/176.cpp @@ -15,31 +15,31 @@ operator_t good_get_operator(bool which) return which ? add : sub; } -int (*bad_get_operator(bool which))(int, int) +int (*bad_get_operator(bool which))(int, int) // $ Alert { return which ? add : sub; } typedef operator_t (*good_meta_t)(bool); -typedef int (*(*bad_meta_t)(bool))(int, int); +typedef int (*(*bad_meta_t)(bool))(int, int); // $ Alert int good_call(operator_t op, int lhs, int rhs) { return op(lhs, rhs); } -int bad_call(int(*op)(int, int), int lhs, int rhs) +int bad_call(int(*op)(int, int), int lhs, int rhs) // $ Alert { return op(lhs, rhs); } typedef int (*good_call_t)(operator_t, int, int); -typedef int (*bad_call_t)(int(*)(int, int), int, int); +typedef int (*bad_call_t)(int(*)(int, int), int, int); // $ Alert void usages() { operator_t good_op = add; - int (*bad_op)(int, int) = good_op; + int (*bad_op)(int, int) = good_op; // $ Alert good_meta_t good_meta_1 = good_get_operator; bad_meta_t good_meta_2 = good_meta_1; diff --git a/cpp/ql/test/query-tests/jsf/4.22 Pointers and References/AV Rule 176/176.qlref b/cpp/ql/test/query-tests/jsf/4.22 Pointers and References/AV Rule 176/176.qlref index b4218cca8350..18ed00a74cf6 100644 --- a/cpp/ql/test/query-tests/jsf/4.22 Pointers and References/AV Rule 176/176.qlref +++ b/cpp/ql/test/query-tests/jsf/4.22 Pointers and References/AV Rule 176/176.qlref @@ -1 +1,2 @@ -jsf/4.22 Pointers and References/AV Rule 176.ql +query: jsf/4.22 Pointers and References/AV Rule 176.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 186/AV Rule 186.qlref b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 186/AV Rule 186.qlref index f6fb0bccea00..a811ca432d09 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 186/AV Rule 186.qlref +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 186/AV Rule 186.qlref @@ -1 +1,2 @@ -jsf/4.24 Control Flow Structures/AV Rule 186.ql +query: jsf/4.24 Control Flow Structures/AV Rule 186.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 186/test.c b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 186/test.c index 5dc0c0e94172..9014d238e886 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 186/test.c +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 186/test.c @@ -11,7 +11,7 @@ void called2() x++; } -void not_called() +void not_called() // $ Alert { x++; // BAD: unreachable } @@ -29,7 +29,7 @@ int main(int argc, const char* argv[]) while (1) { x++; } - x++; // BAD: unreachable + x++; // $ Alert // BAD: unreachable } else if (argc > 4) { x++; // BAD: unreachable [NOT DETECTED] } else if (argc > 5) { diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/AV Rule 193.c b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/AV Rule 193.c index 4a0f0e07dd0d..844d5f7defd4 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/AV Rule 193.c +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/AV Rule 193.c @@ -7,7 +7,7 @@ void m(enum color value) { switch(value) { case red: // compliant case green: // compliant - case blue: // non-compliant + case blue: // $ Alert // non-compliant f(value); case cyan: // compliant case magenta: // compliant @@ -33,7 +33,7 @@ void m(enum color value) { case green: // COMPLIANT f(value); break; - default: // NON-COMPLIANT + default: // $ Alert // NON-COMPLIANT g(value); case cyan: // COMPLIANT g(value); diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/AV Rule 193.qlref b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/AV Rule 193.qlref index ee2fb8681614..6fb2579f4d37 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/AV Rule 193.qlref +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/AV Rule 193.qlref @@ -1 +1,2 @@ -jsf/4.24 Control Flow Structures/AV Rule 193.ql +query: jsf/4.24 Control Flow Structures/AV Rule 193.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/nested.c b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/nested.c index ae2ea4e9c8fe..2a2d79d3a54f 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/nested.c +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/nested.c @@ -17,12 +17,12 @@ void nested1(int i) { void nested2(int i) { switch (i) { - case 1: + case 1: // $ Alert i = 1; break; { ; ; ; ; ; ; ; - default: + default: // $ Alert i = 3; } case 2: diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/test.c b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/test.c index 9cee970ddf11..3f9fe567a539 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/test.c +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 193/test.c @@ -3,7 +3,7 @@ void f1(int i) { switch(i) { case 1: case 2: - case 3: + case 3: // $ Alert i = 3; // Bad case 4: case 5: @@ -24,14 +24,14 @@ void f2(int i) { switch(i) { case 1: case 2: - case 3: + case 3: // $ Alert i = 3; // Bad case 4: case 5: case 6: i = 6; break; // OK: has break - default: + default: // $ Alert i = 10; // Bad: default not at end case 7: case 8: @@ -45,7 +45,7 @@ void f3(int i) { switch(i) { case 1: case 2: - case 3: + case 3: // $ Alert i = 3; // Bad case 4: case 5: @@ -59,7 +59,7 @@ void f3(int i) { return; // OK: has return case 10: case 11: - case 12: + case 12: // $ Alert i = 12; // Bad } } @@ -68,7 +68,7 @@ void f4(int i) { switch(i) { case 1: case 2: - case 3: + case 3: // $ Alert { i = 3; // Bad } diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.c b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.c index 85a29ed21ba3..d401c9aa170a 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.c +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.c @@ -1,19 +1,19 @@ static void f(int x) { switch(x) { - } + } // $ Alert switch(x) { default:; - } + } // $ Alert switch(x) { case 0:; - } + } // $ Alert switch(x) { default: case 0:; - } + } // $ Alert switch(x) { case 0:; diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.qlref b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.qlref index 6a4f71e8e16d..1b51ce65ee6a 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.qlref +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 196/AV Rule 196.qlref @@ -1 +1,2 @@ -jsf/4.24 Control Flow Structures/AV Rule 196.ql +query: jsf/4.24 Control Flow Structures/AV Rule 196.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/AV Rule 201.c b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/AV Rule 201.c index b106f648aaa5..c0d0659eff58 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/AV Rule 201.c +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/AV Rule 201.c @@ -10,14 +10,14 @@ int main() j = 0; for (i = 0; i < 10; i++) { - i = 10; // BAD (for loop variable changed in body) + i = 10; // $ Alert[cpp/loop-variable-changed] // BAD (for loop variable changed in body) j = 10; } - + // nested loops for (i = 0; i < 10; i++) { - for (i = 0; i < 10; i++) // BAD (nested loops with same variable) + for (i = 0; i < 10; i++) // $ Alert[cpp/nested-loops-with-same-variable] // BAD (nested loops with same variable) { // ... } @@ -26,12 +26,12 @@ int main() { for (j = 0; j < 10; j++) { - i++; // BAD (for loop variable changed in body) - j++; // BAD (for loop variable changed in body) + i++; // $ Alert[cpp/loop-variable-changed] // BAD (for loop variable changed in body) + j++; // $ Alert[cpp/loop-variable-changed] // BAD (for loop variable changed in body) k++; } - - for (i = 0; i < 10; i++) // BAD (nested loops with same variable) + + for (i = 0; i < 10; i++) // $ Alert[cpp/nested-loops-with-same-variable] // BAD (nested loops with same variable) { j++; } @@ -40,7 +40,7 @@ int main() { for (j = 0; j < 10; j++) { - for (i = 0; i < 10; i++) // BAD (nested loops with same variable) + for (i = 0; i < 10; i++) // $ Alert[cpp/nested-loops-with-same-variable] // BAD (nested loops with same variable) { // ... } @@ -50,9 +50,9 @@ int main() { for (j = 0; j < 10; j++) { - for (j = 0; j < 10; j++) // BAD (nested loops with same variable) + for (j = 0; j < 10; j++) // $ Alert[cpp/nested-loops-with-same-variable] // BAD (nested loops with same variable) { - j++; // BAD (for loop variable changed in body) + j++; // $ Alert[cpp/loop-variable-changed] // BAD (for loop variable changed in body) } } } @@ -62,20 +62,20 @@ int main() { c = *char_ptr; *char_ptr += 1; - char_ptr += 1; // BAD (for loop variable changed in body) + char_ptr += 1; // $ Alert[cpp/loop-variable-changed] // BAD (for loop variable changed in body) } // more nested loops for (i = 0; i < 10; i++) { - for (j = 0; j < 10; i++) // BAD (for loop variable changed in body) + for (j = 0; j < 10; i++) // $ Alert[cpp/loop-variable-changed] // BAD (for loop variable changed in body) { } - - for (i = 0; j < 10; j++) // BAD (for loop variable changed in body) + + for (i = 0; j < 10; j++) // $ Alert[cpp/loop-variable-changed] // BAD (for loop variable changed in body) { } } return 0; -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/AV Rule 201.qlref b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/AV Rule 201.qlref index f972ec2b8b84..95b0090d38d1 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/AV Rule 201.qlref +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/AV Rule 201.qlref @@ -1 +1,2 @@ -jsf/4.24 Control Flow Structures/AV Rule 201.ql +query: jsf/4.24 Control Flow Structures/AV Rule 201.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/NestedLoopSameVar.qlref b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/NestedLoopSameVar.qlref index 699de5e67d17..3a75252c4109 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/NestedLoopSameVar.qlref +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/NestedLoopSameVar.qlref @@ -1 +1,2 @@ -Likely Bugs/NestedLoopSameVar.ql +query: Likely Bugs/NestedLoopSameVar.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/StructMembers.cpp b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/StructMembers.cpp index ef9f5ac51d8d..46a86ee684ec 100644 --- a/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/StructMembers.cpp +++ b/cpp/ql/test/query-tests/jsf/4.24 Control Flow Structures/AV Rule 201/StructMembers.cpp @@ -18,12 +18,12 @@ int main() { } - for (s1.b = 0; s1.b < 10; s1.b++) // BAD: same loop variable as a surrounding loop + for (s1.b = 0; s1.b < 10; s1.b++) // $ Alert[cpp/nested-loops-with-same-variable] // BAD: same loop variable as a surrounding loop { } s2.b++; // GOOD - s1.b++; // BAD: modifies loop counter of a surrounding loop + s1.b++; // $ Alert[cpp/loop-variable-changed] // BAD: modifies loop counter of a surrounding loop } } } diff --git a/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c b/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c index 57f5432c7024..516c8d25426b 100644 --- a/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c +++ b/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c @@ -1,5 +1,5 @@ -union myUnion1 { // BAD +union myUnion1 { // $ Alert // BAD int asInt; char asChar[4]; }; @@ -16,17 +16,17 @@ union myUnion3 { // GOOD void test1(int *myIntPtr) { - short *myShortPtr = (short *)myIntPtr; // BAD - long long *myLongPtr = (long long *)myIntPtr; // BAD + short *myShortPtr = (short *)myIntPtr; // $ Alert // BAD + long long *myLongPtr = (long long *)myIntPtr; // $ Alert // BAD int myArray[10]; myIntPtr = (int *)myArray; // GOOD - myShortPtr = (short *)myArray; // BAD [BUT DOUBLY REPORTED] + myShortPtr = (short *)myArray; // $ Alert // BAD [BUT DOUBLY REPORTED] return 0; } -union myUnion4 { // GOOD? [FALSE POSITIVE] +union myUnion4 { // $ Alert // GOOD? [FALSE POSITIVE] char myChar; int myInt; }; diff --git a/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.qlref b/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.qlref index 093bf9f081e5..fe56120cad85 100644 --- a/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.qlref +++ b/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.qlref @@ -1 +1,2 @@ -jsf/4.28 Portable Code/AV Rule 210.ql +query: jsf/4.28 Portable Code/AV Rule 210.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql From 843ac7c6b0aeb2638303a4d46b2bae7bf53441ea Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 7 Jul 2026 10:54:11 +0100 Subject: [PATCH 23/44] Add `SPURIOUS:` tags --- .../CWE-190/AllocMultiplicationOverflow/test.cpp | 2 +- .../Security/CWE/CWE-193/constant-size/test.cpp | 10 +++++----- .../CommaBeforeMisleadingIndentation/test.cpp | 2 +- .../OffsetUseBeforeRangeCheck/test.cpp | 2 +- .../Unused Entities/UnusedStaticVariables/test.cpp | 2 +- .../Critical/MemoryFreed/my_auto_ptr.cpp | 6 +++--- .../query-tests/Critical/MemoryFreed/test_free.cpp | 6 +++--- .../Critical/MissingCheckScanf/test.cpp | 14 +++++++------- .../LOC-4/Rule 29/NonConstFunctionPointer/test.c | 2 +- .../PointlessComparison/PointlessComparison.c | 2 +- .../Format/WrongNumberOfFormatArguments/test.c | 4 ++-- .../Leap Year/Adding365DaysPerYear/test.cpp | 4 ++-- .../Memory Management/AllocaInLoop/BoundedLoop.cpp | 2 +- .../SuspiciousCallToMemset/test.cpp | 2 +- .../SuspiciousCallToStrncat/test.c | 4 ++-- .../Likely Bugs/ReturnConstType/test.cpp | 4 ++-- .../Security/CWE/CWE-119/SAMATE/test.cpp | 2 +- .../Security/CWE/CWE-119/SAMATE/tests.cpp | 2 +- .../CWE-190/semmle/ArithmeticUncontrolled/test.cpp | 8 ++++---- .../test.cpp | 6 +++--- .../test/query-tests/Security/CWE/CWE-193/test.cpp | 14 +++++++------- .../Security/CWE/CWE-311/semmle/tests/test3.cpp | 4 ++-- .../Security/CWE/CWE-367/semmle/test2.cpp | 2 +- .../tests/IteratorToExpiredContainer/test.cpp | 2 +- .../CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp | 6 +++--- .../query-tests/Security/CWE/CWE-611/tests.cpp | 2 +- .../query-tests/Security/CWE/CWE-611/tests3.cpp | 2 +- .../Security/CWE/CWE-764/semmle/tests/test.cpp | 6 +++--- .../test/query-tests/Security/CWE/CWE-843/test.cpp | 2 +- .../jsf/4.10 Classes/AV Rule 73/original.cpp | 2 +- .../jsf/4.10 Classes/AV Rule 79/ListDelete.cpp | 2 +- .../jsf/4.10 Classes/AV Rule 79/Variants.cpp | 2 +- .../jsf/4.13 Functions/AV Rule 114/test.cpp | 2 +- .../4.28 Portable Code/AV Rule 210/AV Rule 210.c | 2 +- 34 files changed, 68 insertions(+), 68 deletions(-) diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp index 2e9073474366..40845e355e03 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp @@ -16,7 +16,7 @@ void test() if ((x <= 1000) && (y <= 1000)) { - char *buffer5 = (char *)malloc(x * y); // $ Alert // GOOD [FALSE POSITIVE] + char *buffer5 = (char *)malloc(x * y); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } size_t size1 = x * y; // $ Source diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp index a91e14e51936..ccba2d22ffc8 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp @@ -135,7 +135,7 @@ char testStrncmp2(char *arr) { if(strncmp(arr, "", 6) == 0) { arr += 6; // $ Alert } - return *arr; // $ Sink // GOOD [FALSE POSITIVE] + return *arr; // $ SPURIOUS: Sink // GOOD [FALSE POSITIVE] } void testStrncmp1() { @@ -144,7 +144,7 @@ void testStrncmp1() { } void countdownBuf1(int **p) { - *--(*p) = 1; // $ Sink // GOOD [FALSE POSITIVE] + *--(*p) = 1; // $ SPURIOUS: Sink // GOOD [FALSE POSITIVE] *--(*p) = 2; // GOOD *--(*p) = 3; // GOOD *--(*p) = 4; // GOOD @@ -258,7 +258,7 @@ void call_use(unsigned char* p, int n) { if(n == 3) { unsigned char x = p[0]; unsigned char y = p[1]; - unsigned char z = p[2]; // $ Alert // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point. + unsigned char z = p[2]; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]: `call_use(buffer2, 2)` won't reach this point. use(x, y, z); } } @@ -296,7 +296,7 @@ int guardingCallee(int *arr, int size) { int sum; for (int i = 0; i < size; i++) { - sum += arr[i]; // $ Alert // GOOD [FALSE POSITIVE] - guarded by size + sum += arr[i]; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] - guarded by size } return sum; } @@ -319,7 +319,7 @@ void correlatedCondition(int num) { end = temp + 56; } else if (num < 64) { - end = temp + 64; // $ Alert // GOOD [FALSE POSITVE] + end = temp + 64; // $ SPURIOUS: Alert // GOOD [FALSE POSITVE] } char *temp2 = temp + num; while(temp2 != end) { // $ Sink diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp index 7d13d1f2274b..eaf539c5c8fd 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp @@ -163,7 +163,7 @@ int Foo::test(int (*baz)(int)) if (1) foo( i++ - ), j++; // $ Alert // GOOD? [FALSE POSITIVE] + ), j++; // $ SPURIOUS: Alert // GOOD? [FALSE POSITIVE] if (1) baz( i++ diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp index b12fd51c5dca..cc0a56168196 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp @@ -36,7 +36,7 @@ void test(char *buffer, int bufferSize) // look for 'ab' for (i = 0; i < bufferSize; i++) { - if ((buffer[i] == 'a') && (i < bufferSize - 1) && (buffer[i + 1] == 'b')) // $ Alert // GOOD [FALSE POSITIVE] + if ((buffer[i] == 'a') && (i < bufferSize - 1) && (buffer[i + 1] == 'b')) // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] break; } diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp index c8d9eb222f8d..3b60a4722d4d 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp @@ -9,7 +9,7 @@ static int staticVar6 = 6; // $ Alert // BAD (unused) static __attribute__((__unused__)) int staticVar7; // GOOD (unused but this is expected) const int constVar8 = 8; // $ Alert // BAD (const defaults to static) extern const int constVar9 = 9; // GOOD -static int staticVar10 = 10; // $ Alert // GOOD [FALSE POSITIVE] (referenced in a never instantiated template) +static int staticVar10 = 10; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] (referenced in a never instantiated template) void f() { diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp index 50a4f950e861..93f39b5be5b3 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/my_auto_ptr.cpp @@ -52,9 +52,9 @@ template class AutoContainer2 { public: - AutoContainer2() : v(new T) // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] + AutoContainer2() : v(new T) // $ SPURIOUS: Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] { - ns::my_auto_ptr ap(new T); // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] + ns::my_auto_ptr ap(new T); // $ SPURIOUS: Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] } ns::my_auto_ptr v; @@ -68,7 +68,7 @@ class AutoCloner AutoCloner(AutoCloner &from) : val(from.val) {}; ns::my_auto_ptr clone() { - return ns::my_auto_ptr(new AutoCloner(*this)); // $ Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] + return ns::my_auto_ptr(new AutoCloner(*this)); // $ SPURIOUS: Alert[cpp/memory-never-freed] // GOOD [FALSE POSITIVE] } private: diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp index 8eec079f0ef3..c16127e18a63 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp @@ -233,17 +233,17 @@ void test_loop3(char ** a, char ** b) { free(*a); // $ Source[cpp/use-after-free] a++; } - use(*a); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] + use(*a); // $ SPURIOUS: Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] for (;*b; b++) { free(*b); // $ Source[cpp/use-after-free] } - use(*b); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] + use(*b); // $ SPURIOUS: Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] } void test_deref(char **a) { free(*a); // $ Source[cpp/use-after-free] - use(*a); // $ Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] + use(*a); // $ SPURIOUS: Alert[cpp/use-after-free] // GOOD [FALSE POSITIVE] } // Refs diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp index abbce0e932db..ba79df57fee4 100644 --- a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp +++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp @@ -269,7 +269,7 @@ int main() set_by_ref(i); scanf("%d", &i); // $ Source[cpp/missing-check-scanf] - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] } { @@ -277,7 +277,7 @@ int main() set_by_ptr(&i); scanf("%d", &i); // $ Source[cpp/missing-check-scanf] - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE] } { @@ -401,7 +401,7 @@ char *my_string_copy() { for (int i = 0; i < len; i += 2) { unsigned int u; sscanf(src + i, "%2x", &u); // $ Source[cpp/missing-check-scanf] - *ptr++ = (char) u; // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]? src+i+{0,1} are always valid %x digits, so this should be OK. + *ptr++ = (char) u; // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]? src+i+{0,1} are always valid %x digits, so this should be OK. } *ptr++ = 0; return DST_STRING; @@ -413,14 +413,14 @@ void scan_and_write() { if (scanf("%d", &i) < 1) { // $ Source[cpp/missing-check-scanf] i = 0; } - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails } { int i; if (scanf("%d", &i) != 1) { // $ Source[cpp/missing-check-scanf] i = 0; } - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD [FALSE POSITIVE]: variable is overwritten with a default value when scanf fails } } @@ -481,7 +481,7 @@ void multiple_checks() { if (res >= 0) { if (res != 0) { - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] } } } @@ -492,7 +492,7 @@ void multiple_checks() { if (res < 0) return; if (res != 0) { - use(i); // $ Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] + use(i); // $ SPURIOUS: Alert[cpp/missing-check-scanf] // GOOD: checks return value [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c index c87226eba3de..825ba11029ad 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c +++ b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 29/NonConstFunctionPointer/test.c @@ -17,5 +17,5 @@ void test() funPtr1(); // $ Alert // BAD funPtr2(); // $ Alert // BAD - funPtr3(); // $ Alert // GOOD [FALSE POSITIVE] + funPtr3(); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c index b024284751ff..188aa46d7905 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c @@ -261,7 +261,7 @@ int overeager_wraparound(unsigned int u32bound, unsigned long long u64bound) { int negative_zero(double dbl) { if (dbl >= 0) { - return dbl >= -dbl; // $ Alert[cpp/constant-comparison] // GOOD [FALSE POSITIVE] + return dbl >= -dbl; // $ SPURIOUS: Alert[cpp/constant-comparison] // GOOD [FALSE POSITIVE] } return 0; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c index 3fa9e7f33773..f054f382c5fc 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c @@ -29,7 +29,7 @@ void test(int i, const char *str) printf("%2$*1$d", width); // $ Alert[cpp/wrong-number-format-arguments] // BAD (too few format arguments) printf("%1$*2$d", 0, num, width); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE] - printf("%1$*2$d", num, width); // $ Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] + printf("%1$*2$d", num, width); // $ SPURIOUS: Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] printf("%1$*2$d", width); // BAD (too few format arguments) [NOT DETECTED] } { @@ -37,7 +37,7 @@ void test(int i, const char *str) float num; printf("%2$.*4$f", 0, 0, num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE] - printf("%2$.*4$f", 0, num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] + printf("%2$.*4$f", 0, num, 0, precision); // $ SPURIOUS: Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] printf("%2$.*4$f", num, 0, precision); // $ Alert[cpp/too-many-format-arguments] // BAD (too few format arguments) [INCORRECT MESSAGE] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp index 0b22366e9764..4d6e39f0fbc3 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/test.cpp @@ -214,8 +214,8 @@ void checkedExample() qwLongTime += 365 * 24 * 60 * 60 * 10000000LLU; // copy back to a FILETIME - ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // $ Alert // GOOD [FALSE POSITIVE] - ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // $ Alert // GOOD [FALSE POSITIVE] + ft.dwLowDateTime = (DWORD)(qwLongTime & 0xFFFFFFFF); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] + ft.dwHighDateTime = (DWORD)(qwLongTime >> 32); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] // convert back to SYSTEMTIME for display or other usage if (FileTimeToSystemTime(&ft, &st) == 0) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp index d9cf74338922..b14dbbbb8de6 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp @@ -102,7 +102,7 @@ void incBefore() { int i = -1; i++; // not understood by data flow for (; i < 2; i++) { - alloca(100); // $ Alert // GOOD [FALSE POSITIVE] + alloca(100); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp index fcc6fd98c059..92be81a5f03e 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp @@ -126,7 +126,7 @@ void myFunc(myStruct paramArray[80], myStruct &refStruct) memset(&localArray, 0, sizeof(localArray)); // GOOD memset(paramArray, 0, sizeof(myStruct) * 80); // GOOD - memset(paramArray, 0, sizeof(paramArray)); // $ Alert // GOOD [FALSE POSITIVE] + memset(paramArray, 0, sizeof(paramArray)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] memset(¶mArray, 0, sizeof(myStruct) * 80); // $ Alert // BAD memset(¶mArray, 0, sizeof(paramArray)); // BAD [NOT DETECTED] diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c index 03286e33f1b3..b76482179ca8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c @@ -88,7 +88,7 @@ void strncat_test6() { char dest[60]; dest[0] = '\0'; // Will write `dest[0 .. 5]` - strncat(dest, "small", sizeof(dest)); // $ Alert // GOOD [FALSE POSITIVE] + strncat(dest, "small", sizeof(dest)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } { @@ -96,6 +96,6 @@ void strncat_test6() { memset(dest, 'a', sizeof(dest)); dest[54] = '\0'; // Will write `dest[54 .. 59]` - strncat(dest, "small", sizeof(dest)); // $ Alert // GOOD [FALSE POSITIVE] + strncat(dest, "small", sizeof(dest)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp index f52accf2126d..ca892be25efb 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/ReturnConstType/test.cpp @@ -43,10 +43,10 @@ template class myWrapper { myWrapper testTemplateClass{t: 'a'}; #define MYCHAR const char -MYCHAR getAMYCHAR(); // $ Alert // FALSE POSITIVE +MYCHAR getAMYCHAR(); // $ SPURIOUS: Alert // FALSE POSITIVE #define ID(T) T id_ (T x) {return x;} -ID(const char); // $ Alert // FALSE POSITIVE +ID(const char); // $ SPURIOUS: Alert // FALSE POSITIVE const float pi = 3.14159626f; const float &getPiRef() { return pi; } // GOOD diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp index 52272d4dae32..a39c2bd47cfb 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp @@ -263,7 +263,7 @@ void test7(unsigned n) { if(!p) { p = (char*)malloc(++n); } - memset(p, 0, n); // $ Alert[cpp/overrun-write] // GOOD [FALSE POSITIVE] + memset(p, 0, n); // $ SPURIOUS: Alert[cpp/overrun-write] // GOOD [FALSE POSITIVE] } void test8(unsigned size, unsigned src_pos) diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp index 5df613f80006..c3a27a2ddd84 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp @@ -303,7 +303,7 @@ namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE193_wchar_t_ncpy_01 wchar_t source[10+1] = SRC_STRING; /* Copy length + 1 to include NUL terminator from source */ /* POTENTIAL FLAW: data may not have enough space to hold source */ - wcsncpy(data, source, wcslen(source) + 1); // $ Alert[cpp/bad-strncpy-size] // [FALSE POSITIVE RESULT] (debatable) + wcsncpy(data, source, wcslen(source) + 1); // $ SPURIOUS: Alert[cpp/bad-strncpy-size] // [FALSE POSITIVE RESULT] (debatable) printWLine(data); delete [] data; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp index 9f717ad670b4..20326533dd8d 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp @@ -62,7 +62,7 @@ unsigned int test_remainder_subtract_unsigned() unsigned int x = rand(); // $ Source unsigned int y = x % 100; // y <= x - return x - y; // $ Alert // GOOD (as y <= x) [FALSE POSITIVE] + return x - y; // $ SPURIOUS: Alert // GOOD (as y <= x) [FALSE POSITIVE] } typedef unsigned long size_t; @@ -143,7 +143,7 @@ int test_conditional_assignment_3() y = x; } - return y * c; // $ Alert // GOOD (as y <= 100) [FALSE POSITIVE] + return y * c; // $ SPURIOUS: Alert // GOOD (as y <= 100) [FALSE POSITIVE] } int test_underflow() @@ -193,7 +193,7 @@ void test_if_const_bounded() if (x < 1000) { x = x * 2; // GOOD - x = x * c; // $ Alert // GOOD [FALSE POSITIVE] + x = x * c; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } else { x = x * 2; // $ Alert // BAD x = x * c; // $ Alert // BAD @@ -205,7 +205,7 @@ void test_if_const_bounded() y = y * c; // $ Alert // BAD } else { y = y * 2; // GOOD - y = y * c; // $ Alert // GOOD [FALSE POSITIVE] + y = y * c; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp index 234248610b0b..d04a31b78ee5 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp @@ -59,7 +59,7 @@ void test(unsigned x, unsigned y, bool unknown) { if(unknown) { ++y; } } - if(x - y > 0) { } // $ Alert // GOOD [FALSE POSITIVE] + if(x - y > 0) { } // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] x = y; while(cond()) { @@ -72,7 +72,7 @@ void test(unsigned x, unsigned y, bool unknown) { if (n > x - y) { n = x - y; } if (n > 0) { y += n; // NOTE: `n` is at most `x - y` at this point. - if (x - y > 0) {} // $ Alert // GOOD [FALSE POSITIVE] + if (x - y > 0) {} // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } @@ -179,7 +179,7 @@ void test9() { b = 0; } - if (a - b > 0) { // $ Alert // GOOD (as a >= b) [FALSE POSITIVE] + if (a - b > 0) { // $ SPURIOUS: Alert // GOOD (as a >= b) [FALSE POSITIVE] // ... } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp index f26d67738223..6d9fef227ac5 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp @@ -193,23 +193,23 @@ void test11(unsigned size) { void test12(unsigned len, unsigned index) { char* p = (char *)malloc(len); char* end = p + len; // $ alloc=L194 - + if(p + index > end) { return; } - + p[index] = '\0'; // $ MISSING: deref=L195->L201 // BAD [NOT DETECTED] } void test13(unsigned len, unsigned index) { char* p = (char *)malloc(len); // $ Source[cpp/invalid-pointer-deref]=r7 char* end = p + len; // $ alloc=L205 - + char* q = p + index; if(q > end) { return; } - + *q = '\0'; // $ deref=L206->L213 Alert[cpp/invalid-pointer-deref]=r7 // BAD } @@ -764,12 +764,12 @@ void test38(unsigned size) { case '0': if (n != 1) error(""); - char x = alloc[pos + 1]; // $ alloc=L754 deref=L767 Alert[cpp/invalid-pointer-deref]=r22 Alert[cpp/invalid-pointer-deref]=r23 // GOOD [FALSE POSITIVE] + char x = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L767 Alert[cpp/invalid-pointer-deref]=r22 Alert[cpp/invalid-pointer-deref]=r23 // GOOD [FALSE POSITIVE] break; case '1': if (n != 2) error(""); - char a = alloc[pos + 1]; // $ alloc=L754 deref=L772 Alert[cpp/invalid-pointer-deref]=r24 Alert[cpp/invalid-pointer-deref]=r25 // GOOD [FALSE POSITIVE] + char a = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L772 Alert[cpp/invalid-pointer-deref]=r24 Alert[cpp/invalid-pointer-deref]=r25 // GOOD [FALSE POSITIVE] char b = alloc[pos + 2]; break; } @@ -783,7 +783,7 @@ void test38_simple(unsigned size, unsigned pos, unsigned numParams) { if (pos < size) { if (pos + numParams < size) { if (numParams == 1) { - char x = p[pos + 1]; // $ alloc=L781 deref=L786 Alert[cpp/invalid-pointer-deref]=r26 // GOOD [FALSE POSITIVE] + char x = p[pos + 1]; // $ SPURIOUS: alloc=L781 deref=L786 Alert[cpp/invalid-pointer-deref]=r26 // GOOD [FALSE POSITIVE] } } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp index 0f79301cded9..4bc6fbe6773f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp @@ -417,7 +417,7 @@ void test_member_password() { packet p; - recv(val(), p.password, 256, val()); // $ Alert[cpp/cleartext-transmission] // GOOD: password is encrypted [FALSE POSITIVE] + recv(val(), p.password, 256, val()); // $ SPURIOUS: Alert[cpp/cleartext-transmission] // GOOD: password is encrypted [FALSE POSITIVE] decrypt_inplace(p.password); // proof that `password` was in fact encrypted } } @@ -428,7 +428,7 @@ void test_stdin_param(FILE *stream) { char password[128]; - fgets(password, 128, stream); // $ Alert[cpp/cleartext-transmission] // GOOD: from standard input (see call below) [FALSE POSITIVE] + fgets(password, 128, stream); // $ SPURIOUS: Alert[cpp/cleartext-transmission] // GOOD: from standard input (see call below) [FALSE POSITIVE] } void test_stdin() diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp index febab29186a0..e8e0161e1e7f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp @@ -206,7 +206,7 @@ void test2_11(const char *path, int arg) if (stat(path, &buf)) { - f = open(path, arg); // $ Alert // GOOD (here stat is just a redundant check that the file exists / path is valid, confirmed by the return value of open) [FALSE POSITIVE] + f = open(path, arg); // $ SPURIOUS: Alert // GOOD (here stat is just a redundant check that the file exists / path is valid, confirmed by the return value of open) [FALSE POSITIVE] if (f == -1) { // handle error diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp index 1a671983761e..ae217188c62d 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp @@ -854,7 +854,7 @@ struct PlusPlusReturnByValueIterator void test7() { PlusPlusReturnByValueIterator it; - it.operator++(); // $ Alert // GOOD [FALSE POSITIVE] + it.operator++(); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] it.begin(); } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp index fde729331ce5..7dd80687e9c0 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp @@ -194,7 +194,7 @@ void test13() { data = NULL; } - use(data); // $ Alert // GOOD [FALSE POSITIVE] + use(data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } void test14() @@ -245,12 +245,12 @@ void malloc_after_free(myStruct *s) { if (s->i1.data == 0) { return; } - use(s->i1.data); // $ Alert // GOOD [FALSE POSITIVE] + use(s->i1.data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] free(s->i2->data); // $ Source s->i2->data = (char *)malloc(100*sizeof(char)); if (s->i2->data == 0) { return; } - use(s->i2->data); // $ Alert // GOOD [FALSE POSITIVE] + use(s->i2->data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp index c6253a56bdf4..13bbe6b4e0be 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests.cpp @@ -101,7 +101,7 @@ void test9(InputSource &data) { XercesDOMParser &q = *p; p->setDisableDefaultEntityResolution(true); - q.parse(data); // $ Alert // GOOD [FALSE POSITIVE] + q.parse(data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp index 9c3911dde7bf..9a55e1e5ea47 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests3.cpp @@ -53,7 +53,7 @@ void test3_5_init() { void test3_5(InputSource &data) { test3_5_init(); - p_3_5->parse(data); // $ Alert // GOOD [FALSE POSITIVE] + p_3_5->parse(data); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } void test3_6(InputSource &data) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp index 4d0f833c4eb8..6e5271066ff4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-764/semmle/tests/test.cpp @@ -300,7 +300,7 @@ void interproc_test_09() { void test_10() { std::mutex mtx; - if (!mtx.try_lock()) { // $ Alert[cpp/unreleased-lock] // [FALSE POSITIVE] + if (!mtx.try_lock()) { // $ SPURIOUS: Alert[cpp/unreleased-lock] // [FALSE POSITIVE] } else { mtx.unlock(); } @@ -310,7 +310,7 @@ void test_10() void test_11() { std::mutex mtx; - if (!mtx.try_lock()) { // $ Alert[cpp/unreleased-lock] // [FALSE POSITIVE] + if (!mtx.try_lock()) { // $ SPURIOUS: Alert[cpp/unreleased-lock] // [FALSE POSITIVE] return; } @@ -439,7 +439,7 @@ struct data_t { bool test_mutex(data_t *data) { - CHECK(mutex_lock(&(data->mutex))); // $ Alert[cpp/unreleased-lock] // GOOD [FALSE POSITIVE] + CHECK(mutex_lock(&(data->mutex))); // $ SPURIOUS: Alert[cpp/unreleased-lock] // GOOD [FALSE POSITIVE] data->val = 1; CHECK(mutex_unlock(&(data->mutex))); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp index 632deabecab7..5d03c1fef852 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp @@ -156,7 +156,7 @@ void test13(bool b, Cat* c) { // because we don't find a flow path from `a = c` to `static_cast(a)` because // the "source" (i.e., `a = c`) doesn't have an allocation. if(b) { - Cat* d = static_cast(a); // $ Alert // GOOD [FALSE POSITIVE] + Cat* d = static_cast(a); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp index f5a6afd7e1dc..c0d8399a5753 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 73/original.cpp @@ -73,7 +73,7 @@ class AlsoGood char getChar(); }; -AlsoGood::AlsoGood() // $ Alert // compliant [FALSE POSITIVE] +AlsoGood::AlsoGood() // $ SPURIOUS: Alert // compliant [FALSE POSITIVE] { cp = 0; } diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp index 31686ad60e62..bca36a174b5f 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp @@ -18,7 +18,7 @@ class MyThingColection { public: MyThingColection() { - first = new MyThing; // $ Alert // GOOD (all deleted in destructor) [FALSE POSITIVE] + first = new MyThing; // $ SPURIOUS: Alert // GOOD (all deleted in destructor) [FALSE POSITIVE] first->next = new MyThing; // GOOD (all deleted in destructor) diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp index 3b49556e37db..e44985e534ea 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/Variants.cpp @@ -23,7 +23,7 @@ class MyClass4 c = d = new int; // GOOD (d is deleted) e = local = new int; // BAD (e is not deleted) [NOT REPORTED] - f = new int; // $ Alert // GOOD (ID(f) is deleted) [FALSE POSITIVE] + f = new int; // $ SPURIOUS: Alert // GOOD (ID(f) is deleted) [FALSE POSITIVE] g = ID(new int); // GOOD (g is deleted) } diff --git a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp index 6101e4ca1037..bac7bf85df68 100644 --- a/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp +++ b/cpp/ql/test/query-tests/jsf/4.13 Functions/AV Rule 114/test.cpp @@ -186,7 +186,7 @@ int g22() { } int g23() { - Aborting().a(); // $ Alert // GOOD [FALSE POSITIVE] + Aborting().a(); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] } [[__noreturn__]] diff --git a/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c b/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c index 516c8d25426b..fba29f653430 100644 --- a/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c +++ b/cpp/ql/test/query-tests/jsf/4.28 Portable Code/AV Rule 210/AV Rule 210.c @@ -26,7 +26,7 @@ void test1(int *myIntPtr) return 0; } -union myUnion4 { // $ Alert // GOOD? [FALSE POSITIVE] +union myUnion4 { // $ SPURIOUS: Alert // GOOD? [FALSE POSITIVE] char myChar; int myInt; }; From 76d8ae869443ff05268639b78f73f65ed6728f9b Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 7 Jul 2026 10:59:21 +0100 Subject: [PATCH 24/44] Add `MISSING:` tag --- .../BadLocking/UnintendedDeclaration.cpp | 2 +- .../NoCheckBeforeUnsafePutUser/test.cpp | 6 +-- .../AllocMultiplicationOverflow/test.cpp | 2 +- .../CWE/CWE-193/array-access/test.cpp | 2 +- .../Security/CWE/CWE-200/test3/test.cpp | 4 +- .../CWE/CWE-369/semmle/tests/test.cpp | 10 ++--- .../CWE/CWE-377/semmle/tests/test.cpp | 2 +- .../CWE/CWE-754/semmle/tests/test.cpp | 2 +- .../Best Practices/GuardedFree/test.cpp | 4 +- .../OffsetUseBeforeRangeCheck/test.cpp | 12 +++--- .../UnusedStaticFunctions/extraction_error.c | 2 +- .../query-tests/Critical/MemoryFreed/test.cpp | 4 +- .../Critical/MemoryFreed/test_free.cpp | 12 +++--- .../Critical/MissingCheckScanf/test.cpp | 6 +-- .../Critical/MissingNullTest/test.cpp | 4 +- .../query-tests/Critical/NewFree/test.cpp | 2 +- .../Critical/OverflowCalculated/tests1.cpp | 12 +++--- .../Critical/OverflowCalculated/tests2.cpp | 16 +++---- .../Critical/OverflowCalculated/tests3.cpp | 2 +- .../Critical/OverflowStatic/test.c | 16 +++---- .../Critical/OverflowStatic/test.cpp | 8 ++-- .../query-tests/Critical/SizeCheck/test2.c | 4 +- .../Rule 30/FunctionPointerConversions/test.c | 4 +- .../BadAdditionOverflowCheck/templates.cpp | 2 +- .../Arithmetic/BitwiseSignCheck/bsc.cpp | 2 +- .../Arithmetic/ComparisonPrecedence/test.cpp | 2 +- .../Arithmetic/IntMultToLong/Buildless.c | 4 +- .../Arithmetic/IntMultToLong/IntMultToLong.c | 6 +-- .../PointlessComparison/PointlessComparison.c | 4 +- .../Conversion/ArrayArgSizeMismatch/test.cpp | 2 +- .../LossyFunctionResultCast/test.cpp | 8 ++-- .../Likely Bugs/Format/NonConstantFormat/a.c | 2 +- .../Likely Bugs/Format/NonConstantFormat/b.c | 4 +- .../Format/NonConstantFormat/test.cpp | 2 +- .../Format/SnprintfOverflow/test.cpp | 2 +- .../Format/WrongNumberOfFormatArguments/a.c | 4 +- .../Format/WrongNumberOfFormatArguments/b.c | 4 +- .../Format/WrongNumberOfFormatArguments/c.c | 4 +- .../WrongNumberOfFormatArguments/test.c | 2 +- .../Buildless/second.cpp | 4 +- .../Linux_signed_chars/a.c | 2 +- .../Linux_signed_chars/b.c | 4 +- .../DubiousNullCheck/DubiousNullCheck.cpp | 4 +- .../ExprHasNoEffect/templatey.cpp | 4 +- .../inconsistentLoopDirection.cpp | 6 +-- .../AllocaInLoop/BoundedLoop.cpp | 2 +- .../ImproperNullTermination/test.cpp | 18 ++++---- .../PointerOverflow/test.cpp | 2 +- .../StrncpyFlippedArgs/test.cpp | 2 +- .../SuspiciousCallToMemset/test.cpp | 6 +-- .../SuspiciousCallToStrncat/test.c | 8 ++-- .../RedundantNullCheckSimple.cpp | 8 ++-- .../Underspecified Functions/test.c | 2 +- .../Likely Bugs/UseInOwnInitializer/test.cpp | 2 +- .../query-tests/Security/CWE/CWE-014/test.c | 42 +++++++++---------- .../query-tests/Security/CWE/CWE-014/test.cpp | 22 +++++----- .../UncontrolledProcessOperation/test.cpp | 4 +- .../Security/CWE/CWE-119/SAMATE/test.cpp | 10 ++--- .../semmle/tests/test_buffer_overrun.cpp | 6 +-- .../CWE/CWE-119/semmle/tests/tests.cpp | 2 +- .../CWE-119/semmle/tests/var_size_struct.cpp | 4 +- .../CWE/CWE-120/semmle/tests/tests2.cpp | 2 +- .../CWE/CWE-120/semmle/tests/unions.c | 4 +- .../NoSpaceForZeroTerminator/test2.cpp | 4 +- .../semmle/ArithmeticUncontrolled/test.c | 10 ++--- .../semmle/ArithmeticUncontrolled/test.cpp | 6 +-- .../semmle/ArithmeticWithExtremeValues/test.c | 12 +++--- .../semmle/TaintedAllocationSize/test.cpp | 8 ++-- .../query-tests/Security/CWE/CWE-193/test.cpp | 36 ++++++++-------- .../query-tests/Security/CWE/CWE-295/test.cpp | 4 +- .../CWE/CWE-311/semmle/tests/test3.cpp | 4 +- .../query-tests/Security/CWE/CWE-327/test.cpp | 22 +++++----- .../Security/CWE/CWE-327/test2.cpp | 16 +++---- .../Security/CWE/CWE-367/semmle/test2.cpp | 8 ++-- .../tests/IteratorToExpiredContainer/test.cpp | 6 +-- .../semmle/tests/UseAfterFree/test.cpp | 20 ++++----- .../test.cpp | 4 +- .../CWE/CWE-457/semmle/tests/test.cpp | 6 +-- .../SuspiciousAddWithSizeof/buildless.cpp | 4 +- .../Security/CWE/CWE-611/tests4.cpp | 4 +- .../Security/CWE/CWE-611/tests5.cpp | 4 +- .../CWE-807/semmle/TaintedCondition/test.cpp | 8 ++-- .../query-tests/Security/CWE/CWE-843/test.cpp | 6 +-- .../4.10 Classes/AV Rule 79/DeleteThis.cpp | 4 +- .../jsf/4.10 Classes/AV Rule 79/QObject.cpp | 2 +- .../jsf/4.21 Operators/AV Rule 164/test.c | 6 +-- .../jsf/4.21 Operators/AV Rule 165/test.c | 2 +- 87 files changed, 284 insertions(+), 284 deletions(-) diff --git a/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp b/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp index 48f279c83357..5f8bcb25ec38 100644 --- a/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp +++ b/cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp @@ -86,7 +86,7 @@ class MyTestClass void test7() { - Lock(memberMutex); // BAD (creates an uninitialized variable called `memberMutex`, probably not intended) [NOT DETECTED] + Lock(memberMutex); // $ MISSING: Alert // BAD (creates an uninitialized variable called `memberMutex`, probably not intended) [NOT DETECTED] // ... } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp index f474b33c65d2..287e1c674495 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp @@ -19,7 +19,7 @@ void test1(int p) { sys_somesystemcall(&p); - unsafe_put_user(123, &p); // BAD [NOT DETECTED] + unsafe_put_user(123, &p); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED] } void test2(int p) @@ -40,7 +40,7 @@ void test3() sys_somesystemcall(&v); - unsafe_put_user(123, &v); // BAD [NOT DETECTED] + unsafe_put_user(123, &v); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED] } void test4() @@ -68,7 +68,7 @@ void test5() sys_somesystemcall(&myData); - unsafe_put_user(123, &(myData.x)); // BAD [NOT DETECTED] + unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED] } void test6() diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp index 40845e355e03..8065679ec2d2 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp @@ -24,7 +24,7 @@ void test() size_t size2 = x; size2 *= y; - char *buffer6 = (char *)malloc(size2); // BAD [NOT DETECTED] + char *buffer6 = (char *)malloc(size2); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED] char *buffer7 = new char[x * 10]; // GOOD char *buffer8 = new char[x * y]; // $ Alert // BAD diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp index dc60e34f2537..f22d65934565 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp @@ -105,6 +105,6 @@ void test7(int size) { } for (char *p = arr; p <= arr + size; p++) { - *p = 0; // BAD [NOT DETECTED] + *p = 0; // $ MISSING: Alert // BAD [NOT DETECTED] } } diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp index cadf28ca6ecc..a882316f0c38 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp @@ -10,8 +10,8 @@ int main(int argc, char *argv[]) { FILE *fp; char buf[128]; - fp = fopen("myFile.txt","r+"); // BAD [NOT DETECTED] - fgets(buf,128,fp); + fp = fopen("myFile.txt","r+"); // $ MISSING: Alert // BAD [NOT DETECTED] + fgets(buf,128,fp); fprintf(fp,"%s\n","data to file"); fclose(fp); return 0; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp index c3f27c3aa648..e97918a37707 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp @@ -58,9 +58,9 @@ int badTestf3(int type, int met) { is = getSize(type); switch (met) { case 1: - if (is >= 0) return 123 / is; // BAD [NOT DETECTED] + if (is >= 0) return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED] case 2: - if (0 == is) return 123 / is; // BAD [NOT DETECTED] + if (0 == is) return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED] case 3: if (!is & 123 / is) // $ Alert // BAD return 123; @@ -82,7 +82,7 @@ int badTestf3(int type, int met) { } if (is != 0) return -1; if (is == 0) type += 1; - return 123 / is; // BAD [NOT DETECTED] + return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED] } int goodTestf3(int type, int met) { @@ -223,7 +223,7 @@ int badTestf12(FILE * f) { int a; int ret = -1; a = getc(f); - if (a == 0) ret = 123 / a; // BAD [NOT DETECTED] + if (a == 0) ret = 123 / a; // $ MISSING: Alert // BAD [NOT DETECTED] return ret; } @@ -262,7 +262,7 @@ void badTestf13(int type) { if (is < 5) badMySubDiv(type, is); // $ Alert // BAD if (is < 0) - badMySubDiv(type, is); // BAD [NOT DETECTED] + badMySubDiv(type, is); // $ MISSING: Alert // BAD [NOT DETECTED] if (is > 5) badMySubDiv(type, is); // GOOD if (is == 0) diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp index 758fdfda8a7b..d2277725a3e0 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp @@ -39,7 +39,7 @@ int funcTest3() FILE *fp; char filename[80]; strcat(filename, "/tmp/tmp.name"); - fp = fopen(filename,"w"); // BAD [NOT DETECTED] + fp = fopen(filename,"w"); // $ MISSING: Alert // BAD [NOT DETECTED] fprintf(fp,"%s\n","data to file"); fclose(fp); return 0; diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp index 72a11620eb3d..8909566f201f 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp @@ -60,7 +60,7 @@ int functionWork1b(int retIndex) { } int functionWork1_() { int i; - scanf("%i",&i); // BAD [NOT DETECTED] + scanf("%i",&i); // $ MISSING: Alert // BAD [NOT DETECTED] if(i<10) return -1; return i; diff --git a/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp b/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp index 136575fdced0..ad2f800ae987 100644 --- a/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp @@ -52,7 +52,7 @@ void test6(char *x) { } void test7(char *x) { - if (x || x) { // BAD [NOT DETECTED] + if (x || x) { // $ MISSING: Alert // BAD [NOT DETECTED] free(x); } } @@ -91,7 +91,7 @@ void test10(char *x) { if (x) free(x); void test11(char *x) { - TRY_FREE(x) // BAD [NOT DETECTED] + TRY_FREE(x) // $ MISSING: Alert // BAD [NOT DETECTED] } bool test12(char *x) { diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp index cc0a56168196..0d096e4407a2 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp @@ -15,24 +15,24 @@ void test(char *buffer, int bufferSize) if ((buffer[i] == 'x') && (i < bufferSize)) {} // $ Alert // BAD if ((bufferSize > i) && (buffer[i] == 'x')) {} // GOOD - if ((buffer[i] == 'x') && (bufferSize > i)) {} // BAD [NOT DETECTED] + if ((buffer[i] == 'x') && (bufferSize > i)) {} // $ MISSING: Alert // BAD [NOT DETECTED] if ((i <= bufferSize - 1) && (buffer[i] == 'x')) {} // GOOD - if ((buffer[i] == 'x') && (i <= bufferSize - 1)) {} // BAD [NOT DETECTED] + if ((buffer[i] == 'x') && (i <= bufferSize - 1)) {} // $ MISSING: Alert // BAD [NOT DETECTED] if ((bufferSize >= i + 1) && (buffer[i] == 'x')) {} // GOOD - if ((buffer[i] == 'x') && (bufferSize >= i + 1)) {} // BAD [NOT DETECTED] + if ((buffer[i] == 'x') && (bufferSize >= i + 1)) {} // $ MISSING: Alert // BAD [NOT DETECTED] if ((i < bufferSize) && (true) && (buffer[i] == 'x')) {} // GOOD if ((buffer[i] == 'x') && (true) && (i < bufferSize)) {} // $ Alert // BAD if ((i < bufferSize - 1) && (buffer[i + 1] == 'x')) {} // GOOD - if ((buffer[i + 1] == 'x') && (i < bufferSize - 1)) {} // BAD [NOT DETECTED] + if ((buffer[i + 1] == 'x') && (i < bufferSize - 1)) {} // $ MISSING: Alert // BAD [NOT DETECTED] if ((i < bufferSize) && (buffer[i] == 'x') && (i < bufferSize - 1)) {} // GOOD if ((i < bufferSize) && ((buffer[i] == 'x') && (i < bufferSize - 1))) {} // GOOD - if ((i < bufferSize + 1) && (buffer[i] == 'x') && (i < bufferSize)) {} // BAD [NOT DETECTED] - if ((i < bufferSize + 1) && ((buffer[i] == 'x') && (i < bufferSize))) {} // BAD [NOT DETECTED] + if ((i < bufferSize + 1) && (buffer[i] == 'x') && (i < bufferSize)) {} // $ MISSING: Alert // BAD [NOT DETECTED] + if ((i < bufferSize + 1) && ((buffer[i] == 'x') && (i < bufferSize))) {} // $ MISSING: Alert // BAD [NOT DETECTED] // look for 'ab' for (i = 0; i < bufferSize; i++) { diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/extraction_error.c b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/extraction_error.c index 66eedf743fbb..66e0d05e98b7 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/extraction_error.c +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/extraction_error.c @@ -2,7 +2,7 @@ static void my_function1_called() {} // GOOD static void my_function2_called_after_error() {} // GOOD -static void my_function3_not_called() {} // BAD [NOT DETECTED] +static void my_function3_not_called() {} // $ MISSING: Alert // BAD [NOT DETECTED] int main(void) { my_function1_called(); diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp index b46cc6b54a4b..7dbad5fcc810 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp @@ -182,7 +182,7 @@ void test_strdupa_no_dealloc() { void test_strdupa_dealloc() { char msg[] = "OctoCat"; char *cpy = strdupa(msg); - free(cpy); // BAD [NOT DETECTED] + free(cpy); // $ MISSING: Alert // BAD [NOT DETECTED] } // --- strndupa --- @@ -196,7 +196,7 @@ void test_strndupa_no_dealloc() { void test_strndupa_dealloc() { char msg[] = "OctoCat"; char *cpy = strndupa(msg, 4); - free(cpy); // BAD [NOT DETECTED] + free(cpy); // $ MISSING: Alert // BAD [NOT DETECTED] } // --- diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp index c16127e18a63..75ecfcf3d6d6 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp @@ -23,7 +23,7 @@ void test_double_free_aliasing(void *a, void* b) { free(a); // GOOD a = b; free(a); // GOOD - free(b); // BAD [NOT DETECTED] + free(b); // $ MISSING: Alert // BAD [NOT DETECTED] } void test_dominance1(void *a) { @@ -40,8 +40,8 @@ void test_dominance2(void *a) { void test_post_dominance1(int *a) { if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] - if (condition()) a[2] = 5; // BAD [NOT DETECTED] - if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] // BAD [NOT DETECTED] + if (condition()) a[2] = 5; // $ MISSING: Alert // BAD [NOT DETECTED] + if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] // $ MISSING: Alert // BAD [NOT DETECTED] a[2] = 5; // $ Alert[cpp/use-after-free] // BAD free(a); // $ Alert[cpp/double-free] // BAD } @@ -61,7 +61,7 @@ void test_use_after_free6(int *a, int *b) { free(a); a=b; free(b); - if (condition()) a[0] = 5; // BAD [NOT DETECTED] + if (condition()) a[0] = 5; // $ MISSING: Alert // BAD [NOT DETECTED] } void test_use_after_free7(int *a) { @@ -343,7 +343,7 @@ void test_array(PtrContainer *containers) { delete containers[0].ptr; // GOOD delete containers[1].ptr; // GOOD delete containers[2].ptr; // GOOD - delete containers[2].ptr; // BAD (double free) [NOT DETECTED] + delete containers[2].ptr; // $ MISSING: Alert // BAD (double free) [NOT DETECTED] } struct E { @@ -424,5 +424,5 @@ void testHasGetter() { free(buffer2); HasGetterNoFree hg3; - void *buffer3 = hg3.getBuffer(); // BAD (not freed) [NOT DETECTED] + void *buffer3 = hg3.getBuffer(); // $ MISSING: Alert // BAD (not freed) [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp index ba79df57fee4..25f04f1938bd 100644 --- a/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp +++ b/cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp @@ -299,7 +299,7 @@ int main() int *ptr_i = &i; scanf("%d", &i); - use(*ptr_i); // BAD [NOT DETECTED]: may not have written `i` + use(*ptr_i); // $ MISSING: Alert // BAD [NOT DETECTED]: may not have written `i` } { @@ -307,7 +307,7 @@ int main() int *ptr_i = &i; scanf("%d", ptr_i); - use(i); // BAD [NOT DETECTED]: may not have written `*ptr_i` + use(i); // $ MISSING: Alert // BAD [NOT DETECTED]: may not have written `*ptr_i` } { @@ -380,7 +380,7 @@ void my_scan_int_test() use(i); // GOOD: used before scanf my_scan_int(i); - use(i); // BAD [NOT DETECTED] + use(i); // $ MISSING: Alert // BAD [NOT DETECTED] if (my_scan_int(i)) { diff --git a/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp b/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp index 8872bf79364f..ff4dfcfa1711 100644 --- a/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp +++ b/cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp @@ -18,13 +18,13 @@ void test1(bool cond) { int *p, *q; - y = *p; // BAD (p is uninitialized and could be 0) [NOT DETECTED] + y = *p; // $ MISSING: Alert // BAD (p is uninitialized and could be 0) [NOT DETECTED] p = NULL; y = *p; // $ Alert // BAD (p is 0) p = &x; y = *p; // GOOD (p points to x) p = q; - y = *p; // BAD (p is uninitialized and could be 0) [NOT DETECTED] + y = *p; // $ MISSING: Alert // BAD (p is uninitialized and could be 0) [NOT DETECTED] } { diff --git a/cpp/ql/test/query-tests/Critical/NewFree/test.cpp b/cpp/ql/test/query-tests/Critical/NewFree/test.cpp index d886ee070beb..26aff45efef7 100644 --- a/cpp/ql/test/query-tests/Critical/NewFree/test.cpp +++ b/cpp/ql/test/query-tests/Critical/NewFree/test.cpp @@ -190,7 +190,7 @@ void test6(bool do_array_delete) if (do_array_delete) { - delete [] c_ptr_array[5]; // BAD [NOT DETECTED] + delete [] c_ptr_array[5]; // $ MISSING: Alert // BAD [NOT DETECTED] } else { delete c_ptr_array[5]; // GOOD } diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp index e00b70765ed6..72dba152a230 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp +++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp @@ -43,7 +43,7 @@ void tests1(int case_num) break; case 5: - buffer = (char *)calloc(strlen(str), sizeof(char)); // BAD [NOT DETECTED] + buffer = (char *)calloc(strlen(str), sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED] strcpy(buffer, str); break; @@ -81,7 +81,7 @@ void tests1(int case_num) break; case 12: - buffer = (char *)malloc(strlen(str) + 0); // BAD [NOT DETECTED] + buffer = (char *)malloc(strlen(str) + 0); // $ MISSING: Alert // BAD [NOT DETECTED] strcpy(buffer, str); break; @@ -91,17 +91,17 @@ void tests1(int case_num) break; case 102: - wbuffer = (wchar_t *)malloc(wcslen(wstr) + 1); // BAD (no sizeof) [NOT DETECTED] + wbuffer = (wchar_t *)malloc(wcslen(wstr) + 1); // $ MISSING: Alert // BAD (no sizeof) [NOT DETECTED] wcscpy(wbuffer, wstr); break; case 103: - wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(char)); // BAD [NOT DETECTED] + wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED] wcscpy(wbuffer, wstr); break; case 104: - wbuffer = (wchar_t *)calloc(wcslen(wstr) + 1, sizeof(char)); // BAD (wrong sizeof) [NOT DETECTED] + wbuffer = (wchar_t *)calloc(wcslen(wstr) + 1, sizeof(char)); // $ MISSING: Alert // BAD (wrong sizeof) [NOT DETECTED] wcscpy(wbuffer, wstr); break; @@ -116,7 +116,7 @@ void tests1(int case_num) break; case 107: - wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(wchar_t)); // BAD [NOT DETECTED] + wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(wchar_t)); // $ MISSING: Alert // BAD [NOT DETECTED] wcscpy(wbuffer, wstr); break; diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp index db6928a7015a..c24e9cb66a31 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp +++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp @@ -35,7 +35,7 @@ void tests2(int case_num) break; case 2: - buffer = (char *)malloc(strlen(str1) + strlen(str2)); // BAD [NOT DETECTED] + buffer = (char *)malloc(strlen(str1) + strlen(str2)); // $ MISSING: Alert // BAD [NOT DETECTED] strcpy(buffer, str1); strcat(buffer, str2); break; @@ -53,7 +53,7 @@ void tests2(int case_num) break; case 5: - buffer = (char *)malloc((strlen(str1) + strlen(str2)) * sizeof(char)); // BAD [NOT DETECTED] + buffer = (char *)malloc((strlen(str1) + strlen(str2)) * sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED] strcpy(buffer, str1); strcat(buffer, str2); break; @@ -65,7 +65,7 @@ void tests2(int case_num) break; case 7: - buffer = (char *)malloc((strlen(str1) + strlen(str2) + 1) * sizeof(char)); // BAD [NOT DETECTED] + buffer = (char *)malloc((strlen(str1) + strlen(str2) + 1) * sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED] strcpy(buffer, str1); strcat(buffer, str2); strcat(buffer, str3); @@ -79,24 +79,24 @@ void tests2(int case_num) break; case 101: - wbuffer = (wchar_t *)malloc((wcslen(wstr1) + 1) * sizeof(wchar_t)); // BAD [NOT DETECTED] + wbuffer = (wchar_t *)malloc((wcslen(wstr1) + 1) * sizeof(wchar_t)); // $ MISSING: Alert // BAD [NOT DETECTED] wcscpy(wbuffer, wstr1); wcscat(wbuffer, wstr2); break; - + case 102: - wbuffer = (wchar_t *)malloc((wcslen(wstr1) + wcslen(wstr2)) * sizeof(wchar_t)); // BAD [NOT DETECTED] + wbuffer = (wchar_t *)malloc((wcslen(wstr1) + wcslen(wstr2)) * sizeof(wchar_t)); // $ MISSING: Alert // BAD [NOT DETECTED] wcscpy(wbuffer, wstr1); wcscat(wbuffer, wstr2); break; - + case 103: wbuffer = (wchar_t *)malloc((wcslen(wstr1) + wcslen(wstr2) + 1) * sizeof(wchar_t)); // GOOD wcscpy(wbuffer, wstr1); wcscat(wbuffer, wstr2); break; } - + if (buffer != 0) { free(buffer); diff --git a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp index d6ff097fd2f5..4a6d75562e45 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp +++ b/cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp @@ -59,7 +59,7 @@ void test3b() void test3c() { - char *buffer = new char[10]; // BAD [NOT DETECTED] + char *buffer = new char[10]; // $ MISSING: Alert // BAD [NOT DETECTED] strcpy(buffer, "123456"); strcat(buffer, "123456"); diff --git a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c index 8a191a56365a..f6de6b4e56f5 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c +++ b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.c @@ -8,19 +8,19 @@ struct { void f(void) { char c; - c = xs[-1]; // BAD [NOT DETECTED] + c = xs[-1]; // $ MISSING: Alert // BAD [NOT DETECTED] c = xs[0]; // GOOD c = xs[4]; // GOOD c = xs[5]; // $ Alert // BAD c = xs[6]; // $ Alert // BAD - c = stru.ys[-1]; // BAD [NOT DETECTED] + c = stru.ys[-1]; // $ MISSING: Alert // BAD [NOT DETECTED] c = stru.ys[0]; // GOOD c = stru.ys[4]; // GOOD c = stru.ys[5]; // $ Alert // BAD c = stru.ys[6]; // $ Alert // BAD - c = stru.zs[-1]; // BAD [NOT DETECTED] + c = stru.zs[-1]; // $ MISSING: Alert // BAD [NOT DETECTED] c = stru.zs[0]; // GOOD (zs is variable size) c = stru.zs[4]; // GOOD (zs is variable size) c = stru.zs[5]; // GOOD (zs is variable size) @@ -32,7 +32,7 @@ void test_buffer_sentinal() { struct { char len; char buf[1]; } *b = malloc(10); // len(buf.buffer) effectively 8 b->buf[0] = 0; // GOOD b->buf[7] = 0; // GOOD - b->buf[8] = 0; // BAD [NOT DETECTED] + b->buf[8] = 0; // $ MISSING: Alert // BAD [NOT DETECTED] } union u { @@ -44,21 +44,21 @@ void union_test() { union u u; u.ptr[0] = 0; // GOOD u.ptr[sizeof(u)-1] = 0; // GOOD - u.ptr[sizeof(u)] = 0; // BAD [NOT DETECTED] + u.ptr[sizeof(u)] = 0; // $ MISSING: Alert // BAD [NOT DETECTED] } void test_struct_union() { struct { union u u; } v; v.u.ptr[0] = 0; // GOOD v.u.ptr[sizeof(union u)-1] = 0; // GOOD - v.u.ptr[sizeof(union u)] = 0; // BAD [NOT DETECTED] + v.u.ptr[sizeof(union u)] = 0; // $ MISSING: Alert // BAD [NOT DETECTED] } void union_test2() { union { char ptr[1]; unsigned long value; } u; u.ptr[0] = 0; // GOOD u.ptr[sizeof(u)-1] = 0; // GOOD - u.ptr[sizeof(u)] = 0; // BAD [NOT DETECTED] + u.ptr[sizeof(u)] = 0; // $ MISSING: Alert // BAD [NOT DETECTED] } typedef struct { @@ -69,5 +69,5 @@ typedef struct { void test_alloc() { // Special case of taking sizeof without any addition or multiplications var_buf *b = malloc(sizeof(var_buf)); - b->buf[1] = 0; // BAD [NOT DETECTED] + b->buf[1] = 0; // $ MISSING: Alert // BAD [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp index 6f8ce4c7d7ab..19d0fa76badd 100644 --- a/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp +++ b/cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp @@ -35,16 +35,16 @@ void f2(char *src) amount = 100; memcpy(buffer, src, amount); // GOOD amount = amount + 1; - memcpy(buffer, src, amount); // BAD [NOT DETECTED] + memcpy(buffer, src, amount); // $ MISSING: Alert // BAD [NOT DETECTED] amount = 101; memcpy(buffer, src, amount); // $ Alert // BAD ptr = buffer; - memcpy(ptr, src, 101); // BAD [NOT DETECTED] + memcpy(ptr, src, 101); // $ MISSING: Alert // BAD [NOT DETECTED] ptr = &(buffer[0]); - memcpy(ptr, src, 101); // BAD [NOT DETECTED] + memcpy(ptr, src, 101); // $ MISSING: Alert // BAD [NOT DETECTED] ptr = &(buffer[1]); - memcpy(ptr, src, 100); // BAD [NOT DETECTED] + memcpy(ptr, src, 100); // $ MISSING: Alert // BAD [NOT DETECTED] } void f3() { diff --git a/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c b/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c index 5e09a428bf38..e6095acc3d24 100644 --- a/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c +++ b/cpp/ql/test/query-tests/Critical/SizeCheck/test2.c @@ -50,8 +50,8 @@ void *MyMalloc2(size_t size); void customAllocatorTests() { - double *dptr1 = MyMalloc1(33); // BAD -- Not a multiple of sizeof(double) [NOT DETECTED] - double *dptr2 = MyMalloc2(33); // BAD -- Not a multiple of sizeof(double) [NOT DETECTED] + double *dptr1 = MyMalloc1(33); // $ MISSING: Alert // BAD -- Not a multiple of sizeof(double) [NOT DETECTED] + double *dptr2 = MyMalloc2(33); // $ MISSING: Alert // BAD -- Not a multiple of sizeof(double) [NOT DETECTED] } // --- variable length data structures --- diff --git a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c index 73ebd802501a..a6f915b6c7f5 100644 --- a/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c +++ b/cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c @@ -20,8 +20,8 @@ void test() funPtr1 = funPtr2; // GOOD funPtr2 = funPtr2; // GOOD - intPtr = funPtr2; // BAD (function pointer -> int pointer) [NOT DETECTED] - voidPtr = funPtr2; // BAD (function pointer -> void pointer) [NOT DETECTED] + intPtr = funPtr2; // $ MISSING: Alert // BAD (function pointer -> int pointer) [NOT DETECTED] + voidPtr = funPtr2; // $ MISSING: Alert // BAD (function pointer -> void pointer) [NOT DETECTED] i = funPtr2; // GOOD (permitted) funPtr1 = (void (*)())funPtr1; // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp index ea71b1bb770b..ee111a7b7cd3 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp @@ -13,7 +13,7 @@ bool compareValues() { // instantiations outside. return T1::value < T2::value || // GOOD - T1::value < T1::value || // BAD [NOT DETECTED] + T1::value < T1::value || // $ MISSING: Alert // BAD [NOT DETECTED] C1::value < C1::value ; // $ Alert[cpp/comparison-of-identical-expressions] // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp index c1f671a43d1d..ff973794f0d8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp @@ -39,5 +39,5 @@ bool is_bit_set_v3(int x, int bitnum) { } bool is_bit_set_v4(int x, int bitnum) { - return (x & (1 << bitnum)) >= 1; // BAD [NOT DETECTED] + return (x & (1 << bitnum)) >= 1; // $ MISSING: Alert // BAD [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp index f727b8bb5669..35c38c1700e1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp @@ -57,7 +57,7 @@ void test1(int x, int y, int z) { { MyClass1 a, b, c; - if (a < b < c) {} // BAD (the overloaded `operator<` behaves like `<`) [NOT DETECTED] + if (a < b < c) {} // $ MISSING: Alert // BAD (the overloaded `operator<` behaves like `<`) [NOT DETECTED] } // overloaded non-comparison diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c index 388d6a74d6de..1dd3ebb25876 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c @@ -8,7 +8,7 @@ void test_float_double1(float f, double d) { float f1 = fabsf(f * f); // GOOD float f2 = fabsf(f * d); // GOOD - double f3 = fabs(f * f); // BAD [NOT DETECTED] + double f3 = fabs(f * f); // $ MISSING: Alert // BAD [NOT DETECTED] double f4 = fabs(f * d); // GOOD } @@ -23,6 +23,6 @@ void test_float_double2(float f, double d) { float f1 = fabsf(f * f); // GOOD float f2 = fabsf(f * d); // GOOD - double f3 = fabs(f * f); // BAD [NOT DETECTED] + double f3 = fabs(f * f); // $ MISSING: Alert // BAD [NOT DETECTED] double f4 = fabs(f * d); // GOOD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c index 08e799fe7950..9446d6177ce8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c @@ -102,9 +102,9 @@ void g(unsigned char uchar1, unsigned char uchar2, unsigned char uchar3, int i) ulong4 = (uchar1 + (uchar1 + 1)) * (uchar2 + 1); // GOOD ulong5 = (i + (uchar1 + 1)) * (uchar2 + 1); // $ Alert // BAD - ulong5 = (uchar1 + 1073741824) * uchar2; // BAD [NOT DETECTED] - ulong5 = (uchar1 + (1 << 30)) * uchar2; // BAD [NOT DETECTED] - ulong5 = uchar1 * uchar1 * uchar1 * uchar2 * uchar2 * uchar2; // BAD [NOT DETECTED] + ulong5 = (uchar1 + 1073741824) * uchar2; // $ MISSING: Alert // BAD [NOT DETECTED] + ulong5 = (uchar1 + (1 << 30)) * uchar2; // $ MISSING: Alert // BAD [NOT DETECTED] + ulong5 = uchar1 * uchar1 * uchar1 * uchar2 * uchar2 * uchar2; // $ MISSING: Alert // BAD [NOT DETECTED] ulong5 = (uchar1 + (unsigned short)(-1)) * (uchar2 + (unsigned short)(-1)); // $ Alert // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c index 188aa46d7905..54882e520a54 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c @@ -247,12 +247,12 @@ int overeager_wraparound(unsigned int u32bound, unsigned long long u64bound) { unsigned long long u64idx; for (u32idx = 1; u32idx < u32bound; u32idx++) { - if (u32idx == 0) // BAD [NOT DETECTED] + if (u32idx == 0) // $ MISSING: Alert // BAD [NOT DETECTED] return 0; } for (u64idx = 1; u64idx < u64bound; u64idx++) { - if (u64idx == 0) // BAD [NOT DETECTED] + if (u64idx == 0) // $ MISSING: Alert // BAD [NOT DETECTED] return 0; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp index f4a60ece66a9..ec9bcd08cb0f 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp @@ -25,7 +25,7 @@ void test(float f3[3], float f4[4], float f5[5], float *fp) g(arr4); // GOOD g(arr5); // GOOD - h(f3); // BAD [NOT DETECTED] + h(f3); // $ MISSING: Alert // BAD [NOT DETECTED] h(f4); // GOOD h(f5); // GOOD h(fp); // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp index ce5328772201..120aad86ddf4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp @@ -49,14 +49,14 @@ void test1() { // ... } - if (getFloatRef()) // BAD [NOT DETECTED] + if (getFloatRef()) // $ MISSING: Alert // BAD [NOT DETECTED] { - setPosInt(getFloatRef()); // BAD [NOT DETECTED] + setPosInt(getFloatRef()); // $ MISSING: Alert // BAD [NOT DETECTED] setPosFloat(getFloatRef()); } - if (getConstFloatRef()) // BAD [NOT DETECTED] + if (getConstFloatRef()) // $ MISSING: Alert // BAD [NOT DETECTED] { - setPosInt(getConstFloatRef()); // BAD [NOT DETECTED] + setPosInt(getConstFloatRef()); // $ MISSING: Alert // BAD [NOT DETECTED] setPosFloat(getConstFloatRef()); } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c index 5b31d31b9fba..41003dc8bc65 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c @@ -13,7 +13,7 @@ char *getString(); void test_custom_printf1() { myMultiplyDefinedPrintf("string", getString()); // GOOD - myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED] + myMultiplyDefinedPrintf(getString(), "string"); // $ MISSING: Alert // BAD [NOT DETECTED] myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which declaration is correct so we have to assume this is OK) myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which declaration is correct so we have to assume this is OK) } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c index b0addf37881f..cf639858a883 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c @@ -10,7 +10,7 @@ char *getString(); void test_custom_printf2(char *string) { myMultiplyDefinedPrintf("string", getString()); // GOOD - myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED] + myMultiplyDefinedPrintf(getString(), "string"); // $ MISSING: Alert // BAD [NOT DETECTED] myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which declaration is correct so we have to assume this is OK) myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which declaration is correct so we have to assume this is OK) -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp index d562142df536..58eaaa1d8506 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp @@ -48,7 +48,7 @@ int main(int argc, char **argv) { // $ Source printf(choose_message(argc - 1), argc - 1); // GOOD printf(messages[1]); // GOOD printf(message); // GOOD - printf(make_message(argc - 1)); // BAD [NOT DETECTED] + printf(make_message(argc - 1)); // $ MISSING: Alert // BAD [NOT DETECTED] printf("Hello, World\n"); // GOOD printf(_("Hello, World\n")); // GOOD { diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp index a1ddd23aff29..ec865e1ab828 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp @@ -83,7 +83,7 @@ void test6(const char *sa, const char *sb) int pos = 0; pos = snprintf(buffer, 100, "'%s', ", sa); - pos += snprintf(&(buffer[pos]), 100 - pos, "'%s'.", sb); // BAD [NOT DETECTED] + pos += snprintf(&(buffer[pos]), 100 - pos, "'%s'.", sb); // $ MISSING: Alert // BAD [NOT DETECTED] } size_t strlen(const char *str); diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c index c58fd98c2316..280e75a7d829 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c @@ -18,8 +18,8 @@ void test_custom_printf1() myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK) - myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] + myMultiplyDefinedPrintf2("%i", 0, 1, 2); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] myMultiplyDefinedPrintf3("%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf3("%s", "%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) - myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] + myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c index 9de6d71014aa..f6ed16e02c80 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c @@ -15,8 +15,8 @@ void test_custom_printf2() myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK) - myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] + myMultiplyDefinedPrintf2("%i", 0, 1, 2); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] myMultiplyDefinedPrintf3("%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf3("%s", "%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) - myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] + myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c index a5f3ef6669b0..43682db2b7e1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c @@ -7,8 +7,8 @@ void test_custom_printf2() myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK) - myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] + myMultiplyDefinedPrintf2("%i", 0, 1, 2); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] myMultiplyDefinedPrintf3("%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) myMultiplyDefinedPrintf3("%s", "%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK) - myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] + myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c index f054f382c5fc..ba974ced7f78 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c @@ -30,7 +30,7 @@ void test(int i, const char *str) printf("%1$*2$d", 0, num, width); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE] printf("%1$*2$d", num, width); // $ SPURIOUS: Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE] - printf("%1$*2$d", width); // BAD (too few format arguments) [NOT DETECTED] + printf("%1$*2$d", width); // $ MISSING: Alert // BAD (too few format arguments) [NOT DETECTED] } { int precision; diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp index bced96527852..74877883c586 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp @@ -12,10 +12,10 @@ void test_size_t() { printf("%zi", s); // GOOD printf("%zu", s); // GOOD (we generally permit signedness changes) printf("%zx", s); // GOOD (we generally permit signedness changes) - printf("%d", s); // BAD [NOT DETECTED] + printf("%d", s); // $ MISSING: Alert // BAD [NOT DETECTED] printf("%ld", s); // DUBIOUS [NOT DETECTED] printf("%lld", s); // DUBIOUS [NOT DETECTED] - printf("%u", s); // BAD [NOT DETECTED] + printf("%u", s); // $ MISSING: Alert // BAD [NOT DETECTED] char buffer[1024]; diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c index 17d1bd98feda..a51afbeb62e2 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c @@ -10,7 +10,7 @@ void myMultiplyDefinedPrintf2(const char *format, const char *extraArg, ...); void test_custom_printf1() { myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD - myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED] + myMultiplyDefinedPrintf("%i", "%f", 1.0f); // $ MISSING: Alert // BAD [NOT DETECTED] myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which declaration is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which declaration is correct so we have to assume this is OK) } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c index adf443c1e9dc..570a08e63d22 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c @@ -8,7 +8,7 @@ void myMultiplyDefinedPrintf2(const char *extraArg, const char *format, ...); void test_custom_printf2() { myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD - myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED] + myMultiplyDefinedPrintf("%i", "%f", 1.0f); // $ MISSING: Alert // BAD [NOT DETECTED] myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which declaration is correct so we have to assume this is OK) myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which declaration is correct so we have to assume this is OK) -} \ No newline at end of file +} diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp index f8e8851abec8..94d7448d2397 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp @@ -22,9 +22,9 @@ class myClass myClass(myClass *ptr, myClass &ref) { assert(ptr != NULL); assert(y != NULL); - assert(&y != NULL); // BAD [NOT DETECTED] + assert(&y != NULL); // $ MISSING: Alert // BAD [NOT DETECTED] assert(this->y != NULL); - assert(&this->y != NULL); // BAD [NOT DETECTED] + assert(&this->y != NULL); // $ MISSING: Alert // BAD [NOT DETECTED] assert(ptr->y != NULL); assert(&ptr->y != NULL); // $ Alert // BAD assert((ptr->y) != NULL); diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp index c47f7febe414..f99db5321d8b 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp @@ -15,9 +15,9 @@ void operator<<(streamable& lhs, streamable& rhs) int main() { int x = 3; - foo(x, x); // BAD [NOT DETECTED] + foo(x, x); // $ MISSING: Alert // BAD [NOT DETECTED] streamable y; - foo(y, y); // BAD [NOT DETECTED] + foo(y, y); // $ MISSING: Alert // BAD [NOT DETECTED] return 0; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp index 794be80efdf4..e0b2358aeaa8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp @@ -197,7 +197,7 @@ void IntendedOverflow(unsigned char p) for (s = m + 1; s < m; s--) {} // $ Alert // BAD (never runs) for (i = p - 1; i < p; i--) {} // GOOD - for (s = p - 1; s < p; s--) {} // BAD [NOT DETECTED] + for (s = p - 1; s < p; s--) {} // $ MISSING: Alert // BAD [NOT DETECTED] { int n; @@ -210,10 +210,10 @@ void IntendedOverflow(unsigned char p) for (i = 63; i < n; i--) {} // GOOD n = 64; - for (s = n - 1; s < n; s--) {} // BAD [NOT DETECTED] + for (s = n - 1; s < n; s--) {} // $ MISSING: Alert // BAD [NOT DETECTED] n = 64; for (s = n - 1; s < 64; s--) {} // $ Alert // BAD n = 64; - for (s = 63; s < n; s--) {} // BAD [NOT DETECTED] + for (s = 63; s < n; s--) {} // $ MISSING: Alert // BAD [NOT DETECTED] } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp index b14dbbbb8de6..67f45dbbf8e6 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp @@ -109,7 +109,7 @@ void incBefore() { void nestedAddsUp() { for (int i = 0; i < 16; i++) { for (int j = 0; j < 16; j++) { - alloca(100); // BAD [NOT DETECTED] + alloca(100); // $ MISSING: Alert // BAD [NOT DETECTED] } } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp index 6a1548052330..4a18f34108b4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp @@ -27,8 +27,8 @@ void test_unassigned() strdup(buffer2); // $ Alert[cpp/improper-null-termination] // BAD memcpy(buffer2, buffer1, sizeof(buffer2)); - strdup(buffer1); // BAD [NOT DETECTED] - strdup(buffer2); // BAD [NOT DETECTED] + strdup(buffer1); // $ MISSING: Alert // BAD [NOT DETECTED] + strdup(buffer2); // $ MISSING: Alert // BAD [NOT DETECTED] } { @@ -196,7 +196,7 @@ void test_readlink(int fd, const char *path, size_t sz) char *buffer = (char *)malloc(1024); readlink(path, buffer, 1024); - strdup(buffer); // BAD [NOT DETECTED] + strdup(buffer); // $ MISSING: Alert // BAD [NOT DETECTED] } { @@ -211,7 +211,7 @@ void test_readlink(int fd, const char *path, size_t sz) char *buffer = (char *)malloc(sz); readlink(path, buffer, sz); - strdup(buffer); // BAD [NOT DETECTED] + strdup(buffer); // $ MISSING: Alert // BAD [NOT DETECTED] } { @@ -289,7 +289,7 @@ void test_strcat() char buffer[1024]; doNothing2(buffer); - strcat(buffer, "content"); // BAD [NOT DETECTED] + strcat(buffer, "content"); // $ MISSING: Alert // BAD [NOT DETECTED] } { @@ -303,7 +303,7 @@ void test_strcat() strcat(buffer_ptr, "content"); // GOOD buffer_ptr = buffer2; - strcat(buffer_ptr, "content"); // BAD [NOT DETECTED] + strcat(buffer_ptr, "content"); // $ MISSING: Alert // BAD [NOT DETECTED] } { @@ -361,7 +361,7 @@ void test_strlen(bool cond1, bool cond2) if (cond1) buffer[0] = 0; if (cond2) - strlen(buffer); // BAD [NOT DETECTED] + strlen(buffer); // $ MISSING: Alert // BAD [NOT DETECTED] } { @@ -524,7 +524,7 @@ void test_printf(char *str) char *copied_str = (char *)malloc(len); memcpy(copied_str, str, len); - printf("%s", copied_str); // BAD [NOT DETECTED] + printf("%s", copied_str); // $ MISSING: Alert // BAD [NOT DETECTED] } { @@ -580,7 +580,7 @@ void test_reassignment() { strcpy(buffer_ptr, "content"); // null terminates buffer1 or buffer2 buffer_ptr = buffer2; - strdup(buffer2); // BAD [NOT DETECTED] + strdup(buffer2); // $ MISSING: Alert // BAD [NOT DETECTED] } } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp index 6dae7b3102c7..fb81a49699f1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp @@ -22,7 +22,7 @@ struct Q { void foo(int untrusted_int) { Q q; if (q.begin() + untrusted_int > q.end() || // GOOD (for the purpose of this test) - q.begin() + untrusted_int < q.begin()) // BAD [NOT DETECTED] + q.begin() + untrusted_int < q.begin()) // $ MISSING: Alert // BAD [NOT DETECTED] throw q; } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp index 93ddf132f9e2..5cc20a6b70ba 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp @@ -34,7 +34,7 @@ void test2() wcsncpy(buf1, str, wcslen(str)); // $ Alert // BAD wcsncpy(buf1, str, wcslen(str) + 1); // $ Alert // BAD wcsncpy(buf1, buf2, sizeof(buf2)); // $ Alert // BAD - wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // $ Alert // BAD [NOT DETECTED] + wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // $ Alert // $ MISSING: Alert // BAD [NOT DETECTED] } void test3() diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp index 92be81a5f03e..f305b8c067e8 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp @@ -22,7 +22,7 @@ int main() memset(&ms, 0, sizeof(myStruct)); // GOOD memset(&ms, 0, sizeof(ms)); // GOOD - memset(&ms, 0, 8); // BAD [NOT DETECTED] + memset(&ms, 0, 8); // $ MISSING: Alert // BAD [NOT DETECTED] memset(&ms, 0, sizeof(otherStruct)); // $ Alert // BAD { @@ -87,7 +87,7 @@ int main() memset(&msPtrArr, 0, sizeof(myStruct *) * NUM); // GOOD memset(&msPtrArr, 0, sizeof(myStructPtr) * NUM); // GOOD memset(&msPtrArr, 0, sizeof(myStruct **) * NUM); // $ Alert // BAD - memset(msPtrArr, 0, sizeof(myStruct) * NUM); // BAD [NOT DETECTED] + memset(msPtrArr, 0, sizeof(myStruct) * NUM); // $ MISSING: Alert // BAD [NOT DETECTED] memset(msPtrArr, 0, sizeof(myStruct *) * NUM); // GOOD memset(msPtrArr, 0, sizeof(myStructPtr) * NUM); // GOOD memset(msPtrArr, 0, sizeof(myStruct **) * NUM); // $ Alert // BAD @@ -128,7 +128,7 @@ void myFunc(myStruct paramArray[80], myStruct &refStruct) memset(paramArray, 0, sizeof(myStruct) * 80); // GOOD memset(paramArray, 0, sizeof(paramArray)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] memset(¶mArray, 0, sizeof(myStruct) * 80); // $ Alert // BAD - memset(¶mArray, 0, sizeof(paramArray)); // BAD [NOT DETECTED] + memset(¶mArray, 0, sizeof(paramArray)); // $ MISSING: Alert // BAD [NOT DETECTED] memset(&refStruct, 0, sizeof(myStruct)); // GOOD memset(&refStruct, 0, sizeof(refStruct)); // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c index b76482179ca8..a5d7d9db97fb 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c @@ -15,14 +15,14 @@ void good0(char *s) { char buf[80]; strcpy(buf, "s = "); strncat(buf, s, sizeof(buf)-5); // GOOD - strncat(buf, ".", 1); // BAD [NOT DETECTED] -- there might not be even 1 character of space + strncat(buf, ".", 1); // $ MISSING: Alert // BAD [NOT DETECTED] -- there might not be even 1 character of space } void bad0(char *s) { char buf[80]; strcpy(buf, "s = "); strncat(buf, s, sizeof(buf)); // $ Alert // BAD -- Forgot to allow for "s = " - strncat(buf, ".", 1); // BAD [NOT DETECTED] -- there might not be even 1 character of space + strncat(buf, ".", 1); // $ MISSING: Alert // BAD [NOT DETECTED] -- there might not be even 1 character of space } void good1(char *s) { @@ -36,7 +36,7 @@ void bad1(char *s) { char buf[80]; strcpy(buf, "s = "); strncat(buf, s, sizeof(buf)-strlen("s = ")); // GOOD - strncat(buf, ".", 1); // BAD [NOT DETECTED] -- Need to check if any space is left + strncat(buf, ".", 1); // $ MISSING: Alert // BAD [NOT DETECTED] -- Need to check if any space is left } void strncat_test1(char *s) { @@ -51,7 +51,7 @@ void strncat_test2(char *s) { int len = 80; char* buf = (char *)malloc(len); strncat(buf, s, len - strlen(buf) - 1); // GOOD - strncat(buf, s, len - strlen(buf)); // BAD [NOT DETECTED] + strncat(buf, s, len - strlen(buf)); // $ MISSING: Alert // BAD [NOT DETECTED] } struct buffers diff --git a/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp b/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp index 3036bc4b5e70..d2f88ec331b0 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp @@ -39,7 +39,7 @@ void test_no_single_dominator(int *p, bool b) { } else { x = *p; } - if (p == nullptr) { // BAD [NOT DETECTED] + if (p == nullptr) { // $ MISSING: Alert // BAD [NOT DETECTED] return; } } @@ -52,7 +52,7 @@ int test_postdominator_same_bb(int *p) { } int test_postdominator(int *p) { - int b = (p == nullptr); // BAD [NOT DETECTED] + int b = (p == nullptr); // $ MISSING: Alert // BAD [NOT DETECTED] if (b) b++; // This line breaks up the basic block @@ -62,7 +62,7 @@ int test_postdominator(int *p) { } int test_inverted_logic(int *p) { - if (p == nullptr) { // BAD [NOT DETECTED] + if (p == nullptr) { // $ MISSING: Alert // BAD [NOT DETECTED] // The check above should probably have been `!=` instead of `==`. return *p; } else { @@ -95,7 +95,7 @@ void test_field_local(bool boolvar) { } } else { int *x = sp->p; - if (sp == nullptr) { // BAD [NOT DETECTED] + if (sp == nullptr) { // $ MISSING: Alert // BAD [NOT DETECTED] return; } } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c index 3cdc534d424a..cea100f191e5 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c @@ -32,7 +32,7 @@ void test(int *argv[]) { not_yet_declared2(1); // $ Alert[cpp/implicit-function-declaration] // BAD (GOOD for everything except for cpp/implicit-function-declaration) not_yet_declared2(ca); // $ Alert[cpp/mistyped-function-arguments] // BAD (GOOD for everything except for cpp/mistyped-function-arguments // and cpp/too-few-arguments. Not detected in the case of cpp/too-few-arguments.) - not_yet_declared2(); // BAD [NOT DETECTED] (GOOD for everything except for cpp/too-few-arguments) + not_yet_declared2(); // $ MISSING: Alert // BAD [NOT DETECTED] (GOOD for everything except for cpp/too-few-arguments) declared_empty_defined_with(); // $ Alert[cpp/too-few-arguments] // BAD declared_empty_defined_with(1); // GOOD diff --git a/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp index 8d0c09be66c0..abdb58197864 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp @@ -87,5 +87,5 @@ namespace ns3 { const int v5 = ns1::v6 + 1; // GOOD const int v6 = ns1::v6 + 1; // GOOD [produces INVALID_KEY trap warning] - const int v7 = ns3::v7; // BAD [NOT DETECTED] + const int v7 = ns3::v7; // $ MISSING: Alert // BAD [NOT DETECTED] }; diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.c index 1ca22b5782e6..f46e62849cee 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.c @@ -13,30 +13,30 @@ extern void use_pw(char *pw); // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.14 (WINE): deleted -int func1(void) { +int func1(void) { char pw1[PW_SIZE]; use_pw(pw1); - memset(pw1, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(pw1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] return 0; } // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.14 (WINE): not deleted -int func1a(void) { +int func1a(void) { char pw1a[PW_SIZE]; use_pw(pw1a); - __builtin_memset(pw1a, 0, PW_SIZE); // BAD [NOT DETECTED] + __builtin_memset(pw1a, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] return 0; } // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.14 (WINE): deleted -char *func1b(void) { +char *func1b(void) { char pw1b[PW_SIZE]; use_pw(pw1b); - memset(pw1b, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(pw1b, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] pw1b[0] = pw1b[3] = 'a'; return 0; } @@ -44,7 +44,7 @@ char *func1b(void) { // x86-64 gcc 9.2: not deleted // x86-64 clang 9.0.0: not deleted // x64 msvc v19.14 (WINE): not deleted -int func1c(char pw1c[PW_SIZE]) { +int func1c(char pw1c[PW_SIZE]) { use_pw(pw1c); memset(pw1c, 0, PW_SIZE); // GOOD return 0; @@ -54,7 +54,7 @@ int func1c(char pw1c[PW_SIZE]) { // x86-64 clang 9.0.0: not deleted // x64 msvc v19.14 (WINE): not deleted char pw1d[PW_SIZE]; -int func1d() { +int func1d() { use_pw(pw1d); memset(pw1d, 0, PW_SIZE); // GOOD return 0; @@ -62,47 +62,47 @@ int func1d() { // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.14 (WINE): deleted -char *func2(void) { +char *func2(void) { char pw2[PW_SIZE]; use_pw(pw2); - memset(pw2, 1, PW_SIZE); // BAD [NOT DETECTED] + memset(pw2, 1, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] return pw2; } // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.14 (WINE): partially deleted -int func3(void) { +int func3(void) { char pw3[PW_SIZE]; use_pw(pw3); - memset(pw3, 4, PW_SIZE); // BAD [NOT DETECTED] + memset(pw3, 4, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] return pw3[2]; } // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.14 (WINE): not deleted -int func4(void) { +int func4(void) { char pw1a[PW_SIZE]; use_pw(pw1a); - __builtin_memset(pw1a + 3, 0, PW_SIZE - 3); // BAD [NOT DETECTED] + __builtin_memset(pw1a + 3, 0, PW_SIZE - 3); // $ MISSING: Alert // BAD [NOT DETECTED] return 0; } // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.14 (WINE): not deleted -int func6(void) { +int func6(void) { char pw1a[PW_SIZE]; use_pw(pw1a); - __builtin_memset(&pw1a[3], 0, PW_SIZE - 3); // BAD [NOT DETECTED] + __builtin_memset(&pw1a[3], 0, PW_SIZE - 3); // $ MISSING: Alert // BAD [NOT DETECTED] return pw1a[2]; } // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.14 (WINE): not deleted -int func5(void) { +int func5(void) { char pw1a[PW_SIZE]; use_pw(pw1a); __builtin_memset(pw1a + 3, 0, PW_SIZE - 4); // GOOD @@ -112,17 +112,17 @@ int func5(void) { // x86-64 gcc 9.2: deleted // x86-64 clang 9.0.0: deleted // x64 msvc v19.14 (WINE): not deleted -int func7(void) { +int func7(void) { char pw1a[PW_SIZE]; use_pw(pw1a); - __builtin_memset(&pw1a[3], 0, PW_SIZE - 5); // BAD [NOT DETECTED] + __builtin_memset(&pw1a[3], 0, PW_SIZE - 5); // $ MISSING: Alert // BAD [NOT DETECTED] return 0; } // x86-64 gcc 9.2: not deleted // x86-64 clang 9.0.0: not deleted // x64 msvc v19.14 (WINE): not deleted -int func8(void) { +int func8(void) { char pw1a[PW_SIZE]; use_pw(pw1a); __builtin_memset(pw1a + pw1a[3], 0, PW_SIZE - 4); // GOOD @@ -135,6 +135,6 @@ int func8(void) { char *func9(void) { char pw1[PW_SIZE]; use_pw(pw1); - memset(pw1, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(pw1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] return 0; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp index d7228f50b2ec..4faf1ffe1a2c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp @@ -54,7 +54,7 @@ void func3(unsigned long long sz) { void func4(unsigned long long sz) { char buff[128]; gets(buff); - memset(buff, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(buff, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] strcpy(buff, "Hello"); } @@ -64,7 +64,7 @@ void func4(unsigned long long sz) { void func5(unsigned long long sz) { char buff[128]; gets(buff); - memset(buff, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(buff, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] if (sz > 5) { strcpy(buff, "Hello"); } @@ -85,7 +85,7 @@ void func6(unsigned long long sz) { void func7(unsigned long long sz) { struct mem m; gets(m.b); - memset(&m, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(&m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] m.a = 15; } @@ -95,7 +95,7 @@ void func7(unsigned long long sz) { void func8(unsigned long long sz) { struct mem *m = (struct mem *)malloc(sizeof(struct mem)); gets(m->b); - memset(m, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] } // x86-64 gcc 9.2: deleted @@ -104,7 +104,7 @@ void func8(unsigned long long sz) { void func9(unsigned long long sz) { struct mem *m = (struct mem *)malloc(sizeof(struct mem)); gets(m->b); - memset(m, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] free(m); } @@ -114,7 +114,7 @@ void func9(unsigned long long sz) { void func10(unsigned long long sz) { struct mem *m = (struct mem *)malloc(sizeof(struct mem)); gets(m->b); - memset(m, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] m->a = sz; m->c = m->a + 1; } @@ -125,7 +125,7 @@ void func10(unsigned long long sz) { void func11(unsigned long long sz) { struct mem *m = (struct mem *)malloc(sizeof(struct mem)); gets(m->b); - ::memset(m, 0, PW_SIZE); // BAD [NOT DETECTED] + ::memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] if (sz > 5) { strcpy(m->b, "Hello"); } @@ -211,12 +211,12 @@ void badFunc0_0(){ void nobadFunc1_0() { char* buff1 = (char *) malloc(PW_SIZE); gets(buff1); - memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] } void badFunc1_0(){ char * buff1 = (char *) malloc(PW_SIZE); gets(buff1); - memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] free(buff1); } void badFunc1_1(){ @@ -224,7 +224,7 @@ void badFunc1_1(){ for(int i = 0; i < PW_SIZE; i++) { buff1[i] = 'a' + i; } - memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] free(buff1); } void nobadFunc2_0_0(){ @@ -301,7 +301,7 @@ bool nobadFunc2_1_0(unsigned char ch){ void nobadFunc2_1_2(){ char buff1[PW_SIZE]; gets(buff1); - memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED] + memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED] buff1[2] = 5; } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp index 8b6703dde800..85f2ca9a5728 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp @@ -77,8 +77,8 @@ void testReferencePointer2() { system(buffer); // $ Alert // BAD system(data); // BAD - system(dataref); // BAD [NOT DETECTED] - system(data2); // BAD [NOT DETECTED] + system(dataref); // $ MISSING: Alert // BAD [NOT DETECTED] + system(data2); // $ MISSING: Alert // BAD [NOT DETECTED] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp index a39c2bd47cfb..a5c95e47851c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp @@ -42,7 +42,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) { strncpy(str->string, buf, str->size + 1); // $ Alert[cpp/overrun-write] // BAD strncpy(str->string, buf, size); // GOOD - strncpy(str->string, buf, size + 1); // BAD [NOT DETECTED] + strncpy(str->string, buf, size + 1); // $ MISSING: Alert // BAD [NOT DETECTED] if(anotherSize < str->size) { strncpy(str->string, buf, anotherSize); // GOOD @@ -73,7 +73,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) { } if(anotherSize <= size + 1) { - strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED] + strncpy(str->string, buf, anotherSize); // $ MISSING: Alert // BAD [NOT DETECTED] } if(anotherSize <= str->size + 2) { @@ -81,7 +81,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) { } if(anotherSize <= size + 2) { - strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED] + strncpy(str->string, buf, anotherSize); // $ MISSING: Alert // BAD [NOT DETECTED] } } @@ -138,7 +138,7 @@ void test4(unsigned size, char *buf, unsigned anotherSize) { } if(anotherSize <= size + 2) { - strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED] + strncpy(str->string, buf, anotherSize); // $ MISSING: Alert // BAD [NOT DETECTED] } } @@ -229,7 +229,7 @@ void repeated_alerts(unsigned size, unsigned offset) { while(unknown()) { ++size; } - memset(buffer, 0, size); // BAD [NOT DETECTED] + memset(buffer, 0, size); // $ MISSING: Alert // BAD [NOT DETECTED] } void set_string(string_t* p_str, char* buffer) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp index 8554f8c62fb4..54fb672b881e 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp @@ -5,7 +5,7 @@ void test_buffer_overrun_in_for_loop() { uint8_t data[SIZE] = {0}; for (int x = 0; x < SIZE * 2; x++) { - data[x] = 0x41; // BAD [NOT DETECTED] + data[x] = 0x41; // $ MISSING: Alert // BAD [NOT DETECTED] } } @@ -14,7 +14,7 @@ void test_buffer_overrun_in_while_loop_using_pointer_arithmetic() uint8_t data[SIZE] = {0}; int offset = 0; while (offset < SIZE * 2) { - *(data + offset) = 0x41; // BAD [NOT DETECTED] + *(data + offset) = 0x41; // $ MISSING: Alert // BAD [NOT DETECTED] offset++; } } @@ -24,7 +24,7 @@ void test_buffer_overrun_in_while_loop_using_array_indexing() uint8_t data[SIZE] = {0}; int offset = 0; while (offset < SIZE * 2) { - data[offset] = 0x41; // BAD [NOT DETECTED] + data[offset] = 0x41; // $ MISSING: Alert // BAD [NOT DETECTED] offset++; } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp index 44b2bdae6e8b..4bd5d6935d27 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp @@ -575,7 +575,7 @@ void test20() } num = 101; - if (fread(intBuffer, sizeof(int), num, fileSource) > 0) // BAD [NOT DETECTED] + if (fread(intBuffer, sizeof(int), num, fileSource) > 0) // $ MISSING: Alert // BAD [NOT DETECTED] { // ... } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp index 20beffd578bf..01d4ae353139 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp @@ -51,8 +51,8 @@ void testVarString(int n) { s1->str[1] = '?'; // GOOD s2->str[1] = '?'; // GOOD s3->str[1] = '?'; // GOOD - s4->str[1] = '?'; // BAD [NOT DETECTED] - s5->str[1] = '?'; // BAD [NOT DETECTED] + s4->str[1] = '?'; // $ MISSING: Alert // BAD [NOT DETECTED] + s5->str[1] = '?'; // $ MISSING: Alert // BAD [NOT DETECTED] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp index b9c3a7af36c4..231929e31928 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp @@ -60,5 +60,5 @@ void test3() { dest2 = (char*)malloc(3); if (!dest2) return; - snprintf(dest2, sizeof(src), "%s", src); // BAD [NOT DETECTED] + snprintf(dest2, sizeof(src), "%s", src); // $ MISSING: Alert // BAD [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c index ccfb730b2b96..7779ab082516 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c @@ -22,12 +22,12 @@ void unions_test(MyUnion *mu) strcpy(mu, "1234567890"); // GOOD strcpy(&(mu->ptr), "1234567890"); // GOOD (dubious) strcpy(&(mu->buffer), "1234567890"); // GOOD - strcpy(mu, "12345678901234567890"); // BAD [NOT DETECTED] + strcpy(mu, "12345678901234567890"); // $ MISSING: Alert // BAD [NOT DETECTED] strcpy(&(mu->ptr), "12345678901234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD strcpy(&(mu->buffer), "12345678901234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD mu->ptr = buffer; strcpy(mu->ptr, "1234567890"); // GOOD strcpy(mu->ptr, "12345678901234567890"); // GOOD - strcpy(mu->ptr, "123456789012345678901234567890"); // BAD [NOT DETECTED] + strcpy(mu->ptr, "123456789012345678901234567890"); // $ MISSING: Alert // BAD [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp index 9e590d825122..7efaa43ab3be 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp @@ -39,7 +39,7 @@ namespace std //// Test code ///// static void bad1(char *str) { - // BAD -- Not allocating space for '\0' terminator [NOT DETECTED] + // $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED] char *buffer = (char *)malloc(strlen(str)); std::string str2(buffer); free(buffer); @@ -53,7 +53,7 @@ static void good1(char *str) { } static void bad2(wchar_t *str) { - // BAD -- Not allocating space for '\0' terminator [NOT DETECTED] + // $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED] wchar_t *buffer = (wchar_t *)calloc(wcslen(str), sizeof(wchar_t)); wcscpy(buffer, str); free(buffer); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c index 4c1ce290cf44..5e7902800cd4 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c @@ -68,7 +68,7 @@ void randomTester() { } { - int r = rand() + 100; // BAD [NOT DETECTED] + int r = rand() + 100; // $ MISSING: Alert // BAD [NOT DETECTED] } { @@ -84,20 +84,20 @@ void randomTester() { } { - int r = RAND2() + 100; // BAD [NOT DETECTED] + int r = RAND2() + 100; // $ MISSING: Alert // BAD [NOT DETECTED] } { int r = RAND(); int *ptr_r = &r; - *ptr_r += 100; // BAD [NOT DETECTED] + *ptr_r += 100; // $ MISSING: Alert // BAD [NOT DETECTED] } { int r = 0; int *ptr_r = &r; *ptr_r = RAND(); - r += 100; // BAD [NOT DETECTED] + r += 100; // $ MISSING: Alert // BAD [NOT DETECTED] } { @@ -142,7 +142,7 @@ void moreTests() { { int r = rand(); - r <<= 8; // BAD [NOT DETECTED] + r <<= 8; // $ MISSING: Alert // BAD [NOT DETECTED] } { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp index 20326533dd8d..bc6314a4ac65 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp @@ -157,8 +157,8 @@ int test_underflow() int test_cast() { int x = rand(); - short a = x; // BAD [NOT DETECTED] - short b = -x; // BAD [NOT DETECTED] + short a = x; // $ MISSING: Alert // BAD [NOT DETECTED] + short b = -x; // $ MISSING: Alert // BAD [NOT DETECTED] long long c = x; // GOOD long long d = -x; // GOOD } @@ -174,7 +174,7 @@ void test_float() { int x = rand(); float y = x * 5.0f; // GOOD - int z = y; // BAD [NOT DETECTED] + int z = y; // $ MISSING: Alert // BAD [NOT DETECTED] } { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c index 79650a316f90..f557e62a9d6d 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c @@ -65,7 +65,7 @@ void test_crement() { sc9 += 1; // GOOD sc10 = 1; - sc10 += CHAR_MAX; // BAD [NOT DETECTED] + sc10 += CHAR_MAX; // $ MISSING: Alert // BAD [NOT DETECTED] } void test_negatives() { @@ -75,13 +75,13 @@ void test_negatives() { sc1 += 0; // GOOD sc1 += -1; // GOOD sc2 = CHAR_MIN; - sc2 += -1; // BAD [NOT DETECTED] + sc2 += -1; // $ MISSING: Alert // BAD [NOT DETECTED] sc3 = CHAR_MIN; - sc3 = sc3 + -1; // BAD [NOT DETECTED] + sc3 = sc3 + -1; // $ MISSING: Alert // BAD [NOT DETECTED] sc4 = CHAR_MAX; - sc4 -= -1; // BAD [NOT DETECTED] + sc4 -= -1; // $ MISSING: Alert // BAD [NOT DETECTED] sc5 = -1; - sc5 += CHAR_MIN; // BAD [NOT DETECTED] + sc5 += CHAR_MIN; // $ MISSING: Alert // BAD [NOT DETECTED] } void test_guards1(int cond) { @@ -101,7 +101,7 @@ void test_guards2(int cond) { if (x < 128) return; - return x + 1; // BAD [NOT DETECTED] + return x + 1; // $ MISSING: Alert // BAD [NOT DETECTED] } void test_guards3(int cond) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp index 4251e7cfcf55..448e6a1a8e0f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp @@ -42,7 +42,7 @@ int main(int argc, char **argv) { // $ Source MyStruct *arr1 = (MyStruct *)malloc(sizeof(MyStruct)); // GOOD MyStruct *arr2 = (MyStruct *)malloc(tainted); // $ Alert // BAD MyStruct *arr3 = (MyStruct *)malloc(tainted * sizeof(MyStruct)); // $ Alert // BAD - MyStruct *arr4 = (MyStruct *)malloc(getTainted() * sizeof(MyStruct)); // BAD [NOT DETECTED] + MyStruct *arr4 = (MyStruct *)malloc(getTainted() * sizeof(MyStruct)); // $ MISSING: Alert // BAD [NOT DETECTED] MyStruct *arr5 = (MyStruct *)malloc(sizeof(MyStruct) + tainted); // $ Alert // BAD int size = tainted * 8; @@ -158,7 +158,7 @@ void more_bounded_tests() { if (size < 100) { - malloc(size * sizeof(int)); // BAD [NOT DETECTED] + malloc(size * sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED] } } @@ -213,7 +213,7 @@ void more_bounded_tests() { { int size = atoi(getenv("USER")); - malloc(size * sizeof(int)); // BAD [NOT DETECTED] + malloc(size * sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED] if ((size > 0) && (size < 100)) { @@ -226,7 +226,7 @@ void more_bounded_tests() { if (size > 100) { - malloc(size * sizeof(int)); // BAD [NOT DETECTED] + malloc(size * sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED] } } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp index 6d9fef227ac5..9b6b1daf8746 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp @@ -6,9 +6,9 @@ void test1(int size) { char a = *q; // $ deref=L5->L6 Alert[cpp/invalid-pointer-deref]=r1 // BAD char b = *(q - 1); // GOOD char c = *(q + 1); // $ deref=L5->L8+1 Alert[cpp/invalid-pointer-deref]=r2 // BAD - char d = *(q + size); // BAD [NOT DETECTED] + char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED] char e = *(q - size); // GOOD - char f = *(q + size + 1); // BAD [NOT DETECTED] + char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED] char g = *(q - size - 1); // GOOD } @@ -18,9 +18,9 @@ void test2(int size) { char a = *q; // GOOD char b = *(q - 1); // GOOD char c = *(q + 1); // $ deref=L17->L20 Alert[cpp/invalid-pointer-deref]=r3 // BAD - char d = *(q + size); // BAD [NOT DETECTED] + char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED] char e = *(q - size); // GOOD - char f = *(q + size + 1); // BAD [NOT DETECTED] + char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED] char g = *(q - size - 1); // GOOD } @@ -30,21 +30,21 @@ void test3(int size) { char a = *q; // $ deref=L29->L30 Alert[cpp/invalid-pointer-deref]=r4 // BAD char b = *(q - 1); // GOOD char c = *(q + 1); // $ deref=L29->L32+1 Alert[cpp/invalid-pointer-deref]=r5 // BAD - char d = *(q + size); // BAD [NOT DETECTED] + char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED] char e = *(q - size); // GOOD - char f = *(q + size + 1); // BAD [NOT DETECTED] + char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED] char g = *(q - size - 1); // GOOD } void test4(int size) { char* p = (char*)malloc(size - 1); char* q = p + (size - 1); // $ MISSING: alloc=L40-1 - char a = *q; // $ MISSING: deref=L42 // BAD [NOT DETECTED] + char a = *q; // $ MISSING: deref=L42 // $ MISSING: Alert // BAD [NOT DETECTED] char b = *(q - 1); // GOOD - char c = *(q + 1); // $ MISSING: deref=L44+1 // BAD [NOT DETECTED] - char d = *(q + size); // BAD [NOT DETECTED] + char c = *(q + 1); // $ MISSING: deref=L44+1 // $ MISSING: Alert // BAD [NOT DETECTED] + char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED] char e = *(q - size); // GOOD - char f = *(q + size + 1); // BAD [NOT DETECTED] + char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED] char g = *(q - size - 1); // GOOD } @@ -93,7 +93,7 @@ void test6(int size) { } for (char* p = arr.begin; p <= arr.end; ++p) { - *p = 0; // $ MISSING: deref=L83->L91->L96 deref=L83->L95->L96 // BAD [NOT DETECTED] + *p = 0; // $ MISSING: deref=L83->L91->L96 deref=L83->L95->L96 // $ MISSING: Alert // BAD [NOT DETECTED] } for (char* p = arr.begin; p < arr.end; ++p) { @@ -107,7 +107,7 @@ void test7_callee(array_t arr) { } for (char* p = arr.begin; p <= arr.end; ++p) { - *p = 0; // $ MISSING: deref=L83->L105->L110 deref=L83->L109->L110 // BAD [NOT DETECTED] + *p = 0; // $ MISSING: deref=L83->L105->L110 deref=L83->L109->L110 // $ MISSING: Alert // BAD [NOT DETECTED] } for (char* p = arr.begin; p < arr.end; ++p) { @@ -134,7 +134,7 @@ void test8(int size) { } for (int i = 0; i <= arr.end - arr.begin; i++) { - *(arr.begin + i) = 0; // BAD [NOT DETECTED] + *(arr.begin + i) = 0; // $ MISSING: Alert // BAD [NOT DETECTED] } } @@ -154,7 +154,7 @@ void test9(int size) { } for (char* p = arr->begin; p <= arr->end; ++p) { - *p = 0; // $ MISSING: deref=L144->L156->L157 // BAD [NOT DETECTED] + *p = 0; // $ MISSING: deref=L144->L156->L157 // $ MISSING: Alert // BAD [NOT DETECTED] } for (char* p = arr->begin; p < arr->end; ++p) { @@ -168,7 +168,7 @@ void test10_callee(array_t *arr) { } for (char* p = arr->begin; p <= arr->end; ++p) { - *p = 0; // $ MISSING: deref=L144->L166->L171 deref=L144->L170->L171 // BAD [NOT DETECTED] + *p = 0; // $ MISSING: deref=L144->L166->L171 deref=L144->L170->L171 // $ MISSING: Alert // BAD [NOT DETECTED] } for (char* p = arr->begin; p < arr->end; ++p) { @@ -181,7 +181,7 @@ void test10(int size) { } void deref_plus_one(char* q) { - char a = *(q + 1); // BAD [NOT DETECTED] + char a = *(q + 1); // $ MISSING: Alert // BAD [NOT DETECTED] } void test11(unsigned size) { @@ -198,7 +198,7 @@ void test12(unsigned len, unsigned index) { return; } - p[index] = '\0'; // $ MISSING: deref=L195->L201 // BAD [NOT DETECTED] + p[index] = '\0'; // $ MISSING: deref=L195->L201 // $ MISSING: Alert // BAD [NOT DETECTED] } void test13(unsigned len, unsigned index) { @@ -703,7 +703,7 @@ void test34(unsigned size) { } void deref(char* q) { - char x = *q; // $ MISSING: deref=L714->L705->L706 // BAD [NOT DETECTED] + char x = *q; // $ MISSING: deref=L714->L705->L706 // $ MISSING: Alert // BAD [NOT DETECTED] } void test35(size_t size, char* q) diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp index d93fffc71d64..07927e92b487 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp @@ -113,7 +113,7 @@ void test1_1(SSL *ssl) { int result = SSL_get_verify_result(ssl); - if (result == 1) // BAD (conflates OK and a non-OK codes in `else`) [NOT DETECTED] + if (result == 1) // $ MISSING: Alert // BAD (conflates OK and a non-OK codes in `else`) [NOT DETECTED] { } else { } @@ -139,7 +139,7 @@ void test1_3(SSL *ssl) { int result = SSL_get_verify_result(ssl); - if (result == 0) { // BAD (error code 1 is treated as OK, not as non-OK) [NOT DETECTED] + if (result == 0) { // $ MISSING: Alert // BAD (error code 1 is treated as OK, not as non-OK) [NOT DETECTED] do_good(); } else if (result == 1) { do_good(); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp index 4bc6fbe6773f..2f506a212356 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp @@ -536,14 +536,14 @@ void tests2(person_info *pi) char buffer[1024]; snprintf(buffer, 1024, "salary = %i\n", pi->newSalary); - send(val(), buffer, strlen(buffer), val()); // BAD [NOT DETECTED] + send(val(), buffer, strlen(buffer), val()); // $ MISSING: Alert // BAD [NOT DETECTED] } { char buffer[1024]; int sal = pi->newSalary; snprintf(buffer, 1024, "salary = %i\n", sal); - send(val(), buffer, strlen(buffer), val()); // BAD [NOT DETECTED] + send(val(), buffer, strlen(buffer), val()); // $ MISSING: Alert // BAD [NOT DETECTED] } { char buffer[1024]; diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp index c71170513736..0d65fbd65be3 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp @@ -43,10 +43,10 @@ void test_macros(void *data, size_t amount, const char *str) ENCRYPT_WITH_RC20(data, amount); // GOOD (if there ever is an RC20 algorithm, we have no reason to believe it's weak) ENCRYPT_WITH_DES_REMOVED(data, amount); // GOOD (implementation has been deleted) - DESENCRYPT(data, amount); // BAD [NOT DETECTED] - RC2ENCRYPT(data, amount); // BAD [NOT DETECTED] + DESENCRYPT(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED] + RC2ENCRYPT(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED] AESENCRYPT(data, amount); // GOOD (good algorithm) - DES3ENCRYPT(data, amount); // BAD [NOT DETECTED] + DES3ENCRYPT(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED] DES_DO_ENCRYPTION(data, amount); // BAD RUN_DES_ENCODING(data, amount); // BAD @@ -91,16 +91,16 @@ void test_functions(void *data, size_t amount, const char *str) encrypt3DES(data, amount); // BAD encryptTripleDES(data, amount); // BAD - DESEncrypt(data, amount); // BAD [NOT DETECTED] - RC2Encrypt(data, amount); // BAD [NOT DETECTED] + DESEncrypt(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED] + RC2Encrypt(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED] AESEncrypt(data, amount); // GOOD (good algorithm) - DES3Encrypt(data, amount); // BAD [NOT DETECTED] + DES3Encrypt(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED] - DoDESEncryption(data, amount); // BAD [NOT DETECTED] - encryptDes(data, amount); // BAD [NOT DETECTED] + DoDESEncryption(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED] + encryptDes(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED] do_des_encrypt(data, amount); // BAD - DES_Set_Key(str); // BAD [NOT DETECTED] - DESSetKey(str); // BAD [NOT DETECTED] + DES_Set_Key(str); // $ MISSING: Alert // BAD [NOT DETECTED] + DESSetKey(str); // $ MISSING: Alert // BAD [NOT DETECTED] Des(); // GOOD (probably nothing to do with encryption) Desmond(str); // GOOD (probably nothing to do with encryption) @@ -118,7 +118,7 @@ void my_implementation8(); void test_macros2() { - INIT_ENCRYPT_WITH_DES(); // BAD [NOT DETECTED] + INIT_ENCRYPT_WITH_DES(); // $ MISSING: Alert // BAD [NOT DETECTED] INIT_ENCRYPT_WITH_AES(); // GOOD (good algorithm) // ... diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp index 49bbbf1b25e0..0fb6c88e2bd2 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp @@ -173,13 +173,13 @@ const char *get_algorithm3(); void do_unseen_encrypts(char *data, size_t amount, keytype key) { - set_encryption_algorithm1(ALGO_DES); // BAD [NOT DETECTED] + set_encryption_algorithm1(ALGO_DES); // $ MISSING: Alert // BAD [NOT DETECTED] set_encryption_algorithm1(ALGO_AES); // GOOD - set_encryption_algorithm2(USE_DES); // BAD [NOT DETECTED] + set_encryption_algorithm2(USE_DES); // $ MISSING: Alert // BAD [NOT DETECTED] set_encryption_algorithm2(USE_AES); // GOOD - set_encryption_algorithm3("DES"); // BAD [NOT DETECTED] + set_encryption_algorithm3("DES"); // $ MISSING: Alert // BAD [NOT DETECTED] set_encryption_algorithm3("AES"); // GOOD set_encryption_algorithm3("AES-256"); // GOOD @@ -189,7 +189,7 @@ void do_unseen_encrypts(char *data, size_t amount, keytype key) encryption_with2(data, amount, key, USE_DES); // BAD encryption_with2(data, amount, key, USE_AES); // GOOD - encryption_with3(data, amount, key, "DES"); // BAD [NOT DETECTED] + encryption_with3(data, amount, key, "DES"); // $ MISSING: Alert // BAD [NOT DETECTED] encryption_with3(data, amount, key, "AES"); // GOOD encryption_with3(data, amount, key, "AES-256"); // GOOD @@ -258,7 +258,7 @@ void do_fn_ptr(char *data, size_t amount, keytype key) { implementation_fn_ptr impl; - impl = &my_des_implementation; // BAD [NOT DETECTED] + impl = &my_des_implementation; // $ MISSING: Alert // BAD [NOT DETECTED] impl(data, amount, key); impl = &my_aes_implementation; // GOOD @@ -302,12 +302,12 @@ class templateDesEncryptor void do_template_classes(char *data) { desEncryptor *p = new desEncryptor(); // BAD - container c; // BAD [NOT DETECTED] - templateDesEncryptor t; // BAD [NOT DETECTED] + container c; // $ MISSING: Alert // BAD [NOT DETECTED] + templateDesEncryptor t; // $ MISSING: Alert // BAD [NOT DETECTED] p->doDesEncryption(data); // BAD c.obj->doDesEncryption(data); // BAD - t.doDesEncryption(data); // BAD [NOT DETECTED] + t.doDesEncryption(data); // $ MISSING: Alert // BAD [NOT DETECTED] } // --- assert --- diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp index e8e0161e1e7f..1d8e3e4bdbfc 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp @@ -180,7 +180,7 @@ void test2_9(const char *path, int arg) if (stat(path, &buf)) { - f = creat(path, arg); // BAD [NOT DETECTED] + f = creat(path, arg); // $ MISSING: Alert // BAD [NOT DETECTED] } // ... @@ -193,7 +193,7 @@ void test2_10(int dir, const char *path, int arg) if (fstatat(dir, path, &buf)) { - f = openat(dir, path, arg); // BAD [NOT DETECTED] + f = openat(dir, path, arg); // $ MISSING: Alert // BAD [NOT DETECTED] } // ... @@ -259,7 +259,7 @@ void test3_1(const char *path, int arg) int f; f = open(path, arg); - if (stat(path, &buf)) // BAD [NOT DETECTED] + if (stat(path, &buf)) // $ MISSING: Alert // BAD [NOT DETECTED] { // ... } @@ -314,7 +314,7 @@ void test5_2(const char *path1, const char *path2) if (!rename(path1, path2)) { - f = fopen(path2, "r"); // BAD [NOT DETECTED] + f = fopen(path2, "r"); // $ MISSING: Alert // BAD [NOT DETECTED] } } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp index ae217188c62d..bdff14e60e4d 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp @@ -686,7 +686,7 @@ void test() { for (auto x : returnRef()[0]) {} // GOOD for (auto x : returnRef().at(0)) {} // GOOD - for(auto it = returnValue().begin(); it != returnValue().end(); ++it) {} // BAD [NOT DETECTED] + for(auto it = returnValue().begin(); it != returnValue().end(); ++it) {} // $ MISSING: Alert // BAD [NOT DETECTED] { auto v = returnValue(); @@ -713,7 +713,7 @@ void test() { for(auto it = v.begin(); it != v.end(); ++it) {} // GOOD } - for (auto x : return_self_by_ref(returnValue())) {} // BAD [NOT DETECTED] + for (auto x : return_self_by_ref(returnValue())) {} // $ MISSING: Alert // BAD [NOT DETECTED] for (auto x : return_self_by_value(returnValue())) {} // GOOD } @@ -728,7 +728,7 @@ std::vector& ref_to_first_in_returnValue_1() { } std::vector& ref_to_first_in_returnValue_2() { - return returnValue()[0]; // BAD [NOT DETECTED] + return returnValue()[0]; // $ MISSING: Alert // BAD [NOT DETECTED] } std::vector& ref_to_first_in_returnValue_3() { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp index 7dd80687e9c0..da0371dfe25a 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp @@ -37,7 +37,7 @@ void test1() data = (char *)malloc(100*sizeof(char)); use_if_nonzero(data); // GOOD free(data); // $ Source - use_if_nonzero(data); // BAD [NOT DETECTED] + use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED] use(data); // $ Alert // BAD } @@ -75,7 +75,7 @@ void test4() free(data); // $ Source if (data) { - use_if_nonzero(data); // BAD [NOT DETECTED] + use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED] use(data); // $ Alert // BAD } } @@ -94,8 +94,8 @@ char* returnsFreedData(int i) void test5() { char* data = returnsFreedData(1); - use_if_nonzero(data); // BAD [NOT DETECTED] - use(data); // BAD [NOT DETECTED] + use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED] + use(data); // $ MISSING: Alert // BAD [NOT DETECTED] } void test6() @@ -104,7 +104,7 @@ void test6() data = (char *)malloc(100*sizeof(char)); data2 = data; free(data); // $ Source - use_if_nonzero(data2); // BAD [NOT DETECTED] + use_if_nonzero(data2); // $ MISSING: Alert // BAD [NOT DETECTED] use(data); // $ Alert // BAD } @@ -115,7 +115,7 @@ void test7() data2 = data; free(data); // $ Source data2 = NULL; - use_if_nonzero(data); // BAD [NOT DETECTED] + use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED] use(data); // $ Alert // BAD } @@ -126,7 +126,7 @@ void test8() data = data2; free(data); // $ Source data2 = NULL; - use_if_nonzero(data); // BAD [NOT DETECTED] + use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED] use(data); // $ Alert // BAD } @@ -171,8 +171,8 @@ template T test() T* x; use(x); // GOOD delete x; - use_if_nonzero(x); // BAD [NOT DETECTED] - use(x); // BAD [NOT DETECTED] + use_if_nonzero(x); // $ MISSING: Alert // BAD [NOT DETECTED] + use(x); // $ MISSING: Alert // BAD [NOT DETECTED] } void test12(int count) @@ -214,7 +214,7 @@ template T test15() T* x; use(x); // GOOD delete x; // $ Source - use(x); // $ Alert // BAD [NOT DETECTED] + use(x); // $ Alert // $ MISSING: Alert // BAD [NOT DETECTED] } void test15runner(void) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp index 6990bf23109f..052ca4e74360 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp @@ -27,12 +27,12 @@ void test1() use(b); } - if (maybeInitialize1(&c) == 0) // BAD (initialization check is wrong) [NOT DETECTED] + if (maybeInitialize1(&c) == 0) // $ MISSING: Alert // BAD (initialization check is wrong) [NOT DETECTED] { use(c); } - result1 = maybeInitialize1(&d); // BAD (initialization stored but not checked) [NOT DETECTED] + result1 = maybeInitialize1(&d); // $ MISSING: Alert // BAD (initialization stored but not checked) [NOT DETECTED] use(d); result2 = maybeInitialize1(&e); // GOOD diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp index 4a8e734e2b62..b2edb3e8bdef 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp @@ -27,7 +27,7 @@ void test4(bool b) { if (b) { foo = 1; } - use(foo); // BAD [NOT DETECTED] + use(foo); // $ MISSING: Alert // BAD [NOT DETECTED] } void test5() { @@ -43,7 +43,7 @@ void test5(int count) { for (int i = 0; i < count; i++) { foo = i; } - use(foo); // BAD [NOT DETECTED] + use(foo); // $ MISSING: Alert // BAD [NOT DETECTED] } void test6(bool b) { @@ -523,7 +523,7 @@ int non_exhaustive_switch(State s) { y = 2; break; } - return y; // BAD [NOT DETECTED] (y is not initialized when s = StateC) + return y; // $ MISSING: Alert // BAD [NOT DETECTED] (y is not initialized when s = StateC) } int non_exhaustive_switch_2(State s) { diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp index cd0c9492dde2..fc48183517e8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp @@ -5,6 +5,6 @@ void test_buildless(const char *p_c, const short *p_short, const int *p_int, con *(p_short + sizeof(int)); // $ Alert // BAD *(p_int + sizeof(int)); // $ Alert // BAD *(p_8 + sizeof(int)); // GOOD (`sizeof(uint8_t)` is 1, but there's an error in the type) - *(p_16 + sizeof(int)); // BAD [NOT DETECTED] - *(p_32 + sizeof(int)); // BAD [NOT DETECTED] + *(p_16 + sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED] + *(p_32 + sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp index d08c77d630b5..7f2f14b8904b 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp @@ -96,7 +96,7 @@ void test4_8(const char *fileName) { xmlDoc *p; int flags = XML_PARSE_OPTION_HARMLESS; - p = xmlReadFile(fileName, NULL, flags | XML_PARSE_NOENT); // BAD (parser not correctly configured) [NOT DETECTED] + p = xmlReadFile(fileName, NULL, flags | XML_PARSE_NOENT); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED] if (p != NULL) { xmlFreeDoc(p); @@ -107,7 +107,7 @@ void test4_9(const char *fileName) { xmlDoc *p; int flags = XML_PARSE_NOENT; - p = xmlReadFile(fileName, NULL, flags | XML_PARSE_OPTION_HARMLESS); // BAD (parser not correctly configured) [NOT DETECTED] + p = xmlReadFile(fileName, NULL, flags | XML_PARSE_OPTION_HARMLESS); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED] if (p != NULL) { xmlFreeDoc(p); diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp index 1c945a6a6b34..56a7905653d8 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp @@ -93,11 +93,11 @@ void test5_8(DOMImplementationLS *impl, InputSource &data) { DOMLSParser *p = impl->createLSParser(); DOMConfiguration *cfg = p->getDomConfig(); - p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED] + p->parse(data); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED] cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, true); p->parse(data); // GOOD cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false); - p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED] + p->parse(data); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED] } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp index 2f7eaa12ccad..8df97d9afd37 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp @@ -15,7 +15,7 @@ extern const char* adminCookie; const char *currentUser; -void processRequest() +void processRequest() { const char *userName = getenv("USER_NAME"); // $ Source @@ -35,17 +35,17 @@ void processRequest() adminPrivileges = 0; // OK, since it's a 0 and not a 1 } - // BAD (requires pointer analysis to catch) [NOT DETECTED] + // $ MISSING: Alert // BAD (requires pointer analysis to catch) [NOT DETECTED] const char** userp = ¤tUser; *userp = userName; if (!strcmp(currentUser, "admin")) { - adminPrivileges = 1; + adminPrivileges = 1; } } void bugWithBinop() { const char *userName = getenv("USER_NAME"); - + // The following is tainted, but should not cause // the whole program to be considered tainted. int bytes = strlen(userName) + 1; diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp index 5d03c1fef852..d71c66838c98 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp @@ -138,7 +138,7 @@ void test12() { // This has doesn't have any non-bitfield member, so we don't detect // the problem here since the query currently ignores bitfields. S1* s1 = new S1; - HasBitFields* hbf = reinterpret_cast(s1); // BAD [NOT DETECTED] + HasBitFields* hbf = reinterpret_cast(s1); // $ MISSING: Alert // BAD [NOT DETECTED] S1* s1_2 = new S1; // $ Source // This one has a non-bitfield members. So we detect the problem @@ -168,7 +168,7 @@ void test14(bool b) { a = new Dog; } if(!b) { - Cat* d = static_cast(a); // BAD [NOT DETECTED] + Cat* d = static_cast(a); // $ MISSING: Alert // BAD [NOT DETECTED] } } @@ -206,7 +206,7 @@ union MyUnion void test16() { void* si = new SingleInt; // ... - MyUnion* mu = (MyUnion*)si; // BAD [NOT DETECTED] + MyUnion* mu = (MyUnion*)si; // $ MISSING: Alert // BAD [NOT DETECTED] } struct UnrelatedStructSize { diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp index 7b8ef36945b1..ee6dd48394d9 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp @@ -125,8 +125,8 @@ class MyClass9 c = new MyClass6(); // GOOD d = new MyClass7(); // $ Alert // BAD - e = new MyClass7(); // BAD [NOT DETECTED] - f = new MyClass8(); // BAD [NOT DETECTED] + e = new MyClass7(); // $ MISSING: Alert // BAD [NOT DETECTED] + f = new MyClass8(); // $ MISSING: Alert // BAD [NOT DETECTED] } ~MyClass9() { diff --git a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/QObject.cpp b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/QObject.cpp index d6d481521e95..eb3d1693a9f7 100644 --- a/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/QObject.cpp +++ b/cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/QObject.cpp @@ -13,7 +13,7 @@ class MyQtUser { MyQtUser(QObject *parent) { // This object sets its parent pointer to null and thus must be deleted // manually. - noParent = new DerivedFromQObject(nullptr); // BAD [NOT DETECTED] + noParent = new DerivedFromQObject(nullptr); // $ MISSING: Alert // BAD [NOT DETECTED] // This object does not need to be deleted because it will be deleted by // its parent object when the time is right. diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c index 0a7a9d28c1bb..87a2cd8420dd 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c @@ -10,10 +10,10 @@ void f(unsigned char uc, signed char sc, int i) { uc << 7; uc << 8; // $ Alert // BAD - uc >>= -1; // BAD [NOT DETECTED] - uc >>= 0; // BAD [NOT DETECTED] + uc >>= -1; // $ MISSING: Alert // BAD [NOT DETECTED] + uc >>= 0; // $ MISSING: Alert // BAD [NOT DETECTED] uc >>= 7; - uc >>= 8; // BAD [NOT DETECTED] + uc >>= 8; // $ MISSING: Alert // BAD [NOT DETECTED] sc >> -1; // $ Alert // BAD sc >> 0; diff --git a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c index 8fa1ef8173bd..45004352f2cd 100644 --- a/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c +++ b/cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c @@ -23,5 +23,5 @@ void f(int i, unsigned int ui, signed int si, TUI tui, volatile unsigned int vui vui = -vui; // $ Alert // BAD u = -u; // $ Alert // BAD us = -us; // $ Alert // BAD - ui = -(5U); // BAD [NOT DETECTED] + ui = -(5U); // $ MISSING: Alert // BAD [NOT DETECTED] } From fa167285222ce07c672b2dc346281ab3700801d2 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 7 Jul 2026 12:06:43 +0100 Subject: [PATCH 25/44] Fix comments in one test --- .../CWE/CWE-193/InvalidPointerDeref.expected | 66 +++++++++---------- .../query-tests/Security/CWE/CWE-193/test.cpp | 22 +++---- 2 files changed, 44 insertions(+), 44 deletions(-) diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.expected index 0cfd3b0413ee..533d69241181 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.expected @@ -1,3 +1,36 @@ +#select +| test.cpp:6:14:6:15 | * ... | test.cpp:4:15:4:33 | call to malloc | test.cpp:6:14:6:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:33 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size | +| test.cpp:8:14:8:21 | * ... | test.cpp:4:15:4:33 | call to malloc | test.cpp:8:14:8:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:4:15:4:33 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size | +| test.cpp:20:14:20:21 | * ... | test.cpp:16:15:16:33 | call to malloc | test.cpp:20:14:20:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:16:15:16:33 | call to malloc | call to malloc | test.cpp:17:19:17:22 | size | size | +| test.cpp:30:14:30:15 | * ... | test.cpp:28:15:28:37 | call to malloc | test.cpp:30:14:30:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:28:15:28:37 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... | +| test.cpp:32:14:32:21 | * ... | test.cpp:28:15:28:37 | call to malloc | test.cpp:32:14:32:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:28:15:28:37 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... | +| test.cpp:67:9:67:14 | ... = ... | test.cpp:52:19:52:37 | call to malloc | test.cpp:67:9:67:14 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:52:19:52:37 | call to malloc | call to malloc | test.cpp:53:20:53:23 | size | size | +| test.cpp:213:5:213:13 | ... = ... | test.cpp:205:15:205:33 | call to malloc | test.cpp:213:5:213:13 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:205:15:205:33 | call to malloc | call to malloc | test.cpp:206:21:206:23 | len | len | +| test.cpp:264:13:264:14 | * ... | test.cpp:260:13:260:24 | new[] | test.cpp:264:13:264:14 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:260:13:260:24 | new[] | new[] | test.cpp:261:19:261:21 | len | len | +| test.cpp:274:5:274:10 | ... = ... | test.cpp:270:13:270:24 | new[] | test.cpp:274:5:274:10 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:270:13:270:24 | new[] | new[] | test.cpp:271:19:271:21 | len | len | +| test.cpp:358:14:358:26 | * ... | test.cpp:355:14:355:27 | new[] | test.cpp:358:14:358:26 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:355:14:355:27 | new[] | new[] | test.cpp:356:20:356:23 | size | size | +| test.cpp:359:14:359:32 | * ... | test.cpp:355:14:355:27 | new[] | test.cpp:359:14:359:32 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 2. | test.cpp:355:14:355:27 | new[] | new[] | test.cpp:356:20:356:23 | size | size | +| test.cpp:384:13:384:16 | * ... | test.cpp:377:14:377:27 | new[] | test.cpp:384:13:384:16 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:377:14:377:27 | new[] | new[] | test.cpp:378:20:378:23 | size | size | +| test.cpp:415:7:415:15 | ... = ... | test.cpp:410:14:410:27 | new[] | test.cpp:415:7:415:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:410:14:410:27 | new[] | new[] | test.cpp:411:19:411:22 | size | size | +| test.cpp:426:7:426:15 | ... = ... | test.cpp:421:14:421:27 | new[] | test.cpp:426:7:426:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:421:14:421:27 | new[] | new[] | test.cpp:422:19:422:22 | size | size | +| test.cpp:438:7:438:15 | ... = ... | test.cpp:432:14:432:27 | new[] | test.cpp:438:7:438:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:432:14:432:27 | new[] | new[] | test.cpp:433:19:433:22 | size | size | +| test.cpp:450:7:450:15 | ... = ... | test.cpp:444:14:444:27 | new[] | test.cpp:450:7:450:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:444:14:444:27 | new[] | new[] | test.cpp:445:19:445:22 | size | size | +| test.cpp:486:7:486:15 | ... = ... | test.cpp:480:14:480:27 | new[] | test.cpp:486:7:486:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@ + 498. | test.cpp:480:14:480:27 | new[] | new[] | test.cpp:481:19:481:22 | size | size | +| test.cpp:548:5:548:19 | ... = ... | test.cpp:543:14:543:27 | new[] | test.cpp:548:5:548:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:543:14:543:27 | new[] | new[] | test.cpp:548:8:548:14 | src_pos | src_pos | +| test.cpp:559:5:559:19 | ... = ... | test.cpp:554:14:554:27 | new[] | test.cpp:559:5:559:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:554:14:554:27 | new[] | new[] | test.cpp:559:8:559:14 | src_pos | src_pos | +| test.cpp:647:5:647:19 | ... = ... | test.cpp:642:14:642:31 | new[] | test.cpp:647:5:647:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:642:14:642:31 | new[] | new[] | test.cpp:647:8:647:14 | src_pos | src_pos | +| test.cpp:733:5:733:12 | ... = ... | test.cpp:730:12:730:28 | new[] | test.cpp:733:5:733:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:730:12:730:28 | new[] | new[] | test.cpp:732:21:732:25 | ... + ... | ... + ... | +| test.cpp:767:16:767:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:767:16:767:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:767:22:767:28 | ... + ... | ... + ... | +| test.cpp:767:16:767:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:767:16:767:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:772:22:772:28 | ... + ... | ... + ... | +| test.cpp:772:16:772:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:767:22:767:28 | ... + ... | ... + ... | +| test.cpp:772:16:772:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:772:22:772:28 | ... + ... | ... + ... | +| test.cpp:786:18:786:27 | access to array | test.cpp:781:14:781:27 | new[] | test.cpp:786:18:786:27 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:781:14:781:27 | new[] | new[] | test.cpp:786:20:786:26 | ... + ... | ... + ... | +| test.cpp:807:7:807:12 | ... = ... | test.cpp:793:14:793:32 | call to malloc | test.cpp:807:7:807:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:32 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size | +| test.cpp:821:7:821:12 | ... = ... | test.cpp:793:14:793:32 | call to malloc | test.cpp:821:7:821:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:32 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size | +| test.cpp:842:3:842:20 | ... = ... | test.cpp:841:18:841:35 | call to malloc | test.cpp:842:3:842:20 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:841:18:841:35 | call to malloc | call to malloc | test.cpp:842:11:842:15 | index | index | +| test.cpp:849:5:849:22 | ... = ... | test.cpp:848:20:848:37 | call to malloc | test.cpp:849:5:849:22 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:848:20:848:37 | call to malloc | call to malloc | test.cpp:849:13:849:17 | index | index | +| test.cpp:860:5:860:11 | ... = ... | test.cpp:856:12:856:35 | call to malloc | test.cpp:860:5:860:11 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:856:12:856:35 | call to malloc | call to malloc | test.cpp:857:21:857:28 | ... + ... | ... + ... | +| test.cpp:870:14:870:15 | * ... | test.cpp:868:15:868:35 | call to g_malloc | test.cpp:870:14:870:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:868:15:868:35 | call to g_malloc | call to g_malloc | test.cpp:869:19:869:22 | size | size | edges | test.cpp:4:15:4:33 | call to malloc | test.cpp:4:15:4:33 | call to malloc | provenance | | | test.cpp:4:15:4:33 | call to malloc | test.cpp:5:15:5:22 | ... + ... | provenance | Config | @@ -289,36 +322,3 @@ nodes | test.cpp:869:15:869:22 | ... + ... | semmle.label | ... + ... | | test.cpp:870:14:870:15 | * ... | semmle.label | * ... | subpaths -#select -| test.cpp:6:14:6:15 | * ... | test.cpp:4:15:4:33 | call to malloc | test.cpp:6:14:6:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:33 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size | -| test.cpp:8:14:8:21 | * ... | test.cpp:4:15:4:33 | call to malloc | test.cpp:8:14:8:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:4:15:4:33 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size | -| test.cpp:20:14:20:21 | * ... | test.cpp:16:15:16:33 | call to malloc | test.cpp:20:14:20:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:16:15:16:33 | call to malloc | call to malloc | test.cpp:17:19:17:22 | size | size | -| test.cpp:30:14:30:15 | * ... | test.cpp:28:15:28:37 | call to malloc | test.cpp:30:14:30:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:28:15:28:37 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... | -| test.cpp:32:14:32:21 | * ... | test.cpp:28:15:28:37 | call to malloc | test.cpp:32:14:32:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:28:15:28:37 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... | -| test.cpp:67:9:67:14 | ... = ... | test.cpp:52:19:52:37 | call to malloc | test.cpp:67:9:67:14 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:52:19:52:37 | call to malloc | call to malloc | test.cpp:53:20:53:23 | size | size | -| test.cpp:213:5:213:13 | ... = ... | test.cpp:205:15:205:33 | call to malloc | test.cpp:213:5:213:13 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:205:15:205:33 | call to malloc | call to malloc | test.cpp:206:21:206:23 | len | len | -| test.cpp:264:13:264:14 | * ... | test.cpp:260:13:260:24 | new[] | test.cpp:264:13:264:14 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:260:13:260:24 | new[] | new[] | test.cpp:261:19:261:21 | len | len | -| test.cpp:274:5:274:10 | ... = ... | test.cpp:270:13:270:24 | new[] | test.cpp:274:5:274:10 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:270:13:270:24 | new[] | new[] | test.cpp:271:19:271:21 | len | len | -| test.cpp:358:14:358:26 | * ... | test.cpp:355:14:355:27 | new[] | test.cpp:358:14:358:26 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:355:14:355:27 | new[] | new[] | test.cpp:356:20:356:23 | size | size | -| test.cpp:359:14:359:32 | * ... | test.cpp:355:14:355:27 | new[] | test.cpp:359:14:359:32 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 2. | test.cpp:355:14:355:27 | new[] | new[] | test.cpp:356:20:356:23 | size | size | -| test.cpp:384:13:384:16 | * ... | test.cpp:377:14:377:27 | new[] | test.cpp:384:13:384:16 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:377:14:377:27 | new[] | new[] | test.cpp:378:20:378:23 | size | size | -| test.cpp:415:7:415:15 | ... = ... | test.cpp:410:14:410:27 | new[] | test.cpp:415:7:415:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:410:14:410:27 | new[] | new[] | test.cpp:411:19:411:22 | size | size | -| test.cpp:426:7:426:15 | ... = ... | test.cpp:421:14:421:27 | new[] | test.cpp:426:7:426:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:421:14:421:27 | new[] | new[] | test.cpp:422:19:422:22 | size | size | -| test.cpp:438:7:438:15 | ... = ... | test.cpp:432:14:432:27 | new[] | test.cpp:438:7:438:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:432:14:432:27 | new[] | new[] | test.cpp:433:19:433:22 | size | size | -| test.cpp:450:7:450:15 | ... = ... | test.cpp:444:14:444:27 | new[] | test.cpp:450:7:450:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:444:14:444:27 | new[] | new[] | test.cpp:445:19:445:22 | size | size | -| test.cpp:486:7:486:15 | ... = ... | test.cpp:480:14:480:27 | new[] | test.cpp:486:7:486:15 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@ + 498. | test.cpp:480:14:480:27 | new[] | new[] | test.cpp:481:19:481:22 | size | size | -| test.cpp:548:5:548:19 | ... = ... | test.cpp:543:14:543:27 | new[] | test.cpp:548:5:548:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:543:14:543:27 | new[] | new[] | test.cpp:548:8:548:14 | src_pos | src_pos | -| test.cpp:559:5:559:19 | ... = ... | test.cpp:554:14:554:27 | new[] | test.cpp:559:5:559:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:554:14:554:27 | new[] | new[] | test.cpp:559:8:559:14 | src_pos | src_pos | -| test.cpp:647:5:647:19 | ... = ... | test.cpp:642:14:642:31 | new[] | test.cpp:647:5:647:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:642:14:642:31 | new[] | new[] | test.cpp:647:8:647:14 | src_pos | src_pos | -| test.cpp:733:5:733:12 | ... = ... | test.cpp:730:12:730:28 | new[] | test.cpp:733:5:733:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:730:12:730:28 | new[] | new[] | test.cpp:732:21:732:25 | ... + ... | ... + ... | -| test.cpp:767:16:767:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:767:16:767:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:767:22:767:28 | ... + ... | ... + ... | -| test.cpp:767:16:767:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:767:16:767:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:772:22:772:28 | ... + ... | ... + ... | -| test.cpp:772:16:772:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:767:22:767:28 | ... + ... | ... + ... | -| test.cpp:772:16:772:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:772:22:772:28 | ... + ... | ... + ... | -| test.cpp:786:18:786:27 | access to array | test.cpp:781:14:781:27 | new[] | test.cpp:786:18:786:27 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:781:14:781:27 | new[] | new[] | test.cpp:786:20:786:26 | ... + ... | ... + ... | -| test.cpp:807:7:807:12 | ... = ... | test.cpp:793:14:793:32 | call to malloc | test.cpp:807:7:807:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:32 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size | -| test.cpp:821:7:821:12 | ... = ... | test.cpp:793:14:793:32 | call to malloc | test.cpp:821:7:821:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:32 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size | -| test.cpp:842:3:842:20 | ... = ... | test.cpp:841:18:841:35 | call to malloc | test.cpp:842:3:842:20 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:841:18:841:35 | call to malloc | call to malloc | test.cpp:842:11:842:15 | index | index | -| test.cpp:849:5:849:22 | ... = ... | test.cpp:848:20:848:37 | call to malloc | test.cpp:849:5:849:22 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:848:20:848:37 | call to malloc | call to malloc | test.cpp:849:13:849:17 | index | index | -| test.cpp:860:5:860:11 | ... = ... | test.cpp:856:12:856:35 | call to malloc | test.cpp:860:5:860:11 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:856:12:856:35 | call to malloc | call to malloc | test.cpp:857:21:857:28 | ... + ... | ... + ... | -| test.cpp:870:14:870:15 | * ... | test.cpp:868:15:868:35 | call to g_malloc | test.cpp:870:14:870:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:868:15:868:35 | call to g_malloc | call to g_malloc | test.cpp:869:19:869:22 | size | size | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp index 9b6b1daf8746..586c3abd6c18 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp @@ -1,11 +1,11 @@ using size_t = decltype(sizeof 0); void* malloc(size_t size); void test1(int size) { - char* p = (char*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r1 Source[cpp/invalid-pointer-deref]=r2 + char* p = (char*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r1 char* q = p + size; // $ alloc=L4 char a = *q; // $ deref=L5->L6 Alert[cpp/invalid-pointer-deref]=r1 // BAD char b = *(q - 1); // GOOD - char c = *(q + 1); // $ deref=L5->L8+1 Alert[cpp/invalid-pointer-deref]=r2 // BAD + char c = *(q + 1); // $ deref=L5->L8+1 Alert[cpp/invalid-pointer-deref]=r1 // BAD char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED] char e = *(q - size); // GOOD char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED] @@ -25,11 +25,11 @@ void test2(int size) { } void test3(int size) { - char* p = (char*)malloc(size + 1); // $ Source[cpp/invalid-pointer-deref]=r4 Source[cpp/invalid-pointer-deref]=r5 + char* p = (char*)malloc(size + 1); // $ Source[cpp/invalid-pointer-deref]=r4 char* q = p + (size + 1); // $ alloc=L28+1 char a = *q; // $ deref=L29->L30 Alert[cpp/invalid-pointer-deref]=r4 // BAD char b = *(q - 1); // GOOD - char c = *(q + 1); // $ deref=L29->L32+1 Alert[cpp/invalid-pointer-deref]=r5 // BAD + char c = *(q + 1); // $ deref=L29->L32+1 Alert[cpp/invalid-pointer-deref]=r4 // BAD char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED] char e = *(q - size); // GOOD char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED] @@ -352,11 +352,11 @@ void test24(unsigned size) { } void test25(unsigned size) { - char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r10 Source[cpp/invalid-pointer-deref]=r11 + char *xs = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r10 char *end = xs + size; // $ alloc=L355 char *end_plus_one = end + 1; int val1 = *end_plus_one; // $ deref=L356->L358+1 Alert[cpp/invalid-pointer-deref]=r10 // BAD - int val2 = *(end_plus_one + 1); // $ deref=L356->L359+2 Alert[cpp/invalid-pointer-deref]=r11 // BAD + int val2 = *(end_plus_one + 1); // $ deref=L356->L359+2 Alert[cpp/invalid-pointer-deref]=r10 // BAD } void test26(unsigned size) { @@ -751,7 +751,7 @@ void error(const char * msg) { } void test38(unsigned size) { - char * alloc = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r22 Source[cpp/invalid-pointer-deref]=r23 Source[cpp/invalid-pointer-deref]=r24 Source[cpp/invalid-pointer-deref]=r25 + char * alloc = new char[size]; // $ Source[cpp/invalid-pointer-deref]=r22 unsigned pos = 0; while (pos < size) { @@ -764,12 +764,12 @@ void test38(unsigned size) { case '0': if (n != 1) error(""); - char x = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L767 Alert[cpp/invalid-pointer-deref]=r22 Alert[cpp/invalid-pointer-deref]=r23 // GOOD [FALSE POSITIVE] + char x = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L767 Alert[cpp/invalid-pointer-deref]=r22 // GOOD [FALSE POSITIVE] break; case '1': if (n != 2) error(""); - char a = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L772 Alert[cpp/invalid-pointer-deref]=r24 Alert[cpp/invalid-pointer-deref]=r25 // GOOD [FALSE POSITIVE] + char a = alloc[pos + 1]; // $ SPURIOUS: alloc=L754 deref=L772 Alert[cpp/invalid-pointer-deref]=r22 // GOOD [FALSE POSITIVE] char b = alloc[pos + 2]; break; } @@ -790,7 +790,7 @@ void test38_simple(unsigned size, unsigned pos, unsigned numParams) { } void mk_array_no_field_flow(int size, char** begin, char** end) { - *begin = (char*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r27 Source[cpp/invalid-pointer-deref]=r28 + *begin = (char*)malloc(size); // $ Source[cpp/invalid-pointer-deref]=r27 *end = *begin + size; // $ alloc=L793 } @@ -818,7 +818,7 @@ void test7_callee_no_field_flow(char* begin, char* end) { } for (char* p = begin; p <= end; ++p) { - *p = 0; // $ deref=L794->L815->L821 deref=L794->L816->L821 deref=L794->L820->L821 Alert[cpp/invalid-pointer-deref]=r28 // BAD + *p = 0; // $ deref=L794->L815->L821 deref=L794->L816->L821 deref=L794->L820->L821 Alert[cpp/invalid-pointer-deref]=r27 // BAD } for (char* p = begin; p < end; ++p) { From a812e4aa9948d464365314a33eda491e52a4d0bf Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 7 Jul 2026 12:44:19 +0100 Subject: [PATCH 26/44] Refactor creating barriers with annotations --- java/ql/lib/semmle/code/java/Concepts.qll | 6 ++++++ .../code/java/dataflow/internal/DataFlowUtil.qll | 12 +++++++++++- .../semmle/code/java/security/LogInjection.qll | 8 -------- .../semmle/code/java/security/PathSanitizer.qll | 15 ++------------- .../lib/semmle/code/java/security/Sanitizers.qll | 14 ++++++-------- 5 files changed, 25 insertions(+), 30 deletions(-) diff --git a/java/ql/lib/semmle/code/java/Concepts.qll b/java/ql/lib/semmle/code/java/Concepts.qll index 7ed61223ea83..025ba89d3826 100644 --- a/java/ql/lib/semmle/code/java/Concepts.qll +++ b/java/ql/lib/semmle/code/java/Concepts.qll @@ -25,6 +25,12 @@ private module Frameworks { * * These are either method calls, which return `true` when there is a match, or * annotations, which are considered to match if they are present. + * + * To use a `RegexMatch` as a barrier or sanitizer, instantiate + * `DataFlow::BarrierGuard`. Method-call matches act as ordinary control-flow + * barrier guards, while annotation matches are treated as direct barriers, + * since an annotation does not dominate the expression it constrains; + * `DataFlow::BarrierGuard` handles both, so callers need not distinguish the two. */ class RegexMatch extends Expr instanceof RegexMatch::Range { /** Gets the expression for the regex being executed by this node. */ diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll index d18190ffa1b6..e1df870da7eb 100644 --- a/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll +++ b/java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll @@ -418,7 +418,17 @@ module BarrierGuard { } /** Gets a node that is safely guarded by the given guard check. */ - Node getABarrierNode() { result = BarrierGuardValue::getABarrierNode() } + Node getABarrierNode() { + result = BarrierGuardValue::getABarrierNode() + or + // An annotation doesn't dominate the expression it constrains, so the + // barrier-guard machinery above never yields a node for it; treat it as a + // direct barrier instead. Annotations are always present, so we only + // consider the `true` branch. + exists(Guard g, Expr e | + g instanceof Annotation and guardChecks(g, e, true) and result.asExpr() = e + ) + } } bindingset[this] diff --git a/java/ql/lib/semmle/code/java/security/LogInjection.qll b/java/ql/lib/semmle/code/java/security/LogInjection.qll index b585c249d1eb..0a670c41ae47 100644 --- a/java/ql/lib/semmle/code/java/security/LogInjection.qll +++ b/java/ql/lib/semmle/code/java/security/LogInjection.qll @@ -90,13 +90,6 @@ private predicate logInjectionSanitizer(Expr e) { target.getStringValue() = ["\n", "\r", "\\n", "\\r", "\\R"] ) ) - or - exists(RegexMatch rm, CompileTimeConstantExpr target | - rm instanceof Annotation and - e = rm.getASanitizedExpr() and - target = rm.getRegex() and - regexPreventsLogInjection(target.getStringValue(), true) - ) } /** @@ -113,7 +106,6 @@ private predicate logInjectionGuard(Guard g, Expr e, boolean branch) { or exists(RegexMatch rm, CompileTimeConstantExpr target | rm = g and - not rm instanceof Annotation and target = rm.getRegex() and e = rm.getASanitizedExpr() | diff --git a/java/ql/lib/semmle/code/java/security/PathSanitizer.qll b/java/ql/lib/semmle/code/java/security/PathSanitizer.qll index 1b833b7d9160..42304bb72dc9 100644 --- a/java/ql/lib/semmle/code/java/security/PathSanitizer.qll +++ b/java/ql/lib/semmle/code/java/security/PathSanitizer.qll @@ -10,6 +10,7 @@ private import semmle.code.java.dataflow.SSA private import semmle.code.java.frameworks.kotlin.IO private import semmle.code.java.frameworks.kotlin.Text private import semmle.code.java.dataflow.Nullness +private import semmle.code.java.security.Sanitizers /** A sanitizer that protects against path injection vulnerabilities. */ abstract class PathInjectionSanitizer extends DataFlow::Node { } @@ -470,12 +471,7 @@ private class DirectoryCharactersGuard extends PathGuard { Expr checkedExpr; boolean branch; - DirectoryCharactersGuard() { - // Annotations are handled directly as barriers in `DirectoryCharactersSanitizer`, - // since they don't dominate the sanitized expression and so can't act as barrier guards. - not this instanceof Annotation and - isMatchesCall(this, checkedExpr, branch) - } + DirectoryCharactersGuard() { isMatchesCall(this, checkedExpr, branch) } override Expr getCheckedExpr() { result = checkedExpr } @@ -501,12 +497,5 @@ private class DirectoryCharactersSanitizer extends PathInjectionSanitizer { this.asExpr() instanceof ReplaceDirectoryCharactersSanitizer or this = DataFlow::BarrierGuard::getABarrierNode() - or - // Annotations don't fit into the model of barrier guards because the - // annotation doesn't dominate the sanitized expression, so we instead - // treat them as barriers directly. - exists(RegexMatch rm | rm instanceof Annotation and isMatchesCall(rm, _, true) | - this.asExpr() = rm.getString() - ) } } diff --git a/java/ql/lib/semmle/code/java/security/Sanitizers.qll b/java/ql/lib/semmle/code/java/security/Sanitizers.qll index 0c5f9b98070a..072f2234efe7 100644 --- a/java/ql/lib/semmle/code/java/security/Sanitizers.qll +++ b/java/ql/lib/semmle/code/java/security/Sanitizers.qll @@ -37,11 +37,14 @@ class SimpleTypeSanitizer extends DataFlow::Node { * * This is overapproximate: we do not attempt to reason about the correctness of the regexp. * - * Use this if you want to define a derived `DataFlow::BarrierGuard` without - * make the type recursive. Otherwise use `RegexpCheckBarrier`. + * This holds for both method-call and annotation regular-expression matches. + * Method-call matches yield barrier nodes via ordinary control-flow dominance, + * while annotation matches are treated as direct barriers by + * `DataFlow::BarrierGuard`, since an annotation does not dominate the + * expression it constrains. */ predicate regexpMatchGuardChecks(Guard guard, Expr e, boolean branch) { - exists(RegexMatch rm | not rm instanceof Annotation | + exists(RegexMatch rm | guard = rm and e = rm.getASanitizedExpr() and branch = true @@ -56,11 +59,6 @@ predicate regexpMatchGuardChecks(Guard guard, Expr e, boolean branch) { class RegexpCheckBarrier extends DataFlow::Node { RegexpCheckBarrier() { this = DataFlow::BarrierGuard::getABarrierNode() - or - // Annotations don't fit into the model of barrier guards because the - // annotation doesn't dominate the sanitized expression, so we instead - // treat them as barriers directly. - exists(RegexMatch rm | rm instanceof Annotation | this.asExpr() = rm.getString()) } } From 366d70bfee9885d03957cc6ecd9ca7a68985bcbe Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Sat, 4 Jul 2026 22:46:21 +0100 Subject: [PATCH 27/44] Convert qlref tests to inline expectations --- .../ModifiedFnvFunctionDetection.qlref | 3 +- .../NumberOfKnownCommandsAboveThreshold.qlref | 3 +- .../NumberOfKnownHashesAboveThreshold.qlref | 3 +- .../NumberOfKnownLiteralsAboveThreshold.qlref | 3 +- ...mberOfKnownMethodNamesAboveThreshold.qlref | 3 +- .../SwallowEverythingExceptionHandler.qlref | 3 +- .../Solorigate/test/Solorigate/test.cs | 434 +++++++++--------- .../BlazorTest/Components/MyOutput.razor | 2 +- .../Components/Pages/TestPage.razor | 6 +- .../all-platforms/blazor/XSS.qlref | 4 +- .../BlazorTest/Components/MyOutput.razor | 2 +- .../Components/Pages/TestPage.razor | 6 +- .../blazor_build_mode_none/XSS.qlref | 4 +- .../BlazorTest/Components/MyOutput.razor | 2 +- .../Components/Pages/TestPage.razor | 6 +- .../all-platforms/blazor_net_8/XSS.qlref | 4 +- .../DatabaseQualityDiagnostics.qlref | 2 +- .../DatabaseQualityDiagnostics.qlref | 2 +- .../CWE-020/RuntimeChecksBypassBad.cs | 2 +- .../experimental/CWE-918/RequestForgery.cs | 4 +- .../experimental/CWE-918/RequestForgery.qlref | 3 +- .../CWE-759/HashWithoutSalt.cs | 18 +- .../CWE-759/HashWithoutSalt.qlref | 4 +- ...urity-validations-always-return-true.qlref | 3 +- .../JsonWebTokenHandler/delegation-test.cs | 18 +- .../security-validation-disabled-test.cs | 12 +- .../security-validation-disabled.qlref | 3 +- .../DefiningDatasetRelatedType.qlref | 3 +- ...finingPotentiallyUnsafeXmlSerializer.qlref | 3 +- ...UnsafeTypeUsedDataContractSerializer.qlref | 3 +- .../XmlDeserializationWithDataSet.qlref | 3 +- .../Security Features/Serialization/test0.cs | 14 +- .../DangerousNativeFunctionCall.qlref | 3 +- .../backdoor/PotentialTimeBomb.qlref | 3 +- .../backdoor/ProcessNameToHashTaintFlow.qlref | 3 +- .../Security Features/backdoor/test.cs | 10 +- .../library-tests/arguments/PrintAst.qlref | 2 +- .../library-tests/assignments/PrintAst.qlref | 2 +- .../library-tests/attributes/PrintAst.qlref | 2 +- .../library-tests/comments/PrintAst.qlref | 2 +- .../compilations/CompilerError.qlref | 2 +- .../compilations/CompilerMessage.qlref | 2 +- .../compilations/ExtractorError.qlref | 2 +- .../compilations/ExtractorMessage.qlref | 2 +- .../library-tests/constructors/PrintAst.qlref | 2 +- .../conversion/operator/PrintAst.qlref | 2 +- .../library-tests/csharp11/PrintAst.qlref | 2 +- .../test/library-tests/csharp6/PrintAst.qlref | 2 +- .../library-tests/csharp7.1/PrintAst.qlref | 2 +- .../library-tests/csharp7.2/PrintAst.qlref | 2 +- .../library-tests/csharp7.3/PrintAst.qlref | 2 +- .../test/library-tests/csharp7/PrintAst.qlref | 2 +- .../test/library-tests/csharp8/PrintAst.qlref | 2 +- .../test/library-tests/csharp9/PrintAst.qlref | 2 +- .../dataflow/implicittostring/PrintAst.qlref | 2 +- .../dataflow/tuples/PrintAst.qlref | 2 +- .../library-tests/definitions/PrintAst.qlref | 2 +- .../definitions/definitions.qlref | 2 +- .../library-tests/delegates/PrintAst.qlref | 2 +- .../DiagnosticExtractorErrors.qlref | 2 +- .../diagnostics/ExtractedFiles.qlref | 2 +- .../test/library-tests/dynamic/PrintAst.qlref | 2 +- .../test/library-tests/enums/PrintAst.qlref | 2 +- .../test/library-tests/events/PrintAst.qlref | 2 +- .../library-tests/exceptions/PrintAst.qlref | 2 +- .../library-tests/expressions/PrintAst.qlref | 2 +- .../library-tests/extension/PrintAst.qlref | 2 +- .../test/library-tests/fields/PrintAst.qlref | 2 +- .../filters/ClassifyFiles/ClassifyFiles.qlref | 2 +- .../Components_Pages_TestPage_razor.g.cs | 4 +- .../microsoft/aspnetcore/blazor/Name.cs | 4 +- .../microsoft/aspnetcore/blazor/NameList.cs | 4 +- .../microsoft/aspnetcore/blazor/NameList2.cs | 4 +- .../microsoft/aspnetcore/blazor/Xss.qlref | 4 +- .../library-tests/generics/PrintAst.qlref | 2 +- .../ql/test/library-tests/goto/PrintAst.qlref | 2 +- .../library-tests/indexers/PrintAst.qlref | 2 +- .../library-tests/initializers/PrintAst.qlref | 2 +- .../ql/test/library-tests/linq/PrintAst.qlref | 2 +- .../test/library-tests/members/PrintAst.qlref | 2 +- .../test/library-tests/methods/PrintAst.qlref | 2 +- .../test/library-tests/nameof/PrintAst.qlref | 2 +- .../library-tests/namespaces/PrintAst.qlref | 2 +- .../library-tests/nestedtypes/PrintAst.qlref | 2 +- .../library-tests/operators/PrintAst.qlref | 2 +- .../test/library-tests/partial/PrintAst.qlref | 2 +- .../library-tests/properties/PrintAst.qlref | 2 +- .../library-tests/statements/PrintAst.qlref | 2 +- .../stringinterpolation/PrintAst.qlref | 2 +- .../test/library-tests/types/PrintAst.qlref | 2 +- .../test/library-tests/unsafe/PrintAst.qlref | 2 +- .../CallToGCCollect/CallToGCCollect.qlref | 3 +- .../CallToGCCollect/CallToGCCollectBad.cs | 2 +- .../CallToObsoleteMethod.cs | 2 +- .../CallToObsoleteMethod.qlref | 3 +- .../CallToObsoleteMethodBad.cs | 2 +- .../ClassDoesNotImplementEquals.cs | 6 +- .../ClassDoesNotImplementEquals.qlref | 3 +- .../ClassDoesNotImplementEqualsBad.cs | 2 +- .../ClassImplementsICloneable.qlref | 3 +- .../ClassImplementsICloneableBad.cs | 4 +- .../DisposeNotCalledOnException.cs | 6 +- .../DisposeNotCalledOnException.qlref | 3 +- .../DisposeNotCalledOnExceptionBad.cs | 4 +- .../InconsistentEqualsGetHashCode.cs | 4 +- .../InconsistentEqualsGetHashCode.qlref | 3 +- .../InconsistentEqualsGetHashCodeBad.cs | 2 +- .../IncorrectCompareToSignature.cs | 2 +- .../IncorrectCompareToSignature.qlref | 3 +- .../IncorrectCompareToSignatureBad.cs | 2 +- .../IncorrectEqualsSignature.cs | 2 +- .../IncorrectEqualsSignature.qlref | 3 +- .../IncorrectEqualsSignatureBad.cs | 2 +- .../MissingDisposeCall/MissingDisposeCall.cs | 8 +- .../MissingDisposeCall.qlref | 3 +- .../MissingDisposeCallBad.cs | 2 +- .../MissingDisposeMethod.cs | 12 +- .../MissingDisposeMethod.qlref | 3 +- .../MissingDisposeMethodBad.cs | 2 +- .../NonOverridingMethod.cs | 4 +- .../NonOverridingMethod.qlref | 3 +- .../NonOverridingMethodBad.cs | 2 +- .../NullArgumentToEquals.cs | 6 +- .../NullArgumentToEquals.qlref | 3 +- .../NullArgumentToEqualsBad.cs | 2 +- .../UncheckedReturnValue.cs | 12 +- .../UncheckedReturnValue.qlref | 3 +- .../UncheckedReturnValueBad.cs | 4 +- .../BlockCodeResponseWrite.qlref | 3 +- .../BlockCodeResponseWriteBad.aspx | 2 +- .../ASP/BlockCodeResponseWrite/test.aspx | 2 +- .../ComplexInlineCode/ComplexInlineCode.qlref | 3 +- .../ComplexInlineCodeBad.aspx | 2 +- .../ASP/ComplexInlineCode/test.aspx | 2 +- .../NonInternationalizedText.qlref | 3 +- .../NonInternationalizedTextBad.aspx | 2 +- .../ASP/NonInternationalizedText/test.aspx | 2 +- .../SplitControlStructure.qlref | 3 +- .../SplitControlStructureBad.aspx | 2 +- .../ASP/SplitControlStructure/test.aspx | 2 +- .../AlertSuppression/AlertSuppression.qlref | 2 +- .../MutualDependency/MutualDependency.qlref | 3 +- .../MutualDependency/MutualDependencyBad.cs | 2 +- .../FeatureEnvy/FeatureEnvy.qlref | 3 +- .../FeatureEnvy/FeatureEnvyBad.cs | 2 +- .../InappropriateIntimacy.cs | 4 +- .../InappropriateIntimacy.qlref | 3 +- .../EmptyInterface/EmptyInterface.qlref | 3 +- .../EmptyInterface/EmptyInterfaceBad.cs | 2 +- .../LocalScopeVariableShadowsMember.cs | 12 +- .../LocalScopeVariableShadowsMember.qlref | 3 +- .../LocalScopeVariableShadowsMemberBad.cs | 2 +- .../NoConstantsOnly/NoConstantsOnly.cs | 2 +- .../NoConstantsOnly/NoConstantsOnly.qlref | 3 +- .../NoConstantsOnly/NoConstantsOnlyBad.cs | 2 +- .../TooManyRefParameters.qlref | 3 +- .../TooManyRefParametersBad.cs | 2 +- .../EmptyCatchBlock/EmptyCatchBlock.cs | 2 +- .../EmptyCatchBlock/EmptyCatchBlock.qlref | 3 +- .../AbstractToConcreteCollection.cs | 2 +- .../AbstractToConcreteCollection.qlref | 3 +- .../AbstractToConcreteCollectionBad.cs | 2 +- .../ExposeRepresentation.cs | 2 +- .../ExposeRepresentation.qlref | 3 +- .../ExposeRepresentationBad.cs | 2 +- .../StaticArray/StaticArray.cs | 6 +- .../StaticArray/StaticArray.qlref | 3 +- .../StaticArray/StaticArrayBad.cs | 2 +- .../ConfusingMethodNames.qlref | 3 +- .../ConfusingMethodNames/Program.cs | 2 +- .../VariableNameTooShort.cs | 6 +- .../VariableNameTooShort.qlref | 3 +- .../Bad Practices/Path Combine/PathCombine.cs | 2 +- .../Path Combine/PathCombine.qlref | 3 +- .../VirtualCallInConstructorOrDestructor.cs | 10 +- ...VirtualCallInConstructorOrDestructor.qlref | 3 +- .../CompareIdenticalValues.cs | 48 +- .../CompareIdenticalValues.qlref | 3 +- .../FutileSyncOnField/FutileSyncOnField.cs | 6 +- .../FutileSyncOnField/FutileSyncOnField.qlref | 3 +- .../Concurrency/LockOrder/LockOrder.cs | 6 +- .../Concurrency/LockOrder/LockOrder.qlref | 3 +- .../Concurrency/LockOrder/LockOrderBad.cs | 2 +- .../Concurrency/LockThis/LockThis.cs | 2 +- .../Concurrency/LockThis/LockThis.qlref | 3 +- .../Concurrency/LockedWait/LockedWait.cs | 30 +- .../Concurrency/LockedWait/LockedWait.qlref | 3 +- .../SynchSetUnsynchGet/SynchSetUnsynchGet.cs | 4 +- .../SynchSetUnsynchGet.qlref | 3 +- .../UnsafeLazyInitialization.cs | 12 +- .../UnsafeLazyInitialization.qlref | 3 +- .../UnsynchronizedStaticAccess.cs | 4 +- .../UnsynchronizedStaticAccess.qlref | 3 +- .../EmptyPasswordInConfigurationFile.qlref | 3 +- .../PasswordInConfigurationFile.qlref | 3 +- .../PasswordInConfigurationFile/config.xml | 16 +- .../NonAssignedFields/NonAssignedFields.cs | 4 +- .../NonAssignedFields/NonAssignedFields.qlref | 3 +- .../Dead Code/Tests/DeadRefTypes.qlref | 3 +- .../Dead Code/Tests/UnusedField.qlref | 3 +- .../Dead Code/Tests/UnusedMethod.qlref | 3 +- .../query-tests/Dead Code/Tests/deadcode.cs | 4 +- .../query-tests/Dead Code/Tests/regression.cs | 20 +- .../Documentation/XmldocExtraParam.qlref | 3 +- .../Documentation/XmldocExtraTypeParam.qlref | 3 +- .../Documentation/XmldocMissing.qlref | 3 +- .../XmldocMissingException.qlref | 3 +- .../Documentation/XmldocMissingParam.qlref | 3 +- .../Documentation/XmldocMissingReturn.qlref | 3 +- .../Documentation/XmldocMissingSummary.qlref | 3 +- .../XmldocMissingTypeParam.qlref | 3 +- .../Documentation/documentation.cs | 16 +- .../test/query-tests/EmptyBlock/EmptyBlock.cs | 6 +- .../query-tests/EmptyBlock/EmptyBlock.qlref | 3 +- .../CatchOfGenericException.cs | 6 +- .../CatchOfGenericException.qlref | 3 +- .../Language Abuse/ChainedIs/ChainedIs.cs | 2 +- .../Language Abuse/ChainedIs/ChainedIs.qlref | 3 +- .../DubiousTypeTestOfThis.cs | 4 +- .../DubiousTypeTestOfThis.qlref | 3 +- .../DubiousTypeTestOfThis2.cs | 2 +- .../ForeachCapture/ForeachCapture.cs | 4 +- .../ForeachCapture/ForeachCapture.qlref | 3 +- .../MissedTernaryOpportunity.cs | 4 +- .../MissedTernaryOpportunity.qlref | 3 +- .../Language Abuse/NestedIf/NestedIf.qlref | 3 +- .../Language Abuse/NestedIf/nestedif.cs | 6 +- .../RethrowException/RethrowException.cs | 4 +- .../RethrowException/RethrowException.qlref | 3 +- .../SimplifyBoolExpr/SimplifyBoolExpr.cs | 60 +-- .../SimplifyBoolExpr/SimplifyBoolExpr.qlref | 3 +- .../SimplifyBoolExpr/SimplifyBoolExprBad.cs | 6 +- .../UselessCastToSelf/UselessCastToSelf.cs | 14 +- .../UselessCastToSelf/UselessCastToSelf.qlref | 3 +- .../UselessIsBeforeAs/UselessIsBeforeAs.cs | 2 +- .../UselessIsBeforeAs/UselessIsBeforeAs.qlref | 3 +- .../UselessNullCoalescingExpression.cs | 16 +- .../UselessNullCoalescingExpression.qlref | 3 +- .../UselessUpcast/UselessUpcast.cs | 16 +- .../UselessUpcast/UselessUpcast.qlref | 3 +- .../UselessUpcast/UselessUpcastBad.cs | 2 +- .../Likely Bugs/BadCheckOdd/BadCheckOdd.cs | 8 +- .../Likely Bugs/BadCheckOdd/BadCheckOdd.qlref | 3 +- .../ContainerLengthCmpOffByOne.cs | 8 +- .../ContainerLengthCmpOffByOne.qlref | 3 +- .../ContainerSizeCmpZero.cs | 60 +-- .../ContainerSizeCmpZero.qlref | 3 +- .../DangerousNonShortCircuitLogic.cs | 9 +- .../DangerousNonShortCircuitLogic.qlref | 3 +- .../Likely Bugs/Dynamic/BadDynamicCall.qlref | 3 +- .../Likely Bugs/Dynamic/dynamic.cs | 30 +- .../Likely Bugs/EqualsArray/EqualsArray.cs | 8 +- .../Likely Bugs/EqualsArray/EqualsArray.qlref | 3 +- .../Likely Bugs/EqualsUsesAs/EqualsUsesAs.cs | 2 +- .../EqualsUsesAs/EqualsUsesAs.qlref | 3 +- .../Likely Bugs/EqualsUsesIs/EqualsUsesIs.cs | 2 +- .../EqualsUsesIs/EqualsUsesIs.qlref | 3 +- .../IncomparableEquals/IncomparableEquals.cs | 2 +- .../IncomparableEquals.qlref | 3 +- .../InconsistentCompareTo.cs | 8 +- .../InconsistentCompareTo.qlref | 3 +- .../MishandlingJapaneseEra.qlref | 3 +- .../MishandlingJapaneseEra/Program.cs | 12 +- .../NestedLoopsSameVariable.cs | 2 +- .../NestedLoopsSameVariable.qlref | 3 +- .../NestedLoopsSameVariable/Test.cs | 8 +- .../ObjectComparison/ObjectComparison.cs | 8 +- .../ObjectComparison/ObjectComparison.qlref | 3 +- .../PossibleLossOfPrecision.cs | 28 +- .../PossibleLossOfPrecision.qlref | 3 +- .../RandomUsedOnce/RandomUsedOnce.cs | 10 +- .../RandomUsedOnce/RandomUsedOnce.qlref | 3 +- .../RecursiveEquals/RecursiveEquals.cs | 2 +- .../RecursiveEquals/RecursiveEquals.qlref | 3 +- .../SelfAssignment/SelfAssignment.qlref | 3 +- .../Likely Bugs/SelfAssignment/selfassigns.cs | 22 +- .../StaticFieldWrittenByInstance.cs | 6 +- .../StaticFieldWrittenByInstance.qlref | 3 +- .../StringBufferCharInit.qlref | 3 +- .../StringBuilderCharInit.cs | 10 +- .../ThreadUnsafeICryptoTransform.cs | 10 +- .../ThreadUnsafeICryptoTransform.qlref | 3 +- .../ThreadUnsafeICryptoTransformLambda.cs | 8 +- .../ThreadUnsafeICryptoTransformLambda.qlref | 3 +- .../UncheckedCastInEquals.cs | 2 +- .../UncheckedCastInEquals.qlref | 3 +- .../UnsafeYearConstruction/Program.cs | 10 +- .../UnsafeYearConstruction.qlref | 3 +- .../MissedCastOpportunity.cs | 8 +- .../MissedCastOpportunity.qlref | 3 +- .../MissedWhereOpportunity.cs | 8 +- .../MissedWhereOpportunity.qlref | 3 +- .../MagicConstants/AttributeInts.cs | 2 +- .../MagicConstants/AttributeStrings.cs | 2 +- .../MagicConstants/AttributeStrings.qlref | 3 +- .../query-tests/MagicConstants/HashCode.cs | 2 +- .../MagicConstantsNumbers.qlref | 3 +- .../MagicConstants/MagicNumbersUseConstant.cs | 4 +- .../MagicNumbersUseConstant.qlref | 3 +- .../MagicConstants/MagicStringsUseConstant.cs | 4 +- .../MagicStringsUseConstant.qlref | 3 +- .../flinesofcommentedcode.qlref | 2 +- .../RefTypes/TNumberOfFields/EnumSize.qlref | 2 +- .../Metrics/Summaries/LinesOfCode.qlref | 2 +- .../StringBuilderInLoop.cs | 4 +- .../StringBuilderInLoop.qlref | 3 +- .../StringConcatenationInLoop.cs | 4 +- .../StringConcatenationInLoop.qlref | 3 +- .../UseTryGetValue/UseTryGetValue.cs | 20 +- .../UseTryGetValue/UseTryGetValue.qlref | 3 +- .../ReadOnlyContainer/ReadOnlyContainer.cs | 24 +- .../ReadOnlyContainer/ReadOnlyContainer.qlref | 3 +- .../CWE-011/ASPNetDebug.qlref | 3 +- .../Security Features/CWE-011/bad1/Web.config | 2 +- .../Security Features/CWE-011/bad2/Web.config | 2 +- .../ASPNetMaxRequestLength.qlref | 3 +- .../ASPNetMaxRequestLength/bad/Web.config | 4 +- .../ASPNetPagesValidateRequest.qlref | 3 +- .../ASPNetPagesValidateRequestBad.config | 4 +- .../ASPNetRequestValidationMode.qlref | 3 +- .../ASPNetRequestValidationModeBad.config | 2 +- .../ExternalAPIsUsedWithUntrustedData.qlref | 2 +- .../CWE-020/RuntimeChecksBypass.cs | 6 +- .../CWE-020/RuntimeChecksBypassBad.cs | 2 +- .../CWE-020/RuntimeChecksbypass.qlref | 3 +- .../CWE-020/UntrustedData.cs | 4 +- .../CWE-020/UntrustedDataToExternalAPI.qlref | 4 +- .../CWE-022/TaintedPath/TaintedPath.cs | 16 +- .../CWE-022/TaintedPath/TaintedPath.qlref | 4 +- .../CWE-022/ZipSlip/ZipSlip.cs | 22 +- .../CWE-022/ZipSlip/ZipSlip.qlref | 4 +- .../CWE-022/ZipSlip/ZipSlipBad.cs | 4 +- .../CWE-078/CommandInjection.cs | 16 +- .../CWE-078/CommandInjection.qlref | 4 +- .../CWE-079/StoredXSS/StoredXSS.cs | 4 +- .../CWE-079/StoredXSS/StoredXSS.qlref | 4 +- .../Security Features/CWE-079/XSSAsp/XSS.cs | 36 +- .../CWE-079/XSSAsp/XSS.qlref | 4 +- .../CWE-079/XSSAsp/script.aspx | 6 +- .../Areas/TestArea/Views/Shared/Test18.cshtml | 3 +- .../Areas/TestArea/Views/Test4/Test17.cshtml | 3 +- .../Controllers/TestController.cs | 48 +- ...s_TestArea_Views_Shared_Test18.cshtml.g.cs | 2 +- ...as_TestArea_Views_Test4_Test17.cshtml.g.cs | 2 +- .../Generated/Pages_Shared_Test21.cshtml.g.cs | 2 +- .../XSSRazorPages/Generated/Template.g | 2 +- .../Views_Custom2_Test16.cshtml.g.cs | 2 +- .../Views_Custom_Test3_Test15.cshtml.g.cs | 2 +- .../Generated/Views_Other_Test13.cshtml.g.cs | 2 +- .../Generated/Views_Other_Test5.cshtml.g.cs | 2 +- .../Generated/Views_Other_Test6.cshtml.g.cs | 2 +- .../Generated/Views_Other_Test8.cshtml.g.cs | 2 +- .../Generated/Views_Other_Test9.cshtml.g.cs | 2 +- .../Generated/Views_Shared_Test14.cshtml.g.cs | 2 +- .../Generated/Views_Shared_Test19.cshtml.g.cs | 2 +- .../Generated/Views_Shared_Test2.cshtml.g.cs | 2 +- .../Generated/Views_Shared_Test23.cshtml.g.cs | 2 +- .../Generated/Views_Test2_Test10.cshtml.g.cs | 2 +- .../Generated/Views_Test2_Test11.cshtml.g.cs | 2 +- .../Generated/Views_Test_Test1.cshtml.g.cs | 2 +- .../Generated/Views_Test_Test3.cshtml.g.cs | 2 +- .../Generated/Views_Test_Test4.cshtml.g.cs | 2 +- .../Generated/Views_Test_Test7.cshtml.g.cs | 2 +- .../XSSRazorPages/MyAreas/Test4/Test22.cshtml | 3 +- .../XSSRazorPages/Pages/Shared/Test21.cshtml | 3 +- .../Views/Custom/Test3/Test15.cshtml | 3 +- .../XSSRazorPages/Views/Custom2/Test16.cshtml | 3 +- .../XSSRazorPages/Views/Other/Test13.cshtml | 3 +- .../XSSRazorPages/Views/Other/Test5.cshtml | 3 +- .../XSSRazorPages/Views/Other/Test6.cshtml | 3 +- .../XSSRazorPages/Views/Other/Test8.cshtml | 3 +- .../XSSRazorPages/Views/Other/Test9.cshtml | 3 +- .../XSSRazorPages/Views/Shared/Test12.cshtml | 3 +- .../XSSRazorPages/Views/Shared/Test14.cshtml | 3 +- .../XSSRazorPages/Views/Shared/Test19.cshtml | 3 +- .../XSSRazorPages/Views/Shared/Test2.cshtml | 3 +- .../XSSRazorPages/Views/Shared/Test23.cshtml | 3 +- .../XSSRazorPages/Views/Shared/Test3.cshtml | 3 +- .../XSSRazorPages/Views/Test/Test1.cshtml | 7 +- .../XSSRazorPages/Views/Test/Test3.cshtml | 3 +- .../XSSRazorPages/Views/Test/Test4.cshtml | 3 +- .../XSSRazorPages/Views/Test/Test7.cshtml | 3 +- .../XSSRazorPages/Views/Test2/Test1.cshtml | 3 +- .../XSSRazorPages/Views/Test2/Test10.cshtml | 3 +- .../XSSRazorPages/Views/Test2/Test11.cshtml | 3 +- .../XSSRazorPages/Views/Test2/Test12.cshtml | 3 +- .../XSSRazorPages/Views/Test2/Test14.cshtml | 3 +- .../XSSRazorPages/Views/Test2/Test2.cshtml | 3 +- .../XSSRazorPages/Views/Test2/Test3.cshtml | 3 +- .../XSSRazorPages/Views/Test4/Test20.cshtml | 3 +- .../CWE-079/XSSRazorPages/XSS.expected | 42 +- .../CWE-079/XSSRazorPages/XSS.qlref | 3 +- .../CWE-090/LDAPInjection.cs | 18 +- .../CWE-090/LDAPInjection.qlref | 4 +- .../CWE-091/XMLInjection/Test.cs | 4 +- .../CWE-091/XMLInjection/XMLInjection.qlref | 4 +- .../CWE-094/CodeInjection.cs | 8 +- .../CWE-094/CodeInjection.qlref | 4 +- .../CWE-099/ResourceInjection.cs | 6 +- .../CWE-099/ResourceInjection.qlref | 4 +- .../CWE-112/MissingXMLValidation.cs | 10 +- .../CWE-112/MissingXMLValidation.qlref | 4 +- .../AssemblyPathInjection.qlref | 4 +- .../CWE-114/AssemblyPathInjection/Test.cs | 4 +- .../CWE-119/LocalUnvalidatedArithmetic.cs | 2 +- .../CWE-119/LocalUnvalidatedArithmetic.qlref | 3 +- .../ExposureInTransmittedData.cs | 18 +- .../ExposureInTransmittedData.qlref | 4 +- .../CWE-209/ExceptionInformationExposure.cs | 14 +- .../ExceptionInformationExposure.qlref | 4 +- .../MissingASPNETGlobalErrorHandler.qlref | 3 +- .../WebConfigOff/Web.config | 2 +- .../MissingASPNETGlobalErrorHandler.qlref | 3 +- .../WebFormsTests/MissingAccessControl.qlref | 3 +- .../WebFormsTests/Test1/EditProfile.aspx.cs | 2 +- .../WebFormsTests/Test1/ViewProfile.aspx.cs | 2 +- .../WebFormsTests/Test3/B/EditProfile.aspx.cs | 2 +- .../CWE-312/CleartextStorage.cs | 20 +- .../CWE-312/CleartextStorage.qlref | 3 +- .../HardcodedSymmetricEncryptionKey.cs | 16 +- .../HardcodedSymmetricEncryptionKey.qlref | 4 +- .../DontInstallRootCert.qlref | 3 +- .../CWE-327/DontInstallRootCert/Test.cs | 12 +- .../InsecureSQLConnection.cs | 10 +- .../InsecureSQLConnection.qlref | 3 +- .../InsufficientKeySize.cs | 6 +- .../InsufficientKeySize.qlref | 3 +- .../CWE-338/InsecureRandomness.cs | 14 +- .../CWE-338/InsecureRandomness.qlref | 4 +- .../MissingAntiForgeryTokenValidation.qlref | 3 +- .../MissingAntiForgeryTokenValidation.cs | 4 +- .../MissingAntiForgeryTokenValidation.qlref | 1 + .../MissingAntiForgeryTokenValidation.cs | 4 +- .../MissingAntiForgeryTokenValidation.qlref | 3 +- .../CWE-359/ExposureOfPrivateInformation.cs | 10 +- .../ExposureOfPrivateInformation.qlref | 3 +- .../CWE-384/AbandonSession.cs | 6 +- .../CWE-384/AbandonSession.qlref | 3 +- .../MissingXFrameOptions.qlref | 3 +- .../MissingXFrameOptions.qlref | 3 +- .../MissingXFrameOptions.qlref | 3 +- .../PersistentCookie/PersistentCookie.cs | 4 +- .../PersistentCookie/PersistentCookie.qlref | 3 +- .../CWE-548/ASPNetDirectoryListing.qlref | 3 +- .../Security Features/CWE-548/web.config | 2 +- .../CWE-601/UrlRedirect/UrlRedirect.cs | 16 +- .../CWE-601/UrlRedirect/UrlRedirect.qlref | 4 +- .../CWE-601/UrlRedirect/UrlRedirect2.cs | 2 +- .../CWE-601/UrlRedirect/UrlRedirectCore.cs | 24 +- .../Security Features/CWE-611/Test.cs | 6 +- .../CWE-611/UntrustedDataInsecureXml.qlref | 4 +- .../CWE-611/UseXmlSecureResolver.qlref | 4 +- .../RequireSSL/AddedInCode/RequireSSL.qlref | 3 +- .../RequireSSL/AddedInForms/RequireSSL.qlref | 3 +- .../HttpCookiesCorrect/RequireSSL.qlref | 3 +- .../RequireSSL/HttpCookiesCorrect/Web.config | 2 +- .../RequireSSLMissing/RequireSSL.qlref | 3 +- .../RequireSSL/RequireSSLMissing/Web.config | 4 +- .../CWE-639/MVCTests/CommentController.cs | 4 +- .../InsecureDirectObjectReference.qlref | 3 +- .../CWE-639/MVCTests/MiscTestControllers.cs | 6 +- .../CWE-639/MVCTests/ProfileController.cs | 2 +- .../CWE-639/WebFormsTests/EditComment.aspx.cs | 2 +- .../InsecureDirectObjectReference.qlref | 3 +- .../CWE-643/XPathInjection.cs | 24 +- .../CWE-643/XPathInjection.qlref | 4 +- .../CWE-730/ReDoS/ExponentialRegex.cs | 12 +- .../CWE-730/ReDoS/ReDoS.qlref | 4 +- .../CWE-730/ReDoSGlobalTimeout/ReDoS.qlref | 4 +- .../CWE-730/RegexInjection/RegexInjection.cs | 4 +- .../RegexInjection/RegexInjection.qlref | 4 +- .../CWE-798/HardcodedConnectionString.qlref | 3 +- .../CWE-798/HardcodedCredentials.cs | 18 +- .../CWE-798/HardcodedCredentials.qlref | 3 +- .../CWE-798/TestHardcodedCredentials.cs | 2 +- .../CWE-807/ConditionalBypass.cs | 24 +- .../CWE-807/ConditionalBypass.qlref | 4 +- .../Security Features/CWE-838/HtmlEncode.cs | 2 +- .../CWE-838/InappropriateEncoding.cs | 24 +- .../CWE-838/InappropriateEncoding.qlref | 4 +- .../Security Features/CWE-838/SqlEncode.cs | 4 +- .../Security Features/CWE-838/UrlEncode.cs | 2 +- .../LibraryUsage/ExternalLibraryUsage.qlref | 2 +- .../LibraryUsage/SupportedExternalTaint.qlref | 2 +- .../UnsupportedExternalAPIs.qlref | 2 +- .../SupportedExternalApis.qlref | 2 +- .../SupportedExternalSinks.qlref | 2 +- .../SupportedExternalSources.qlref | 2 +- .../UnusedPropertyValue.cs | 6 +- .../UnusedPropertyValue.qlref | 3 +- .../test/query-tests/UseBraces/UseBraces.cs | 10 +- .../query-tests/UseBraces/UseBraces.qlref | 3 +- .../PointlessForwardingMethod.cs | 4 +- .../PointlessForwardingMethod.qlref | 3 +- .../WriteOnlyContainer/WriteOnlyContainer.cs | 68 +-- .../WriteOnlyContainer.qlref | 3 +- .../IncomparableEquals/IncomparableEquals.cs | 6 +- .../IncomparableEquals.qlref | 3 +- .../ObjectComparison/ObjectComparison.cs | 4 +- .../ObjectComparison/ObjectComparison.qlref | 3 +- .../ApplicationModeEndpoints.qlref | 2 +- .../modeleditor/FrameworkModeEndpoints.qlref | 2 +- 502 files changed, 1602 insertions(+), 1360 deletions(-) diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/ModifiedFnvFunctionDetection.qlref b/csharp/ql/campaigns/Solorigate/test/Solorigate/ModifiedFnvFunctionDetection.qlref index 0bfdf5905b36..d861fc929b23 100644 --- a/csharp/ql/campaigns/Solorigate/test/Solorigate/ModifiedFnvFunctionDetection.qlref +++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/ModifiedFnvFunctionDetection.qlref @@ -1 +1,2 @@ -ModifiedFnvFunctionDetection.ql +query: ModifiedFnvFunctionDetection.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownCommandsAboveThreshold.qlref b/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownCommandsAboveThreshold.qlref index 61c6c1e04a80..6854e44501fe 100644 --- a/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownCommandsAboveThreshold.qlref +++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownCommandsAboveThreshold.qlref @@ -1 +1,2 @@ -NumberOfKnownCommandsAboveThreshold.ql +query: NumberOfKnownCommandsAboveThreshold.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownHashesAboveThreshold.qlref b/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownHashesAboveThreshold.qlref index 718d6c67048c..a66d6d55d198 100644 --- a/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownHashesAboveThreshold.qlref +++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownHashesAboveThreshold.qlref @@ -1 +1,2 @@ -NumberOfKnownHashesAboveThreshold.ql +query: NumberOfKnownHashesAboveThreshold.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownLiteralsAboveThreshold.qlref b/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownLiteralsAboveThreshold.qlref index e17b18d08ae5..38b9897d0685 100644 --- a/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownLiteralsAboveThreshold.qlref +++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownLiteralsAboveThreshold.qlref @@ -1 +1,2 @@ -NumberOfKnownLiteralsAboveThreshold.ql +query: NumberOfKnownLiteralsAboveThreshold.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qlref b/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qlref index 747fb006e437..7f5e000495e2 100644 --- a/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qlref +++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/NumberOfKnownMethodNamesAboveThreshold.qlref @@ -1 +1,2 @@ -NumberOfKnownMethodNamesAboveThreshold.ql +query: NumberOfKnownMethodNamesAboveThreshold.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/SwallowEverythingExceptionHandler.qlref b/csharp/ql/campaigns/Solorigate/test/Solorigate/SwallowEverythingExceptionHandler.qlref index 538eee55bf20..e49d40d16e12 100644 --- a/csharp/ql/campaigns/Solorigate/test/Solorigate/SwallowEverythingExceptionHandler.qlref +++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/SwallowEverythingExceptionHandler.qlref @@ -1 +1,2 @@ -SwallowEverythingExceptionHandler.ql +query: SwallowEverythingExceptionHandler.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs b/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs index 8680d8346940..2530492ef74d 100644 --- a/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs +++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs @@ -6,12 +6,12 @@ class FalsePositiveCases // regular FVN ulong GetRegularFvnHash(string s) { - ulong num = 14695981039346656037UL; /* FNV base offset */ + ulong num = 14695981039346656037UL; /* FNV base offset */ // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] foreach (byte b in Encoding.UTF8.GetBytes(s)) { num ^= (ulong)b; - num *= 1099511628211UL; /* FNV prime */ + num *= 1099511628211UL; /* FNV prime */ // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] } return num; @@ -22,24 +22,24 @@ class TestCases { ulong GetRegularFvnHash(string s) { - ulong num = 14695981039346656037UL; + ulong num = 14695981039346656037UL; // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] try { foreach (byte b in Encoding.UTF8.GetBytes(s)) { num ^= (ulong)b; - num *= 1099511628211UL; + num *= 1099511628211UL; // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] } } catch // BUG : SwallowEverythingExceptionHandler { - } + } // $ Alert[cs/solorigate/swallow-everything-exception] - return num ^ 6605813339339102567UL; // BUG (ModifiedFnvFunctionDetection.ql) + return num ^ 6605813339339102567UL; // $ Alert[cs/solorigate/modified-fnv-function-detection] Alert[cs/solorigate/number-of-known-hashes-above-threshold] // BUG (ModifiedFnvFunctionDetection.ql) } - enum JobEngine + enum JobEngine // $ Alert[cs/solorigate/number-of-known-commands-in-enum-above-threshold] { Idle, Exit, @@ -62,222 +62,222 @@ enum JobEngine None } - void Abort() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void AddFileExecutionEngine() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void AddRegistryExecutionEngine() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void AdjustTokenPrivileges() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Base64Decode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Base64Encode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void ByteArrayToHexString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void CheckServerConnection() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Close() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void CloseHandle() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void CollectSystemDescription() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Compress() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void CreateSecureString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void CreateString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void CreateUploadRequest() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void CreateUploadRequestImpl() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Decompress() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void DecryptShort() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Deflate() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void DelayMin() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void DelayMs() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void DeleteFile() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void DeleteRegistryValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void DeleteValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void ExecuteEngine() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void FileExists() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetAddresses() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetAddressFamily() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetArgumentIndex() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetBaseUri() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetBaseUriImpl() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetCache() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetCurrentProcess() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetCurrentString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetDescriptionId() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetFileHash() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetFileSystemEntries() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetHash() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetHive() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetIntArray() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetIPHostEntry() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetManagementObjectProperty() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetNetworkAdapterConfiguration() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetNewOwnerName() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetNextString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetNextStringEx() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetOrCreateUserID() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetOrionImprovementCustomerId() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetOSVersion() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetPreviousString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetProcessByDescription() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetRegistrySubKeyAndValueNames() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetStringHash() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetSubKeyAndValueNames() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetUserAgent() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void GetWebProxy() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void HexStringToByteArray() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Inflate() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Initialize() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void InitiateSystemShutdownExW() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void IsNullOrInvalidName() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void IsSynchronized() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void KillTask() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void LookupPrivilegeValueW() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void OpenProcessToken() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void ParseServiceResponse() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Quote() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void ReadConfig() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void ReadDeviceInfo() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void ReadRegistryValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void ReadReportStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void ReadServiceStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void RebootComputer() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void RunTask() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SearchAssemblies() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SearchConfigurations() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SearchServices() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SetAutomaticMode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SetKeyOwner() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SetKeyOwnerWithPrivileges() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SetKeyPermissions() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SetManualMode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SetProcessPrivilege() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SetRegistryValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SetTime() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SetValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void SplitString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void ToString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void TrackEvent() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void TrackProcesses() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Unquote() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Unzip() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Update() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void UpdateBuffer() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void UpdateNotification() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void UploadSystemDescription() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Valid() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void WriteConfig() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void WriteFile() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void WriteReportStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void WriteServiceStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold - void Zip() { } // BUG : NumberOfKnownMethodNamesAboveThreshold + void Abort() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void AddFileExecutionEngine() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void AddRegistryExecutionEngine() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void AdjustTokenPrivileges() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Base64Decode() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Base64Encode() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void ByteArrayToHexString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void CheckServerConnection() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Close() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void CloseHandle() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void CollectSystemDescription() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Compress() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void CreateSecureString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void CreateString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void CreateUploadRequest() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void CreateUploadRequestImpl() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Decompress() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void DecryptShort() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Deflate() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void DelayMin() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void DelayMs() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void DeleteFile() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void DeleteRegistryValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void DeleteValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void ExecuteEngine() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void FileExists() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetAddresses() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetAddressFamily() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetArgumentIndex() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetBaseUri() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetBaseUriImpl() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetCache() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetCurrentProcess() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetCurrentString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetDescriptionId() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetFileHash() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetFileSystemEntries() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetHash() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetHive() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetIntArray() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetIPHostEntry() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetManagementObjectProperty() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetNetworkAdapterConfiguration() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetNewOwnerName() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetNextString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetNextStringEx() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetOrCreateUserID() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetOrionImprovementCustomerId() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetOSVersion() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetPreviousString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetProcessByDescription() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetRegistrySubKeyAndValueNames() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetStringHash() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetSubKeyAndValueNames() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetUserAgent() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void GetWebProxy() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void HexStringToByteArray() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Inflate() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Initialize() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void InitiateSystemShutdownExW() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void IsNullOrInvalidName() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void IsSynchronized() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void KillTask() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void LookupPrivilegeValueW() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void OpenProcessToken() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void ParseServiceResponse() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Quote() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void ReadConfig() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void ReadDeviceInfo() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void ReadRegistryValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void ReadReportStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void ReadServiceStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void RebootComputer() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void RunTask() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SearchAssemblies() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SearchConfigurations() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SearchServices() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SetAutomaticMode() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SetKeyOwner() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SetKeyOwnerWithPrivileges() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SetKeyPermissions() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SetManualMode() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SetProcessPrivilege() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SetRegistryValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SetTime() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SetValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void SplitString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void ToString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void TrackEvent() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void TrackProcesses() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Unquote() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Unzip() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Update() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void UpdateBuffer() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void UpdateNotification() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void UploadSystemDescription() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Valid() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void WriteConfig() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void WriteFile() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void WriteReportStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void WriteServiceStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold + void Zip() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold void Hashes() { ulong[] hashes = { // BUG : NumberOfKnownHashesAboveThreshold - 10063651499895178962, 10235971842993272939, 10296494671777307979, - 10336842116636872171, 10374841591685794123, 10393903804869831898, - 10463926208560207521, 10484659978517092504, 10501212300031893463, - 10545868833523019926, 10657751674541025650, 106672141413120087, 10734127004244879770, - 10829648878147112121, 1099511628211, 11073283311104541690, 1109067043404435916, - 11109294216876344399, 11266044540366291518, 11385275378891906608, - 11771945869106552231, 11801746708619571308, 11818825521849580123, - 11913842725949116895, 12027963942392743532, 12094027092655598256, - 12343334044036541897, 12445177985737237804, 12445232961318634374, - 12574535824074203265, 12679195163651834776, 12709986806548166638, - 12718416789200275332, 12785322942775634499, 12790084614253405985, - 12969190449276002545, 13014156621614176974, 13029357933491444455, - 13135068273077306806, 13260224381505715848, 13316211011159594063, - 13464308873961738403, 13544031715334011032, 13581776705111912829, - 13599785766252827703, 13611051401579634621, 13611814135072561278, - 13655261125244647696, 1367627386496056834, 1368907909245890092, 13693525876560827283, - 13783346438774742614, 13799353263187722717, 13825071784440082496, - 13852439084267373191, 13876356431472225791, 14055243717250701608, - 14079676299181301772, 14095938998438966337, 14111374107076822891, - 14193859431895170587, 14226582801651130532, 14243671177281069512, - 14256853800858727521, 14480775929210717493, 14482658293117931546, - 14513577387099045298, 14630721578341374856, 14695981039346656037, - 14710585101020280896, 1475579823244607677, 14868920869169964081, 14968320160131875803, - 14971809093655817917, 15039834196857999838, 15092207615430402812, - 15114163911481793350, 15194901817027173566, 15267980678929160412, - 15457732070353984570, 15514036435533858158, 15535773470978271326, - 15587050164583443069, 155978580751494388, 15695338751700748390, 15997665423159927228, - 16066522799090129502, 16066651430762394116, 16112751343173365533, - 16130138450758310172, 1614465773938842903, 16292685861617888592, 16335643316870329598, - 16423314183614230717, 16570804352575357627, 1682585410644922036, 16858955978146406642, - 16990567851129491937, 17017923349298346219, 17097380490166623672, - 17109238199226571972, 17204844226884380288, 17291806236368054941, - 17351543633914244545, 17439059603042731363, 17574002783607647274, - 17624147599670377042, 17633734304611248415, 17683972236092287897, - 17849680105131524334, 17939405613729073960, 17956969551821596225, - 17978774977754553159, 17984632978012874803, 17997967489723066537, - 18147627057830191163, 18150909006539876521, 18159703063075866524, - 18246404330670877335, 18294908219222222902, 18392881921099771407, - 18446744073709551613, 191060519014405309, 2032008861530788751, 2128122064571842954, - 2147483647, 2147745794, 2380224015317016190, 2478231962306073784, - 2532538262737333146, 2589926981877829912, 2597124982561782591, 2600364143812063535, - 2717025511528702475, 2734787258623754862, 27407921587843457, 2760663353550280147, - 2797129108883749491, 2810460305047003196, 292198192373389586, 2934149816356927366, - 3045986759481489935, 3178468437029279937, 3200333496547938354, 3320026265773918739, - 3320767229281015341, 3341747963119755850, 3407972863931386250, 3413052607651207697, - 3413886037471417852, 3421197789791424393, 3421213182954201407, 3425260965299690882, - 3538022140597504361, 3575761800716667678, 3588624367609827560, 3626142665768487764, - 3642525650883269872, 3656637464651387014, 3660705254426876796, 3769837838875367802, - 3778500091710709090, 3796405623695665524, 3869935012404164040, 3890769468012566366, - 3890794756780010537, 397780960855462669, 4030236413975199654, 4088976323439621041, - 4454255944391929578, 4501656691368064027, 4578480846255629462, 4821863173800309721, - 4931721628717906635, 506634811745884560, 5132256620104998637, 5183687599225757871, - 521157249538507889, 5219431737322569038, 541172992193764396, 5415426428750045503, - 5449730069165757263, 5587557070429522647, 5614586596107908838, 576626207276463000, - 5942282052525294911, 5945487981219695001, 5984963105389676759, 607197993339007484, - 6088115528707848728, 6116246686670134098, 6180361713414290679, 6195833633417633900, - 6274014997237900919, 640589622539783622, 6461429591783621719, 6491986958834001955, - 6508141243778577344, 6605813339339102567, 682250828679635420, 6827032273910657891, - 6943102301517884811, 700598796416086955, 7080175711202577138, 7175363135479931834, - 7315838824213522000, 7412338704062093516, 7516148236133302073, 7574774749059321801, - 7701683279824397773, 7775177810774851294, 7810436520414958497, 7878537243757499832, - 79089792725215063, 7982848972385914508, 8052533790968282297, 8129411991672431889, - 8146185202538899243, 835151375515278827, 8381292265993977266, 8408095252303317471, - 8473756179280619170, 8478833628889826985, 8612208440357175863, 8697424601205169055, - 8698326794961817906, 8709004393777297355, 8727477769544302060, 8760312338504300643, - 8799118153397725683, 8873858923435176895, 8994091295115840290, 9007106680104765185, - 9061219083560670602, 9149947745824492274, 917638920165491138, 9234894663364701749, - 9333057603143916814, 9384605490088500348, 9531326785919727076, 9555688264681862794, - 9559632696372799208, 9903758755917170407 + 10063651499895178962, 10235971842993272939, 10296494671777307979, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 10336842116636872171, 10374841591685794123, 10393903804869831898, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 10463926208560207521, 10484659978517092504, 10501212300031893463, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 10545868833523019926, 10657751674541025650, 106672141413120087, 10734127004244879770, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 10829648878147112121, 1099511628211, 11073283311104541690, 1109067043404435916, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 11109294216876344399, 11266044540366291518, 11385275378891906608, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 11771945869106552231, 11801746708619571308, 11818825521849580123, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 11913842725949116895, 12027963942392743532, 12094027092655598256, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 12343334044036541897, 12445177985737237804, 12445232961318634374, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 12574535824074203265, 12679195163651834776, 12709986806548166638, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 12718416789200275332, 12785322942775634499, 12790084614253405985, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 12969190449276002545, 13014156621614176974, 13029357933491444455, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 13135068273077306806, 13260224381505715848, 13316211011159594063, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 13464308873961738403, 13544031715334011032, 13581776705111912829, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 13599785766252827703, 13611051401579634621, 13611814135072561278, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 13655261125244647696, 1367627386496056834, 1368907909245890092, 13693525876560827283, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 13783346438774742614, 13799353263187722717, 13825071784440082496, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 13852439084267373191, 13876356431472225791, 14055243717250701608, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 14079676299181301772, 14095938998438966337, 14111374107076822891, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 14193859431895170587, 14226582801651130532, 14243671177281069512, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 14256853800858727521, 14480775929210717493, 14482658293117931546, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 14513577387099045298, 14630721578341374856, 14695981039346656037, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 14710585101020280896, 1475579823244607677, 14868920869169964081, 14968320160131875803, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 14971809093655817917, 15039834196857999838, 15092207615430402812, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 15114163911481793350, 15194901817027173566, 15267980678929160412, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 15457732070353984570, 15514036435533858158, 15535773470978271326, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 15587050164583443069, 155978580751494388, 15695338751700748390, 15997665423159927228, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 16066522799090129502, 16066651430762394116, 16112751343173365533, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 16130138450758310172, 1614465773938842903, 16292685861617888592, 16335643316870329598, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 16423314183614230717, 16570804352575357627, 1682585410644922036, 16858955978146406642, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 16990567851129491937, 17017923349298346219, 17097380490166623672, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 17109238199226571972, 17204844226884380288, 17291806236368054941, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 17351543633914244545, 17439059603042731363, 17574002783607647274, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 17624147599670377042, 17633734304611248415, 17683972236092287897, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 17849680105131524334, 17939405613729073960, 17956969551821596225, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 17978774977754553159, 17984632978012874803, 17997967489723066537, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 18147627057830191163, 18150909006539876521, 18159703063075866524, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 18246404330670877335, 18294908219222222902, 18392881921099771407, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 18446744073709551613, 191060519014405309, 2032008861530788751, 2128122064571842954, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 2147483647, 2147745794, 2380224015317016190, 2478231962306073784, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 2532538262737333146, 2589926981877829912, 2597124982561782591, 2600364143812063535, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 2717025511528702475, 2734787258623754862, 27407921587843457, 2760663353550280147, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 2797129108883749491, 2810460305047003196, 292198192373389586, 2934149816356927366, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 3045986759481489935, 3178468437029279937, 3200333496547938354, 3320026265773918739, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 3320767229281015341, 3341747963119755850, 3407972863931386250, 3413052607651207697, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 3413886037471417852, 3421197789791424393, 3421213182954201407, 3425260965299690882, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 3538022140597504361, 3575761800716667678, 3588624367609827560, 3626142665768487764, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 3642525650883269872, 3656637464651387014, 3660705254426876796, 3769837838875367802, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 3778500091710709090, 3796405623695665524, 3869935012404164040, 3890769468012566366, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 3890794756780010537, 397780960855462669, 4030236413975199654, 4088976323439621041, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 4454255944391929578, 4501656691368064027, 4578480846255629462, 4821863173800309721, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 4931721628717906635, 506634811745884560, 5132256620104998637, 5183687599225757871, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 521157249538507889, 5219431737322569038, 541172992193764396, 5415426428750045503, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 5449730069165757263, 5587557070429522647, 5614586596107908838, 576626207276463000, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 5942282052525294911, 5945487981219695001, 5984963105389676759, 607197993339007484, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 6088115528707848728, 6116246686670134098, 6180361713414290679, 6195833633417633900, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 6274014997237900919, 640589622539783622, 6461429591783621719, 6491986958834001955, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 6508141243778577344, 6605813339339102567, 682250828679635420, 6827032273910657891, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 6943102301517884811, 700598796416086955, 7080175711202577138, 7175363135479931834, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 7315838824213522000, 7412338704062093516, 7516148236133302073, 7574774749059321801, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 7701683279824397773, 7775177810774851294, 7810436520414958497, 7878537243757499832, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 79089792725215063, 7982848972385914508, 8052533790968282297, 8129411991672431889, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 8146185202538899243, 835151375515278827, 8381292265993977266, 8408095252303317471, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 8473756179280619170, 8478833628889826985, 8612208440357175863, 8697424601205169055, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 8698326794961817906, 8709004393777297355, 8727477769544302060, 8760312338504300643, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 8799118153397725683, 8873858923435176895, 8994091295115840290, 9007106680104765185, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 9061219083560670602, 9149947745824492274, 917638920165491138, 9234894663364701749, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 9333057603143916814, 9384605490088500348, 9531326785919727076, 9555688264681862794, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + 9559632696372799208, 9903758755917170407 // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] }; } void Literals() { string[] literals = { // BUG : NumberOfKnownLiteralsAboveThreshold - "(?i)([^a-z]|^)(test)([^a-z]|$)", "(?i)(solarwinds)", "[{0,5}] {1,-16} {2}\t{3,5} {4}\\{5}\n", - "[{0,5}] {1}\n", "[E] {0} {1} {2}", - "\"\\{[0-9a-f-]{36}\\}\"|\"[0-9a-f]{32}\"|\"[0-9a-f]{16}\"", ".CortexPlugin", ".Orion", - "\"EventName\":\"EventManager\",", "\"EventType\":\"Orion\",", - "\\OrionImprovement\\SolarWinds.OrionImprovement.exe", - "0123456789abcdefghijklmnopqrstuvwxyz-_.", "\"sessionId\":\"{0}\",", "\"steps\":[", - "\"Succeeded\":true,", "\"Timestamp\":\"\\/Date({0})\\/\",", "\"userId\":\"{0}\",", - "{0} {1} HTTP/{2}\n", "10140", "144.86.226.0", "154.118.140.0", "172.16.0.0", "18.130.0.0", - "184.72.0.0", "192.168.0.0", "199.201.117.0", "20.140.0.0", "20100", "20220", "217.163.7.0", - "224.0.0.0", "240.0.0.0", "255.240.0.0", "255.254.0.0", "255.255.248.0", "3.0.0.382", - "41.84.159.0", "43140", "4320", "43260", "524287", "583da945-62af-10e8-4902-a8f205c72b2e", - "65280", "71.152.53.0", "74.114.24.0", "8.18.144.0", "87.238.80.0", "96.31.172.0", "983040", - "99.79.0.0", "Administrator", "advapi32.dll", "Apollo", "appsync-api", "avsvmcloud.com", - "api.solarwinds.com", "-root", "-cert", "-universal_ca", "-ca", "-primary_ca", "-timestamp", - "-global", "-secureca", "CloudMonitoring", "MACAddress", "DHCPEnabled", "DHCPServer", - "DNSHostName", "DNSDomainSuffixSearchOrder", "DNSServerSearchOrder", "IPAddress", "IPSubnet", - "DefaultIPGateway", "OSArchitecture", "InstallDate", "Organization", "RegisteredUser", - "fc00::", "fe00::", "fec0::", "ffc0::", "ff00::", "HKCC", "HKCR", "HKCU", "HKDD", - "HKEY_CLASSES_ROOT", "HKEY_CURRENT_CONFIG", "HKEY_CURRENT_USER", "HKEY_DYN_DATA", - "HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography", - "HKEY_PERFOMANCE_DATA", "HKEY_USERS", "HKLM", "HKPD", "HKU", "If-None-Match", - "Microsoft-CryptoAPI/", "Nodes", "Volumes", "Interfaces", "Components", "opensans", - "Organization", "OSArchitecture", "ParentProcessID", "PathName", "ReportWatcherPostpone", - "ReportWatcherRetry", "S-1-5-", "SeRestorePrivilege", "SeShutdownPrivilege", - "SeTakeOwnershipPrivilege", "SolarWinds", "SolarWindsOrionImprovementClient/", - "SourceCodePro", "SourceHanSans", "SourceHanSerif", "SourceSerifPro", "Start", "swip/Events", - "swip/upd/", "swip/Upload.ashx", "SYSTEM", "SYSTEM\\CurrentControlSet\\services", "us-east-1", - "us-east-2", "us-west-2", "fonts/woff/{0}-{1}-{2}{3}.woff2", - "fonts/woff/{0}-{1}-{2}-webfont{3}.woff2", "ph2eifo3n5utg1j8d94qrvbmk0sal76c", - "pki/crl/{0}{1}{2}.crl", "rq3gsalt6u1iyfzop572d49bnx8cvmkewhj", - "Select * From Win32_NetworkAdapterConfiguration where IPEnabled=true", - "Select * From Win32_OperatingSystem", "Select * From Win32_Process", - "Select * From Win32_SystemDriver", "Select * From Win32_UserAccount" + "(?i)([^a-z]|^)(test)([^a-z]|$)", "(?i)(solarwinds)", "[{0,5}] {1,-16} {2}\t{3,5} {4}\\{5}\n", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "[{0,5}] {1}\n", "[E] {0} {1} {2}", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "\"\\{[0-9a-f-]{36}\\}\"|\"[0-9a-f]{32}\"|\"[0-9a-f]{16}\"", ".CortexPlugin", ".Orion", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "\"EventName\":\"EventManager\",", "\"EventType\":\"Orion\",", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "\\OrionImprovement\\SolarWinds.OrionImprovement.exe", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "0123456789abcdefghijklmnopqrstuvwxyz-_.", "\"sessionId\":\"{0}\",", "\"steps\":[", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "\"Succeeded\":true,", "\"Timestamp\":\"\\/Date({0})\\/\",", "\"userId\":\"{0}\",", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "{0} {1} HTTP/{2}\n", "10140", "144.86.226.0", "154.118.140.0", "172.16.0.0", "18.130.0.0", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "184.72.0.0", "192.168.0.0", "199.201.117.0", "20.140.0.0", "20100", "20220", "217.163.7.0", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "224.0.0.0", "240.0.0.0", "255.240.0.0", "255.254.0.0", "255.255.248.0", "3.0.0.382", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "41.84.159.0", "43140", "4320", "43260", "524287", "583da945-62af-10e8-4902-a8f205c72b2e", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "65280", "71.152.53.0", "74.114.24.0", "8.18.144.0", "87.238.80.0", "96.31.172.0", "983040", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "99.79.0.0", "Administrator", "advapi32.dll", "Apollo", "appsync-api", "avsvmcloud.com", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "api.solarwinds.com", "-root", "-cert", "-universal_ca", "-ca", "-primary_ca", "-timestamp", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "-global", "-secureca", "CloudMonitoring", "MACAddress", "DHCPEnabled", "DHCPServer", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "DNSHostName", "DNSDomainSuffixSearchOrder", "DNSServerSearchOrder", "IPAddress", "IPSubnet", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "DefaultIPGateway", "OSArchitecture", "InstallDate", "Organization", "RegisteredUser", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "fc00::", "fe00::", "fec0::", "ffc0::", "ff00::", "HKCC", "HKCR", "HKCU", "HKDD", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "HKEY_CLASSES_ROOT", "HKEY_CURRENT_CONFIG", "HKEY_CURRENT_USER", "HKEY_DYN_DATA", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "HKEY_PERFOMANCE_DATA", "HKEY_USERS", "HKLM", "HKPD", "HKU", "If-None-Match", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "Microsoft-CryptoAPI/", "Nodes", "Volumes", "Interfaces", "Components", "opensans", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "Organization", "OSArchitecture", "ParentProcessID", "PathName", "ReportWatcherPostpone", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "ReportWatcherRetry", "S-1-5-", "SeRestorePrivilege", "SeShutdownPrivilege", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "SeTakeOwnershipPrivilege", "SolarWinds", "SolarWindsOrionImprovementClient/", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "SourceCodePro", "SourceHanSans", "SourceHanSerif", "SourceSerifPro", "Start", "swip/Events", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "swip/upd/", "swip/Upload.ashx", "SYSTEM", "SYSTEM\\CurrentControlSet\\services", "us-east-1", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "us-east-2", "us-west-2", "fonts/woff/{0}-{1}-{2}{3}.woff2", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "fonts/woff/{0}-{1}-{2}-webfont{3}.woff2", "ph2eifo3n5utg1j8d94qrvbmk0sal76c", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "pki/crl/{0}{1}{2}.crl", "rq3gsalt6u1iyfzop572d49bnx8cvmkewhj", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "Select * From Win32_NetworkAdapterConfiguration where IPEnabled=true", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "Select * From Win32_OperatingSystem", "Select * From Win32_Process", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] + "Select * From Win32_SystemDriver", "Select * From Win32_UserAccount" // $ Alert[cs/solorigate/number-of-known-literals-above-threshold] }; - + } void SwallowExceptionTest() @@ -286,15 +286,15 @@ void SwallowExceptionTest() Literals(); } catch // BUG : SwallowEverythingExceptionHandler - {} + {} // $ Alert[cs/solorigate/swallow-everything-exception] try{ Literals(); } catch( Exception e) // BUG : SwallowEverythingExceptionHandler { - // - } + // + } // $ Alert[cs/solorigate/swallow-everything-exception] try{ Literals(); diff --git a/csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/MyOutput.razor b/csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/MyOutput.razor index e583e6b2e9c6..5476d75ccf9b 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/MyOutput.razor +++ b/csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/MyOutput.razor @@ -2,7 +2,7 @@

Value from InputText: @Value

-

Raw value from InputText: @(new MarkupString(Value))

+

Raw value from InputText: @(new MarkupString(Value))

@* $ Alert[cs/web/xss]=r1 *@
@code { diff --git a/csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Pages/TestPage.razor b/csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Pages/TestPage.razor index ac3ccbe19207..7a7a02ec222d 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Pages/TestPage.razor +++ b/csharp/ql/integration-tests/all-platforms/blazor/BlazorTest/Components/Pages/TestPage.razor @@ -8,7 +8,7 @@

Route parameter

Go to: /test/@XssUrl

Parameter from URL: @UrlParam

-

Raw parameter from URL: @((MarkupString)UrlParam)

+

Raw parameter from URL: @((MarkupString)UrlParam)

@* $ Alert[cs/web/xss]=r2 $ Alert[cs/web/xss]=r2 *@
@@ -17,7 +17,7 @@

Query parameter

Go to: /test/?qs=@XssUrl

Parameter from query string: @QueryParam

-

Raw parameter from query string: @(new MarkupString(QueryParam))

+

Raw parameter from query string: @(new MarkupString(QueryParam))

@* $ Alert[cs/web/xss]=r3 $ Alert[cs/web/xss]=r3 *@
@@ -82,7 +82,7 @@
- + @* $ Source[cs/web/xss]=r1 *@
@code { diff --git a/csharp/ql/integration-tests/all-platforms/blazor/XSS.qlref b/csharp/ql/integration-tests/all-platforms/blazor/XSS.qlref index 89b5b951bdb6..a71d47846701 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor/XSS.qlref +++ b/csharp/ql/integration-tests/all-platforms/blazor/XSS.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-079/XSS.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/MyOutput.razor b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/MyOutput.razor index e583e6b2e9c6..5476d75ccf9b 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/MyOutput.razor +++ b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/MyOutput.razor @@ -2,7 +2,7 @@

Value from InputText: @Value

-

Raw value from InputText: @(new MarkupString(Value))

+

Raw value from InputText: @(new MarkupString(Value))

@* $ Alert[cs/web/xss]=r1 *@
@code { diff --git a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/Pages/TestPage.razor b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/Pages/TestPage.razor index ac3ccbe19207..7a7a02ec222d 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/Pages/TestPage.razor +++ b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/Pages/TestPage.razor @@ -8,7 +8,7 @@

Route parameter

Go to: /test/@XssUrl

Parameter from URL: @UrlParam

-

Raw parameter from URL: @((MarkupString)UrlParam)

+

Raw parameter from URL: @((MarkupString)UrlParam)

@* $ Alert[cs/web/xss]=r2 $ Alert[cs/web/xss]=r2 *@
@@ -17,7 +17,7 @@

Query parameter

Go to: /test/?qs=@XssUrl

Parameter from query string: @QueryParam

-

Raw parameter from query string: @(new MarkupString(QueryParam))

+

Raw parameter from query string: @(new MarkupString(QueryParam))

@* $ Alert[cs/web/xss]=r3 $ Alert[cs/web/xss]=r3 *@
@@ -82,7 +82,7 @@
- + @* $ Source[cs/web/xss]=r1 *@
@code { diff --git a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/XSS.qlref b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/XSS.qlref index 89b5b951bdb6..a71d47846701 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/XSS.qlref +++ b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/XSS.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-079/XSS.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/MyOutput.razor b/csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/MyOutput.razor index e583e6b2e9c6..5476d75ccf9b 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/MyOutput.razor +++ b/csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/MyOutput.razor @@ -2,7 +2,7 @@

Value from InputText: @Value

-

Raw value from InputText: @(new MarkupString(Value))

+

Raw value from InputText: @(new MarkupString(Value))

@* $ Alert[cs/web/xss]=r1 *@
@code { diff --git a/csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Pages/TestPage.razor b/csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Pages/TestPage.razor index ac3ccbe19207..7a7a02ec222d 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Pages/TestPage.razor +++ b/csharp/ql/integration-tests/all-platforms/blazor_net_8/BlazorTest/Components/Pages/TestPage.razor @@ -8,7 +8,7 @@

Route parameter

Go to: /test/@XssUrl

Parameter from URL: @UrlParam

-

Raw parameter from URL: @((MarkupString)UrlParam)

+

Raw parameter from URL: @((MarkupString)UrlParam)

@* $ Alert[cs/web/xss]=r2 $ Alert[cs/web/xss]=r2 *@
@@ -17,7 +17,7 @@

Query parameter

Go to: /test/?qs=@XssUrl

Parameter from query string: @QueryParam

-

Raw parameter from query string: @(new MarkupString(QueryParam))

+

Raw parameter from query string: @(new MarkupString(QueryParam))

@* $ Alert[cs/web/xss]=r3 $ Alert[cs/web/xss]=r3 *@
@@ -82,7 +82,7 @@
- + @* $ Source[cs/web/xss]=r1 *@
@code { diff --git a/csharp/ql/integration-tests/all-platforms/blazor_net_8/XSS.qlref b/csharp/ql/integration-tests/all-platforms/blazor_net_8/XSS.qlref index 89b5b951bdb6..a71d47846701 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_net_8/XSS.qlref +++ b/csharp/ql/integration-tests/all-platforms/blazor_net_8/XSS.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-079/XSS.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/integration-tests/all-platforms/standalone/DatabaseQualityDiagnostics.qlref b/csharp/ql/integration-tests/all-platforms/standalone/DatabaseQualityDiagnostics.qlref index 6ff2dbd1d5f5..5d28fb2ecf9a 100644 --- a/csharp/ql/integration-tests/all-platforms/standalone/DatabaseQualityDiagnostics.qlref +++ b/csharp/ql/integration-tests/all-platforms/standalone/DatabaseQualityDiagnostics.qlref @@ -1 +1 @@ -Telemetry/DatabaseQualityDiagnostics.ql \ No newline at end of file +query: Telemetry/DatabaseQualityDiagnostics.ql diff --git a/csharp/ql/integration-tests/all-platforms/standalone_buildless_option/DatabaseQualityDiagnostics.qlref b/csharp/ql/integration-tests/all-platforms/standalone_buildless_option/DatabaseQualityDiagnostics.qlref index 6ff2dbd1d5f5..5d28fb2ecf9a 100644 --- a/csharp/ql/integration-tests/all-platforms/standalone_buildless_option/DatabaseQualityDiagnostics.qlref +++ b/csharp/ql/integration-tests/all-platforms/standalone_buildless_option/DatabaseQualityDiagnostics.qlref @@ -1 +1 @@ -Telemetry/DatabaseQualityDiagnostics.ql \ No newline at end of file +query: Telemetry/DatabaseQualityDiagnostics.ql diff --git a/csharp/ql/src/Security Features/CWE-020/RuntimeChecksBypassBad.cs b/csharp/ql/src/Security Features/CWE-020/RuntimeChecksBypassBad.cs index 5d89942f9fe8..8777e35874a2 100644 --- a/csharp/ql/src/Security Features/CWE-020/RuntimeChecksBypassBad.cs +++ b/csharp/ql/src/Security Features/CWE-020/RuntimeChecksBypassBad.cs @@ -16,6 +16,6 @@ public PersonBad(int age) [OnDeserializing] void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context) { - Age = info.GetInt32("age"); // BAD - write is unsafe + Age = info.GetInt32("age"); // $ Alert // BAD - write is unsafe } } diff --git a/csharp/ql/test/experimental/CWE-918/RequestForgery.cs b/csharp/ql/test/experimental/CWE-918/RequestForgery.cs index 02e851d8df10..2c548337ed91 100644 --- a/csharp/ql/test/experimental/CWE-918/RequestForgery.cs +++ b/csharp/ql/test/experimental/CWE-918/RequestForgery.cs @@ -9,9 +9,9 @@ public class SSRFController : Controller { [HttpPost] [ValidateAntiForgeryToken] - public async Task Bad(string url) + public async Task Bad(string url) // $ Source=r1 { - var request = new HttpRequestMessage(HttpMethod.Get, url); + var request = new HttpRequestMessage(HttpMethod.Get, url); // $ Alert=r1 var client = new HttpClient(); await client.SendAsync(request); diff --git a/csharp/ql/test/experimental/CWE-918/RequestForgery.qlref b/csharp/ql/test/experimental/CWE-918/RequestForgery.qlref index 3d529ae5a2ca..d4f3819dbac4 100644 --- a/csharp/ql/test/experimental/CWE-918/RequestForgery.qlref +++ b/csharp/ql/test/experimental/CWE-918/RequestForgery.qlref @@ -1 +1,2 @@ -experimental/CWE-918/RequestForgery.ql \ No newline at end of file +query: experimental/CWE-918/RequestForgery.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.cs b/csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.cs index 302936c0ea62..3f1bd5927438 100644 --- a/csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.cs +++ b/csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.cs @@ -15,9 +15,9 @@ public class Test // BAD - Hash without a salt. public static String HashPassword(string password, string strAlgName ="SHA256") { - IBuffer passBuff = CryptographicBuffer.ConvertStringToBinary(password, BinaryStringEncoding.Utf8); + IBuffer passBuff = CryptographicBuffer.ConvertStringToBinary(password, BinaryStringEncoding.Utf8); // $ Source HashAlgorithmProvider algProvider = HashAlgorithmProvider.OpenAlgorithm(strAlgName); - IBuffer hashBuff = algProvider.HashData(passBuff); + IBuffer hashBuff = algProvider.HashData(passBuff); // $ Alert return CryptographicBuffer.EncodeToBase64String(hashBuff); } @@ -35,8 +35,8 @@ public static string HashPassword2(string password, string salt, string strAlgNa public static string HashPassword(string password) { SHA256 sha256Hash = SHA256.Create(); - byte[] passBytes = System.Text.Encoding.ASCII.GetBytes(password); - byte[] hashBytes = sha256Hash.ComputeHash(passBytes); + byte[] passBytes = System.Text.Encoding.ASCII.GetBytes(password); // $ Source + byte[] hashBytes = sha256Hash.ComputeHash(passBytes); // $ Alert return Convert.ToBase64String(hashBytes); } @@ -47,11 +47,11 @@ public static string HashPassword2(string password) byte[] saltBytes = GenerateSalt(); // Add the salt to the hash. - byte[] rawSalted = new byte[passBytes.Length + saltBytes.Length]; + byte[] rawSalted = new byte[passBytes.Length + saltBytes.Length]; passBytes.CopyTo(rawSalted, 0); saltBytes.CopyTo(rawSalted, passBytes.Length); - //Create the salted hash. + //Create the salted hash. SHA256 sha256 = SHA256.Create(); byte[] saltedPassBytes = sha256.ComputeHash(rawSalted); @@ -67,8 +67,8 @@ public static string HashPassword2(string password) public static string HashPassword3(string password) { HashAlgorithm hashAlg = new SHA256CryptoServiceProvider(); - byte[] passBytes = System.Text.Encoding.ASCII.GetBytes(password); - byte[] hashBytes = hashAlg.ComputeHash(passBytes); + byte[] passBytes = System.Text.Encoding.ASCII.GetBytes(password); // $ Source + byte[] hashBytes = hashAlg.ComputeHash(passBytes); // $ Alert return Convert.ToBase64String(hashBytes); } @@ -164,7 +164,7 @@ private string GetMD5HashBinHex (string toBeHashed) StringBuilder sb = new StringBuilder (); foreach (byte b in result) sb.Append (b.ToString ("x2")); - + return sb.ToString (); } diff --git a/csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.qlref b/csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.qlref index 4816eabeacbc..ed571d23e490 100644 --- a/csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.qlref +++ b/csharp/ql/test/experimental/Security Features/CWE-759/HashWithoutSalt.qlref @@ -1,2 +1,4 @@ query: experimental/Security Features/CWE-759/HashWithoutSalt.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qlref b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qlref index 527ea9259733..2c6cebb2dfc9 100644 --- a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qlref +++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.qlref @@ -1 +1,2 @@ -experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql \ No newline at end of file +query: experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs index 01af41c4b0c0..95118a986d3c 100644 --- a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs +++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs @@ -98,8 +98,8 @@ public void TestCase01() SaveSigninToken = true }; - tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // BUG delegated-security-validations-always-return-true - tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => true; // BUG delegated-security-validations-always-return-true + tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG delegated-security-validations-always-return-true + tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => true; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG delegated-security-validations-always-return-true tokenValidationParamsBaseline.TokenReplayValidator = (DateTime? expirationTime, string securityToken, TokenValidationParameters validationParameters) => // GOOD { if (securityToken is null) @@ -111,12 +111,12 @@ public void TestCase01() tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetime02(securityToken, validationParameters); // GOOD tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => {return securityToken is null?false:true; }; // GOOD - - tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return true; }; // BUG - tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => !false ; // BUG - tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return securityToken is null?true:true; }; // BUG - tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return ValidateLifetimeAlwaysTrue(securityToken, validationParameters);}; //BUG - tokenValidationParamsBaseline.AudienceValidator = (audiences, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); //BUG + + tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return true; }; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG + tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => !false ; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG + tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return securityToken is null?true:true; }; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG + tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return ValidateLifetimeAlwaysTrue(securityToken, validationParameters);}; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] //BUG + tokenValidationParamsBaseline.AudienceValidator = (audiences, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] //BUG } @@ -134,4 +134,4 @@ internal static bool ValidateLifetimeAlwaysTrue02( return !false; } } -} \ No newline at end of file +} diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-test.cs b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-test.cs index 505aba41416f..9d302e051ba0 100644 --- a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-test.cs +++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled-test.cs @@ -28,16 +28,16 @@ public void TestCase01() ClockSkew = TimeSpan.FromMinutes(5), ValidateActor = false, ValidateIssuerSigningKey = false, - ValidateIssuer = false, // BUG - ValidateAudience = false, // BUG - ValidateLifetime = false, // BUG - RequireExpirationTime = false, // BUG + ValidateIssuer = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG + ValidateAudience = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG + ValidateLifetime = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG + RequireExpirationTime = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG ValidateTokenReplay = false, RequireSignedTokens = false, - RequireAudience = false, // BUG + RequireAudience = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG SaveSigninToken = false }; } } -} \ No newline at end of file +} diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qlref b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qlref index ee07957fa06c..6e09f8b533ba 100644 --- a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qlref +++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.qlref @@ -1 +1,2 @@ -experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.ql \ No newline at end of file +query: experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/Serialization/DefiningDatasetRelatedType.qlref b/csharp/ql/test/experimental/Security Features/Serialization/DefiningDatasetRelatedType.qlref index 7283db95daf5..2000d5d88765 100644 --- a/csharp/ql/test/experimental/Security Features/Serialization/DefiningDatasetRelatedType.qlref +++ b/csharp/ql/test/experimental/Security Features/Serialization/DefiningDatasetRelatedType.qlref @@ -1 +1,2 @@ -experimental/Security Features/Serialization/DefiningDatasetRelatedType.ql \ No newline at end of file +query: experimental/Security Features/Serialization/DefiningDatasetRelatedType.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.qlref b/csharp/ql/test/experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.qlref index 8a8632c6ee3b..767133e00a8e 100644 --- a/csharp/ql/test/experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.qlref +++ b/csharp/ql/test/experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.qlref @@ -1 +1,2 @@ -experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.ql \ No newline at end of file +query: experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.qlref b/csharp/ql/test/experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.qlref index 1593497c7932..62c0d0c79d22 100644 --- a/csharp/ql/test/experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.qlref +++ b/csharp/ql/test/experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.qlref @@ -1 +1,2 @@ -experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.ql \ No newline at end of file +query: experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/Serialization/XmlDeserializationWithDataSet.qlref b/csharp/ql/test/experimental/Security Features/Serialization/XmlDeserializationWithDataSet.qlref index 8054e46f929b..1d26399183e2 100644 --- a/csharp/ql/test/experimental/Security Features/Serialization/XmlDeserializationWithDataSet.qlref +++ b/csharp/ql/test/experimental/Security Features/Serialization/XmlDeserializationWithDataSet.qlref @@ -1 +1,2 @@ -experimental/Security Features/Serialization/XmlDeserializationWithDataSet.ql \ No newline at end of file +query: experimental/Security Features/Serialization/XmlDeserializationWithDataSet.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/Serialization/test0.cs b/csharp/ql/test/experimental/Security Features/Serialization/test0.cs index d2b2e772245a..12ca6a18704e 100644 --- a/csharp/ql/test/experimental/Security Features/Serialization/test0.cs +++ b/csharp/ql/test/experimental/Security Features/Serialization/test0.cs @@ -8,9 +8,9 @@ namespace DataSetSerializationTest { - public class DerivesFromDeprecatedType1 : XmlSerializer // warning:DefiningDatasetRelatedType.ql + public class DerivesFromDeprecatedType1 : XmlSerializer // $ Alert[cs/dataset-serialization/defining-dataset-related-type] // warning:DefiningDatasetRelatedType.ql { - public DataSet MyDataSet { get; set; } // bug:DefiningPotentiallyUnsafeXmlSerializer.ql + public DataSet MyDataSet { get; set; } // $ Alert[cs/dataset-serialization/defining-potentially-unsafe-xml-serializer] // bug:DefiningPotentiallyUnsafeXmlSerializer.ql public DerivesFromDeprecatedType1() { @@ -54,9 +54,9 @@ public override void WriteEndObject(XmlDictionaryWriter writer) { } */ [Serializable()] - public class AttributeSerializer01 // warning:DefiningDatasetRelatedType.ql + public class AttributeSerializer01 // $ Alert[cs/dataset-serialization/defining-dataset-related-type] // warning:DefiningDatasetRelatedType.ql { - private DataSet MyDataSet; // bug:DefiningPotentiallyUnsafeXmlSerializer.ql + private DataSet MyDataSet; // $ Alert[cs/dataset-serialization/defining-potentially-unsafe-xml-serializer] // bug:DefiningPotentiallyUnsafeXmlSerializer.ql AttributeSerializer01() { @@ -83,15 +83,15 @@ static void datatable_readxmlschema_01(string fileName) { DataTable newTable = new DataTable(); System.Xml.XmlTextReader reader = new System.Xml.XmlTextReader(fs); - newTable.ReadXmlSchema(reader); //bug:XmlDeserializationWithDataSet.ql + newTable.ReadXmlSchema(reader); // $ Alert[cs/dataset-serialization/xml-deserialization-with-dataset] //bug:XmlDeserializationWithDataSet.ql } } static void Main(string[] args) { - XmlSerializer x = new XmlSerializer(typeof(DataSet)); // bug:UnsafeTypeUsedDataContractSerializer.ql - XmlSerializer y = new XmlSerializer(typeof(AttributeSerializer01)); //bug:UnsafeTypeUsedDataContractSerializer.ql + XmlSerializer x = new XmlSerializer(typeof(DataSet)); // $ Alert[cs/dataset-serialization/unsafe-type-used-data-contract-serializer] // bug:UnsafeTypeUsedDataContractSerializer.ql + XmlSerializer y = new XmlSerializer(typeof(AttributeSerializer01)); // $ Alert[cs/dataset-serialization/unsafe-type-used-data-contract-serializer] //bug:UnsafeTypeUsedDataContractSerializer.ql Console.WriteLine("Hello World!"); } diff --git a/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qlref b/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qlref index 1215c001b40c..4a8dc07046fe 100644 --- a/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qlref +++ b/csharp/ql/test/experimental/Security Features/backdoor/DangerousNativeFunctionCall.qlref @@ -1 +1,2 @@ -experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql \ No newline at end of file +query: experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.qlref b/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.qlref index f76817aa089e..c2b5b618cec9 100644 --- a/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.qlref +++ b/csharp/ql/test/experimental/Security Features/backdoor/PotentialTimeBomb.qlref @@ -1 +1,2 @@ -experimental/Security Features/backdoor/PotentialTimeBomb.ql \ No newline at end of file +query: experimental/Security Features/backdoor/PotentialTimeBomb.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qlref b/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qlref index d1d0d520d61e..767d3e6961af 100644 --- a/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qlref +++ b/csharp/ql/test/experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.qlref @@ -1 +1,2 @@ -experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql \ No newline at end of file +query: experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/experimental/Security Features/backdoor/test.cs b/csharp/ql/test/experimental/Security Features/backdoor/test.cs index 1aecc80aa83f..c582f5e49269 100644 --- a/csharp/ql/test/experimental/Security Features/backdoor/test.cs +++ b/csharp/ql/test/experimental/Security Features/backdoor/test.cs @@ -29,7 +29,7 @@ class External void TestDangerousNativeFunctionCall() { - InitiateSystemShutdownExW(null, null, 0U, true, true, 2147745794U); // BUG : DangerousNativeFunctionCall + InitiateSystemShutdownExW(null, null, 0U, true, true, 2147745794U); // $ Alert[cs/backdoor/dangerous-native-functions] // BUG : DangerousNativeFunctionCall } ulong GetFvnHash(string s) @@ -66,12 +66,12 @@ void TestProcessNameToHashTaintFlow() void TestTimeBomb() { - DateTime lastWriteTime = System.IO.File.GetLastWriteTime("someFile"); + DateTime lastWriteTime = System.IO.File.GetLastWriteTime("someFile"); // $ Source[cs/backdoor/potential-time-bomb] int num = new Random().Next(288, 336); - if (DateTime.Now.CompareTo(lastWriteTime.AddHours((double)num)) >= 0) // BUG : Potential time bomb, currently not detected + if (DateTime.Now.CompareTo(lastWriteTime.AddHours((double)num)) >= 0) // $ Sink[cs/backdoor/potential-time-bomb] // BUG : Potential time bomb, currently not detected { // Some code here - } + } // $ Alert[cs/backdoor/potential-time-bomb] } -} \ No newline at end of file +} diff --git a/csharp/ql/test/library-tests/arguments/PrintAst.qlref b/csharp/ql/test/library-tests/arguments/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/arguments/PrintAst.qlref +++ b/csharp/ql/test/library-tests/arguments/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/assignments/PrintAst.qlref b/csharp/ql/test/library-tests/assignments/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/assignments/PrintAst.qlref +++ b/csharp/ql/test/library-tests/assignments/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/attributes/PrintAst.qlref b/csharp/ql/test/library-tests/attributes/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/attributes/PrintAst.qlref +++ b/csharp/ql/test/library-tests/attributes/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/comments/PrintAst.qlref b/csharp/ql/test/library-tests/comments/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/comments/PrintAst.qlref +++ b/csharp/ql/test/library-tests/comments/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/compilations/CompilerError.qlref b/csharp/ql/test/library-tests/compilations/CompilerError.qlref index a0132abfe57b..4bceeaba10c1 100644 --- a/csharp/ql/test/library-tests/compilations/CompilerError.qlref +++ b/csharp/ql/test/library-tests/compilations/CompilerError.qlref @@ -1 +1 @@ -Diagnostics/CompilerError.ql \ No newline at end of file +query: Diagnostics/CompilerError.ql diff --git a/csharp/ql/test/library-tests/compilations/CompilerMessage.qlref b/csharp/ql/test/library-tests/compilations/CompilerMessage.qlref index 0628dcba52e5..c4a8ee06a014 100644 --- a/csharp/ql/test/library-tests/compilations/CompilerMessage.qlref +++ b/csharp/ql/test/library-tests/compilations/CompilerMessage.qlref @@ -1 +1 @@ -Diagnostics/CompilerMessage.ql \ No newline at end of file +query: Diagnostics/CompilerMessage.ql diff --git a/csharp/ql/test/library-tests/compilations/ExtractorError.qlref b/csharp/ql/test/library-tests/compilations/ExtractorError.qlref index 14290bb4ace5..d343d7778b82 100644 --- a/csharp/ql/test/library-tests/compilations/ExtractorError.qlref +++ b/csharp/ql/test/library-tests/compilations/ExtractorError.qlref @@ -1 +1 @@ -Diagnostics/ExtractorError.ql +query: Diagnostics/ExtractorError.ql diff --git a/csharp/ql/test/library-tests/compilations/ExtractorMessage.qlref b/csharp/ql/test/library-tests/compilations/ExtractorMessage.qlref index ce6ac3bff0ab..cedb003d69c3 100644 --- a/csharp/ql/test/library-tests/compilations/ExtractorMessage.qlref +++ b/csharp/ql/test/library-tests/compilations/ExtractorMessage.qlref @@ -1 +1 @@ -Diagnostics/ExtractorMessage.ql \ No newline at end of file +query: Diagnostics/ExtractorMessage.ql diff --git a/csharp/ql/test/library-tests/constructors/PrintAst.qlref b/csharp/ql/test/library-tests/constructors/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/constructors/PrintAst.qlref +++ b/csharp/ql/test/library-tests/constructors/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/conversion/operator/PrintAst.qlref b/csharp/ql/test/library-tests/conversion/operator/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/conversion/operator/PrintAst.qlref +++ b/csharp/ql/test/library-tests/conversion/operator/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/csharp11/PrintAst.qlref b/csharp/ql/test/library-tests/csharp11/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/csharp11/PrintAst.qlref +++ b/csharp/ql/test/library-tests/csharp11/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/csharp6/PrintAst.qlref b/csharp/ql/test/library-tests/csharp6/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/csharp6/PrintAst.qlref +++ b/csharp/ql/test/library-tests/csharp6/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/csharp7.1/PrintAst.qlref b/csharp/ql/test/library-tests/csharp7.1/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/csharp7.1/PrintAst.qlref +++ b/csharp/ql/test/library-tests/csharp7.1/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/csharp7.2/PrintAst.qlref b/csharp/ql/test/library-tests/csharp7.2/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/csharp7.2/PrintAst.qlref +++ b/csharp/ql/test/library-tests/csharp7.2/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/csharp7.3/PrintAst.qlref b/csharp/ql/test/library-tests/csharp7.3/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/csharp7.3/PrintAst.qlref +++ b/csharp/ql/test/library-tests/csharp7.3/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/csharp7/PrintAst.qlref b/csharp/ql/test/library-tests/csharp7/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/csharp7/PrintAst.qlref +++ b/csharp/ql/test/library-tests/csharp7/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/csharp8/PrintAst.qlref b/csharp/ql/test/library-tests/csharp8/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/csharp8/PrintAst.qlref +++ b/csharp/ql/test/library-tests/csharp8/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/csharp9/PrintAst.qlref b/csharp/ql/test/library-tests/csharp9/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/csharp9/PrintAst.qlref +++ b/csharp/ql/test/library-tests/csharp9/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/dataflow/implicittostring/PrintAst.qlref b/csharp/ql/test/library-tests/dataflow/implicittostring/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/dataflow/implicittostring/PrintAst.qlref +++ b/csharp/ql/test/library-tests/dataflow/implicittostring/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/dataflow/tuples/PrintAst.qlref b/csharp/ql/test/library-tests/dataflow/tuples/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/dataflow/tuples/PrintAst.qlref +++ b/csharp/ql/test/library-tests/dataflow/tuples/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/definitions/PrintAst.qlref b/csharp/ql/test/library-tests/definitions/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/definitions/PrintAst.qlref +++ b/csharp/ql/test/library-tests/definitions/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/definitions/definitions.qlref b/csharp/ql/test/library-tests/definitions/definitions.qlref index 11e03f5ab070..89fab02d1037 100644 --- a/csharp/ql/test/library-tests/definitions/definitions.qlref +++ b/csharp/ql/test/library-tests/definitions/definitions.qlref @@ -1 +1 @@ -definitions.ql \ No newline at end of file +query: definitions.ql diff --git a/csharp/ql/test/library-tests/delegates/PrintAst.qlref b/csharp/ql/test/library-tests/delegates/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/delegates/PrintAst.qlref +++ b/csharp/ql/test/library-tests/delegates/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.qlref b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.qlref index 7068705cc1be..498f8bf078e9 100644 --- a/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.qlref +++ b/csharp/ql/test/library-tests/diagnostics/DiagnosticExtractorErrors.qlref @@ -1 +1 @@ -Diagnostics/DiagnosticExtractionErrors.ql +query: Diagnostics/DiagnosticExtractionErrors.ql diff --git a/csharp/ql/test/library-tests/diagnostics/ExtractedFiles.qlref b/csharp/ql/test/library-tests/diagnostics/ExtractedFiles.qlref index e900e9c5314b..58bc903a431d 100644 --- a/csharp/ql/test/library-tests/diagnostics/ExtractedFiles.qlref +++ b/csharp/ql/test/library-tests/diagnostics/ExtractedFiles.qlref @@ -1 +1 @@ -Diagnostics/ExtractedFiles.ql +query: Diagnostics/ExtractedFiles.ql diff --git a/csharp/ql/test/library-tests/dynamic/PrintAst.qlref b/csharp/ql/test/library-tests/dynamic/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/dynamic/PrintAst.qlref +++ b/csharp/ql/test/library-tests/dynamic/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/enums/PrintAst.qlref b/csharp/ql/test/library-tests/enums/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/enums/PrintAst.qlref +++ b/csharp/ql/test/library-tests/enums/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/events/PrintAst.qlref b/csharp/ql/test/library-tests/events/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/events/PrintAst.qlref +++ b/csharp/ql/test/library-tests/events/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/exceptions/PrintAst.qlref b/csharp/ql/test/library-tests/exceptions/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/exceptions/PrintAst.qlref +++ b/csharp/ql/test/library-tests/exceptions/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/expressions/PrintAst.qlref b/csharp/ql/test/library-tests/expressions/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/expressions/PrintAst.qlref +++ b/csharp/ql/test/library-tests/expressions/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/extension/PrintAst.qlref b/csharp/ql/test/library-tests/extension/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/extension/PrintAst.qlref +++ b/csharp/ql/test/library-tests/extension/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/fields/PrintAst.qlref b/csharp/ql/test/library-tests/fields/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/fields/PrintAst.qlref +++ b/csharp/ql/test/library-tests/fields/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/filters/ClassifyFiles/ClassifyFiles.qlref b/csharp/ql/test/library-tests/filters/ClassifyFiles/ClassifyFiles.qlref index 638bf4567627..612f5dfb3322 100644 --- a/csharp/ql/test/library-tests/filters/ClassifyFiles/ClassifyFiles.qlref +++ b/csharp/ql/test/library-tests/filters/ClassifyFiles/ClassifyFiles.qlref @@ -1 +1 @@ -filters/ClassifyFiles.ql \ No newline at end of file +query: filters/ClassifyFiles.ql diff --git a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_Pages_TestPage_razor.g.cs b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_Pages_TestPage_razor.g.cs index 8732f8c7e4be..4dcde99a22f1 100644 --- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_Pages_TestPage_razor.g.cs +++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_Pages_TestPage_razor.g.cs @@ -135,7 +135,7 @@ protected override void BuildRenderTree(global::Microsoft.AspNetCore.Components. __builder.AddContent(18, "Raw parameter from URL: "); __builder.AddContent(19, #nullable restore -(MarkupString)UrlParam +(MarkupString)UrlParam // $ Alert=r1 $ Alert=r1 #line default #line hidden @@ -185,7 +185,7 @@ protected override void BuildRenderTree(global::Microsoft.AspNetCore.Components. __builder.AddContent(35, "Raw parameter from query string: "); __builder.AddContent(36, #nullable restore -new MarkupString(QueryParam) +new MarkupString(QueryParam) // $ Alert=r2 $ Alert=r2 #line default #line hidden diff --git a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Name.cs b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Name.cs index a9d098470e44..d83db4eb0711 100644 --- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Name.cs +++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Name.cs @@ -10,7 +10,7 @@ protected override void BuildRenderTree(Microsoft.AspNetCore.Components.Renderin { builder.OpenElement(0, "div"); builder.OpenElement(1, "p"); - builder.AddContent(2, (MarkupString)TheName); + builder.AddContent(2, (MarkupString)TheName); // $ Alert=r3 $ Alert=r4 builder.CloseElement(); builder.CloseElement(); } @@ -19,4 +19,4 @@ protected override void BuildRenderTree(Microsoft.AspNetCore.Components.Renderin [Parameter] public string TheName { get; set; } } -} \ No newline at end of file +} diff --git a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/NameList.cs b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/NameList.cs index ceffb35303e5..6b6b82014d3d 100644 --- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/NameList.cs +++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/NameList.cs @@ -28,7 +28,7 @@ protected override void BuildRenderTree(Microsoft.AspNetCore.Components.Renderin builder.OpenElement(6, "p"); builder.AddContent(7, "Name: "); builder.OpenComponent(8); - builder.AddComponentParameter(9, nameof(VulnerableBlazorApp.Components.Name.TheName), Name); + builder.AddComponentParameter(9, nameof(VulnerableBlazorApp.Components.Name.TheName), Name); // $ Source=r4 builder.CloseComponent(); builder.CloseElement(); } @@ -47,4 +47,4 @@ protected override void OnParametersSet() public List Names { get; set; } = new List(); } -} \ No newline at end of file +} diff --git a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/NameList2.cs b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/NameList2.cs index d27d6f2dcde9..4e06a14e8247 100644 --- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/NameList2.cs +++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/NameList2.cs @@ -28,7 +28,7 @@ protected override void BuildRenderTree(Microsoft.AspNetCore.Components.Renderin builder.OpenElement(6, "p"); builder.AddContent(7, "Name: "); builder.OpenComponent(8); - builder.AddComponentParameter(9, "TheName", Name); + builder.AddComponentParameter(9, "TheName", Name); // $ Source=r3 builder.CloseComponent(); builder.CloseElement(); } @@ -47,4 +47,4 @@ protected override void OnParametersSet() public List Names { get; set; } = new List(); } -} \ No newline at end of file +} diff --git a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.qlref b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.qlref index 89b5b951bdb6..a71d47846701 100644 --- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.qlref +++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Xss.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-079/XSS.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/library-tests/generics/PrintAst.qlref b/csharp/ql/test/library-tests/generics/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/generics/PrintAst.qlref +++ b/csharp/ql/test/library-tests/generics/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/goto/PrintAst.qlref b/csharp/ql/test/library-tests/goto/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/goto/PrintAst.qlref +++ b/csharp/ql/test/library-tests/goto/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/indexers/PrintAst.qlref b/csharp/ql/test/library-tests/indexers/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/indexers/PrintAst.qlref +++ b/csharp/ql/test/library-tests/indexers/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/initializers/PrintAst.qlref b/csharp/ql/test/library-tests/initializers/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/initializers/PrintAst.qlref +++ b/csharp/ql/test/library-tests/initializers/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/linq/PrintAst.qlref b/csharp/ql/test/library-tests/linq/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/linq/PrintAst.qlref +++ b/csharp/ql/test/library-tests/linq/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/members/PrintAst.qlref b/csharp/ql/test/library-tests/members/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/members/PrintAst.qlref +++ b/csharp/ql/test/library-tests/members/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/methods/PrintAst.qlref b/csharp/ql/test/library-tests/methods/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/methods/PrintAst.qlref +++ b/csharp/ql/test/library-tests/methods/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/nameof/PrintAst.qlref b/csharp/ql/test/library-tests/nameof/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/nameof/PrintAst.qlref +++ b/csharp/ql/test/library-tests/nameof/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/namespaces/PrintAst.qlref b/csharp/ql/test/library-tests/namespaces/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/namespaces/PrintAst.qlref +++ b/csharp/ql/test/library-tests/namespaces/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/nestedtypes/PrintAst.qlref b/csharp/ql/test/library-tests/nestedtypes/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/nestedtypes/PrintAst.qlref +++ b/csharp/ql/test/library-tests/nestedtypes/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/operators/PrintAst.qlref b/csharp/ql/test/library-tests/operators/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/operators/PrintAst.qlref +++ b/csharp/ql/test/library-tests/operators/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/partial/PrintAst.qlref b/csharp/ql/test/library-tests/partial/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/partial/PrintAst.qlref +++ b/csharp/ql/test/library-tests/partial/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/properties/PrintAst.qlref b/csharp/ql/test/library-tests/properties/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/properties/PrintAst.qlref +++ b/csharp/ql/test/library-tests/properties/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/statements/PrintAst.qlref b/csharp/ql/test/library-tests/statements/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/statements/PrintAst.qlref +++ b/csharp/ql/test/library-tests/statements/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/stringinterpolation/PrintAst.qlref b/csharp/ql/test/library-tests/stringinterpolation/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/stringinterpolation/PrintAst.qlref +++ b/csharp/ql/test/library-tests/stringinterpolation/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/types/PrintAst.qlref b/csharp/ql/test/library-tests/types/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/types/PrintAst.qlref +++ b/csharp/ql/test/library-tests/types/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/library-tests/unsafe/PrintAst.qlref b/csharp/ql/test/library-tests/unsafe/PrintAst.qlref index f867dd01f9f8..1db66182b0ab 100644 --- a/csharp/ql/test/library-tests/unsafe/PrintAst.qlref +++ b/csharp/ql/test/library-tests/unsafe/PrintAst.qlref @@ -1 +1 @@ -shared/PrintAst.ql \ No newline at end of file +query: shared/PrintAst.ql diff --git a/csharp/ql/test/query-tests/API Abuse/CallToGCCollect/CallToGCCollect.qlref b/csharp/ql/test/query-tests/API Abuse/CallToGCCollect/CallToGCCollect.qlref index ca6961e370bf..c911197abb35 100644 --- a/csharp/ql/test/query-tests/API Abuse/CallToGCCollect/CallToGCCollect.qlref +++ b/csharp/ql/test/query-tests/API Abuse/CallToGCCollect/CallToGCCollect.qlref @@ -1 +1,2 @@ -API Abuse/CallToGCCollect.ql \ No newline at end of file +query: API Abuse/CallToGCCollect.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/CallToGCCollect/CallToGCCollectBad.cs b/csharp/ql/test/query-tests/API Abuse/CallToGCCollect/CallToGCCollectBad.cs index acc30b87c8d9..b081d201f10d 100644 --- a/csharp/ql/test/query-tests/API Abuse/CallToGCCollect/CallToGCCollectBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/CallToGCCollect/CallToGCCollectBad.cs @@ -4,6 +4,6 @@ class Bad { void M() { - GC.Collect(); + GC.Collect(); // $ Alert } } diff --git a/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethod.cs b/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethod.cs index c546c406f310..ea0ffeeb7645 100644 --- a/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethod.cs +++ b/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethod.cs @@ -16,7 +16,7 @@ static void NotObsoleteMethod() static void Main(string[] args) { // BAD: Call to obsolete method - ObsoleteMethod(); + ObsoleteMethod(); // $ Alert // GOOD: Call to non-obsolete method NotObsoleteMethod(); diff --git a/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethod.qlref b/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethod.qlref index 08b2c9a51d4e..028fb010e8ef 100644 --- a/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethod.qlref +++ b/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethod.qlref @@ -1 +1,2 @@ -API Abuse/CallToObsoleteMethod.ql \ No newline at end of file +query: API Abuse/CallToObsoleteMethod.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethodBad.cs b/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethodBad.cs index c8c10de283d5..9ea4f5b80a44 100644 --- a/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethodBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/CallToObsoleteMethod/CallToObsoleteMethodBad.cs @@ -4,7 +4,7 @@ class Bad { void M() { - Logger.Log("Hello, World!"); + Logger.Log("Hello, World!"); // $ Alert } static class Logger diff --git a/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEquals.cs b/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEquals.cs index a2e5f7333e9e..865b31f2ca07 100644 --- a/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEquals.cs +++ b/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEquals.cs @@ -1,7 +1,7 @@ using System; // BAD -class Incorrect +class Incorrect // $ Alert { public static bool operator ==(Incorrect a, Incorrect b) => default(bool); public static bool operator !=(Incorrect a, Incorrect b) => !(a == b); @@ -21,7 +21,7 @@ class Correct } // BAD: needs to redefine Equals -class IncorrectOverrides : Correct +class IncorrectOverrides : Correct // $ Alert { public static bool operator ==(IncorrectOverrides a, IncorrectOverrides b) => default(bool); public static bool operator !=(IncorrectOverrides a, IncorrectOverrides b) => !(a == b); @@ -47,7 +47,7 @@ static void Main(string[] args) } // BAD: should also implement Equals. -class MyEquatable : IEquatable +class MyEquatable : IEquatable // $ Alert { public bool Equals(MyEquatable other) { diff --git a/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEquals.qlref b/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEquals.qlref index 5ffe8a70dec4..9b025e76c304 100644 --- a/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEquals.qlref +++ b/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEquals.qlref @@ -1 +1,2 @@ -API Abuse/ClassDoesNotImplementEquals.ql \ No newline at end of file +query: API Abuse/ClassDoesNotImplementEquals.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEqualsBad.cs b/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEqualsBad.cs index 619f462a96c8..305bd87c2cf8 100644 --- a/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEqualsBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/ClassDoesNotImplementEquals/ClassDoesNotImplementEqualsBad.cs @@ -21,7 +21,7 @@ public override bool Equals(object obj) } } - class GasolineCar : Car + class GasolineCar : Car // $ Alert { protected bool unleaded; diff --git a/csharp/ql/test/query-tests/API Abuse/ClassImplementsICloneable/ClassImplementsICloneable.qlref b/csharp/ql/test/query-tests/API Abuse/ClassImplementsICloneable/ClassImplementsICloneable.qlref index e597d142a2d1..65eb6ca729d1 100644 --- a/csharp/ql/test/query-tests/API Abuse/ClassImplementsICloneable/ClassImplementsICloneable.qlref +++ b/csharp/ql/test/query-tests/API Abuse/ClassImplementsICloneable/ClassImplementsICloneable.qlref @@ -1 +1,2 @@ -API Abuse/ClassImplementsICloneable.ql \ No newline at end of file +query: API Abuse/ClassImplementsICloneable.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/ClassImplementsICloneable/ClassImplementsICloneableBad.cs b/csharp/ql/test/query-tests/API Abuse/ClassImplementsICloneable/ClassImplementsICloneableBad.cs index 0999bd87d281..e1636158bf2f 100644 --- a/csharp/ql/test/query-tests/API Abuse/ClassImplementsICloneable/ClassImplementsICloneableBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/ClassImplementsICloneable/ClassImplementsICloneableBad.cs @@ -8,7 +8,7 @@ class Thing public Thing(int i) { I = i; } } - class Shallow : ICloneable + class Shallow : ICloneable // $ Alert { public Thing T { get; set; } public Shallow(Thing t) { T = t; } @@ -17,7 +17,7 @@ class Shallow : ICloneable public object Clone() { return new Shallow(T); } } - class Deep : ICloneable + class Deep : ICloneable // $ Alert { public Thing T { get; set; } public Deep(Thing t) { T = t; } diff --git a/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnException.cs b/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnException.cs index acde0fc477f7..31505eb740c6 100644 --- a/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnException.cs +++ b/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnException.cs @@ -45,17 +45,17 @@ public void Method() // BAD: No Dispose call in case of exception SqlConnection c1d = new SqlConnection(); c1d.Open(); - c1d.Dispose(); + c1d.Dispose(); // $ Alert // BAD: No Dispose call in case of exception SqlConnection c1e = new SqlConnection(); Throw1(c1e); - c1e.Dispose(); + c1e.Dispose(); // $ Alert // BAD: No Dispose call in case of exception SqlConnection c1f = new SqlConnection(); Throw2(c1f); - c1f.Dispose(); + c1f.Dispose(); // $ Alert // GOOD: using declaration using SqlConnection c2 = new SqlConnection(""); diff --git a/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnException.qlref b/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnException.qlref index d55f9b7dcba7..4273ca0a55c6 100644 --- a/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnException.qlref +++ b/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnException.qlref @@ -1 +1,2 @@ -API Abuse/DisposeNotCalledOnException.ql \ No newline at end of file +query: API Abuse/DisposeNotCalledOnException.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnExceptionBad.cs b/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnExceptionBad.cs index c0674285bba1..22827a1e3d03 100644 --- a/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnExceptionBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/DisposeNotCalledOnException/DisposeNotCalledOnExceptionBad.cs @@ -11,8 +11,8 @@ public SqlDataReader GetAllCustomers() var cmd = new SqlCommand("SELECT * FROM Customers", conn); var ret = cmd.ExecuteReader(); - cmd.Dispose(); - conn.Dispose(); + cmd.Dispose(); // $ Alert + conn.Dispose(); // $ Alert return ret; } diff --git a/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCode.cs b/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCode.cs index 8e8b8f8430b3..f05764f99c55 100644 --- a/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCode.cs +++ b/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCode.cs @@ -1,6 +1,6 @@ using System; -class ClassMissingGetHashCode +class ClassMissingGetHashCode // $ Alert { public override bool Equals(object other) { @@ -13,7 +13,7 @@ public override bool Equals(object other) } } -class ClassMissingEquals +class ClassMissingEquals // $ Alert { public new bool Equals(object other) { // not overridden diff --git a/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCode.qlref b/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCode.qlref index 6425e440f739..26171a4ca75d 100644 --- a/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCode.qlref +++ b/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCode.qlref @@ -1 +1,2 @@ -API Abuse/InconsistentEqualsGetHashCode.ql \ No newline at end of file +query: API Abuse/InconsistentEqualsGetHashCode.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCodeBad.cs b/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCodeBad.cs index 6b3b95966dc9..00da432846f3 100644 --- a/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCodeBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/InconsistentEqualsGetHashCode/InconsistentEqualsGetHashCodeBad.cs @@ -1,6 +1,6 @@ using System; -class Bad +class Bad // $ Alert { private int id; diff --git a/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignature.cs b/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignature.cs index 5b5780ed9778..5c6744472116 100644 --- a/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignature.cs +++ b/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignature.cs @@ -2,7 +2,7 @@ class C1 { - public int CompareTo(T other) => throw null; // BAD + public int CompareTo(T other) => throw null; // $ Alert // BAD } class C2 { } diff --git a/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignature.qlref b/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignature.qlref index 23abf6ab339d..afab98e27ce5 100644 --- a/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignature.qlref +++ b/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignature.qlref @@ -1 +1,2 @@ -API Abuse/IncorrectCompareToSignature.ql \ No newline at end of file +query: API Abuse/IncorrectCompareToSignature.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignatureBad.cs b/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignatureBad.cs index efeb55ce65bc..33b1e3ad8d45 100644 --- a/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignatureBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/IncorrectCompareToSignature/IncorrectCompareToSignatureBad.cs @@ -2,5 +2,5 @@ class Bad { - public int CompareTo(Bad b) => 0; + public int CompareTo(Bad b) => 0; // $ Alert } diff --git a/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignature.cs b/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignature.cs index effb17a558a2..f858cc35a0fc 100644 --- a/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignature.cs +++ b/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignature.cs @@ -3,7 +3,7 @@ // BAD class Incorrect { - public bool Equals(Incorrect other) => false; + public bool Equals(Incorrect other) => false; // $ Alert } // GOOD diff --git a/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignature.qlref b/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignature.qlref index f56496da8be1..c05a5f0af8d0 100644 --- a/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignature.qlref +++ b/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignature.qlref @@ -1 +1,2 @@ -API Abuse/IncorrectEqualsSignature.ql \ No newline at end of file +query: API Abuse/IncorrectEqualsSignature.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignatureBad.cs b/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignatureBad.cs index 723110d1de11..7b03d029eb8a 100644 --- a/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignatureBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/IncorrectEqualsSignature/IncorrectEqualsSignatureBad.cs @@ -9,6 +9,6 @@ public Bad(int Id) this.id = Id; } - public bool Equals(Bad b) => + public bool Equals(Bad b) => // $ Alert this.id == b.id; } diff --git a/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCall.cs b/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCall.cs index dd069476b1bb..b71c2f2a5c93 100644 --- a/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCall.cs +++ b/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCall.cs @@ -20,7 +20,7 @@ class C1 : IDisposable C1 Field1; // GOOD C1 Field2; // BAD - public virtual void Dispose() + public virtual void Dispose() // $ Alert { Field1.Dispose(); } @@ -31,7 +31,7 @@ class C2 : C1 C1 Field1; // GOOD C1 Field2; // BAD - public override void Dispose() + public override void Dispose() // $ Alert { base.Dispose(); Field1.Dispose(); @@ -49,7 +49,7 @@ class C5 : C4 C1 Field1; // GOOD C1 Field2; // BAD - public override void Dispose(bool disposing) + public override void Dispose(bool disposing) // $ Alert { base.Dispose(disposing); if (disposing) @@ -64,7 +64,7 @@ class C6 : Component C1 Field1; // GOOD C1 Field2; // BAD - protected override void Dispose(bool disposing) + protected override void Dispose(bool disposing) // $ Alert { base.Dispose(disposing); if (disposing) diff --git a/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCall.qlref b/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCall.qlref index a1d172302306..442cf4780c15 100644 --- a/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCall.qlref +++ b/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCall.qlref @@ -1 +1,2 @@ -API Abuse/MissingDisposeCall.ql \ No newline at end of file +query: API Abuse/MissingDisposeCall.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCallBad.cs b/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCallBad.cs index 6386abc84003..ed3a1851c87f 100644 --- a/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCallBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/MissingDisposeCall/MissingDisposeCallBad.cs @@ -6,7 +6,7 @@ class Bad : IDisposable private FileStream stream1 = new FileStream("a.txt", FileMode.Open); private FileStream stream2 = new FileStream("b.txt", FileMode.Open); - public void Dispose() + public void Dispose() // $ Alert { stream1.Dispose(); } diff --git a/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethod.cs b/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethod.cs index 1e71bba55eb2..998bc757cd55 100644 --- a/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethod.cs +++ b/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethod.cs @@ -25,7 +25,7 @@ public virtual void Dispose() } } -class C2 : C1 +class C2 : C1 // $ Alert { C2 Field; // BAD } @@ -41,13 +41,13 @@ public override void Dispose() } } -class WebPage : Page +class WebPage : Page // $ Alert { C1 Field1; // BAD Control Field2; // GOOD } -class WebControl : Control +class WebControl : Control // $ Alert { C1 Field1; // BAD Control Field2; // GOOD @@ -73,12 +73,12 @@ public override void Dispose(bool disposing) } } -class C6 : C4 +class C6 : C4 // $ Alert { C2 Field; // BAD } -class C7 : Component +class C7 : Component // $ Alert { C2 Field; // BAD } @@ -97,7 +97,7 @@ protected override void Dispose(bool disposing) } } -class C9 : C1 +class C9 : C1 // $ Alert { C2 Field; // BAD diff --git a/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethod.qlref b/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethod.qlref index 61be6bbcf704..d9cb769bef36 100644 --- a/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethod.qlref +++ b/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethod.qlref @@ -1 +1,2 @@ -API Abuse/MissingDisposeMethod.ql \ No newline at end of file +query: API Abuse/MissingDisposeMethod.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethodBad.cs b/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethodBad.cs index db8067735cfb..5cc9d68d7fae 100644 --- a/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethodBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/MissingDisposeMethod/MissingDisposeMethodBad.cs @@ -11,7 +11,7 @@ public virtual void Dispose() } } -class Bad : BadBase +class Bad : BadBase // $ Alert { private FileStream stream2 = new FileStream("b.txt", FileMode.Open); } diff --git a/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethod.cs b/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethod.cs index b2cb30b17ada..a35d0d0b51a5 100644 --- a/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethod.cs +++ b/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethod.cs @@ -12,13 +12,13 @@ class C1 class C2 : C1 { // BAD: M1 does not override C1.M1 - public int M1() { return 1; } + public int M1() { return 1; } // $ Alert // GOOD: M2 overrides using the explicit keyword "override" public override int M2() { return 2; } // BAD: M3 does not override C1.M3 - public IEnumerable M3() { return null; } + public IEnumerable M3() { return null; } // $ Alert // GOOD: M4 overrides using the explicit keyword "override" public override IEnumerable M4() { return null; } diff --git a/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethod.qlref b/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethod.qlref index fb31441316c0..7fe57a6c15cb 100644 --- a/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethod.qlref +++ b/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethod.qlref @@ -1 +1,2 @@ -API Abuse/NonOverridingMethod.ql \ No newline at end of file +query: API Abuse/NonOverridingMethod.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethodBad.cs b/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethodBad.cs index cb76d9ab9947..8641dd60fbe7 100644 --- a/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethodBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/NonOverridingMethod/NonOverridingMethodBad.cs @@ -7,6 +7,6 @@ public virtual void Foo() { } class Sub : Super { - public void Foo() { } + public void Foo() { } // $ Alert } } diff --git a/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEquals.cs b/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEquals.cs index 08219f61a73e..97af033f9346 100644 --- a/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEquals.cs +++ b/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEquals.cs @@ -3,16 +3,16 @@ class NullArgumentToEquals void M() { int i = 0; - i.Equals(null); // BAD + i.Equals(null); // $ Alert // BAD int? i2 = null; i2.Equals(null); // GOOD C c = null; - c.Equals(null); // BAD + c.Equals(null); // $ Alert // BAD object o = null; - o.Equals(null); // BAD + o.Equals(null); // $ Alert // BAD } class C diff --git a/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEquals.qlref b/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEquals.qlref index c6b40febef05..12129a164b04 100644 --- a/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEquals.qlref +++ b/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEquals.qlref @@ -1 +1,2 @@ -API Abuse/NullArgumentToEquals.ql \ No newline at end of file +query: API Abuse/NullArgumentToEquals.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEqualsBad.cs b/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEqualsBad.cs index 612aaa2b1ac6..932ced4ef4a2 100644 --- a/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEqualsBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/NullArgumentToEquals/NullArgumentToEqualsBad.cs @@ -1,4 +1,4 @@ class Bad { - bool IsNull(object o) => o.Equals(null); + bool IsNull(object o) => o.Equals(null); // $ Alert } diff --git a/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValue.cs b/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValue.cs index cf290a84bcbb..3a03dddc63ce 100644 --- a/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValue.cs +++ b/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValue.cs @@ -21,7 +21,7 @@ static void Main(string[] args) ret = intHashSet.Add(42); // BAD: - stringHashSet.Add("42"); + stringHashSet.Add("42"); // $ Alert } } @@ -64,8 +64,8 @@ static void Main(string[] args) ret = s.Read(null, 0, 0); ret = s.Read(null, 0, 0); ret = s.Read(null, 0, 0); - s.Read(null, 0, 0); // always check - s.ReadByte(); // always check + s.Read(null, 0, 0); // $ Alert // always check + s.ReadByte(); // $ Alert // always check } } @@ -82,7 +82,7 @@ static void M() ret1 = M1(); ret1 = M1(); ret1 = M1(); - M1(); // BAD + M1(); // $ Alert // BAD M1(); // GOOD var ret2 = M2(); @@ -103,7 +103,7 @@ static void M() ret2 = M2(); ret2 = M2(); ret2 = M2(); - M2(); // BAD + M2(); // $ Alert // BAD var ret3 = M3(null); ret3 = M3(null); @@ -115,7 +115,7 @@ static void M() ret3 = M3(null); ret3 = M3(null); M3(null); // GOOD - M3(null); // BAD + M3(null); // $ Alert // BAD M3(null); // GOOD } diff --git a/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValue.qlref b/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValue.qlref index ca9751d2857a..c04faa8008ad 100644 --- a/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValue.qlref +++ b/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValue.qlref @@ -1 +1,2 @@ -API Abuse/UncheckedReturnValue.ql \ No newline at end of file +query: API Abuse/UncheckedReturnValue.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValueBad.cs b/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValueBad.cs index 394906e70241..6d9743172c29 100644 --- a/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValueBad.cs +++ b/csharp/ql/test/query-tests/API Abuse/UncheckedReturnValue/UncheckedReturnValueBad.cs @@ -26,13 +26,13 @@ public void IgnoreOne() if (DoPrint("I")) Console.WriteLine("I"); - DoPrint("J"); + DoPrint("J"); // $ Alert } void IgnoreRead(string path) { var file = new byte[10]; using (var f = new FileStream(path, FileMode.Open)) - f.Read(file, 0, file.Length); + f.Read(file, 0, file.Length); // $ Alert } } diff --git a/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/BlockCodeResponseWrite.qlref b/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/BlockCodeResponseWrite.qlref index 40da4c8a2d57..35d5389b7189 100644 --- a/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/BlockCodeResponseWrite.qlref +++ b/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/BlockCodeResponseWrite.qlref @@ -1 +1,2 @@ -ASP/BlockCodeResponseWrite.ql +query: ASP/BlockCodeResponseWrite.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/BlockCodeResponseWriteBad.aspx b/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/BlockCodeResponseWriteBad.aspx index 1e4a0fffc015..ebf2cadc8b3f 100644 --- a/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/BlockCodeResponseWriteBad.aspx +++ b/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/BlockCodeResponseWriteBad.aspx @@ -2,6 +2,6 @@ -

2 + 3 = <%Response.Write(2 + 3)%>

+

2 + 3 = <%Response.Write(2 + 3)%>

<%-- $ Alert[cs/asp/response-write] --%> diff --git a/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/test.aspx b/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/test.aspx index 1e4a0fffc015..ebf2cadc8b3f 100644 --- a/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/test.aspx +++ b/csharp/ql/test/query-tests/ASP/BlockCodeResponseWrite/test.aspx @@ -2,6 +2,6 @@ -

2 + 3 = <%Response.Write(2 + 3)%>

+

2 + 3 = <%Response.Write(2 + 3)%>

<%-- $ Alert[cs/asp/response-write] --%> diff --git a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCode.qlref b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCode.qlref index 85395099ce9a..9a5bdd6c37e6 100644 --- a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCode.qlref +++ b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCode.qlref @@ -1 +1,2 @@ -ASP/ComplexInlineCode.ql +query: ASP/ComplexInlineCode.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCodeBad.aspx b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCodeBad.aspx index f4457d89606f..b8e0a25ac2c8 100644 --- a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCodeBad.aspx +++ b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/ComplexInlineCodeBad.aspx @@ -15,6 +15,6 @@ } else { ec.Emit (Response, OpCodes.Ldloca, builder); } -%> +%> <%-- $ Alert[cs/asp/complex-inline-code] --%> diff --git a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/test.aspx b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/test.aspx index 1c2d09586ab5..39055702e35c 100644 --- a/csharp/ql/test/query-tests/ASP/ComplexInlineCode/test.aspx +++ b/csharp/ql/test/query-tests/ASP/ComplexInlineCode/test.aspx @@ -9,7 +9,7 @@ Response.write(3 + 2); } End If -%>

+%>

<%-- $ Alert[cs/asp/complex-inline-code] --%>

2 + 3 = <%=2 + 3%>

diff --git a/csharp/ql/test/query-tests/ASP/NonInternationalizedText/NonInternationalizedText.qlref b/csharp/ql/test/query-tests/ASP/NonInternationalizedText/NonInternationalizedText.qlref index 16700623f76e..0ca3c026d73e 100644 --- a/csharp/ql/test/query-tests/ASP/NonInternationalizedText/NonInternationalizedText.qlref +++ b/csharp/ql/test/query-tests/ASP/NonInternationalizedText/NonInternationalizedText.qlref @@ -1 +1,2 @@ -ASP/NonInternationalizedText.ql +query: ASP/NonInternationalizedText.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/ASP/NonInternationalizedText/NonInternationalizedTextBad.aspx b/csharp/ql/test/query-tests/ASP/NonInternationalizedText/NonInternationalizedTextBad.aspx index 2d5e7757d3af..935a9c19e0ef 100644 --- a/csharp/ql/test/query-tests/ASP/NonInternationalizedText/NonInternationalizedTextBad.aspx +++ b/csharp/ql/test/query-tests/ASP/NonInternationalizedText/NonInternationalizedTextBad.aspx @@ -2,6 +2,6 @@ -

Amount: <%= Amount %>

+

Amount: <%= Amount %>

<%-- $ Alert[cs/asp/text-not-internationalized] --%> diff --git a/csharp/ql/test/query-tests/ASP/NonInternationalizedText/test.aspx b/csharp/ql/test/query-tests/ASP/NonInternationalizedText/test.aspx index 44b6ab46947f..7027d6a07cb9 100644 --- a/csharp/ql/test/query-tests/ASP/NonInternationalizedText/test.aspx +++ b/csharp/ql/test/query-tests/ASP/NonInternationalizedText/test.aspx @@ -2,6 +2,6 @@ -

This text is plain English.

+

This text is plain English.

<%-- $ Alert[cs/asp/text-not-internationalized] --%> diff --git a/csharp/ql/test/query-tests/ASP/SplitControlStructure/SplitControlStructure.qlref b/csharp/ql/test/query-tests/ASP/SplitControlStructure/SplitControlStructure.qlref index 4e98f2ecbaa5..57c16f0abe63 100644 --- a/csharp/ql/test/query-tests/ASP/SplitControlStructure/SplitControlStructure.qlref +++ b/csharp/ql/test/query-tests/ASP/SplitControlStructure/SplitControlStructure.qlref @@ -1 +1,2 @@ -ASP/SplitControlStructure.ql +query: ASP/SplitControlStructure.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/ASP/SplitControlStructure/SplitControlStructureBad.aspx b/csharp/ql/test/query-tests/ASP/SplitControlStructure/SplitControlStructureBad.aspx index 4ef3f00f3bfc..870c3df8fd37 100644 --- a/csharp/ql/test/query-tests/ASP/SplitControlStructure/SplitControlStructureBad.aspx +++ b/csharp/ql/test/query-tests/ASP/SplitControlStructure/SplitControlStructureBad.aspx @@ -2,7 +2,7 @@ -<% If ShouldWarn() Then %> +<% If ShouldWarn() Then %> <%-- $ Alert[cs/asp/split-control-structure] --%>

WARNING: <%=warning()%>

<% End If %> diff --git a/csharp/ql/test/query-tests/ASP/SplitControlStructure/test.aspx b/csharp/ql/test/query-tests/ASP/SplitControlStructure/test.aspx index 8cd7245d0ca6..69d889b570a5 100644 --- a/csharp/ql/test/query-tests/ASP/SplitControlStructure/test.aspx +++ b/csharp/ql/test/query-tests/ASP/SplitControlStructure/test.aspx @@ -2,7 +2,7 @@ -<% If Something() Then %> +<% If Something() Then %> <%-- $ Alert[cs/asp/split-control-structure] --%>

2 + 3 = <%=2 + 3%>

<% End If %> diff --git a/csharp/ql/test/query-tests/AlertSuppression/AlertSuppression.qlref b/csharp/ql/test/query-tests/AlertSuppression/AlertSuppression.qlref index 1641277045f7..dc898fca718c 100644 --- a/csharp/ql/test/query-tests/AlertSuppression/AlertSuppression.qlref +++ b/csharp/ql/test/query-tests/AlertSuppression/AlertSuppression.qlref @@ -1 +1 @@ -AlertSuppression.ql \ No newline at end of file +query: AlertSuppression.ql diff --git a/csharp/ql/test/query-tests/Architecture/Dependencies/MutualDependency/MutualDependency.qlref b/csharp/ql/test/query-tests/Architecture/Dependencies/MutualDependency/MutualDependency.qlref index ab1dbe353ef6..273ed4d757a6 100644 --- a/csharp/ql/test/query-tests/Architecture/Dependencies/MutualDependency/MutualDependency.qlref +++ b/csharp/ql/test/query-tests/Architecture/Dependencies/MutualDependency/MutualDependency.qlref @@ -1 +1,2 @@ -Architecture/Dependencies/MutualDependency.ql \ No newline at end of file +query: Architecture/Dependencies/MutualDependency.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Architecture/Dependencies/MutualDependency/MutualDependencyBad.cs b/csharp/ql/test/query-tests/Architecture/Dependencies/MutualDependency/MutualDependencyBad.cs index 370b75b45890..4aeddea95ba8 100644 --- a/csharp/ql/test/query-tests/Architecture/Dependencies/MutualDependency/MutualDependencyBad.cs +++ b/csharp/ql/test/query-tests/Architecture/Dependencies/MutualDependency/MutualDependencyBad.cs @@ -1,6 +1,6 @@ public class Bad { - private class BadModel + private class BadModel // $ Alert { private int i; private BadView view; diff --git a/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/FeatureEnvy/FeatureEnvy.qlref b/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/FeatureEnvy/FeatureEnvy.qlref index 9a63a65cd867..6931ecc2f7ec 100644 --- a/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/FeatureEnvy/FeatureEnvy.qlref +++ b/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/FeatureEnvy/FeatureEnvy.qlref @@ -1 +1,2 @@ -Architecture/Refactoring Opportunities/FeatureEnvy.ql \ No newline at end of file +query: Architecture/Refactoring Opportunities/FeatureEnvy.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/FeatureEnvy/FeatureEnvyBad.cs b/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/FeatureEnvy/FeatureEnvyBad.cs index 15678d585760..a3f064ff746c 100644 --- a/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/FeatureEnvy/FeatureEnvyBad.cs +++ b/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/FeatureEnvy/FeatureEnvyBad.cs @@ -13,7 +13,7 @@ class Item class Basket { - decimal GetTotalPrice(Item i) + decimal GetTotalPrice(Item i) // $ Alert { if (i.IsOutOfStock) throw new Exception("Item ${i} is out of stock."); diff --git a/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/InappropriateIntimacy/InappropriateIntimacy.cs b/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/InappropriateIntimacy/InappropriateIntimacy.cs index 95ff360b3d88..19ce015cdb54 100644 --- a/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/InappropriateIntimacy/InappropriateIntimacy.cs +++ b/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/InappropriateIntimacy/InappropriateIntimacy.cs @@ -2,7 +2,7 @@ class InappropriateIntimacy { - class A + class A // $ Alert { public int F1; public int F2; @@ -25,7 +25,7 @@ int M(B b) => b.F1 + b.F2 + b.F3 + b.F4 + b.F5 + b.F6 + b.F7 + b.F8 + b.F9 + b.F10 + b.F11 + b.F12 + b.F13 + b.F14 + b.F15 + b.F16; } - class B + class B // $ Alert { public int F1; public int F2; diff --git a/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/InappropriateIntimacy/InappropriateIntimacy.qlref b/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/InappropriateIntimacy/InappropriateIntimacy.qlref index 3b1c4aa5b018..938449179aef 100644 --- a/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/InappropriateIntimacy/InappropriateIntimacy.qlref +++ b/csharp/ql/test/query-tests/Architecture/Refactoring Opportunities/InappropriateIntimacy/InappropriateIntimacy.qlref @@ -1 +1,2 @@ -Architecture/Refactoring Opportunities/InappropriateIntimacy.ql \ No newline at end of file +query: Architecture/Refactoring Opportunities/InappropriateIntimacy.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/EmptyInterface/EmptyInterface.qlref b/csharp/ql/test/query-tests/Bad Practices/Declarations/EmptyInterface/EmptyInterface.qlref index 3984405db6bd..b2b0cf600bce 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/EmptyInterface/EmptyInterface.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/EmptyInterface/EmptyInterface.qlref @@ -1 +1,2 @@ -Bad Practices/Declarations/EmptyInterface.ql \ No newline at end of file +query: Bad Practices/Declarations/EmptyInterface.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/EmptyInterface/EmptyInterfaceBad.cs b/csharp/ql/test/query-tests/Bad Practices/Declarations/EmptyInterface/EmptyInterfaceBad.cs index 00f577a62a4f..09fcf1003d71 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/EmptyInterface/EmptyInterfaceBad.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/EmptyInterface/EmptyInterfaceBad.cs @@ -2,6 +2,6 @@ class Bad { - interface IsPrintable { } + interface IsPrintable { } // $ Alert class Form1 : IsPrintable { } } diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMember.cs b/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMember.cs index cf3062f8af65..05e3dab22c45 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMember.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMember.cs @@ -4,13 +4,13 @@ class C { protected int f; - protected virtual void M1(int f) { } // BAD + protected virtual void M1(int f) { } // $ Alert // BAD int M2(int f) => this.f + f; // GOOD void M3() { - var f = ""; // BAD + var f = ""; // $ Alert // BAD } void M4() @@ -23,13 +23,13 @@ struct S { int f; - void M1(int f) { } // BAD + void M1(int f) { } // $ Alert // BAD int M2(int f) => this.f + f; // GOOD void M3() { - var f = ""; // BAD + var f = ""; // $ Alert // BAD } void M4() @@ -45,9 +45,9 @@ interface I class C2 : C, I { - protected override void M1(int f) { } // BAD + protected override void M1(int f) { } // $ Alert // BAD - public void M5(int f) { } // BAD + public void M5(int f) { } // $ Alert // BAD } class C3 : C, I diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMember.qlref b/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMember.qlref index 913445e68f24..d7d02b3a9b8d 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMember.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMember.qlref @@ -1 +1,2 @@ -Bad Practices/Declarations/LocalScopeVariableShadowsMember.ql \ No newline at end of file +query: Bad Practices/Declarations/LocalScopeVariableShadowsMember.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMemberBad.cs b/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMemberBad.cs index 80ce45469375..d2be18995763 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMemberBad.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/LocalScopeVariableShadowsMember/LocalScopeVariableShadowsMemberBad.cs @@ -7,7 +7,7 @@ class Bad public void DisplayDetails() { - var title = "Person Details"; + var title = "Person Details"; // $ Alert var message = "Title: " + title + "\nName: " + name; MessageBox.Show(message, title); } diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnly.cs b/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnly.cs index 0d7d15b56532..0fa96bccb0f2 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnly.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnly.cs @@ -2,7 +2,7 @@ class NoConstantsOnly { - abstract class MathConstants + abstract class MathConstants // $ Alert { public const double Pi = 3.14; // BAD } diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnly.qlref b/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnly.qlref index 3b7e478699de..b46263c9d51a 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnly.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnly.qlref @@ -1 +1,2 @@ -Bad Practices/Declarations/NoConstantsOnly.ql \ No newline at end of file +query: Bad Practices/Declarations/NoConstantsOnly.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnlyBad.cs b/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnlyBad.cs index 28f308546ad6..cd92eabd7cf1 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnlyBad.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/NoConstantsOnly/NoConstantsOnlyBad.cs @@ -2,7 +2,7 @@ class Bad { - abstract class MathConstants + abstract class MathConstants // $ Alert { public static readonly double Pi = 3.14; } diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/TooManyRefParameters/TooManyRefParameters.qlref b/csharp/ql/test/query-tests/Bad Practices/Declarations/TooManyRefParameters/TooManyRefParameters.qlref index 867e4e929bd0..37d7e6ce81ee 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/TooManyRefParameters/TooManyRefParameters.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/TooManyRefParameters/TooManyRefParameters.qlref @@ -1 +1,2 @@ -Bad Practices/Declarations/TooManyRefParameters.ql \ No newline at end of file +query: Bad Practices/Declarations/TooManyRefParameters.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Declarations/TooManyRefParameters/TooManyRefParametersBad.cs b/csharp/ql/test/query-tests/Bad Practices/Declarations/TooManyRefParameters/TooManyRefParametersBad.cs index 08da4c6c3345..2d8f65570eea 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Declarations/TooManyRefParameters/TooManyRefParametersBad.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Declarations/TooManyRefParameters/TooManyRefParametersBad.cs @@ -2,7 +2,7 @@ class Bad { - private static void PopulateDetails(ref string name, ref string address, ref string tel) + private static void PopulateDetails(ref string name, ref string address, ref string tel) // $ Alert { name = "Foo"; address = "23 Bar Street"; diff --git a/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.cs b/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.cs index e57deea7f3d1..812c271e1762 100644 --- a/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.cs +++ b/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.cs @@ -9,7 +9,7 @@ void bad() } catch (Exception) { - } + } // $ Alert } void good() diff --git a/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.qlref b/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.qlref index 734bb1cadf90..3ba3a0114731 100644 --- a/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/EmptyCatchBlock/EmptyCatchBlock.qlref @@ -1 +1,2 @@ -Bad Practices/EmptyCatchBlock.ql \ No newline at end of file +query: Bad Practices/EmptyCatchBlock.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollection.cs b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollection.cs index 795952a82055..8fc03028947f 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollection.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollection.cs @@ -4,7 +4,7 @@ class AbstractToConcreteCollection { void M(IEnumerable strings) { - var list = (List) strings; // BAD + var list = (List) strings; // $ Alert // BAD var o = (object) strings; // GOOD } } diff --git a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollection.qlref b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollection.qlref index 307c259dbbb9..26e061e5206e 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollection.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollection.qlref @@ -1 +1,2 @@ -Bad Practices/Implementation Hiding/AbstractToConcreteCollection.ql \ No newline at end of file +query: Bad Practices/Implementation Hiding/AbstractToConcreteCollection.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollectionBad.cs b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollectionBad.cs index 9538fb9d7a06..92b80ea94d73 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollectionBad.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/AbstractToConcreteCollection/AbstractToConcreteCollectionBad.cs @@ -5,7 +5,7 @@ class Bad public static void Main(string[] args) { var names = GetNames(); - var list = (List) names; + var list = (List) names; // $ Alert list.Add("Eve"); } diff --git a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentation.cs b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentation.cs index 01b05a000278..073ae9086cfd 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentation.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentation.cs @@ -5,7 +5,7 @@ class ExposeRepresentation class Range { private int[] rarray = new int[2]; - public void Set(int[] a) { rarray = a; } + public void Set(int[] a) { rarray = a; } // $ Alert } public static void Main(string[] args) diff --git a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentation.qlref b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentation.qlref index e8bd17759d48..eafb170539aa 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentation.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentation.qlref @@ -1 +1,2 @@ -Bad Practices/Implementation Hiding/ExposeRepresentation.ql \ No newline at end of file +query: Bad Practices/Implementation Hiding/ExposeRepresentation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentationBad.cs b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentationBad.cs index 221f906aa97f..ee56212d1737 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentationBad.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/ExposeRepresentation/ExposeRepresentationBad.cs @@ -15,7 +15,7 @@ public Range(int min, int max) } } - public int[] Get() => rarray; + public int[] Get() => rarray; // $ Alert } public static void Main(string[] args) diff --git a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArray.cs b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArray.cs index 210be320a6ee..c42eef53adcc 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArray.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArray.cs @@ -10,13 +10,13 @@ class Program public static readonly int[] EmptyArray4; // GOOD: empty - public static readonly int[] NonEmptyArray1 = new int[] { 42 }; // BAD + public static readonly int[] NonEmptyArray1 = new int[] { 42 }; // $ Alert // BAD static readonly int[] NonEmptyArray2 = new int[] { 42 }; // GOOD: private - public static readonly int[] NonEmptyArray3; // BAD + public static readonly int[] NonEmptyArray3; // $ Alert // BAD - public static readonly int[] Array = new int[new Random().Next()]; // BAD + public static readonly int[] Array = new int[new Random().Next()]; // $ Alert // BAD static Program() { diff --git a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArray.qlref b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArray.qlref index 8dcd9bf72bed..e49a055b5a5e 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArray.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArray.qlref @@ -1 +1,2 @@ -Bad Practices/Implementation Hiding/StaticArray.ql \ No newline at end of file +query: Bad Practices/Implementation Hiding/StaticArray.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArrayBad.cs b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArrayBad.cs index fe035d4e4f1d..57d8f21c1956 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArrayBad.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Implementation Hiding/StaticArray/StaticArrayBad.cs @@ -1,6 +1,6 @@ class Bad { - public static readonly string[] Foo = { "hello", "world" }; + public static readonly string[] Foo = { "hello", "world" }; // $ Alert public static void Main(string[] args) { Foo[0] = "goodbye"; diff --git a/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/ConfusingMethodNames/ConfusingMethodNames.qlref b/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/ConfusingMethodNames/ConfusingMethodNames.qlref index 3308ff3889ef..94d4dc04c64f 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/ConfusingMethodNames/ConfusingMethodNames.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/ConfusingMethodNames/ConfusingMethodNames.qlref @@ -1 +1,2 @@ -Bad Practices/Naming Conventions/ConfusingMethodNames.ql +query: Bad Practices/Naming Conventions/ConfusingMethodNames.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/ConfusingMethodNames/Program.cs b/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/ConfusingMethodNames/Program.cs index 7ec82a410312..119c46139af5 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/ConfusingMethodNames/Program.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/ConfusingMethodNames/Program.cs @@ -1,6 +1,6 @@ class C1 { - int F() => 0; // BAD: Confusing + int F() => 0; // $ Alert // BAD: Confusing int f() => 0; int G() => 0; // GOOD: Same name int G(int x) => x; diff --git a/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/VariableNameTooShort/VariableNameTooShort.cs b/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/VariableNameTooShort/VariableNameTooShort.cs index a5eb951e148a..bbabb2e0ceec 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/VariableNameTooShort/VariableNameTooShort.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/VariableNameTooShort/VariableNameTooShort.cs @@ -3,14 +3,14 @@ class VariableNameTooShort { - int F; // BAD + int F; // $ Alert // BAD int Foo; // GOOD Func Func = _ => ""; - void M(int i /* BAD */, int[] args /* GOOD */) + void M(int i /* BAD */, int[] args /* GOOD */) // $ Alert { args.Select(x /* GOOD */ => x + 1); - Func func = x /* BAD */ => x + 1; + Func func = x /* BAD */ => x + 1; // $ Alert } } diff --git a/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/VariableNameTooShort/VariableNameTooShort.qlref b/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/VariableNameTooShort/VariableNameTooShort.qlref index 02458a1b30fc..c80ef4583b05 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/VariableNameTooShort/VariableNameTooShort.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Naming Conventions/VariableNameTooShort/VariableNameTooShort.qlref @@ -1 +1,2 @@ -Bad Practices/Naming Conventions/VariableNameTooShort.ql \ No newline at end of file +query: Bad Practices/Naming Conventions/VariableNameTooShort.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/Path Combine/PathCombine.cs b/csharp/ql/test/query-tests/Bad Practices/Path Combine/PathCombine.cs index bf9b19c4a5c7..d3595dfb540f 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Path Combine/PathCombine.cs +++ b/csharp/ql/test/query-tests/Bad Practices/Path Combine/PathCombine.cs @@ -4,7 +4,7 @@ class PathCombine { void bad() { - Path.Combine(@"C:\Users", @"C:\Program Files"); + Path.Combine(@"C:\Users", @"C:\Program Files"); // $ Alert } void good() diff --git a/csharp/ql/test/query-tests/Bad Practices/Path Combine/PathCombine.qlref b/csharp/ql/test/query-tests/Bad Practices/Path Combine/PathCombine.qlref index eaf41d047402..db4baecbd0f7 100644 --- a/csharp/ql/test/query-tests/Bad Practices/Path Combine/PathCombine.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/Path Combine/PathCombine.qlref @@ -1 +1,2 @@ -Bad Practices/PathCombine.ql \ No newline at end of file +query: Bad Practices/PathCombine.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Bad Practices/VirtualCallInConstructorOrDestructor/VirtualCallInConstructorOrDestructor.cs b/csharp/ql/test/query-tests/Bad Practices/VirtualCallInConstructorOrDestructor/VirtualCallInConstructorOrDestructor.cs index 767c4e484a14..6db005e00cef 100644 --- a/csharp/ql/test/query-tests/Bad Practices/VirtualCallInConstructorOrDestructor/VirtualCallInConstructorOrDestructor.cs +++ b/csharp/ql/test/query-tests/Bad Practices/VirtualCallInConstructorOrDestructor/VirtualCallInConstructorOrDestructor.cs @@ -42,7 +42,7 @@ class C : B C() { // Method call - f_virtual(); // BAD + f_virtual(); // $ Alert // BAD f_sealed(); // GOOD f_nonvirtual(); // GOOD f_interface(); // GOOD @@ -51,23 +51,23 @@ class C : B // Method access Action a; - a = f_virtual; // BAD + a = f_virtual; // $ Alert // BAD a = f_sealed; // GOOD a = f_nonvirtual; // GOOD a = f_interface; // GOOD // Property access - int i = p_virtual; // BAD + int i = p_virtual; // $ Alert // BAD i = p_sealed; // GOOD i = p_nonvirtual; // GOOD // Indexer access - i = this[0]; // BAD + i = this[0]; // $ Alert // BAD i = this[""]; // GOOD i = this[new object()]; // GOOD // Event access - e_virtual += f_nonvirtual; // BAD + e_virtual += f_nonvirtual; // $ Alert // BAD e_sealed += f_nonvirtual; // GOOD e_nonvirtual += f_nonvirtual; // GOOD } diff --git a/csharp/ql/test/query-tests/Bad Practices/VirtualCallInConstructorOrDestructor/VirtualCallInConstructorOrDestructor.qlref b/csharp/ql/test/query-tests/Bad Practices/VirtualCallInConstructorOrDestructor/VirtualCallInConstructorOrDestructor.qlref index 22b4b9fc49c7..b7e586c7dac9 100644 --- a/csharp/ql/test/query-tests/Bad Practices/VirtualCallInConstructorOrDestructor/VirtualCallInConstructorOrDestructor.qlref +++ b/csharp/ql/test/query-tests/Bad Practices/VirtualCallInConstructorOrDestructor/VirtualCallInConstructorOrDestructor.qlref @@ -1 +1,2 @@ -Bad Practices/VirtualCallInConstructorOrDestructor.ql \ No newline at end of file +query: Bad Practices/VirtualCallInConstructorOrDestructor.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs index 719aaa865761..540ce6bb8146 100644 --- a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs +++ b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs @@ -11,8 +11,8 @@ class CompareIdenticalValues : Super { public void M() { - if (this.Foo == Foo) ; - if (base.Foo == Foo) ; + if (this.Foo == Foo) ; // $ Alert + if (base.Foo == Foo) ; // $ Alert if (Foo == new CompareIdenticalValues().Foo) ; var x = "Abc"; @@ -20,45 +20,45 @@ public void M() var temp = x == x; // BAD: but flagged by cs/constant-comparison double d = double.NaN; - if (d == d) ; // !double.IsNan(d) - if (d <= d) ; // !double.IsNan(d), but unlikely to be intentional - if (d >= d) ; // !double.IsNan(d), but unlikely to be intentional - if (d != d) ; // double.IsNan(d) - if (d > d) ; // always false - if (d < d) ; // always false + if (d == d) ; // $ Alert // !double.IsNan(d) + if (d <= d) ; // $ Alert // !double.IsNan(d), but unlikely to be intentional + if (d >= d) ; // $ Alert // !double.IsNan(d), but unlikely to be intentional + if (d != d) ; // $ Alert // double.IsNan(d) + if (d > d) ; // $ Alert // always false + if (d < d) ; // $ Alert // always false float f = float.NaN; - if (f == f) ; // !float.IsNan(f) - if (f <= f) ; // !float.IsNan(f), but unlikely to be intentional - if (f >= f) ; // !float.IsNan(f), but unlikely to be intentional - if (f != f) ; // float.IsNan(f) - if (f > f) ; // always false - if (f < f) ; // always false + if (f == f) ; // $ Alert // !float.IsNan(f) + if (f <= f) ; // $ Alert // !float.IsNan(f), but unlikely to be intentional + if (f >= f) ; // $ Alert // !float.IsNan(f), but unlikely to be intentional + if (f != f) ; // $ Alert // float.IsNan(f) + if (f > f) ; // $ Alert // always false + if (f < f) ; // $ Alert // always false int i = 0; if (i == i) ; // BAD: but flagged by cs/constant-condition if (i != i) ; // BAD: but flagged by cs/constant-condition CompareIdenticalValues c = null; - c.Prop.Equals(c.Prop); - Equals(c.Prop.Prop.Prop.Foo + 2, c.Prop.Prop.Prop.Foo + 2); + c.Prop.Equals(c.Prop); // $ Alert + Equals(c.Prop.Prop.Prop.Foo + 2, c.Prop.Prop.Prop.Foo + 2); // $ Alert Equals(c.Prop.Prop.Prop.Foo, c.Prop.Prop.Foo); if (base.Bar == Bar) ; - if (Bar == this.Bar) ; - Equals(this); + if (Bar == this.Bar) ; // $ Alert + Equals(this); // $ Alert if (1 + 1 == 2) ; // BAD: but flagged by cs/constant-condition if (1 + 1 == 3) ; if (0 == 1) ; var a = new int[0]; - if (a[0] == a[0]) ; + if (a[0] == a[0]) ; // $ Alert - if (this.Bar[0] == Bar[1 - 1]) ; + if (this.Bar[0] == Bar[1 - 1]) ; // $ Alert if (this.Bar[0] == Bar[1]) ; - if (this.Prop[Foo] == Prop[this.Foo]) ; + if (this.Prop[Foo] == Prop[this.Foo]) ; // $ Alert if (this.Prop[0] == Prop[1]) ; } @@ -73,17 +73,17 @@ public void IsBoxed(T x) where T : I public void IsBoxedWrong1(T x) where T : struct { - ReferenceEquals(x, x); + ReferenceEquals(x, x); // $ Alert } public void IsBoxedWrong2(T x) where T : class { - ReferenceEquals(x, x); + ReferenceEquals(x, x); // $ Alert } public void IsBoxedWrong3(T x) where T : Super { - ReferenceEquals(x, x); + ReferenceEquals(x, x); // $ Alert } public int this[int i] { get { return 0; } } diff --git a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.qlref b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.qlref index 9df8726c3122..cbe82efdbb0e 100644 --- a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.qlref +++ b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.qlref @@ -1 +1,2 @@ -CSI/CompareIdenticalValues.ql \ No newline at end of file +query: CSI/CompareIdenticalValues.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Concurrency/FutileSyncOnField/FutileSyncOnField.cs b/csharp/ql/test/query-tests/Concurrency/FutileSyncOnField/FutileSyncOnField.cs index b0fd29e17fa9..3bb2733dee0a 100644 --- a/csharp/ql/test/query-tests/Concurrency/FutileSyncOnField/FutileSyncOnField.cs +++ b/csharp/ql/test/query-tests/Concurrency/FutileSyncOnField/FutileSyncOnField.cs @@ -10,12 +10,12 @@ void f(Object o2) void test() { - lock (o) + lock (o) // $ Alert { o = new Foo(); // BAD } - lock (o) + lock (o) // $ Alert { f(o = null); // BAD } @@ -25,7 +25,7 @@ void test() o = new Foo(); // GOOD } - lock (o2) + lock (o2) // $ Alert { GetNewObject(out o2); // BAD } diff --git a/csharp/ql/test/query-tests/Concurrency/FutileSyncOnField/FutileSyncOnField.qlref b/csharp/ql/test/query-tests/Concurrency/FutileSyncOnField/FutileSyncOnField.qlref index f3967efa87b8..74b0da761fbf 100644 --- a/csharp/ql/test/query-tests/Concurrency/FutileSyncOnField/FutileSyncOnField.qlref +++ b/csharp/ql/test/query-tests/Concurrency/FutileSyncOnField/FutileSyncOnField.qlref @@ -1 +1,2 @@ -Concurrency/FutileSyncOnField.ql \ No newline at end of file +query: Concurrency/FutileSyncOnField.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrder.cs b/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrder.cs index d2634c3e793b..69f1b89c657e 100644 --- a/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrder.cs +++ b/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrder.cs @@ -3,7 +3,7 @@ class LocalTest { // BAD: b is flagged. - Object a, b, c; + Object a, b, c; // $ Alert void F() { @@ -24,7 +24,7 @@ void H() class GlobalTest { // BAD: b is flagged. - static Object a, b, c; + static Object a, b, c; // $ Alert void F() { @@ -51,7 +51,7 @@ void I() class LambdaTest { // BAD: a is flagged. - static Object a, b; + static Object a, b; // $ Alert void F() { diff --git a/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrder.qlref b/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrder.qlref index ee922bdeb80a..7404f9bf0183 100644 --- a/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrder.qlref +++ b/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrder.qlref @@ -1 +1,2 @@ -Concurrency/LockOrder.ql \ No newline at end of file +query: Concurrency/LockOrder.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrderBad.cs b/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrderBad.cs index a9dd05ac8663..f2c3b18f1b44 100644 --- a/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrderBad.cs +++ b/csharp/ql/test/query-tests/Concurrency/LockOrder/LockOrderBad.cs @@ -3,7 +3,7 @@ class Deadlock { - private readonly Object lock1 = new Object(); + private readonly Object lock1 = new Object(); // $ Alert private readonly Object lock2 = new Object(); public void thread1() diff --git a/csharp/ql/test/query-tests/Concurrency/LockThis/LockThis.cs b/csharp/ql/test/query-tests/Concurrency/LockThis/LockThis.cs index f1bc631ced95..02c7afff5c96 100644 --- a/csharp/ql/test/query-tests/Concurrency/LockThis/LockThis.cs +++ b/csharp/ql/test/query-tests/Concurrency/LockThis/LockThis.cs @@ -6,7 +6,7 @@ class Program void f() { - lock (this) // Not OK + lock (this) // $ Alert // Not OK { } diff --git a/csharp/ql/test/query-tests/Concurrency/LockThis/LockThis.qlref b/csharp/ql/test/query-tests/Concurrency/LockThis/LockThis.qlref index 1cdf31326db7..7eb86f638bd3 100644 --- a/csharp/ql/test/query-tests/Concurrency/LockThis/LockThis.qlref +++ b/csharp/ql/test/query-tests/Concurrency/LockThis/LockThis.qlref @@ -1 +1,2 @@ -Concurrency/LockThis.ql \ No newline at end of file +query: Concurrency/LockThis.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Concurrency/LockedWait/LockedWait.cs b/csharp/ql/test/query-tests/Concurrency/LockedWait/LockedWait.cs index 8fbee2d035af..2067229d9ff9 100644 --- a/csharp/ql/test/query-tests/Concurrency/LockedWait/LockedWait.cs +++ b/csharp/ql/test/query-tests/Concurrency/LockedWait/LockedWait.cs @@ -22,14 +22,14 @@ static void Main() lock (lock1) { - System.Threading.Monitor.Wait(lock2); // BAD + System.Threading.Monitor.Wait(lock2); // $ Alert // BAD } lock (lock1) { lock (lock2) { - System.Threading.Monitor.Wait(lock2); // BAD + System.Threading.Monitor.Wait(lock2); // $ Alert // BAD } } @@ -37,7 +37,7 @@ static void Main() { lock (lock2) { - System.Threading.Monitor.Wait(lock1); // BAD + System.Threading.Monitor.Wait(lock1); // $ Alert // BAD } } } @@ -45,13 +45,13 @@ static void Main() [MethodImpl(MethodImplOptions.Synchronized)] void Lock2() { - System.Threading.Monitor.Wait(lock1); // BAD + System.Threading.Monitor.Wait(lock1); // $ Alert // BAD System.Threading.Monitor.Wait(this); // GOOD - System.Threading.Monitor.Wait(typeof(Program)); // BAD - System.Threading.Monitor.Wait(typeof(Int32)); // BAD + System.Threading.Monitor.Wait(typeof(Program)); // $ Alert // BAD + System.Threading.Monitor.Wait(typeof(Int32)); // $ Alert // BAD lock (lock1) { - System.Threading.Monitor.Wait(lock1); // BAD + System.Threading.Monitor.Wait(lock1); // $ Alert // BAD } } @@ -60,28 +60,28 @@ static void Lock3() { lock (lock1) { - System.Threading.Monitor.Wait(lock1); // BAD + System.Threading.Monitor.Wait(lock1); // $ Alert // BAD } - System.Threading.Monitor.Wait(lock1); // BAD + System.Threading.Monitor.Wait(lock1); // $ Alert // BAD System.Threading.Monitor.Wait(typeof(Program)); // GOOD - System.Threading.Monitor.Wait(typeof(Int32)); // BAD + System.Threading.Monitor.Wait(typeof(Int32)); // $ Alert // BAD } void Lock4() { lock (this) { - System.Threading.Monitor.Wait(typeof(Program)); // BAD + System.Threading.Monitor.Wait(typeof(Program)); // $ Alert // BAD System.Threading.Monitor.Wait(this); // GOOD - System.Threading.Monitor.Wait(lock1); // BAD + System.Threading.Monitor.Wait(lock1); // $ Alert // BAD } lock (typeof(Program)) { System.Threading.Monitor.Wait(typeof(Program)); // GOOD - System.Threading.Monitor.Wait(this); // BAD - System.Threading.Monitor.Wait(lock1); // BAD - System.Threading.Monitor.Wait(typeof(Int32)); // BAD + System.Threading.Monitor.Wait(this); // $ Alert // BAD + System.Threading.Monitor.Wait(lock1); // $ Alert // BAD + System.Threading.Monitor.Wait(typeof(Int32)); // $ Alert // BAD } } } diff --git a/csharp/ql/test/query-tests/Concurrency/LockedWait/LockedWait.qlref b/csharp/ql/test/query-tests/Concurrency/LockedWait/LockedWait.qlref index 559d900bb6cd..64c4021f0d81 100644 --- a/csharp/ql/test/query-tests/Concurrency/LockedWait/LockedWait.qlref +++ b/csharp/ql/test/query-tests/Concurrency/LockedWait/LockedWait.qlref @@ -1 +1,2 @@ -Concurrency/LockedWait.ql \ No newline at end of file +query: Concurrency/LockedWait.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Concurrency/SynchSetUnsynchGet/SynchSetUnsynchGet.cs b/csharp/ql/test/query-tests/Concurrency/SynchSetUnsynchGet/SynchSetUnsynchGet.cs index 8b41604a9e67..288783fabae0 100644 --- a/csharp/ql/test/query-tests/Concurrency/SynchSetUnsynchGet/SynchSetUnsynchGet.cs +++ b/csharp/ql/test/query-tests/Concurrency/SynchSetUnsynchGet/SynchSetUnsynchGet.cs @@ -6,7 +6,7 @@ class C1 object mutex = new Object(); // BAD: getter is unlocked - int BadProperty1 + int BadProperty1 // $ Alert { get { @@ -20,7 +20,7 @@ int BadProperty1 } // BAD: getter is not properly locked - int BadProperty2 + int BadProperty2 // $ Alert { get { diff --git a/csharp/ql/test/query-tests/Concurrency/SynchSetUnsynchGet/SynchSetUnsynchGet.qlref b/csharp/ql/test/query-tests/Concurrency/SynchSetUnsynchGet/SynchSetUnsynchGet.qlref index e1b6f28159c6..4604a0daa6c2 100644 --- a/csharp/ql/test/query-tests/Concurrency/SynchSetUnsynchGet/SynchSetUnsynchGet.qlref +++ b/csharp/ql/test/query-tests/Concurrency/SynchSetUnsynchGet/SynchSetUnsynchGet.qlref @@ -1 +1,2 @@ -Concurrency/SynchSetUnsynchGet.ql \ No newline at end of file +query: Concurrency/SynchSetUnsynchGet.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.cs b/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.cs index cd83b18e65c4..6a292c83ae5b 100644 --- a/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.cs +++ b/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.cs @@ -23,13 +23,13 @@ void Fn() obj1 = null; } } - } + } // $ Alert // BAD if (obj1 == null) lock (mutex) if (obj1 == null) - obj1 = null; + obj1 = null; // $ Alert // GOOD: A value-type if (cond1) @@ -84,7 +84,7 @@ void Fn() if (null == obj1) obj1 = null; } - } + } // $ Alert // GOOD: not a field object a = null; @@ -103,7 +103,7 @@ void Fn() obj1 = null; } } - } + } // $ Alert // BAD: both obj1 and obj3 are flagged. if (obj1 == null && obj3 == null) @@ -116,7 +116,7 @@ void Fn() obj3 = null; } } - } + } // $ Alert // GOOD: Locking a struct if (struct1 == struct2) @@ -134,7 +134,7 @@ void Fn() if (struct1.x is null) lock (mutex) if(struct1.x is null) - struct1.x = 3; + struct1.x = 3; // $ Alert // GOOD: Tuples are structs so cannot be volatile. if(pair1 == (1,2)) diff --git a/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.qlref b/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.qlref index 084b5abcc176..a78173ad9fb8 100644 --- a/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.qlref +++ b/csharp/ql/test/query-tests/Concurrency/UnsafeLazyInitialization/UnsafeLazyInitialization.qlref @@ -1 +1,2 @@ -Concurrency/UnsafeLazyInitialization.ql \ No newline at end of file +query: Concurrency/UnsafeLazyInitialization.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Concurrency/UnsynchronizedStaticAccess/UnsynchronizedStaticAccess.cs b/csharp/ql/test/query-tests/Concurrency/UnsynchronizedStaticAccess/UnsynchronizedStaticAccess.cs index c78ca515b518..eef9339a23fe 100644 --- a/csharp/ql/test/query-tests/Concurrency/UnsynchronizedStaticAccess/UnsynchronizedStaticAccess.cs +++ b/csharp/ql/test/query-tests/Concurrency/UnsynchronizedStaticAccess/UnsynchronizedStaticAccess.cs @@ -20,7 +20,7 @@ public static void aWriter() public void test() { // BAD: unsynchronized access - string val = dict["foo"]; + string val = dict["foo"]; // $ Alert lock (mutex) { @@ -66,6 +66,6 @@ private void testLocked() private void testMethod() { // BAD: called concurrently by thread - string val = dict["foo"]; + string val = dict["foo"]; // $ Alert } } diff --git a/csharp/ql/test/query-tests/Concurrency/UnsynchronizedStaticAccess/UnsynchronizedStaticAccess.qlref b/csharp/ql/test/query-tests/Concurrency/UnsynchronizedStaticAccess/UnsynchronizedStaticAccess.qlref index 59d6716994fd..2fceef745285 100644 --- a/csharp/ql/test/query-tests/Concurrency/UnsynchronizedStaticAccess/UnsynchronizedStaticAccess.qlref +++ b/csharp/ql/test/query-tests/Concurrency/UnsynchronizedStaticAccess/UnsynchronizedStaticAccess.qlref @@ -1 +1,2 @@ -Concurrency/UnsynchronizedStaticAccess.ql \ No newline at end of file +query: Concurrency/UnsynchronizedStaticAccess.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/EmptyPasswordInConfigurationFile.qlref b/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/EmptyPasswordInConfigurationFile.qlref index 9dae41964f3f..75899b3d5f2e 100644 --- a/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/EmptyPasswordInConfigurationFile.qlref +++ b/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/EmptyPasswordInConfigurationFile.qlref @@ -1 +1,2 @@ -Configuration/EmptyPasswordInConfigurationFile.ql +query: Configuration/EmptyPasswordInConfigurationFile.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/PasswordInConfigurationFile.qlref b/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/PasswordInConfigurationFile.qlref index b440a1f6909b..9ae43388c25c 100644 --- a/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/PasswordInConfigurationFile.qlref +++ b/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/PasswordInConfigurationFile.qlref @@ -1 +1,2 @@ -Configuration/PasswordInConfigurationFile.ql +query: Configuration/PasswordInConfigurationFile.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/config.xml b/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/config.xml index a72d5f8fa752..7a5f382236f8 100644 --- a/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/config.xml +++ b/csharp/ql/test/query-tests/Configuration/PasswordInConfigurationFile/config.xml @@ -1,15 +1,15 @@ - - + + - - + + - - - - + + + + diff --git a/csharp/ql/test/query-tests/Dead Code/NonAssignedFields/NonAssignedFields.cs b/csharp/ql/test/query-tests/Dead Code/NonAssignedFields/NonAssignedFields.cs index f7f18a187da2..00f79bc89d74 100644 --- a/csharp/ql/test/query-tests/Dead Code/NonAssignedFields/NonAssignedFields.cs +++ b/csharp/ql/test/query-tests/Dead Code/NonAssignedFields/NonAssignedFields.cs @@ -84,8 +84,8 @@ struct PtrToStructure2 class Fields1 { // BAD: - int BadNonAssigned; - object BadAssignedNull = null; + int BadNonAssigned; // $ Alert + object BadAssignedNull = null; // $ Alert // GOOD: int GoodAssignedByInitializer = 0; diff --git a/csharp/ql/test/query-tests/Dead Code/NonAssignedFields/NonAssignedFields.qlref b/csharp/ql/test/query-tests/Dead Code/NonAssignedFields/NonAssignedFields.qlref index 39148492539f..c2632de3dd2e 100644 --- a/csharp/ql/test/query-tests/Dead Code/NonAssignedFields/NonAssignedFields.qlref +++ b/csharp/ql/test/query-tests/Dead Code/NonAssignedFields/NonAssignedFields.qlref @@ -1 +1,2 @@ -Dead Code/NonAssignedFields.ql \ No newline at end of file +query: Dead Code/NonAssignedFields.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Dead Code/Tests/DeadRefTypes.qlref b/csharp/ql/test/query-tests/Dead Code/Tests/DeadRefTypes.qlref index 56db2195eb87..e8ba93a5e7fc 100644 --- a/csharp/ql/test/query-tests/Dead Code/Tests/DeadRefTypes.qlref +++ b/csharp/ql/test/query-tests/Dead Code/Tests/DeadRefTypes.qlref @@ -1 +1,2 @@ -Dead Code/DeadRefTypes.ql \ No newline at end of file +query: Dead Code/DeadRefTypes.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Dead Code/Tests/UnusedField.qlref b/csharp/ql/test/query-tests/Dead Code/Tests/UnusedField.qlref index 8464f79cd9bc..3803f9ec7bad 100644 --- a/csharp/ql/test/query-tests/Dead Code/Tests/UnusedField.qlref +++ b/csharp/ql/test/query-tests/Dead Code/Tests/UnusedField.qlref @@ -1 +1,2 @@ -Dead Code/UnusedField.ql +query: Dead Code/UnusedField.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Dead Code/Tests/UnusedMethod.qlref b/csharp/ql/test/query-tests/Dead Code/Tests/UnusedMethod.qlref index efc3937de8c0..9edba82f5dbf 100644 --- a/csharp/ql/test/query-tests/Dead Code/Tests/UnusedMethod.qlref +++ b/csharp/ql/test/query-tests/Dead Code/Tests/UnusedMethod.qlref @@ -1 +1,2 @@ -Dead Code/UnusedMethod.ql +query: Dead Code/UnusedMethod.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Dead Code/Tests/deadcode.cs b/csharp/ql/test/query-tests/Dead Code/Tests/deadcode.cs index d6905a6100fd..fb406104d6ad 100644 --- a/csharp/ql/test/query-tests/Dead Code/Tests/deadcode.cs +++ b/csharp/ql/test/query-tests/Dead Code/Tests/deadcode.cs @@ -21,7 +21,7 @@ sealed class Exported : Interface1 } // BAD: Class is dead -sealed class Dead2 +sealed class Dead2 // $ Alert[cs/unused-reftype] { } @@ -82,7 +82,7 @@ static int Main(string[] args) public struct S { - C Field; // dead + C Field; // $ Alert[cs/unused-field] // dead class C { } // not dead } diff --git a/csharp/ql/test/query-tests/Dead Code/Tests/regression.cs b/csharp/ql/test/query-tests/Dead Code/Tests/regression.cs index 3f6a4a2937b4..bc4a3d6ce893 100644 --- a/csharp/ql/test/query-tests/Dead Code/Tests/regression.cs +++ b/csharp/ql/test/query-tests/Dead Code/Tests/regression.cs @@ -4,7 +4,7 @@ class Test : IComparer { // this is really dead - private string dead = "Actual dead field"; + private string dead = "Actual dead field"; // $ Alert[cs/unused-field] private static void Main(string[] args) { @@ -48,7 +48,7 @@ private static int PartCompare(string a, string b) } // this is really dead - private void ActualDeadMethod() { } + private void ActualDeadMethod() { } // $ Alert[cs/unused-method] // this is live private void DynamicSig(dynamic d) { } @@ -57,7 +57,7 @@ private void DynamicSig(dynamic d) { } private void DynamicallyCalled(int i) { } // this is dead - private void NotDynamicallyCalled(int i) { } + private void NotDynamicallyCalled(int i) { } // $ Alert[cs/unused-method] // this is live private void DynamicallyCalledOnDynamicType(int i) { } @@ -74,14 +74,14 @@ public static int GenericTest() static int liveFieldAccessedFromGeneric; // BAD: This is dead - void DeadCaller() + void DeadCaller() // $ Alert[cs/unused-method] { DeadGeneric(0); DeadGeneric(0.0); } // BAD: This is dead (called from dead) - void DeadGeneric(V a) { } + void DeadGeneric(V a) { } // $ Alert[cs/unused-method] } class GenericClass @@ -102,18 +102,18 @@ int LiveGeneric(V v) int liveField; // BAD: These are not live - void DeadGeneric1() + void DeadGeneric1() // $ Alert[cs/unused-method] { DeadGeneric2(0); DeadGeneric2(1.0); } - void DeadGeneric2(V v) { } + void DeadGeneric2(V v) { } // $ Alert[cs/unused-method] // BAD: This is dead (never accessed) - int deadField; + int deadField; // $ Alert[cs/unused-field] // BAD: This is dead (only ever written) - int deadWrittenField; + int deadWrittenField; // $ Alert[cs/unused-field] } class MemberInitialization @@ -126,7 +126,7 @@ class ThisIsLive : ITest { } public class FieldOutParam { // BAD: Only written (by an out param) - int deadField; + int deadField; // $ Alert[cs/unused-field] public void Test() { diff --git a/csharp/ql/test/query-tests/Documentation/XmldocExtraParam.qlref b/csharp/ql/test/query-tests/Documentation/XmldocExtraParam.qlref index fd8371466b6f..8439ce413ec1 100644 --- a/csharp/ql/test/query-tests/Documentation/XmldocExtraParam.qlref +++ b/csharp/ql/test/query-tests/Documentation/XmldocExtraParam.qlref @@ -1 +1,2 @@ -Documentation/XmldocExtraParam.ql +query: Documentation/XmldocExtraParam.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Documentation/XmldocExtraTypeParam.qlref b/csharp/ql/test/query-tests/Documentation/XmldocExtraTypeParam.qlref index bc8515e6675c..67de8cb4600e 100644 --- a/csharp/ql/test/query-tests/Documentation/XmldocExtraTypeParam.qlref +++ b/csharp/ql/test/query-tests/Documentation/XmldocExtraTypeParam.qlref @@ -1 +1,2 @@ -Documentation/XmldocExtraTypeParam.ql \ No newline at end of file +query: Documentation/XmldocExtraTypeParam.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Documentation/XmldocMissing.qlref b/csharp/ql/test/query-tests/Documentation/XmldocMissing.qlref index 281a5cb07029..6ca5136a2e38 100644 --- a/csharp/ql/test/query-tests/Documentation/XmldocMissing.qlref +++ b/csharp/ql/test/query-tests/Documentation/XmldocMissing.qlref @@ -1 +1,2 @@ -Documentation/XmldocMissing.ql \ No newline at end of file +query: Documentation/XmldocMissing.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Documentation/XmldocMissingException.qlref b/csharp/ql/test/query-tests/Documentation/XmldocMissingException.qlref index ec059908e38c..4cd247832588 100644 --- a/csharp/ql/test/query-tests/Documentation/XmldocMissingException.qlref +++ b/csharp/ql/test/query-tests/Documentation/XmldocMissingException.qlref @@ -1 +1,2 @@ -Documentation/XmldocMissingException.ql +query: Documentation/XmldocMissingException.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Documentation/XmldocMissingParam.qlref b/csharp/ql/test/query-tests/Documentation/XmldocMissingParam.qlref index 9a8d6f801b7b..9b34d284c01d 100644 --- a/csharp/ql/test/query-tests/Documentation/XmldocMissingParam.qlref +++ b/csharp/ql/test/query-tests/Documentation/XmldocMissingParam.qlref @@ -1 +1,2 @@ -Documentation/XmldocMissingParam.ql +query: Documentation/XmldocMissingParam.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Documentation/XmldocMissingReturn.qlref b/csharp/ql/test/query-tests/Documentation/XmldocMissingReturn.qlref index 6eb8865b4b5d..ad0ea9697424 100644 --- a/csharp/ql/test/query-tests/Documentation/XmldocMissingReturn.qlref +++ b/csharp/ql/test/query-tests/Documentation/XmldocMissingReturn.qlref @@ -1 +1,2 @@ -Documentation/XmldocMissingReturn.ql +query: Documentation/XmldocMissingReturn.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Documentation/XmldocMissingSummary.qlref b/csharp/ql/test/query-tests/Documentation/XmldocMissingSummary.qlref index 5046e31a3db4..b90b6e39ce7f 100644 --- a/csharp/ql/test/query-tests/Documentation/XmldocMissingSummary.qlref +++ b/csharp/ql/test/query-tests/Documentation/XmldocMissingSummary.qlref @@ -1 +1,2 @@ -Documentation/XmldocMissingSummary.ql +query: Documentation/XmldocMissingSummary.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Documentation/XmldocMissingTypeParam.qlref b/csharp/ql/test/query-tests/Documentation/XmldocMissingTypeParam.qlref index f06bbb263d02..7090a1612d89 100644 --- a/csharp/ql/test/query-tests/Documentation/XmldocMissingTypeParam.qlref +++ b/csharp/ql/test/query-tests/Documentation/XmldocMissingTypeParam.qlref @@ -1 +1,2 @@ -Documentation/XmldocMissingTypeParam.ql +query: Documentation/XmldocMissingTypeParam.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Documentation/documentation.cs b/csharp/ql/test/query-tests/Documentation/documentation.cs index 810e9b5a34af..1efeeb8d4599 100644 --- a/csharp/ql/test/query-tests/Documentation/documentation.cs +++ b/csharp/ql/test/query-tests/Documentation/documentation.cs @@ -30,13 +30,13 @@ public virtual int method1(int p1, int p2) /// BAD: This XML comment is missing several tags /// BAD: This parameter does not exist /// BAD: This should say Exception2 - public int method2(int p1, int p2) + public int method2(int p1, int p2) // $ Alert[cs/xmldoc/missing-exception] Alert[cs/xmldoc/missing-parameter] Alert[cs/xmldoc/missing-return] Alert[cs/xmldoc/missing-summary] Alert[cs/xmldoc/unknown-parameter] { return p1 > 0 ? throw new Exception2() : p2; } // BAD: Missing documentation comment - public int method3() + public int method3() // $ Alert[cs/xmldoc/missing-xmldoc] { return 0; } @@ -48,7 +48,7 @@ internal int method4() } // BAD: Public class is not documented - public class Class2 + public class Class2 // $ Alert[cs/xmldoc/missing-xmldoc] { } @@ -71,7 +71,7 @@ public Class1(int p) } // BAD: Constructor is public and not documented - public Class1(int a, int b) + public Class1(int a, int b) // $ Alert[cs/xmldoc/missing-xmldoc] { } @@ -80,7 +80,7 @@ public Class1(int a, int b) /// BAD: Contains an extra typeparam /// /// The type - class Class4 { } + class Class4 { } // $ Alert[cs/xmldoc/missing-type-parameter] Alert[cs/xmldoc/unknown-type-parameter] /// /// GOOD: Type params are correctly labeled @@ -95,7 +95,7 @@ class Class5 { } /// /// BAD typeparam /// GOOD typeparam - void method5() { } + void method5() { } // $ Alert[cs/xmldoc/missing-type-parameter] Alert[cs/xmldoc/unknown-type-parameter] // BAD: These fields are empty /// @@ -103,7 +103,7 @@ void method5() { } /// /// /// - public virtual int method4(int p1, int p2) { return p1; } + public virtual int method4(int p1, int p2) { return p1; } // $ Alert[cs/xmldoc/missing-parameter] Alert[cs/xmldoc/missing-return] Alert[cs/xmldoc/missing-summary] Alert[cs/xmldoc/missing-type-parameter] } class Class2 : Class1 @@ -132,7 +132,7 @@ public void method5() // BAD: Has only System.Runtime.CompilerServices attribute [System.Runtime.CompilerServices.My2] - public void method6() + public void method6() // $ Alert[cs/xmldoc/missing-xmldoc] { } } diff --git a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.cs b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.cs index b3e0cff6ae30..4095af2863a4 100644 --- a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.cs +++ b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.cs @@ -7,7 +7,7 @@ static void Method(string[] args) // BAD foreach (var arg in args) { - } + } // $ Alert // OK - comment foreach (var arg in args) @@ -24,7 +24,7 @@ static void Method(string[] args) // BAD if (true) { - } + } // $ Alert // OK - comment if (true) @@ -46,6 +46,6 @@ static void Method(string[] args) // BAD: there is no update for (int i = 0; i < 10;) { - } + } // $ Alert } } diff --git a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.qlref b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.qlref index af8a3a21f8a7..5fe264815b80 100644 --- a/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.qlref +++ b/csharp/ql/test/query-tests/EmptyBlock/EmptyBlock.qlref @@ -1 +1,2 @@ -Likely Bugs/Statements/EmptyBlock.ql +query: Likely Bugs/Statements/EmptyBlock.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.cs b/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.cs index 64c4038d3319..45dc182cc729 100644 --- a/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.cs +++ b/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.cs @@ -9,14 +9,14 @@ void M(bool rethrow) } catch (Exception) { // BAD - } + } // $ Alert try { } catch { // BAD - } + } // $ Alert try { @@ -53,6 +53,6 @@ double reciprocal(double input) { // BAD // division by zero, return 0 return 0; - } + } // $ Alert } } diff --git a/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.qlref b/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.qlref index 9606fc128a75..c5b986a2b663 100644 --- a/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/CatchOfGenericException/CatchOfGenericException.qlref @@ -1 +1,2 @@ -Language Abuse/CatchOfGenericException.ql \ No newline at end of file +query: Language Abuse/CatchOfGenericException.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.cs b/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.cs index ffe1da808750..3917ff990801 100644 --- a/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.cs +++ b/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.cs @@ -62,7 +62,7 @@ public void M(object x) } else if (x is F) { - } // BAD + } // $ Alert // BAD } class A { } diff --git a/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.qlref b/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.qlref index 0d67fca32396..a46923159024 100644 --- a/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/ChainedIs/ChainedIs.qlref @@ -1 +1,2 @@ -Language Abuse/ChainedIs.ql +query: Language Abuse/ChainedIs.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis.cs b/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis.cs index a6cad0e456e4..c8a3e85f3630 100644 --- a/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis.cs +++ b/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis.cs @@ -4,10 +4,10 @@ class BaseClass { public int add(int x) { - if (this is FiveAdder) + if (this is FiveAdder) // $ Alert return x + 5; - if (this is TenAdder) + if (this is TenAdder) // $ Alert return x + 10; return 0; diff --git a/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis.qlref b/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis.qlref index cf59e9dbd51a..c51f8fb4f465 100644 --- a/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis.qlref @@ -1 +1,2 @@ -Language Abuse/DubiousTypeTestOfThis.ql \ No newline at end of file +query: Language Abuse/DubiousTypeTestOfThis.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis2.cs b/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis2.cs index 0c3a8e543f7d..8f09181dafd9 100644 --- a/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis2.cs +++ b/csharp/ql/test/query-tests/Language Abuse/DubiousTypeTestOfThis/DubiousTypeTestOfThis2.cs @@ -5,7 +5,7 @@ class C { void M() { - if (this is D) ; // BAD + if (this is D) ; // $ Alert // BAD Debug.Assert(this is D); // GOOD } } diff --git a/csharp/ql/test/query-tests/Language Abuse/ForeachCapture/ForeachCapture.cs b/csharp/ql/test/query-tests/Language Abuse/ForeachCapture/ForeachCapture.cs index 18fdcc9c1bc9..9af0f31392da 100644 --- a/csharp/ql/test/query-tests/Language Abuse/ForeachCapture/ForeachCapture.cs +++ b/csharp/ql/test/query-tests/Language Abuse/ForeachCapture/ForeachCapture.cs @@ -11,7 +11,7 @@ static void Main(string[] args) foreach (var arg in args) { // BAD: Storing a delegate in an event. - event1 += () => arg; + event1 += () => arg; // $ Alert // GOOD: Make a copy of the loop variable. var argCopy = arg; @@ -21,7 +21,7 @@ static void Main(string[] args) goodUseOfDelegate(() => arg); // BAD: Calling a function which stores the delegate - badUseOfDelegate(() => arg); + badUseOfDelegate(() => arg); // $ Alert // GOOD: The delegate does not escape the loop Del d = () => arg; diff --git a/csharp/ql/test/query-tests/Language Abuse/ForeachCapture/ForeachCapture.qlref b/csharp/ql/test/query-tests/Language Abuse/ForeachCapture/ForeachCapture.qlref index 733f31198af9..01f701f769f9 100644 --- a/csharp/ql/test/query-tests/Language Abuse/ForeachCapture/ForeachCapture.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/ForeachCapture/ForeachCapture.qlref @@ -1 +1,2 @@ -Language Abuse/ForeachCapture.ql +query: Language Abuse/ForeachCapture.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/MissedTernaryOpportunity/MissedTernaryOpportunity.cs b/csharp/ql/test/query-tests/Language Abuse/MissedTernaryOpportunity/MissedTernaryOpportunity.cs index 407bde9643e4..f5796513c781 100644 --- a/csharp/ql/test/query-tests/Language Abuse/MissedTernaryOpportunity/MissedTernaryOpportunity.cs +++ b/csharp/ql/test/query-tests/Language Abuse/MissedTernaryOpportunity/MissedTernaryOpportunity.cs @@ -6,11 +6,11 @@ public bool M() { if (true) { return false; } else { Field++; return true; } // GOOD return true ? false : true; // GOOD - if (true) return false; else { { return true; } } // BAD + if (true) return false; else { { return true; } } // $ Alert // BAD var x = ""; if (true) { Field = 0; } else { x = ""; } // GOOD if (true) { Field = 0; } else { x = ""; Field = 1; } // GOOD Field = true ? 0 : 1; // GOOD - if (true) { this.Field = 0; } else Field = 1; // BAD + if (true) { this.Field = 0; } else Field = 1; // $ Alert // BAD } } diff --git a/csharp/ql/test/query-tests/Language Abuse/MissedTernaryOpportunity/MissedTernaryOpportunity.qlref b/csharp/ql/test/query-tests/Language Abuse/MissedTernaryOpportunity/MissedTernaryOpportunity.qlref index 7efb97ac6fe4..4d45b7edd2fb 100644 --- a/csharp/ql/test/query-tests/Language Abuse/MissedTernaryOpportunity/MissedTernaryOpportunity.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/MissedTernaryOpportunity/MissedTernaryOpportunity.qlref @@ -1 +1,2 @@ -Language Abuse/MissedTernaryOpportunity.ql +query: Language Abuse/MissedTernaryOpportunity.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/NestedIf/NestedIf.qlref b/csharp/ql/test/query-tests/Language Abuse/NestedIf/NestedIf.qlref index c3c2012be180..19cd4d8ca684 100644 --- a/csharp/ql/test/query-tests/Language Abuse/NestedIf/NestedIf.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/NestedIf/NestedIf.qlref @@ -1 +1,2 @@ -Language Abuse/NestedIf.ql \ No newline at end of file +query: Language Abuse/NestedIf.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/NestedIf/nestedif.cs b/csharp/ql/test/query-tests/Language Abuse/NestedIf/nestedif.cs index 733325d2c597..bb59facd9c89 100644 --- a/csharp/ql/test/query-tests/Language Abuse/NestedIf/nestedif.cs +++ b/csharp/ql/test/query-tests/Language Abuse/NestedIf/nestedif.cs @@ -5,10 +5,10 @@ class NestedIf void fn() { // BAD: - if (true) if (false) return; + if (true) if (false) return; // $ Alert // BAD - if (true) if (false) if (true) return; + if (true) if (false) if (true) return; // $ Alert // BAD: using braces if (true) @@ -18,7 +18,7 @@ void fn() { } } - } + } // $ Alert // GOOD: contains else part if (true) diff --git a/csharp/ql/test/query-tests/Language Abuse/RethrowException/RethrowException.cs b/csharp/ql/test/query-tests/Language Abuse/RethrowException/RethrowException.cs index ee7cf41a0a21..a42490db4d36 100644 --- a/csharp/ql/test/query-tests/Language Abuse/RethrowException/RethrowException.cs +++ b/csharp/ql/test/query-tests/Language Abuse/RethrowException/RethrowException.cs @@ -9,7 +9,7 @@ static void Main(string[] args) } catch (Exception e) { - throw e; // BAD + throw e; // $ Alert // BAD } try @@ -18,7 +18,7 @@ static void Main(string[] args) catch (Exception e) { if (true) - throw e; // BAD + throw e; // $ Alert // BAD } try diff --git a/csharp/ql/test/query-tests/Language Abuse/RethrowException/RethrowException.qlref b/csharp/ql/test/query-tests/Language Abuse/RethrowException/RethrowException.qlref index b406a8b5fccd..1f83a6b74e62 100644 --- a/csharp/ql/test/query-tests/Language Abuse/RethrowException/RethrowException.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/RethrowException/RethrowException.qlref @@ -1 +1,2 @@ -Language Abuse/RethrowException.ql \ No newline at end of file +query: Language Abuse/RethrowException.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExpr.cs b/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExpr.cs index 5ea4c8c15cf5..175507010a13 100644 --- a/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExpr.cs +++ b/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExpr.cs @@ -6,36 +6,36 @@ void Fn() bool b = false; int x = 0, y = 0; - if (b == true) ; - if (b == false) ; - if (true == b) ; - if (false == b) ; - if (b != true) ; - if (b != false) ; - if (true != b) ; - if (false != b) ; - if (b && true) ; - if (b && false) ; - if (true && b) ; - if (false && b) ; - if (b || true) ; - if (b || false) ; - if (true || b) ; - if (false || b) ; - if (!(x == y)) ; - if (!(x != y)) ; - if (!(x < y)) ; - if (!(x <= y)) ; - if (!(x >= y)) ; - if (!(x > y)) ; - if (b ? true : false) ; - if (b ? true : true) ; - if (b ? false : true) ; - if (b ? true : true) ; - if (b ? b : false) ; - if (b ? b : true) ; - if (b ? false : b) ; - if (b ? true : b) ; + if (b == true) ; // $ Alert + if (b == false) ; // $ Alert + if (true == b) ; // $ Alert + if (false == b) ; // $ Alert + if (b != true) ; // $ Alert + if (b != false) ; // $ Alert + if (true != b) ; // $ Alert + if (false != b) ; // $ Alert + if (b && true) ; // $ Alert + if (b && false) ; // $ Alert + if (true && b) ; // $ Alert + if (false && b) ; // $ Alert + if (b || true) ; // $ Alert + if (b || false) ; // $ Alert + if (true || b) ; // $ Alert + if (false || b) ; // $ Alert + if (!(x == y)) ; // $ Alert + if (!(x != y)) ; // $ Alert + if (!(x < y)) ; // $ Alert + if (!(x <= y)) ; // $ Alert + if (!(x >= y)) ; // $ Alert + if (!(x > y)) ; // $ Alert + if (b ? true : false) ; // $ Alert + if (b ? true : true) ; // $ Alert + if (b ? false : true) ; // $ Alert + if (b ? true : true) ; // $ Alert + if (b ? b : false) ; // $ Alert + if (b ? b : true) ; // $ Alert + if (b ? false : b) ; // $ Alert + if (b ? true : b) ; // $ Alert // BAD if (true ? b : b) ; diff --git a/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExpr.qlref b/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExpr.qlref index 27f8ee90aa90..222fc236213b 100644 --- a/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExpr.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExpr.qlref @@ -1 +1,2 @@ -Language Abuse/SimplifyBoolExpr.ql \ No newline at end of file +query: Language Abuse/SimplifyBoolExpr.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExprBad.cs b/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExprBad.cs index e65c2a88fbf7..89e72c2780ab 100644 --- a/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExprBad.cs +++ b/csharp/ql/test/query-tests/Language Abuse/SimplifyBoolExpr/SimplifyBoolExprBad.cs @@ -2,7 +2,7 @@ class Bad { int Size { get; set; } - bool Espresso => !(Size > 4); - bool Latte => Espresso == false && Size <= 8; - bool Grande => Espresso == false ? Latte != true : false; + bool Espresso => !(Size > 4); // $ Alert + bool Latte => Espresso == false && Size <= 8; // $ Alert + bool Grande => Espresso == false ? Latte != true : false; // $ Alert } diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs b/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs index e3aa1ad3067c..3b3f06ded0f0 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs +++ b/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs @@ -6,11 +6,11 @@ class Test void f() { // BAD - var bad1 = (int)1; - var bad2 = (Test)this; - var bad3 = this as Test; + var bad1 = (int)1; // $ Alert + var bad2 = (Test)this; // $ Alert + var bad3 = this as Test; // $ Alert func = (Func)(x => x); // MISSING - exprFunc = (Expression>)(x => x); + exprFunc = (Expression>)(x => x); // $ Alert // GOOD var good1 = (object)1; @@ -22,16 +22,16 @@ void f() var good7 = (Action)((int x) => { }); func = x => x; exprFunc = x => x; - exprFuncUntyped = (Expression>)(x => x); // FP + exprFuncUntyped = (Expression>)(x => x); // $ Alert // FP } enum Enum { A = 2, B = 1 | A, - C = 1 | (int)A, // BAD + C = 1 | (int)A, // $ Alert // BAD D = 9 | (32 << A), - E = 9 | (32 << (int)A) // BAD + E = 9 | (32 << (int)A) // $ Alert // BAD } private Func func; diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.qlref b/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.qlref index 7a137fff0870..6e56b5c55af3 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.qlref @@ -1 +1,2 @@ -Language Abuse/UselessCastToSelf.ql \ No newline at end of file +query: Language Abuse/UselessCastToSelf.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessIsBeforeAs/UselessIsBeforeAs.cs b/csharp/ql/test/query-tests/Language Abuse/UselessIsBeforeAs/UselessIsBeforeAs.cs index af7d26c98f58..981fda177faa 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessIsBeforeAs/UselessIsBeforeAs.cs +++ b/csharp/ql/test/query-tests/Language Abuse/UselessIsBeforeAs/UselessIsBeforeAs.cs @@ -5,7 +5,7 @@ public object M(object x) if (x is string) { M(x as string); // GOOD - return (x as string) + " "; // BAD + return (x as string) + " "; // $ Alert // BAD } else { diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessIsBeforeAs/UselessIsBeforeAs.qlref b/csharp/ql/test/query-tests/Language Abuse/UselessIsBeforeAs/UselessIsBeforeAs.qlref index 9a5a7fd703c1..3c499bb78025 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessIsBeforeAs/UselessIsBeforeAs.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/UselessIsBeforeAs/UselessIsBeforeAs.qlref @@ -1 +1,2 @@ -Language Abuse/UselessIsBeforeAs.ql +query: Language Abuse/UselessIsBeforeAs.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessNullCoalescingExpression/UselessNullCoalescingExpression.cs b/csharp/ql/test/query-tests/Language Abuse/UselessNullCoalescingExpression/UselessNullCoalescingExpression.cs index f05782416fd5..63f29437a9b7 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessNullCoalescingExpression/UselessNullCoalescingExpression.cs +++ b/csharp/ql/test/query-tests/Language Abuse/UselessNullCoalescingExpression/UselessNullCoalescingExpression.cs @@ -6,14 +6,14 @@ void Main(int? param) { int? a = 5, b; - a = a ?? a; // BAD - a = a ?? (b = a); // BAD - a = Prop ?? Prop; // BAD - a = param ?? param; // BAD - a = a ?? use(a); // BAD - a = Field ?? this.Field; // BAD - a ??= a; // BAD - a ??= b = a; // BAD + a = a ?? a; // $ Alert // BAD + a = a ?? (b = a); // $ Alert // BAD + a = Prop ?? Prop; // $ Alert // BAD + a = param ?? param; // $ Alert // BAD + a = a ?? use(a); // $ Alert // BAD + a = Field ?? this.Field; // $ Alert // BAD + a ??= a; // $ Alert // BAD + a ??= b = a; // $ Alert // BAD a = a ?? cache(ref a); // GOOD a = a ?? store(out a); // GOOD diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessNullCoalescingExpression/UselessNullCoalescingExpression.qlref b/csharp/ql/test/query-tests/Language Abuse/UselessNullCoalescingExpression/UselessNullCoalescingExpression.qlref index 1eb957001c9e..1145cc6ae816 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessNullCoalescingExpression/UselessNullCoalescingExpression.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/UselessNullCoalescingExpression/UselessNullCoalescingExpression.qlref @@ -1 +1,2 @@ -Language Abuse/UselessNullCoalescingExpression.ql \ No newline at end of file +query: Language Abuse/UselessNullCoalescingExpression.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcast.cs b/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcast.cs index 0ec950e836d3..2a3f69946311 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcast.cs +++ b/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcast.cs @@ -49,13 +49,13 @@ void Test1(string[] args) B b = new B(); object o; - o = (A)b; // BAD + o = (A)b; // $ Alert // BAD o = (B)b; // GOOD: Not an upcast b.M((A)b); // GOOD: Disambiguating method call - a.M1((A)b); // BAD + a.M1((A)b); // $ Alert // BAD a.M2((A)b); // GOOD: Disambiguating method call o = true ? (A)a : b; // GOOD: Needed for ternary @@ -64,7 +64,7 @@ void Test1(string[] args) Fn((A)b); // GOOD: Disambiguating method call - Fn2((A)b); // BAD + Fn2((A)b); // $ Alert // BAD ((I2)a).Foo(); // GOOD: Cast to an interface @@ -80,7 +80,7 @@ void Test1(string[] args) StaticMethods.M1((A)b); // GOOD: disambiguate targets from `StaticMethods` void M2(A _) { } - M2((A)b); // BAD: local functions cannot be overloaded + M2((A)b); // $ Alert // BAD: local functions cannot be overloaded } static void M2(A _) { } @@ -89,7 +89,7 @@ void Test2(B b) { // BAD: even though `StaticMethods` has an `M2`, only overloads in // `Tests` are taken into account - M2((A)b); + M2((A)b); // $ Alert } class Nested @@ -100,7 +100,7 @@ static void Test(C c) { // BAD: even though `StaticMethods` and `Tests` have `M2`s, only // overloads in `Nested` are taken into account - M2((B)c); + M2((B)c); // $ Alert } } } @@ -155,11 +155,11 @@ public Sub(Sub s) : base((I1)s) { } // GOOD class SubSub : Sub { - SubSub(SubSub ss) : base((Sub)ss) { } // BAD + SubSub(SubSub ss) : base((Sub)ss) { } // $ Alert // BAD void M(SubSub ss) { - new Sub((Sub)ss); // BAD + new Sub((Sub)ss); // $ Alert // BAD } } diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcast.qlref b/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcast.qlref index f0a49b78b14b..d48a3f989428 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcast.qlref +++ b/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcast.qlref @@ -1 +1,2 @@ -Language Abuse/UselessUpcast.ql \ No newline at end of file +query: Language Abuse/UselessUpcast.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcastBad.cs b/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcastBad.cs index c69db3104fb1..f3c20dc5d574 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcastBad.cs +++ b/csharp/ql/test/query-tests/Language Abuse/UselessUpcast/UselessUpcastBad.cs @@ -6,6 +6,6 @@ class Sub : Super {} void M() { var sub = new Sub(); - Super super = (Super)sub; + Super super = (Super)sub; // $ Alert } } diff --git a/csharp/ql/test/query-tests/Likely Bugs/BadCheckOdd/BadCheckOdd.cs b/csharp/ql/test/query-tests/Likely Bugs/BadCheckOdd/BadCheckOdd.cs index c5e87a4ed1e6..5bdfc4d6b512 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/BadCheckOdd/BadCheckOdd.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/BadCheckOdd/BadCheckOdd.cs @@ -14,13 +14,13 @@ static void Main(string[] args) int a = 2; // BAD - if (a % 2 == 1) + if (a % 2 == 1) // $ Alert Console.Out.WriteLine("a is odd"); - if (a % 2 != 1) + if (a % 2 != 1) // $ Alert Console.Out.WriteLine("a is even"); - if (a % 2 > 0) + if (a % 2 > 0) // $ Alert Console.Out.WriteLine("a is odd"); - if ((a % 2) > 0) + if ((a % 2) > 0) // $ Alert Console.Out.WriteLine("a is odd"); // GOOD diff --git a/csharp/ql/test/query-tests/Likely Bugs/BadCheckOdd/BadCheckOdd.qlref b/csharp/ql/test/query-tests/Likely Bugs/BadCheckOdd/BadCheckOdd.qlref index 759b3f4ab230..b65ba073c357 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/BadCheckOdd/BadCheckOdd.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/BadCheckOdd/BadCheckOdd.qlref @@ -1 +1,2 @@ -Likely Bugs/BadCheckOdd.ql \ No newline at end of file +query: Likely Bugs/BadCheckOdd.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.cs b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.cs index d68bbfc274ec..a3266b494e8d 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.cs @@ -5,13 +5,13 @@ class Test void Test1(string[] args) { // BAD: Loop upper bound is off-by-one - for (int i = 0; i <= args.Length; i++) + for (int i = 0; i <= args.Length; i++) // $ Alert { Console.WriteLine(args[i]); } // BAD: Loop upper bound is off-by-one - for (int i = 0; args.Length >= i; i++) + for (int i = 0; args.Length >= i; i++) // $ Alert { Console.WriteLine(args[i]); } @@ -24,13 +24,13 @@ void Test1(string[] args) int j = 0; // BAD: Off-by-one on index validity check - if (j <= args.Length) + if (j <= args.Length) // $ Alert { Console.WriteLine(args[j]); } // BAD: Off-by-one on index validity check - if (args.Length >= j) + if (args.Length >= j) // $ Alert { Console.WriteLine(args[j]); } diff --git a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.qlref b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.qlref index 637dac3c9b85..ce56c59063f7 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerLengthCmpOffByOne/ContainerLengthCmpOffByOne.qlref @@ -1 +1,2 @@ -Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql \ No newline at end of file +query: Likely Bugs/Collections/ContainerLengthCmpOffByOne.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerSizeCmpZero/ContainerSizeCmpZero.cs b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerSizeCmpZero/ContainerSizeCmpZero.cs index 1fb70bd8dff2..3418b184d5f1 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerSizeCmpZero/ContainerSizeCmpZero.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerSizeCmpZero/ContainerSizeCmpZero.cs @@ -29,16 +29,16 @@ static void Main(string[] args) // Arrays // NOT OK: always true - b = args.Length >= 0; + b = args.Length >= 0; // $ Alert // NOT OK: always true - b = 0 <= args.Length; + b = 0 <= args.Length; // $ Alert // NOT OK: always false - b = args.Length < 0; + b = args.Length < 0; // $ Alert // NOT OK: always false - b = 0 > args.Length; + b = 0 > args.Length; // $ Alert // OK: sometimes could be false b = args.Length > 0; @@ -58,12 +58,12 @@ static void Main(string[] args) var ys = new Stack(); // NOT OK - b = xs.Count >= 0; - b = 0 <= xs.Count; - b = 0 <= ys.Count; + b = xs.Count >= 0; // $ Alert + b = 0 <= xs.Count; // $ Alert + b = 0 <= ys.Count; // $ Alert - b = xs.Count < 0; - b = 0 > ys.Count; + b = xs.Count < 0; // $ Alert + b = 0 > ys.Count; // $ Alert // OK b = xs.Count >= -1; @@ -74,15 +74,15 @@ static void Main(string[] args) ///////// // missed in java, but not here - b = xs.Count >= (short)0; - b = xs.Count >= (byte)0; + b = xs.Count >= (short)0; // $ Alert + b = xs.Count >= (byte)0; // $ Alert ///////// // missed cases // NOT OK - b = xs.Count >= 0 + 0; - b = xs.Count >= 0 - 0; + b = xs.Count >= 0 + 0; // $ Alert + b = xs.Count >= 0 - 0; // $ Alert b = args.LongLength >= 0L; @@ -91,24 +91,24 @@ static void Main(string[] args) var zs = new MyList>(); // NOT OK - b = zs.Count >= 0; - b = zs.Count < 0; + b = zs.Count >= 0; // $ Alert + b = zs.Count < 0; // $ Alert // NOT OK - b = zs[0].Count >= 0; + b = zs[0].Count >= 0; // $ Alert // NOT OK - b = zs[0][0].Length >= 0; + b = zs[0][0].Length >= 0; // $ Alert ///////// // Dictionaries var ws = new Dictionary(); // NOT OK: Always true - b = ws.Count >= 0; + b = ws.Count >= 0; // $ Alert // NOT OK: Always true - b = 0 <= ws.Count; + b = 0 <= ws.Count; // $ Alert // OK: can be false b = ws.Count >= -1; @@ -123,12 +123,12 @@ static void Main(string[] args) var vs = new System.Collections.BitArray(1); // NOT OK: Always true - b = us.Count >= 0; - b = 0 > vs.Count; + b = us.Count >= 0; // $ Alert + b = 0 > vs.Count; // $ Alert // NOT OK: Always true - b = 0 <= us.Count; - b = vs.Count < 0; + b = 0 <= us.Count; // $ Alert + b = vs.Count < 0; // $ Alert // OK: can be false b = us.Count >= -1; @@ -144,13 +144,13 @@ static bool ReadOnlyCollection(IReadOnlyCollection xs, IReadOnlyList= 0; - b = 0 <= xs.Count; - b = 0 <= ys.Count; + b = xs.Count >= 0; // $ Alert + b = 0 <= xs.Count; // $ Alert + b = 0 <= ys.Count; // $ Alert - b = xs.Count < 0; - b = ys.Count < 0; - b = 0 > xs.Count; + b = xs.Count < 0; // $ Alert + b = ys.Count < 0; // $ Alert + b = 0 > xs.Count; // $ Alert return b; } @@ -158,6 +158,6 @@ static bool ReadOnlyCollection(IReadOnlyCollection xs, IReadOnlyList c) { Debug.Assert(c.Count >= 0); // OK - return c.Count >= 0; // NOT OK + return c.Count >= 0; // $ Alert // NOT OK } } diff --git a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerSizeCmpZero/ContainerSizeCmpZero.qlref b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerSizeCmpZero/ContainerSizeCmpZero.qlref index 17c0434a3a81..92952b25bdb6 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerSizeCmpZero/ContainerSizeCmpZero.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/Collections/ContainerSizeCmpZero/ContainerSizeCmpZero.qlref @@ -1 +1,2 @@ -Likely Bugs/Collections/ContainerSizeCmpZero.ql \ No newline at end of file +query: Likely Bugs/Collections/ContainerSizeCmpZero.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.cs b/csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.cs index 0d10e11b7f63..976f18c7e153 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.cs @@ -12,10 +12,10 @@ void M() if (c != null ^ this.Field > 0) ; // GOOD if (c != null && c.Field > 0) ; // GOOD - if (c != null & c.Field > 0) ; // BAD - if (c == null | c.Property == "") ; // BAD - if (c == null | c[0]) ; // BAD - if (c == null | c.Method()) ; // BAD + if (c != null & c.Field > 0) ; // $ Alert // BAD + if (c == null | c.Property == "") ; // $ Alert // BAD + if (c == null | c[0]) ; // $ Alert // BAD + if (c == null | c.Method()) ; // $ Alert // BAD var b = true; b &= c.Method(); // GOOD @@ -34,4 +34,3 @@ class C public bool Method(out int x) { x = 0; return false; } } } - diff --git a/csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.qlref b/csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.qlref index 6e192b5b73f1..c150d5b2bd61 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/DangerousNonShortCircuitLogic/DangerousNonShortCircuitLogic.qlref @@ -1 +1,2 @@ -Likely Bugs/DangerousNonShortCircuitLogic.ql \ No newline at end of file +query: Likely Bugs/DangerousNonShortCircuitLogic.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/Dynamic/BadDynamicCall.qlref b/csharp/ql/test/query-tests/Likely Bugs/Dynamic/BadDynamicCall.qlref index e9490e9041ad..60268eb9d750 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/Dynamic/BadDynamicCall.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/Dynamic/BadDynamicCall.qlref @@ -1 +1,2 @@ -Likely Bugs/Dynamic/BadDynamicCall.ql \ No newline at end of file +query: Likely Bugs/Dynamic/BadDynamicCall.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/Dynamic/dynamic.cs b/csharp/ql/test/query-tests/Likely Bugs/Dynamic/dynamic.cs index 66626400b902..06f18e05320f 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/Dynamic/dynamic.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/Dynamic/dynamic.cs @@ -43,17 +43,17 @@ void TestCall() x.M5(1, new string[1]); // These are BAD: - x.M1(1); - x.M2(); - x.M2("", 1); - x.M2(1, "", 2.0); - x.M3(); - x.M3(1, 2, 3, 4); - x.M4(); - x.M4(1, 2); - x.M4(""); - x.M4(1, new object[1]); - x.M6(); + x.M1(1); // $ Alert + x.M2(); // $ Alert + x.M2("", 1); // $ Alert + x.M2(1, "", 2.0); // $ Alert + x.M3(); // $ Alert + x.M3(1, 2, 3, 4); // $ Alert + x.M4(); // $ Alert + x.M4(1, 2); // $ Alert + x.M4(""); // $ Alert + x.M4(1, new object[1]); // $ Alert + x.M6(); // $ Alert // These are GOOD: x.M7(2); @@ -61,8 +61,8 @@ void TestCall() x.M5(1, new string[] { "abc" }, new string[] { "def" }); // These are BAD: - x.M7(2, "abc"); - x.M8(1, new string[] { "abc" }, new string[] { "def" }); + x.M7(2, "abc"); // $ Alert + x.M8(1, new string[] { "abc" }, new string[] { "def" }); // $ Alert // These are GOOD: if ("" + "" == "") ; @@ -73,7 +73,7 @@ void TestCall() d -= 10; // These are BAD: - x = x + x; + x = x + x; // $ Alert // These are GOOD: dynamic d2 = GetI(); @@ -81,7 +81,7 @@ void TestCall() // These are BAD: dynamic d3 = GetI(); - d3.M(); + d3.M(); // $ Alert // These are GOOD dynamic d4 = ""; diff --git a/csharp/ql/test/query-tests/Likely Bugs/EqualsArray/EqualsArray.cs b/csharp/ql/test/query-tests/Likely Bugs/EqualsArray/EqualsArray.cs index dba87ee0450c..1639ee8f8445 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/EqualsArray/EqualsArray.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/EqualsArray/EqualsArray.cs @@ -8,7 +8,7 @@ public class Test // NOT OK public bool AreTheseMyNumbers(int[] numbers) { - return this.numbers.Equals(numbers); + return this.numbers.Equals(numbers); // $ Alert } // OK @@ -20,13 +20,13 @@ public bool HonestAreTheseMyNumbers(int[] numbers) // NOT OK (string is also IEnumerable) public bool Incomparable(string s) { - return numbers.Equals(s); + return numbers.Equals(s); // $ Alert } // NOT OK public bool CollectionEquals(IEnumerable c1) { - return c1.Equals(c1); + return c1.Equals(c1); // $ Alert } class CollectionImplementingIEnumerable1 : IEnumerable @@ -84,7 +84,7 @@ public override bool Equals(object other) // NOT OK: Nothing overrides Equals() bool OverriddenEquals(CollectionImplementingIEnumerable1 c) { - return c.Equals(c); + return c.Equals(c); // $ Alert } // OK: ImplementEquals overrides Equals() diff --git a/csharp/ql/test/query-tests/Likely Bugs/EqualsArray/EqualsArray.qlref b/csharp/ql/test/query-tests/Likely Bugs/EqualsArray/EqualsArray.qlref index d96256b3b972..8e560893a1de 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/EqualsArray/EqualsArray.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/EqualsArray/EqualsArray.qlref @@ -1 +1,2 @@ -Likely Bugs/EqualsArray.ql \ No newline at end of file +query: Likely Bugs/EqualsArray.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesAs/EqualsUsesAs.cs b/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesAs/EqualsUsesAs.cs index f50ada45a414..a83e94bd23da 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesAs/EqualsUsesAs.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesAs/EqualsUsesAs.cs @@ -2,7 +2,7 @@ public class Test1 { public override bool Equals(object other) { - var otherTest = other as Test1; // BAD + var otherTest = other as Test1; // $ Alert // BAD return otherTest != null; } } diff --git a/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesAs/EqualsUsesAs.qlref b/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesAs/EqualsUsesAs.qlref index e3ec94efc2c9..269ea2e6e511 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesAs/EqualsUsesAs.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesAs/EqualsUsesAs.qlref @@ -1 +1,2 @@ -Likely Bugs/EqualsUsesAs.ql \ No newline at end of file +query: Likely Bugs/EqualsUsesAs.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesIs/EqualsUsesIs.cs b/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesIs/EqualsUsesIs.cs index 6e1db1bd05a2..ab8c3da664a4 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesIs/EqualsUsesIs.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesIs/EqualsUsesIs.cs @@ -2,7 +2,7 @@ public class Test1 { public override bool Equals(object other) { - return other is Test1; // BAD + return other is Test1; // $ Alert // BAD } } diff --git a/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesIs/EqualsUsesIs.qlref b/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesIs/EqualsUsesIs.qlref index 04003a637c0b..cbff9b573dd6 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesIs/EqualsUsesIs.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/EqualsUsesIs/EqualsUsesIs.qlref @@ -1 +1,2 @@ -Likely Bugs/EqualsUsesIs.ql \ No newline at end of file +query: Likely Bugs/EqualsUsesIs.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/IncomparableEquals/IncomparableEquals.cs b/csharp/ql/test/query-tests/Likely Bugs/IncomparableEquals/IncomparableEquals.cs index cb9c97e8aa93..52043bfd4f41 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/IncomparableEquals/IncomparableEquals.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/IncomparableEquals/IncomparableEquals.cs @@ -3,7 +3,7 @@ public class Test public bool M() { var x = new Test2(); - return this.Equals(x); // BAD + return this.Equals(x); // $ Alert // BAD } } diff --git a/csharp/ql/test/query-tests/Likely Bugs/IncomparableEquals/IncomparableEquals.qlref b/csharp/ql/test/query-tests/Likely Bugs/IncomparableEquals/IncomparableEquals.qlref index 96eae4e2eac5..91b47c6ddd94 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/IncomparableEquals/IncomparableEquals.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/IncomparableEquals/IncomparableEquals.qlref @@ -1 +1,2 @@ -Likely Bugs/IncomparableEquals.ql \ No newline at end of file +query: Likely Bugs/IncomparableEquals.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/InconsistentCompareTo/InconsistentCompareTo.cs b/csharp/ql/test/query-tests/Likely Bugs/InconsistentCompareTo/InconsistentCompareTo.cs index b405dc09e1f2..78a9749afebb 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/InconsistentCompareTo/InconsistentCompareTo.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/InconsistentCompareTo/InconsistentCompareTo.cs @@ -31,25 +31,25 @@ abstract class GoodComparableAbstract : IComparable public abstract int CompareTo(object other); } -class BadComparable : IComparable +class BadComparable : IComparable // $ Alert { public int CompareTo(object other) { return 0; } public override int GetHashCode() { return 0; } } -class BadComparableInt : IComparable +class BadComparableInt : IComparable // $ Alert { public int CompareTo(int x) { return 0; } public override int GetHashCode() { return 0; } } -class BadComparableT : IComparable +class BadComparableT : IComparable // $ Alert { public int CompareTo(T t) { return 0; } public override int GetHashCode() { return 0; } } -class BadComparableNewEquals : IComparable +class BadComparableNewEquals : IComparable // $ Alert { public int CompareTo(object other) { return 0; } public new bool Equals(object other) { return false; } diff --git a/csharp/ql/test/query-tests/Likely Bugs/InconsistentCompareTo/InconsistentCompareTo.qlref b/csharp/ql/test/query-tests/Likely Bugs/InconsistentCompareTo/InconsistentCompareTo.qlref index 5663237f6729..03552e829c86 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/InconsistentCompareTo/InconsistentCompareTo.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/InconsistentCompareTo/InconsistentCompareTo.qlref @@ -1 +1,2 @@ -Likely Bugs/InconsistentCompareTo.ql \ No newline at end of file +query: Likely Bugs/InconsistentCompareTo.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/MishandlingJapaneseEra/MishandlingJapaneseEra.qlref b/csharp/ql/test/query-tests/Likely Bugs/MishandlingJapaneseEra/MishandlingJapaneseEra.qlref index cf11ec925453..791b603a2e9f 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/MishandlingJapaneseEra/MishandlingJapaneseEra.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/MishandlingJapaneseEra/MishandlingJapaneseEra.qlref @@ -1 +1,2 @@ -Likely Bugs/MishandlingJapaneseEra.ql \ No newline at end of file +query: Likely Bugs/MishandlingJapaneseEra.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/MishandlingJapaneseEra/Program.cs b/csharp/ql/test/query-tests/Likely Bugs/MishandlingJapaneseEra/Program.cs index 561b093f2308..9412593929a1 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/MishandlingJapaneseEra/Program.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/MishandlingJapaneseEra/Program.cs @@ -9,28 +9,28 @@ class Program static void Main(string[] args) { // BAD: hard-coded era start date - var henseiStart = new DateTime(1989, 1, 8); + var henseiStart = new DateTime(1989, 1, 8); // $ Alert // BAD: hard-coded era start dates, list - List listOfEraStart = new List { new DateTime(1989, 1, 8) }; + List listOfEraStart = new List { new DateTime(1989, 1, 8) }; // $ Alert // BAD: hardcoded era name string currentEra = "Heisei"; DateTimeOffset dateNow = DateTimeOffset.Now; - DateTimeOffset dateThisEra = new DateTimeOffset(1989, 1, 8, 0, 0, 0, 0, TimeSpan.Zero); + DateTimeOffset dateThisEra = new DateTimeOffset(1989, 1, 8, 0, 0, 0, 0, TimeSpan.Zero); // $ Alert CultureInfo japaneseCulture = CultureInfo.GetCultureInfo("ja-JP"); JapaneseCalendar jk = new JapaneseCalendar(); // BAD: datetime is created from constant year in the current era, and the result will change with era change - var datejkCurrentEra = jk.ToDateTime(32, 2, 1, 9, 9, 9, 9); + var datejkCurrentEra = jk.ToDateTime(32, 2, 1, 9, 9, 9, 9); // $ Alert Console.WriteLine("Date for datejkCurrentEra {0} and year {1}", datejkCurrentEra.ToString(japaneseCulture), jk.GetYear (datejkCurrentEra)); // BAD: datetime is created from constant year in the current era, and the result will change with era change - var datejk = jk.ToDateTime(32, 2, 1, 9, 9, 9, 9, 0); + var datejk = jk.ToDateTime(32, 2, 1, 9, 9, 9, 9, 0); // $ Alert Console.WriteLine("Date for jk {0} and year {1}", datejk.ToString(japaneseCulture), jk.GetYear (datejk)); // OK: datetime is created from constant year in the specific era, and the result will not change with era change @@ -46,7 +46,7 @@ static void Main(string[] args) Console.WriteLine("Which converts to year {0}", realYear); // BAD: creating DateTime using specified Japanese era date. This may yield a different date when era changes - DateTime val = new DateTime(32, 2, 1, new JapaneseCalendar()); + DateTime val = new DateTime(32, 2, 1, new JapaneseCalendar()); // $ Alert Console.WriteLine("DateTime from constructor {0}", val); // OK: variable data for Year, not necessarily hard-coded and can come from adjusted source diff --git a/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/NestedLoopsSameVariable.cs b/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/NestedLoopsSameVariable.cs index cd01795f202b..8dc1062d15b7 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/NestedLoopsSameVariable.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/NestedLoopsSameVariable.cs @@ -6,7 +6,7 @@ static void Main(string[] args) { for (int i = 0; i < 2; i++) { - for (int j = 0; j < 2; i++) + for (int j = 0; j < 2; i++) // $ Alert { Console.WriteLine(i + " " + j); } diff --git a/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/NestedLoopsSameVariable.qlref b/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/NestedLoopsSameVariable.qlref index c28b56d296d0..1e4470543922 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/NestedLoopsSameVariable.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/NestedLoopsSameVariable.qlref @@ -1 +1,2 @@ -Likely Bugs/NestedLoopsSameVariable.ql \ No newline at end of file +query: Likely Bugs/NestedLoopsSameVariable.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/Test.cs b/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/Test.cs index 7b08cd2c9145..671ffccb1d07 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/Test.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/NestedLoopsSameVariable/Test.cs @@ -19,7 +19,7 @@ void DifferentCondition1() for (int i=0; i<10; ++i) { // BAD: considered to be a different condition - for (; 10>i; ++i) + for (; 10>i; ++i) // $ Alert { Console.WriteLine(i); } @@ -31,7 +31,7 @@ void DifferentCondition2() for (int i=0; i<10; ++i) { // BAD: different condition - for (; i<9; ++i) + for (; i<9; ++i) // $ Alert { Console.WriteLine(i); } @@ -43,7 +43,7 @@ void DifferentConditions3() for (int i=0; i<10; ++i) { // BAD: different condition - for (; i<=10; ++i) + for (; i<=10; ++i) // $ Alert { Console.WriteLine(i); } @@ -54,7 +54,7 @@ void UseAfterInnerLoop() { for (int i=0; i<10; ++i) { - for (; i<10; ++i) + for (; i<10; ++i) // $ Alert { } diff --git a/csharp/ql/test/query-tests/Likely Bugs/ObjectComparison/ObjectComparison.cs b/csharp/ql/test/query-tests/Likely Bugs/ObjectComparison/ObjectComparison.cs index 2774b9229fb9..abaaf77ab44e 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/ObjectComparison/ObjectComparison.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/ObjectComparison/ObjectComparison.cs @@ -13,10 +13,10 @@ void M() ObjectComparisonTest y = new ObjectComparisonTest(); var b = x == y; // GOOD: but still reference equality - b = (object)x == y; // BAD - b = x == (object)y; // BAD - b = (I)x == y; // BAD - b = x == (I)y; // BAD + b = (object)x == y; // $ Alert // BAD + b = x == (object)y; // $ Alert // BAD + b = (I)x == y; // $ Alert // BAD + b = x == (I)y; // $ Alert // BAD b = (object)x == Field1; // GOOD b = Field1 == (object)x; // GOOD diff --git a/csharp/ql/test/query-tests/Likely Bugs/ObjectComparison/ObjectComparison.qlref b/csharp/ql/test/query-tests/Likely Bugs/ObjectComparison/ObjectComparison.qlref index 6f834d6d6548..e47228487204 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/ObjectComparison/ObjectComparison.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/ObjectComparison/ObjectComparison.qlref @@ -1 +1,2 @@ -Likely Bugs/ObjectComparison.ql \ No newline at end of file +query: Likely Bugs/ObjectComparison.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/PossibleLossOfPrecision/PossibleLossOfPrecision.cs b/csharp/ql/test/query-tests/Likely Bugs/PossibleLossOfPrecision/PossibleLossOfPrecision.cs index 9a5cdc7c4901..639e914e4799 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/PossibleLossOfPrecision/PossibleLossOfPrecision.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/PossibleLossOfPrecision/PossibleLossOfPrecision.cs @@ -11,18 +11,18 @@ static void main(string[] args) decimal dec; // These are BAD: - d = 1 / 2; - f = 1 / 2; - d = -1 / 2; - f = -2 / 3; - d = x / y; - f = x / y; - d = x / 2; - d = 4 / y; - d = 1.0 + 1 / 2; - d = 2.0 * (1 / 2); - d = 1 + 1 / 2 + 4 / 2; - d = 1 * (1 / 2); + d = 1 / 2; // $ Alert + f = 1 / 2; // $ Alert + d = -1 / 2; // $ Alert + f = -2 / 3; // $ Alert + d = x / y; // $ Alert + f = x / y; // $ Alert + d = x / 2; // $ Alert + d = 4 / y; // $ Alert + d = 1.0 + 1 / 2; // $ Alert + d = 2.0 * (1 / 2); // $ Alert + d = 1 + 1 / 2 + 4 / 2; // $ Alert + d = 1 * (1 / 2); // $ Alert // These are GOOD: d = 4 / 2; @@ -30,8 +30,8 @@ static void main(string[] args) i = 5 / 10; // These are BAD: - dec = 2 * i + 1; - dec = unchecked(int.MaxValue * int.MaxValue); + dec = 2 * i + 1; // $ Alert + dec = unchecked(int.MaxValue * int.MaxValue); // $ Alert // These are GOOD: dec = 2 * (uint)int.MaxValue - 1; diff --git a/csharp/ql/test/query-tests/Likely Bugs/PossibleLossOfPrecision/PossibleLossOfPrecision.qlref b/csharp/ql/test/query-tests/Likely Bugs/PossibleLossOfPrecision/PossibleLossOfPrecision.qlref index ecddf650e791..82a58e295a56 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/PossibleLossOfPrecision/PossibleLossOfPrecision.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/PossibleLossOfPrecision/PossibleLossOfPrecision.qlref @@ -1 +1,2 @@ -Likely Bugs/PossibleLossOfPrecision.ql \ No newline at end of file +query: Likely Bugs/PossibleLossOfPrecision.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/RandomUsedOnce/RandomUsedOnce.cs b/csharp/ql/test/query-tests/Likely Bugs/RandomUsedOnce/RandomUsedOnce.cs index fac7c9135af2..f62866a6bc37 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/RandomUsedOnce/RandomUsedOnce.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/RandomUsedOnce/RandomUsedOnce.cs @@ -8,14 +8,14 @@ class RandomTest { void f() { - new Random().Next(); // BAD + new Random().Next(); // $ Alert // BAD byte[] buffer = new byte[10]; - new Random().NextBytes(buffer); // BAD + new Random().NextBytes(buffer); // $ Alert // BAD - new Random().NextDouble(); // BAD - new Random().Next(10); // BAD - new Random().Next(10, 20); // BAD + new Random().NextDouble(); // $ Alert // BAD + new Random().Next(10); // $ Alert // BAD + new Random().Next(10, 20); // $ Alert // BAD new Random().Equals(null); // GOOD } diff --git a/csharp/ql/test/query-tests/Likely Bugs/RandomUsedOnce/RandomUsedOnce.qlref b/csharp/ql/test/query-tests/Likely Bugs/RandomUsedOnce/RandomUsedOnce.qlref index bff453451145..f9bb6c3eeb50 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/RandomUsedOnce/RandomUsedOnce.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/RandomUsedOnce/RandomUsedOnce.qlref @@ -1 +1,2 @@ -Likely Bugs/RandomUsedOnce.ql \ No newline at end of file +query: Likely Bugs/RandomUsedOnce.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/RecursiveEquals/RecursiveEquals.cs b/csharp/ql/test/query-tests/Likely Bugs/RecursiveEquals/RecursiveEquals.cs index 3182dc8430c3..f97b22ed2241 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/RecursiveEquals/RecursiveEquals.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/RecursiveEquals/RecursiveEquals.cs @@ -6,7 +6,7 @@ class Bad public override bool Equals(object rhs) { if (rhs.GetType() != this.GetType()) return false; - return Equals(rhs); + return Equals(rhs); // $ Alert } public bool Equals(Bad rhs) diff --git a/csharp/ql/test/query-tests/Likely Bugs/RecursiveEquals/RecursiveEquals.qlref b/csharp/ql/test/query-tests/Likely Bugs/RecursiveEquals/RecursiveEquals.qlref index d78738e7f9d1..68a07bb347dd 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/RecursiveEquals/RecursiveEquals.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/RecursiveEquals/RecursiveEquals.qlref @@ -1 +1,2 @@ -Likely Bugs/RecursiveEquals.ql \ No newline at end of file +query: Likely Bugs/RecursiveEquals.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/SelfAssignment/SelfAssignment.qlref b/csharp/ql/test/query-tests/Likely Bugs/SelfAssignment/SelfAssignment.qlref index 28778bdd1c8b..82f6d5d9682b 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/SelfAssignment/SelfAssignment.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/SelfAssignment/SelfAssignment.qlref @@ -1 +1,2 @@ -Likely Bugs/SelfAssignment.ql +query: Likely Bugs/SelfAssignment.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/SelfAssignment/selfassigns.cs b/csharp/ql/test/query-tests/Likely Bugs/SelfAssignment/selfassigns.cs index 6d1387a5e1db..c65c39349b37 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/SelfAssignment/selfassigns.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/SelfAssignment/selfassigns.cs @@ -70,17 +70,17 @@ public void OK(SelfAssigns obj, int x) public void NotOK(SelfAssigns obj, int y) { - this[4] = this[4]; - y = y; - obj.y = obj.y; - z = this.z; - this.z = z; - obj.Normal1 = obj.Normal1; - obj.Normal2 = obj.Normal2; - base.IntField = IntField; - this.BoolProp = base.BoolProp; - this.Self.Self.Self.StringProp = Self.Self.Self.StringProp; - intArray[1] = this.intArray[1 + 0]; + this[4] = this[4]; // $ Alert + y = y; // $ Alert + obj.y = obj.y; // $ Alert + z = this.z; // $ Alert + this.z = z; // $ Alert + obj.Normal1 = obj.Normal1; // $ Alert + obj.Normal2 = obj.Normal2; // $ Alert + base.IntField = IntField; // $ Alert + this.BoolProp = base.BoolProp; // $ Alert + this.Self.Self.Self.StringProp = Self.Self.Self.StringProp; // $ Alert + intArray[1] = this.intArray[1 + 0]; // $ Alert } enum Enum diff --git a/csharp/ql/test/query-tests/Likely Bugs/StaticFieldWrittenByInstance/StaticFieldWrittenByInstance.cs b/csharp/ql/test/query-tests/Likely Bugs/StaticFieldWrittenByInstance/StaticFieldWrittenByInstance.cs index 244a6b2fd156..ad95d66798df 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/StaticFieldWrittenByInstance/StaticFieldWrittenByInstance.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/StaticFieldWrittenByInstance/StaticFieldWrittenByInstance.cs @@ -12,7 +12,7 @@ static StaticFields() StaticFields() { - staticField = 0; // BAD + staticField = 0; // $ Alert // BAD instanceField = 0; // OK } @@ -23,7 +23,7 @@ static void StaticTest() void InstanceTest() { - staticField = 0; // BAD + staticField = 0; // $ Alert // BAD instanceField = 0; // OK } @@ -40,7 +40,7 @@ object Prop { get { - return backingField ?? (backingField = new object()); // BAD + return backingField ?? (backingField = new object()); // $ Alert // BAD } } } diff --git a/csharp/ql/test/query-tests/Likely Bugs/StaticFieldWrittenByInstance/StaticFieldWrittenByInstance.qlref b/csharp/ql/test/query-tests/Likely Bugs/StaticFieldWrittenByInstance/StaticFieldWrittenByInstance.qlref index 6c3a7cc48249..62a3ba9ac281 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/StaticFieldWrittenByInstance/StaticFieldWrittenByInstance.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/StaticFieldWrittenByInstance/StaticFieldWrittenByInstance.qlref @@ -1 +1,2 @@ -Likely Bugs/StaticFieldWrittenByInstance.ql +query: Likely Bugs/StaticFieldWrittenByInstance.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/StringBuilderCharInit/StringBufferCharInit.qlref b/csharp/ql/test/query-tests/Likely Bugs/StringBuilderCharInit/StringBufferCharInit.qlref index 8d6feb01896b..10a4fb9ee8e3 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/StringBuilderCharInit/StringBufferCharInit.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/StringBuilderCharInit/StringBufferCharInit.qlref @@ -1 +1,2 @@ -Likely Bugs/StringBuilderCharInit.ql \ No newline at end of file +query: Likely Bugs/StringBuilderCharInit.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/StringBuilderCharInit/StringBuilderCharInit.cs b/csharp/ql/test/query-tests/Likely Bugs/StringBuilderCharInit/StringBuilderCharInit.cs index 256199df1776..a6d15816aeb2 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/StringBuilderCharInit/StringBuilderCharInit.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/StringBuilderCharInit/StringBuilderCharInit.cs @@ -6,14 +6,14 @@ static void Main() { new StringBuilder(); new StringBuilder(12); - new StringBuilder('a'); // BAD + new StringBuilder('a'); // $ Alert // BAD new StringBuilder(3, 4); - new StringBuilder(3, 'a'); // BAD - new StringBuilder('a', 'b'); // BAD + new StringBuilder(3, 'a'); // $ Alert // BAD + new StringBuilder('a', 'b'); // $ Alert // BAD new StringBuilder(""); new StringBuilder("", 12); - new StringBuilder("", 'a'); // BAD + new StringBuilder("", 'a'); // $ Alert // BAD new StringBuilder("abc", 1, 1, 12); - new StringBuilder("abc", 1, 1, 'a'); // BAD + new StringBuilder("abc", 1, 1, 'a'); // $ Alert // BAD } } diff --git a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransform/ThreadUnsafeICryptoTransform.cs b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransform/ThreadUnsafeICryptoTransform.cs index e886518dcdf1..9cf42b90263b 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransform/ThreadUnsafeICryptoTransform.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransform/ThreadUnsafeICryptoTransform.cs @@ -37,12 +37,12 @@ public ListNonStatic() /// public class Nest03 { - private static readonly Nest01 _n = new Nest01(); + private static readonly Nest01 _n = new Nest01(); // $ Alert } public class Nest04 { - static ListNonStatic _list = new ListNonStatic(); + static ListNonStatic _list = new ListNonStatic(); // $ Alert } public static class StaticMemberChildUsage @@ -53,7 +53,7 @@ public enum DigestAlgorithm SHA256, } - private static readonly IDictionary HashMap = new Dictionary + private static readonly IDictionary HashMap = new Dictionary // $ Alert { { DigestAlgorithm.SHA1, SHA1.Create() }, { DigestAlgorithm.SHA256, SHA256.Create() }, @@ -62,12 +62,12 @@ public enum DigestAlgorithm public class StaticMember { - private static SHA1 _sha1 = SHA1.Create(); + private static SHA1 _sha1 = SHA1.Create(); // $ Alert } public class IndirectStatic2 { - static Nest02 _n = new Nest02(); + static Nest02 _n = new Nest02(); // $ Alert } /// diff --git a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransform/ThreadUnsafeICryptoTransform.qlref b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransform/ThreadUnsafeICryptoTransform.qlref index e247961a538d..7a9c70237578 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransform/ThreadUnsafeICryptoTransform.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransform/ThreadUnsafeICryptoTransform.qlref @@ -1 +1,2 @@ -Likely Bugs/ThreadUnsafeICryptoTransform.ql \ No newline at end of file +query: Likely Bugs/ThreadUnsafeICryptoTransform.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.cs b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.cs index f62c25025fc2..83018409f5cf 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.cs @@ -23,7 +23,7 @@ public static void Run(int max) // BUG expected var threads = Enumerable.Range(0, threadCount) - .Select(_ => new ThreadStart(start)) + .Select(_ => new ThreadStart(start)) // $ Alert .Select(x => new Thread(x)) .ToList(); foreach (var t in threads) t.Start(); @@ -85,7 +85,7 @@ public static void Run(int max) } }; var threads = Enumerable.Range(0, threadCount) - .Select(_ => new ThreadStart(start)) + .Select(_ => new ThreadStart(start)) // $ Alert .Select(x => new Thread(x)) .ToList(); foreach (var t in threads) t.Start(); @@ -143,12 +143,12 @@ public static void Run() { var bytes = new byte[4]; Convert.ToBase64String(sha1.ComputeHash(bytes)); - }, + }, // $ Alert () => { var bytes = new byte[4]; Convert.ToBase64String(sha1.ComputeHash(bytes)); - } + } // $ Alert ); } diff --git a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.qlref b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.qlref index 0a869270c9ba..f206d84cd77e 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/ThreadUnsafeICryptoTransformLambda/ThreadUnsafeICryptoTransformLambda.qlref @@ -1 +1,2 @@ -Likely Bugs/ThreadUnsafeICryptoTransformLambda.ql \ No newline at end of file +query: Likely Bugs/ThreadUnsafeICryptoTransformLambda.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.cs b/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.cs index 31e2336d0ca3..346dcc94c070 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.cs @@ -4,6 +4,6 @@ public class Test public override bool Equals(object other) { - return ((Test)other).Field == this.Field; + return ((Test)other).Field == this.Field; // $ Alert } } diff --git a/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.qlref b/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.qlref index 4fc0cc8938f5..fa38710c7511 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/UncheckedCastInEquals/UncheckedCastInEquals.qlref @@ -1 +1,2 @@ -Likely Bugs/UncheckedCastInEquals.ql \ No newline at end of file +query: Likely Bugs/UncheckedCastInEquals.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Likely Bugs/UnsafeYearConstruction/Program.cs b/csharp/ql/test/query-tests/Likely Bugs/UnsafeYearConstruction/Program.cs index b7b6b4d4e3a6..83c18ca52763 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/UnsafeYearConstruction/Program.cs +++ b/csharp/ql/test/query-tests/Likely Bugs/UnsafeYearConstruction/Program.cs @@ -10,11 +10,11 @@ public PipelineProperties() { var now = DateTime.UtcNow; // BAD - this.Start = new DateTime(now.Year - 1, now.Month, now.Day, 0, 0, 0, DateTimeKind.Utc); + this.Start = new DateTime(now.Year - 1, now.Month, now.Day, 0, 0, 0, DateTimeKind.Utc); // $ Alert - var endYear = now.Year + 1; + var endYear = now.Year + 1; // $ Source // BAD - this.End = new DateTime(endYear, now.Month, now.Day, 0, 0, 1, DateTimeKind.Utc); + this.End = new DateTime(endYear, now.Month, now.Day, 0, 0, 1, DateTimeKind.Utc); // $ Alert // GOOD this.Start = now.AddYears(-1).Date; @@ -23,14 +23,14 @@ public PipelineProperties() private void Test(int year, int month, int day) { // BAD (arithmetic operation from StartTest) - this.Start = new DateTime(year, month, day); + this.Start = new DateTime(year, month, day); // $ Alert } public void StartTest() { var now = DateTime.UtcNow; // flows into Test (source for bug) - Test(now.Year - 1, now.Month, now.Day); + Test(now.Year - 1, now.Month, now.Day); // $ Source } public void StartTestFP() diff --git a/csharp/ql/test/query-tests/Likely Bugs/UnsafeYearConstruction/UnsafeYearConstruction.qlref b/csharp/ql/test/query-tests/Likely Bugs/UnsafeYearConstruction/UnsafeYearConstruction.qlref index 37fd40fb036c..8eebe63939d1 100644 --- a/csharp/ql/test/query-tests/Likely Bugs/UnsafeYearConstruction/UnsafeYearConstruction.qlref +++ b/csharp/ql/test/query-tests/Likely Bugs/UnsafeYearConstruction/UnsafeYearConstruction.qlref @@ -1 +1,2 @@ -Likely Bugs/LeapYear/UnsafeYearConstruction.ql \ No newline at end of file +query: Likely Bugs/LeapYear/UnsafeYearConstruction.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.cs b/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.cs index fe5617c228a1..5bd7f5dcec08 100644 --- a/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.cs +++ b/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.cs @@ -11,7 +11,7 @@ public void M1(List animals) { Dog d = (Dog)a; d.Woof(); - } + } // $ Alert } public void M2(NonEnumerableClass nec) @@ -31,7 +31,7 @@ public void M3(Animal[] animals) { Dog d = (Dog)animal; d.Woof(); - } + } // $ Alert } public void M4(Array animals) @@ -41,7 +41,7 @@ public void M4(Array animals) { Dog d = (Dog)animal; d.Woof(); - } + } // $ Alert } public void M5(IEnumerable animals) @@ -51,7 +51,7 @@ public void M5(IEnumerable animals) { Dog d = (Dog)animal; d.Woof(); - } + } // $ Alert } public class NonEnumerableClass diff --git a/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.qlref b/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.qlref index 8d70f9995033..3731b64605f5 100644 --- a/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.qlref +++ b/csharp/ql/test/query-tests/Linq/MissedCastOpportunity/MissedCastOpportunity.qlref @@ -1 +1,2 @@ -Linq/MissedCastOpportunity.ql +query: Linq/MissedCastOpportunity.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.cs b/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.cs index d1326c70ee23..0fee1e9c48ff 100644 --- a/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.cs +++ b/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.cs @@ -13,7 +13,7 @@ public void M1(List lst) continue; Console.WriteLine(i); Console.WriteLine((i / 2)); - } + } // $ Alert // BAD: Can be replaced with lst.Where(e => e % 2 == 0) foreach (int i in lst) @@ -23,7 +23,7 @@ public void M1(List lst) Console.WriteLine(i); Console.WriteLine((i / 2)); } - } + } // $ Alert } public void M2(NonEnumerableClass nec) @@ -49,7 +49,7 @@ public void M3(int[] arr) Console.WriteLine(n); Console.WriteLine((n / 2)); } - } + } // $ Alert } public void M4(Array arr) @@ -73,7 +73,7 @@ public void M5(IEnumerable elements) { Console.WriteLine(element); } - } + } // $ Alert } public class NonEnumerableClass diff --git a/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.qlref b/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.qlref index 4a08b459a6c3..815371aba99c 100644 --- a/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.qlref +++ b/csharp/ql/test/query-tests/Linq/MissedWhereOpportunity/MissedWhereOpportunity.qlref @@ -1 +1,2 @@ -Linq/MissedWhereOpportunity.ql +query: Linq/MissedWhereOpportunity.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/MagicConstants/AttributeInts.cs b/csharp/ql/test/query-tests/MagicConstants/AttributeInts.cs index 370dc0a948f2..441525751b80 100644 --- a/csharp/ql/test/query-tests/MagicConstants/AttributeInts.cs +++ b/csharp/ql/test/query-tests/MagicConstants/AttributeInts.cs @@ -20,7 +20,7 @@ void f1() void f2() { // BAD - var x = 555 + + var x = 555 + // $ Alert[cs/magic-number] 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555 + 555; } diff --git a/csharp/ql/test/query-tests/MagicConstants/AttributeStrings.cs b/csharp/ql/test/query-tests/MagicConstants/AttributeStrings.cs index 5dd81b335f71..4100d12f93fc 100644 --- a/csharp/ql/test/query-tests/MagicConstants/AttributeStrings.cs +++ b/csharp/ql/test/query-tests/MagicConstants/AttributeStrings.cs @@ -3,7 +3,7 @@ class MyClass { public static void Main() { - System.Console.WriteLine("Hello, World!"); + System.Console.WriteLine("Hello, World!"); // $ Alert[cs/magic-string] System.Console.WriteLine("Hello, World!"); System.Console.WriteLine("Hello, World!"); System.Console.WriteLine("Hello, World!"); diff --git a/csharp/ql/test/query-tests/MagicConstants/AttributeStrings.qlref b/csharp/ql/test/query-tests/MagicConstants/AttributeStrings.qlref index c471ffedda83..7b0fd125d426 100644 --- a/csharp/ql/test/query-tests/MagicConstants/AttributeStrings.qlref +++ b/csharp/ql/test/query-tests/MagicConstants/AttributeStrings.qlref @@ -1 +1,2 @@ -Bad Practices/Magic Constants/MagicConstantsString.ql \ No newline at end of file +query: Bad Practices/Magic Constants/MagicConstantsString.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/MagicConstants/HashCode.cs b/csharp/ql/test/query-tests/MagicConstants/HashCode.cs index 71308f8fb6c6..7767fa6499db 100644 --- a/csharp/ql/test/query-tests/MagicConstants/HashCode.cs +++ b/csharp/ql/test/query-tests/MagicConstants/HashCode.cs @@ -13,7 +13,7 @@ int NotHashCode() { // BAD: Number 391 is repeated. return - 391 + + 391 + // $ Alert[cs/magic-number] 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 391 + 397; } diff --git a/csharp/ql/test/query-tests/MagicConstants/MagicConstantsNumbers.qlref b/csharp/ql/test/query-tests/MagicConstants/MagicConstantsNumbers.qlref index 8047296eeeba..514381dce917 100644 --- a/csharp/ql/test/query-tests/MagicConstants/MagicConstantsNumbers.qlref +++ b/csharp/ql/test/query-tests/MagicConstants/MagicConstantsNumbers.qlref @@ -1 +1,2 @@ -Bad Practices/Magic Constants/MagicConstantsNumbers.ql \ No newline at end of file +query: Bad Practices/Magic Constants/MagicConstantsNumbers.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/MagicConstants/MagicNumbersUseConstant.cs b/csharp/ql/test/query-tests/MagicConstants/MagicNumbersUseConstant.cs index 35f1bbb1435a..039ac137dda2 100644 --- a/csharp/ql/test/query-tests/MagicConstants/MagicNumbersUseConstant.cs +++ b/csharp/ql/test/query-tests/MagicConstants/MagicNumbersUseConstant.cs @@ -16,12 +16,12 @@ class UseConstantNumber byte[] values2 = { 241 }; // BAD: Use constant - int values3 = 241; + int values3 = 241; // $ Alert[cs/use-number-constant] void Test() { // BAD: Use constant - var v1 = 241; + var v1 = 241; // $ Alert[cs/use-number-constant] // GOOD: Constant used var v2 = IntConstants.PUBLIC_CONST; diff --git a/csharp/ql/test/query-tests/MagicConstants/MagicNumbersUseConstant.qlref b/csharp/ql/test/query-tests/MagicConstants/MagicNumbersUseConstant.qlref index 65c1a785c6cf..75437932f589 100644 --- a/csharp/ql/test/query-tests/MagicConstants/MagicNumbersUseConstant.qlref +++ b/csharp/ql/test/query-tests/MagicConstants/MagicNumbersUseConstant.qlref @@ -1 +1,2 @@ -Bad Practices/Magic Constants/MagicNumbersUseConstant.ql \ No newline at end of file +query: Bad Practices/Magic Constants/MagicNumbersUseConstant.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/MagicConstants/MagicStringsUseConstant.cs b/csharp/ql/test/query-tests/MagicConstants/MagicStringsUseConstant.cs index c0b0fc8189c6..a09bf27c8d9a 100644 --- a/csharp/ql/test/query-tests/MagicConstants/MagicStringsUseConstant.cs +++ b/csharp/ql/test/query-tests/MagicConstants/MagicStringsUseConstant.cs @@ -14,12 +14,12 @@ class UseConstantString string[] values1 = { "abcdefgh" }; // BAD: Use constant - string values2 = "abcdefgh"; + string values2 = "abcdefgh"; // $ Alert[cs/use-string-constant] void Test() { // BAD: Use constant - var v1 = "abcdefgh"; + var v1 = "abcdefgh"; // $ Alert[cs/use-string-constant] // GOOD: Constant used. var v2 = StringConstants.PUBLIC_CONSTANT; diff --git a/csharp/ql/test/query-tests/MagicConstants/MagicStringsUseConstant.qlref b/csharp/ql/test/query-tests/MagicConstants/MagicStringsUseConstant.qlref index 72b6dcbab7d4..7ded4ffe161b 100644 --- a/csharp/ql/test/query-tests/MagicConstants/MagicStringsUseConstant.qlref +++ b/csharp/ql/test/query-tests/MagicConstants/MagicStringsUseConstant.qlref @@ -1 +1,2 @@ -Bad Practices/Magic Constants/MagicStringsUseConstant.ql \ No newline at end of file +query: Bad Practices/Magic Constants/MagicStringsUseConstant.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Metrics/Files/FLinesOfCommentedCode/flinesofcommentedcode.qlref b/csharp/ql/test/query-tests/Metrics/Files/FLinesOfCommentedCode/flinesofcommentedcode.qlref index 85a80a9627eb..952183500693 100644 --- a/csharp/ql/test/query-tests/Metrics/Files/FLinesOfCommentedCode/flinesofcommentedcode.qlref +++ b/csharp/ql/test/query-tests/Metrics/Files/FLinesOfCommentedCode/flinesofcommentedcode.qlref @@ -1 +1 @@ -Metrics/Files/FLinesOfCommentedCode.ql \ No newline at end of file +query: Metrics/Files/FLinesOfCommentedCode.ql diff --git a/csharp/ql/test/query-tests/Metrics/RefTypes/TNumberOfFields/EnumSize.qlref b/csharp/ql/test/query-tests/Metrics/RefTypes/TNumberOfFields/EnumSize.qlref index c20a0d3886c1..67b897b1f5dc 100644 --- a/csharp/ql/test/query-tests/Metrics/RefTypes/TNumberOfFields/EnumSize.qlref +++ b/csharp/ql/test/query-tests/Metrics/RefTypes/TNumberOfFields/EnumSize.qlref @@ -1 +1 @@ -Metrics/RefTypes/TNumberOfFields.ql \ No newline at end of file +query: Metrics/RefTypes/TNumberOfFields.ql diff --git a/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.qlref b/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.qlref index 8c18065043fd..7510037b8101 100644 --- a/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.qlref +++ b/csharp/ql/test/query-tests/Metrics/Summaries/LinesOfCode.qlref @@ -1 +1 @@ -Metrics/Summaries/LinesOfCode.ql \ No newline at end of file +query: Metrics/Summaries/LinesOfCode.ql diff --git a/csharp/ql/test/query-tests/Performance/StringBuilderInLoop/StringBuilderInLoop.cs b/csharp/ql/test/query-tests/Performance/StringBuilderInLoop/StringBuilderInLoop.cs index 63b8d5b386eb..dc1c24e3d3eb 100644 --- a/csharp/ql/test/query-tests/Performance/StringBuilderInLoop/StringBuilderInLoop.cs +++ b/csharp/ql/test/query-tests/Performance/StringBuilderInLoop/StringBuilderInLoop.cs @@ -7,7 +7,7 @@ static void Main(string[] args) { foreach (var arg in args) { - var sb = new StringBuilder(); // BAD: Creation in loop + var sb = new StringBuilder(); // $ Alert // BAD: Creation in loop sb.Append("Hello ").Append(arg); Console.WriteLine(sb); } @@ -33,7 +33,7 @@ void ControlFlow(string[] args) sb = new StringBuilder(); // GOOD: Not in all control paths else sb.Clear(); - lock (sb) sb = new StringBuilder(); // BAD: In all control paths + lock (sb) sb = new StringBuilder(); // $ Alert // BAD: In all control paths sb.Append("Hello ").Append(arg); Console.WriteLine(sb); } diff --git a/csharp/ql/test/query-tests/Performance/StringBuilderInLoop/StringBuilderInLoop.qlref b/csharp/ql/test/query-tests/Performance/StringBuilderInLoop/StringBuilderInLoop.qlref index 3b5d707f51e6..8b8d7b8e147b 100644 --- a/csharp/ql/test/query-tests/Performance/StringBuilderInLoop/StringBuilderInLoop.qlref +++ b/csharp/ql/test/query-tests/Performance/StringBuilderInLoop/StringBuilderInLoop.qlref @@ -1 +1,2 @@ -Performance/StringBuilderInLoop.ql \ No newline at end of file +query: Performance/StringBuilderInLoop.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Performance/StringConcatenationInLoop/StringConcatenationInLoop.cs b/csharp/ql/test/query-tests/Performance/StringConcatenationInLoop/StringConcatenationInLoop.cs index 4947363a083c..80dde40d5532 100644 --- a/csharp/ql/test/query-tests/Performance/StringConcatenationInLoop/StringConcatenationInLoop.cs +++ b/csharp/ql/test/query-tests/Performance/StringConcatenationInLoop/StringConcatenationInLoop.cs @@ -10,8 +10,8 @@ public Program() var x1 = ""; for (var i = 0; i < 1000; i++) { - x0 += "" + i; // BAD - x1 = x1 + i; // BAD + x0 += "" + i; // $ Alert // BAD + x1 = x1 + i; // $ Alert // BAD var x2 = ""; x2 += x1; // GOOD } diff --git a/csharp/ql/test/query-tests/Performance/StringConcatenationInLoop/StringConcatenationInLoop.qlref b/csharp/ql/test/query-tests/Performance/StringConcatenationInLoop/StringConcatenationInLoop.qlref index edd774f1e609..302e7fefd8a6 100644 --- a/csharp/ql/test/query-tests/Performance/StringConcatenationInLoop/StringConcatenationInLoop.qlref +++ b/csharp/ql/test/query-tests/Performance/StringConcatenationInLoop/StringConcatenationInLoop.qlref @@ -1 +1,2 @@ -Performance/StringConcatenationInLoop.ql \ No newline at end of file +query: Performance/StringConcatenationInLoop.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Performance/UseTryGetValue/UseTryGetValue.cs b/csharp/ql/test/query-tests/Performance/UseTryGetValue/UseTryGetValue.cs index 296ffaa82f27..9f39c43926e2 100644 --- a/csharp/ql/test/query-tests/Performance/UseTryGetValue/UseTryGetValue.cs +++ b/csharp/ql/test/query-tests/Performance/UseTryGetValue/UseTryGetValue.cs @@ -16,24 +16,24 @@ static void Main(string[] args) dict.TryGetValue(2, out x); // These are BAD - if (dict.ContainsKey(1)) x = dict[1]; - if (dict.ContainsKey(1) && dict[1] == 2) ; - if (!dict.ContainsKey(1) && dict[1] == 2) ; - if (!dict.ContainsKey(1) || dict[1] == 2) ; - if (dict.ContainsKey(1) || dict[1] == 2) ; + if (dict.ContainsKey(1)) x = dict[1]; // $ Alert + if (dict.ContainsKey(1) && dict[1] == 2) ; // $ Alert + if (!dict.ContainsKey(1) && dict[1] == 2) ; // $ Alert + if (!dict.ContainsKey(1) || dict[1] == 2) ; // $ Alert + if (dict.ContainsKey(1) || dict[1] == 2) ; // $ Alert - if (dict.ContainsKey(1)) + if (dict.ContainsKey(1)) // $ Alert x = dict[1]; else x = dict[1]; - if (!dict.ContainsKey(1)) + if (!dict.ContainsKey(1)) // $ Alert x = dict[1]; else x = dict[1]; - x = dict.ContainsKey(1) ? dict[1] : dict[1]; - x = !dict.ContainsKey(1) ? dict[1] : dict[1]; - x = true && !dict.ContainsKey(1) ? dict[1] : dict[1]; + x = dict.ContainsKey(1) ? dict[1] : dict[1]; // $ Alert + x = !dict.ContainsKey(1) ? dict[1] : dict[1]; // $ Alert + x = true && !dict.ContainsKey(1) ? dict[1] : dict[1]; // $ Alert // GOOD: Different index if (dict.ContainsKey(0)) x = dict[1]; diff --git a/csharp/ql/test/query-tests/Performance/UseTryGetValue/UseTryGetValue.qlref b/csharp/ql/test/query-tests/Performance/UseTryGetValue/UseTryGetValue.qlref index 13889c6245fc..5ca355f78242 100644 --- a/csharp/ql/test/query-tests/Performance/UseTryGetValue/UseTryGetValue.qlref +++ b/csharp/ql/test/query-tests/Performance/UseTryGetValue/UseTryGetValue.qlref @@ -1 +1,2 @@ -Performance/UseTryGetValue.ql \ No newline at end of file +query: Performance/UseTryGetValue.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/ReadOnlyContainer/ReadOnlyContainer.cs b/csharp/ql/test/query-tests/ReadOnlyContainer/ReadOnlyContainer.cs index f9914566bb98..b627b6e65b3f 100644 --- a/csharp/ql/test/query-tests/ReadOnlyContainer/ReadOnlyContainer.cs +++ b/csharp/ql/test/query-tests/ReadOnlyContainer/ReadOnlyContainer.cs @@ -6,11 +6,11 @@ class Test { // Test variable scope - IList v1 = new List(); // BAD: private scope + IList v1 = new List(); // $ Alert // BAD: private scope void f() { - var v2 = new List(); // BAD: local scope + var v2 = new List(); // $ Alert // BAD: local scope var x = v1.Contains(1); var y = v2.Contains(2); } @@ -27,7 +27,7 @@ void g() // Test initializer IList n3 = new List { 1, 2, 3 }; // GOOD: initialized - IList v3; // BAD: unassigned + IList v3; // $ Alert // BAD: unassigned void h() { @@ -52,7 +52,7 @@ void f1() n5 = new List { 1, 2, 3 }; n5.Contains(1); - var v4 = new List(); // BAD: assigned only from empty list + var v4 = new List(); // $ Alert // BAD: assigned only from empty list v4 = new List(); v4.Contains(1); @@ -73,30 +73,30 @@ void f3() void f4() { - var v5 = new Dictionary(); // BAD + var v5 = new Dictionary(); // $ Alert // BAD v5.ContainsKey(1); v5.ContainsValue(1); v5.GetEnumerator(); var tmp = new HashSet(); - var v6 = new HashSet(); // BAD + var v6 = new HashSet(); // $ Alert // BAD v6.IsSubsetOf(tmp); v6.IsProperSubsetOf(tmp); v6.IsSupersetOf(tmp); v6.IsProperSupersetOf(tmp); - var v7 = new LinkedList(); // BAD + var v7 = new LinkedList(); // $ Alert // BAD v7.Contains(1); - var v8 = new Queue(); // BAD + var v8 = new Queue(); // $ Alert // BAD v8.Dequeue(); v8.Peek(); v8.ToArray(); - var v9 = new Stack(); // BAD + var v9 = new Stack(); // $ Alert // BAD v9.Pop(); - var v10 = new List(); // BAD: property access + var v10 = new List(); // $ Alert // BAD: property access var x = v10.Count; } @@ -118,7 +118,7 @@ void f5() void f6() { - var v11 = new Dictionary(); // BAD: read by Index + var v11 = new Dictionary(); // $ Alert // BAD: read by Index var x = v11[1]; var n12 = new Dictionary(); // GOOD: written by Index @@ -155,7 +155,7 @@ void f8(object arguments) void f9() { - var l1 = new MyList(); // BAD + var l1 = new MyList(); // $ Alert // BAD var x1 = l1[0]; var l2 = new MyList(); // GOOD diff --git a/csharp/ql/test/query-tests/ReadOnlyContainer/ReadOnlyContainer.qlref b/csharp/ql/test/query-tests/ReadOnlyContainer/ReadOnlyContainer.qlref index 2f4f5248a6bb..623d63c75056 100644 --- a/csharp/ql/test/query-tests/ReadOnlyContainer/ReadOnlyContainer.qlref +++ b/csharp/ql/test/query-tests/ReadOnlyContainer/ReadOnlyContainer.qlref @@ -1 +1,2 @@ -Likely Bugs/Collections/ReadOnlyContainer.ql \ No newline at end of file +query: Likely Bugs/Collections/ReadOnlyContainer.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-011/ASPNetDebug.qlref b/csharp/ql/test/query-tests/Security Features/CWE-011/ASPNetDebug.qlref index da2dbc17be05..f197b183e75e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-011/ASPNetDebug.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-011/ASPNetDebug.qlref @@ -1 +1,2 @@ -Security Features/CWE-011/ASPNetDebug.ql \ No newline at end of file +query: Security Features/CWE-011/ASPNetDebug.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-011/bad1/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-011/bad1/Web.config index ffc04c240fae..c79a46e2c881 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-011/bad1/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-011/bad1/Web.config @@ -4,6 +4,6 @@ + /> diff --git a/csharp/ql/test/query-tests/Security Features/CWE-011/bad2/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-011/bad2/Web.config index ffc04c240fae..c79a46e2c881 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-011/bad2/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-011/bad2/Web.config @@ -4,6 +4,6 @@ + /> diff --git a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/ASPNetMaxRequestLength.qlref b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/ASPNetMaxRequestLength.qlref index 7469d5d2e98a..5c2fc1ad4f63 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/ASPNetMaxRequestLength.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/ASPNetMaxRequestLength.qlref @@ -1 +1,2 @@ -Security Features/CWE-016/ASPNetMaxRequestLength.ql \ No newline at end of file +query: Security Features/CWE-016/ASPNetMaxRequestLength.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/bad/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/bad/Web.config index ea52bd2505b8..a9e98986c4cb 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/bad/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetMaxRequestLength/bad/Web.config @@ -1,6 +1,6 @@ - + - \ No newline at end of file + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequest.qlref b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequest.qlref index 2116949f754e..5eaf78b95be4 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequest.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequest.qlref @@ -1 +1,2 @@ -Security Features/CWE-016/ASPNetPagesValidateRequest.ql \ No newline at end of file +query: Security Features/CWE-016/ASPNetPagesValidateRequest.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequestBad.config b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequestBad.config index e8fbc48cb6e8..927a73b39d00 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequestBad.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetPagesValidateRequest/ASPNetPagesValidateRequestBad.config @@ -1,5 +1,5 @@ - + - \ No newline at end of file + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetRequestValidationMode/ASPNetRequestValidationMode.qlref b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetRequestValidationMode/ASPNetRequestValidationMode.qlref index 86ac50728428..c057ae5aa6c8 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetRequestValidationMode/ASPNetRequestValidationMode.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetRequestValidationMode/ASPNetRequestValidationMode.qlref @@ -1 +1,2 @@ -Security Features/CWE-016/ASPNetRequestValidationMode.ql \ No newline at end of file +query: Security Features/CWE-016/ASPNetRequestValidationMode.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetRequestValidationMode/ASPNetRequestValidationModeBad.config b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetRequestValidationMode/ASPNetRequestValidationModeBad.config index e2c8b8dc9031..2a9be99dc51e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetRequestValidationMode/ASPNetRequestValidationModeBad.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-016/ASPNetRequestValidationMode/ASPNetRequestValidationModeBad.config @@ -1,5 +1,5 @@ - + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.qlref b/csharp/ql/test/query-tests/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.qlref index 68f234e9d372..44a26f7eb0f4 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.qlref @@ -1 +1 @@ -Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.ql \ No newline at end of file +query: Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypass.cs b/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypass.cs index aea3c4e244f8..4be65381f5a0 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypass.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypass.cs @@ -17,7 +17,7 @@ public Test1(string v) [OnDeserializing] public void Deserialize() { - f = GetString(); // BAD, non-constant and non-object creation expr + f = GetString(); // $ Alert[cs/serialization-check-bypass] // BAD, non-constant and non-object creation expr } string GetString() { throw null; } @@ -123,7 +123,7 @@ public Test5(int age) [OnDeserializing] void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context) { - Age = info.GetInt32("age"); // BAD + Age = info.GetInt32("age"); // $ Alert[cs/serialization-check-bypass] // BAD } } @@ -167,7 +167,7 @@ void ISerializable.GetObjectData(SerializationInfo info, StreamingContext contex int age = info.GetInt32("age"); if (false) throw new SerializationException("age"); - Age = age; // BAD + Age = age; // $ Alert[cs/serialization-check-bypass] // BAD } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypassBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypassBad.cs index 5d89942f9fe8..c41bbf776b10 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypassBad.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksBypassBad.cs @@ -16,6 +16,6 @@ public PersonBad(int age) [OnDeserializing] void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context) { - Age = info.GetInt32("age"); // BAD - write is unsafe + Age = info.GetInt32("age"); // $ Alert[cs/serialization-check-bypass] // BAD - write is unsafe } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksbypass.qlref b/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksbypass.qlref index c5615a7415c4..375a7f00e550 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksbypass.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-020/RuntimeChecksbypass.qlref @@ -1 +1,2 @@ -Security Features/CWE-020/RuntimeChecksBypass.ql \ No newline at end of file +query: Security Features/CWE-020/RuntimeChecksBypass.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedData.cs b/csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedData.cs index 7b0f789c2aec..997ecc4f5cd2 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedData.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedData.cs @@ -6,11 +6,11 @@ public class UntrustedData : IHttpHandler { public void ProcessRequest(HttpContext ctx) { - var name = ctx.Request.QueryString["name"]; + var name = ctx.Request.QueryString["name"]; // $ Alert[cs/untrusted-data-to-external-api]=r1 $ Alert[cs/untrusted-data-to-external-api]=r1 $ Source[cs/untrusted-data-to-external-api]=r2 var len = name.Length; var myEncodedString = HttpUtility.HtmlEncode(name); - ctx.Response.Write(name); + ctx.Response.Write(name); // $ Alert[cs/untrusted-data-to-external-api]=r2 } public bool IsReusable => true; diff --git a/csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedDataToExternalAPI.qlref b/csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedDataToExternalAPI.qlref index 22d3fe2ef63c..65b603105088 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedDataToExternalAPI.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedDataToExternalAPI.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-020/UntrustedDataToExternalAPI.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.cs b/csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.cs index 3ea90facfd3c..3881cc9179b5 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.cs @@ -7,14 +7,14 @@ public class TaintedPathHandler : IHttpHandler public void ProcessRequest(HttpContext ctx) { - String path = ctx.Request.QueryString["page"]; + String path = ctx.Request.QueryString["page"]; // $ Source=r1 Source=r2 Source=r3 Source=r4 Source=r5 Source=r6 Source=r7 // BAD: Used via a File.Create... call. - using (StreamWriter sw = File.CreateText(path)) + using (StreamWriter sw = File.CreateText(path)) // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 { sw.WriteLine("Hello"); } // BAD: Used via StreamWriter constructor - using (StreamWriter sw = new StreamWriter(path)) + using (StreamWriter sw = new StreamWriter(path)) // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 { sw.WriteLine("Hello"); } @@ -22,20 +22,20 @@ public void ProcessRequest(HttpContext ctx) // BAD: Check is insufficient, text is read. if (!path.StartsWith("../")) { - File.ReadAllText(path); + File.ReadAllText(path); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 } // BAD: Check is insufficient, text is read. if (!string.IsNullOrEmpty(path)) { - File.ReadAllText(path); + File.ReadAllText(path); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 } // BAD: Check is insufficient, text is read. string badPath = "/home/user/" + path; - if (File.Exists(badPath)) + if (File.Exists(badPath)) // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 { - ctx.Response.Write(File.ReadAllText(badPath)); + ctx.Response.Write(File.ReadAllText(badPath)); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 } // GOOD: Tainted path is passed through MapPath @@ -48,7 +48,7 @@ public void ProcessRequest(HttpContext ctx) File.ReadAllText(path); } - Directory.Exists(path); + Directory.Exists(path); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 // GOOD: A Guid. File.ReadAllText(new Guid(path).ToString()); diff --git a/csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.qlref b/csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.qlref index 10abc41286cf..9ab7666c8f1e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.qlref @@ -1,3 +1,5 @@ query: Security Features/CWE-022/TaintedPath.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlip.cs b/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlip.cs index 1ec93bba3edd..977765b2f164 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlip.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlip.cs @@ -12,15 +12,15 @@ public static void UnzipFileByFile(ZipArchive archive, { foreach (var entry in archive.Entries) { - string fullPath = Path.GetFullPath(entry.FullName); + string fullPath = Path.GetFullPath(entry.FullName); // $ Alert=r1 Alert=r2 Alert=r3 string fileName = Path.GetFileName(entry.FullName); string filename = entry.Name; - string file = entry.FullName; + string file = entry.FullName; // $ Alert=r4 if (!string.IsNullOrEmpty(file)) { // BAD string destFileName = Path.Combine(destDirectory, file); - entry.ExtractToFile(destFileName, true); + entry.ExtractToFile(destFileName, true); // $ Sink=r4 // GOOD string sanitizedFileName = Path.Combine(destDirectory, fileName); @@ -28,15 +28,15 @@ public static void UnzipFileByFile(ZipArchive archive, // BAD string destFilePath = Path.Combine(destDirectory, fullPath); - entry.ExtractToFile(destFilePath, true); + entry.ExtractToFile(destFilePath, true); // $ Sink=r1 Sink=r2 Sink=r3 // BAD: destFilePath isn't fully resolved, so may still contain .. if (destFilePath.StartsWith(destDirectory)) - entry.ExtractToFile(destFilePath, true); + entry.ExtractToFile(destFilePath, true); // $ Sink=r2 Sink=r1 Sink=r3 // BAD destFilePath = Path.GetFullPath(Path.Combine(destDirectory, fullPath)); - entry.ExtractToFile(destFilePath, true); + entry.ExtractToFile(destFilePath, true); // $ Sink=r3 Sink=r1 Sink=r2 // GOOD: a check for StartsWith against a fully resolved path if (destFilePath.StartsWith(destDirectory)) @@ -58,28 +58,28 @@ private static int UnzipToStream(Stream zipStream, string installDir) foreach (ZipArchiveEntry entry in archive.Entries) { // figure out where we are putting the file - String destFilePath = Path.Combine(InstallDir, entry.FullName); + String destFilePath = Path.Combine(InstallDir, entry.FullName); // $ Alert=r5 Alert=r6 Alert=r7 Alert=r8 Directory.CreateDirectory(Path.GetDirectoryName(destFilePath)); using (Stream archiveFileStream = entry.Open()) { // BAD: writing to file stream - using (Stream tfsFileStream = new FileStream(destFilePath, FileMode.CreateNew, FileAccess.ReadWrite, FileShare.None)) + using (Stream tfsFileStream = new FileStream(destFilePath, FileMode.CreateNew, FileAccess.ReadWrite, FileShare.None)) // $ Sink=r5 Sink=r6 Sink=r7 Sink=r8 { Console.WriteLine(@"Writing ""{0}""", destFilePath); archiveFileStream.CopyTo(tfsFileStream); } // BAD: can do it this way too - using (Stream tfsFileStream = File.Create(destFilePath)) + using (Stream tfsFileStream = File.Create(destFilePath)) // $ Sink=r6 Sink=r5 Sink=r7 Sink=r8 { Console.WriteLine(@"Writing ""{0}""", destFilePath); archiveFileStream.CopyTo(tfsFileStream); } // BAD: creating stream using fileInfo - var fileInfo = new FileInfo(destFilePath); + var fileInfo = new FileInfo(destFilePath); // $ Sink=r7 Sink=r5 Sink=r6 Sink=r8 using (FileStream fs = fileInfo.OpenWrite()) { Console.WriteLine(@"Writing ""{0}""", destFilePath); @@ -87,7 +87,7 @@ private static int UnzipToStream(Stream zipStream, string installDir) } // BAD: creating stream using fileInfo - var fileInfo1 = new FileInfo(destFilePath); + var fileInfo1 = new FileInfo(destFilePath); // $ Sink=r8 Sink=r5 Sink=r6 Sink=r7 using (FileStream fs = fileInfo1.Open(FileMode.Create)) { Console.WriteLine(@"Writing ""{0}""", destFilePath); diff --git a/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlip.qlref b/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlip.qlref index f8a7ab34e883..9d8f3ad5a64b 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlip.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlip.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-022/ZipSlip.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlipBad.cs b/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlipBad.cs index fb6bce23b72f..eb5e84fd291e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlipBad.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlipBad.cs @@ -6,7 +6,7 @@ class Bad public static void WriteToDirectory(ZipArchiveEntry entry, string destDirectory) { - string destFileName = Path.Combine(destDirectory, entry.FullName); - entry.ExtractToFile(destFileName); + string destFileName = Path.Combine(destDirectory, entry.FullName); // $ Alert=r9 + entry.ExtractToFile(destFileName); // $ Sink=r9 } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs index df3db94b4335..9a1e0ce55484 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.cs @@ -24,16 +24,16 @@ class CommandInjection public void WebCommandInjection() { // BAD: Reading from textbox, then using that in the arguments and file name - string userInput = categoryTextBox.Text; - Process.Start("foo.exe" + userInput, "/c " + userInput); + string userInput = categoryTextBox.Text; // $ Source=r1 Source=r2 Source=r3 Source=r4 Source=r5 Source=r6 Source=r7 + Process.Start("foo.exe" + userInput, "/c " + userInput); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 - ProcessStartInfo startInfo = new ProcessStartInfo(userInput, userInput); + ProcessStartInfo startInfo = new ProcessStartInfo(userInput, userInput); // $ Alert=r3 Alert=r4 Alert=r1 Alert=r2 Alert=r5 Alert=r6 Alert=r7 Process.Start(startInfo); ProcessStartInfo startInfoProps = new ProcessStartInfo(); - startInfoProps.FileName = userInput; - startInfoProps.Arguments = userInput; - startInfoProps.WorkingDirectory = userInput; + startInfoProps.FileName = userInput; // $ Alert=r5 Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r6 Alert=r7 + startInfoProps.Arguments = userInput; // $ Alert=r6 Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r7 + startInfoProps.WorkingDirectory = userInput; // $ Alert=r7 Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Process.Start(startInfoProps); } @@ -43,12 +43,12 @@ public void StoredCommandInjection() { connection.Open(); SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection); - SqlDataReader customerReader = customerCommand.ExecuteReader(); + SqlDataReader customerReader = customerCommand.ExecuteReader(); // $ Source=r8 while (customerReader.Read()) { // BAD: Read from database, and use it to directly execute a command - Process.Start("foo.exe", "/c " + customerReader.GetString(1)); + Process.Start("foo.exe", "/c " + customerReader.GetString(1)); // $ Alert=r8 } customerReader.Close(); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.qlref index 366f5105393f..607983370399 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-078/CommandInjection.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.cs index 1096634b6903..65c6d44ee676 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.cs @@ -14,12 +14,12 @@ public void processRequest(HttpContext context) { connection.Open(); SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection); - SqlDataReader customerReader = customerCommand.ExecuteReader(); + SqlDataReader customerReader = customerCommand.ExecuteReader(); // $ Source=r1 while (customerReader.Read()) { // BAD: Read from database, write it straight to a response - context.Response.Write("Orders for " + customerReader.GetString(1)); + context.Response.Write("Orders for " + customerReader.GetString(1)); // $ Alert=r1 } customerReader.Close(); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.qlref b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.qlref index 89b5b951bdb6..a71d47846701 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-079/XSS.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/XSS.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/XSS.cs index eba40b891d58..7c67ad8f965f 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/XSS.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/XSS.cs @@ -23,10 +23,10 @@ public void WebUIXSS() { // BAD: Reading from textbox, then writing an amended value to a control that does not HTML encode StringBuilder userInput = new StringBuilder(); - userInput.AppendFormat("{0} test", categoryTextBox.Text); - calendar.Caption = userInput.ToString(); - table.Caption = userInput.ToString(); - label.Text = userInput.ToString(); + userInput.AppendFormat("{0} test", categoryTextBox.Text); // $ Source=r1 $ Source=r2 $ Source=r3 + calendar.Caption = userInput.ToString(); // $ Alert=r1 $ Alert=r2 $ Alert=r3 + table.Caption = userInput.ToString(); // $ Alert=r2 $ Alert=r1 $ Alert=r3 + label.Text = userInput.ToString(); // $ Alert=r3 $ Alert=r1 $ Alert=r2 // GOOD: Reading from textbox, then writing an amended value to a control that does HTML encode categoryTextBox.Text = userInput.ToString(); @@ -35,8 +35,8 @@ public void WebUIXSS() public void processRequest(HttpContext context) { // BAD: Read user input from a request, write it straight to a response - string name = context.Request.QueryString["name"]; - context.Response.Write(name); + string name = context.Request.QueryString["name"]; // $ Source=r4 + context.Response.Write(name); // $ Alert=r4 // GOOD: Read user input from a request, but encode it before writing to the response string name2 = context.Request.QueryString["name"]; @@ -55,9 +55,9 @@ public void processNumber(HttpContext context) public void mvcProcess(HttpContext context) { // BAD: Mimic what happens in cshtml pages - string name = context.Request.Unvalidated.QueryString["name"]; + string name = context.Request.Unvalidated.QueryString["name"]; // $ Source=r5 HtmlHelper html = new HtmlHelper(null, null); - html.Raw(name); + html.Raw(name); // $ Alert=r5 } public void listener(HttpContext context) @@ -73,27 +73,27 @@ public void listener(HttpContext context) public void contextBase(HttpContextBase context) { // BAD: Writing user input directly to a HttpListenerResponse - string name = context.Request.QueryString["name"]; - context.Response.Write(name); + string name = context.Request.QueryString["name"]; // $ Source=r6 + context.Response.Write(name); // $ Alert=r6 // BAD: Writing user input directly to a HttpListenerResponse - string name2 = context.Request["name"]; - context.Response.Write(name2); + string name2 = context.Request["name"]; // $ Source=r7 + context.Response.Write(name2); // $ Alert=r7 } public void htmlStrings(HttpContextBase context) { // BAD: Writing user input into a HtmlString without encoding - string name = context.Request.QueryString["name"]; - new HtmlString(name); - new MvcHtmlString(name); + string name = context.Request.QueryString["name"]; // $ Source=r8 $ Source=r9 + new HtmlString(name); // $ Alert=r8 $ Alert=r9 + new MvcHtmlString(name); // $ Alert=r9 $ Alert=r8 new MyHtmlString(context.Request); } public void WebContent(HttpContextBase context) { // BAD: Writing user input into a StringContent without encoding - string name = context.Request.QueryString["name"]; - new StringContent(name); + string name = context.Request.QueryString["name"]; // $ Source=r10 + new StringContent(name); // $ Alert=r10 } public void HtmlEncoded(HttpContextBase context) @@ -137,7 +137,7 @@ public MyHtmlString(HttpRequestBase request) public string ToHtmlString() { - return Request.RawUrl; + return Request.RawUrl; // $ Alert=r11 $ Alert=r11 } } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/XSS.qlref b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/XSS.qlref index 89b5b951bdb6..a71d47846701 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/XSS.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/XSS.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-079/XSS.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/script.aspx b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/script.aspx index 5dd4830d7567..7581e301c02f 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/script.aspx +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSAsp/script.aspx @@ -9,13 +9,13 @@ diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Shared/Test18.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Shared/Test18.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Shared/Test18.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Shared/Test18.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Test4/Test17.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Test4/Test17.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Test4/Test17.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Areas/TestArea/Views/Test4/Test17.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Controllers/TestController.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Controllers/TestController.cs index 001c83b9f345..104a4671b2a7 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Controllers/TestController.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Controllers/TestController.cs @@ -10,59 +10,59 @@ public class UserData } public class TestController : Controller { - public IActionResult test1(UserData tainted1) { + public IActionResult test1(UserData tainted1) { // $ Source[cs/web/xss] // Expected to find file /Views/Test/Test1.cshtml return View("Test1", tainted1); } - public IActionResult test2(UserData tainted2) { + public IActionResult test2(UserData tainted2) { // $ Source[cs/web/xss] // Expected to find file /Views/Shared/Test2.cshtml return View("Test2", tainted2); } - public IActionResult test3(UserData tainted3) { + public IActionResult test3(UserData tainted3) { // $ Source[cs/web/xss] // Expected to find file /Views/Test/Test3.cshtml and NOT /Views/Shared/Test3.cshtml return View("Test3", tainted3); } - public IActionResult test4(UserData tainted4) { + public IActionResult test4(UserData tainted4) { // $ Source[cs/web/xss] // Expected to find file /Views/Test/Test4.cshtml return View("./Test4", tainted4); } - public IActionResult test5(UserData tainted5) { + public IActionResult test5(UserData tainted5) { // $ Source[cs/web/xss] // Expected to find file /Views/Other/Test5.cshtml return View("../Other/Test5", tainted5); } - public IActionResult test6(UserData tainted6) { + public IActionResult test6(UserData tainted6) { // $ Source[cs/web/xss] // Expected to find file /Views/Other/Test6.cshtml return View("../../Views/.////Shared/../Other//Test6", tainted6); } - public IActionResult Test7(UserData tainted7) { + public IActionResult Test7(UserData tainted7) { // $ Source[cs/web/xss] // Expected to find file /Views/Test/Test7.cshtml return View(tainted7); } - public IActionResult test8(UserData tainted8) { + public IActionResult test8(UserData tainted8) { // $ Source[cs/web/xss] // Expected to find file /Views/Other/Test8.cshtml return View("/Views/Other/Test8.cshtml", tainted8); } - public IActionResult test9(UserData tainted9) { + public IActionResult test9(UserData tainted9) { // $ Source[cs/web/xss] // Expected to find file /Views/Test/Test9.cshtml return View("~/Views/Other/Test9.cshtml", tainted9); } } -public class Test2Controller : Controller { - public IActionResult test10(UserData tainted10) { +public class Test2Controller : Controller { + public IActionResult test10(UserData tainted10) { // $ Source[cs/web/xss] // Expected to find file /Views/Test2/Test10.cshtml return View("Test10", tainted10); } - public IActionResult test11(UserData tainted11) { + public IActionResult test11(UserData tainted11) { // $ Source[cs/web/xss] // Expected to find file /Views/Test2/Test10.cshtml return helper(tainted11); } @@ -76,14 +76,14 @@ public IActionResult Test12(UserData tainted12) { private IActionResult helper2(UserData x) { return View(x); - } + } - public IActionResult test13(UserData tainted13) { - // Expected to find file /Views/Other/Test13.cshtml. + public IActionResult test13(UserData tainted13) { // $ Source[cs/web/xss] + // Expected to find file /Views/Other/Test13.cshtml. return Helper.helper3(this, tainted13); } - public IActionResult test14(UserData tainted14) { + public IActionResult test14(UserData tainted14) { // $ Source[cs/web/xss] // Expected to find file /Views/Shared/Test14.cshtml and NOT /Views/Test2/Test14.cshtml return Helper.helper4(this, tainted14); } @@ -103,12 +103,12 @@ public void Setup(RazorViewEngineOptions o) { o.AreaViewLocationFormats.Add("/MyAreas/{2}/{1}/{0}.cshtml"); } - public IActionResult Test15(UserData tainted15) { + public IActionResult Test15(UserData tainted15) { // $ Source[cs/web/xss] // Expected to find file /Views/Custom/Test3/Test15.cshtml return View(tainted15); } - public IActionResult test16(UserData tainted16) { + public IActionResult test16(UserData tainted16) { // $ Source[cs/web/xss] // Expected to find file /Views/Custom2/Test16.cshtml return View("Test16", tainted16); } @@ -116,17 +116,17 @@ public IActionResult test16(UserData tainted16) { [Area("TestArea")] public class Test4Controller : Controller { - public IActionResult test17(UserData tainted17) { + public IActionResult test17(UserData tainted17) { // $ Source[cs/web/xss] // Expected to find file /Areas/TestArea/Views/Test4/Test17.cshtml return View("Test17", tainted17); } - public IActionResult test18(UserData tainted18) { + public IActionResult test18(UserData tainted18) { // $ Source[cs/web/xss] // Expected to find file /Areas/TestArea/Views/Shared/Test17.cshtml return View("Test18", tainted18); } - public IActionResult test19(UserData tainted19) { + public IActionResult test19(UserData tainted19) { // $ Source[cs/web/xss] // Expected to find file /Views/Shared/Test19.cshtml return View("Test19", tainted19); } @@ -136,7 +136,7 @@ public IActionResult test20(UserData tainted20) { return View("Test20", tainted20); } - public IActionResult test21(UserData tainted21) { + public IActionResult test21(UserData tainted21) { // $ Source[cs/web/xss] // Expected to find file /Pages/Shared/Test21.cshtml return View("Test21", tainted21); } @@ -146,10 +146,10 @@ public IActionResult test22(UserData tainted22) { return View("Test22", tainted22); } - public IActionResult test23(string tainted23) { + public IActionResult test23(string tainted23) { // $ Source[cs/web/xss] // Expected to find file /Views/Shared/Test23.cshtml UserData x = new UserData(); x.Name = tainted23; return View("Test23", x); } -} \ No newline at end of file +} diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Shared_Test18.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Shared_Test18.cshtml.g.cs index 52b0510994e6..a167f928b9d3 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Shared_Test18.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Shared_Test18.cshtml.g.cs @@ -34,7 +34,7 @@ public class Areas_TestArea_Views_Shared_Test18 : global::Microsoft.AspNetCore.M WriteLiteral("

Hello \""); #nullable restore #line 8 "../Areas/TestArea/Views/Shared/Test18.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Test4_Test17.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Test4_Test17.cshtml.g.cs index 5d33dbbed54a..09db41110ece 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Test4_Test17.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Areas_TestArea_Views_Test4_Test17.cshtml.g.cs @@ -34,7 +34,7 @@ public class Areas_TestArea_Views_Test4_Test17 : global::Microsoft.AspNetCore.Mv WriteLiteral("

Hello \""); #nullable restore #line 8 "../Areas/TestArea/Views/Test4/Test17.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Pages_Shared_Test21.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Pages_Shared_Test21.cshtml.g.cs index c75acc2aaa9e..d48b61162d42 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Pages_Shared_Test21.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Pages_Shared_Test21.cshtml.g.cs @@ -34,7 +34,7 @@ public class Pages_Shared_Test21 : global::Microsoft.AspNetCore.Mvc.Razor.RazorP WriteLiteral("

Hello \""); #nullable restore #line 8 "../Pages/Shared/Test21.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Template.g b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Template.g index 0fa1767db71c..39f32de23855 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Template.g +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Template.g @@ -34,7 +34,7 @@ using test; WriteLiteral("

Hello \""); #nullable restore #line 8 "../$PATHSLASH" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Custom2_Test16.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Custom2_Test16.cshtml.g.cs index 82ed62549562..7046d354ca15 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Custom2_Test16.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Custom2_Test16.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Custom2_Test16 : global::Microsoft.AspNetCore.Mvc.Razor.Razor WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Custom2/Test16.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Custom_Test3_Test15.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Custom_Test3_Test15.cshtml.g.cs index eb366a727b68..02299c594abd 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Custom_Test3_Test15.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Custom_Test3_Test15.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Custom_Test3_Test15 : global::Microsoft.AspNetCore.Mvc.Razor. WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Custom/Test3/Test15.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test13.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test13.cshtml.g.cs index 240733439bc8..b14feb49a9ed 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test13.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test13.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Other_Test13 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPa WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Other/Test13.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test5.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test5.cshtml.g.cs index f51631b536ae..9a52fc9a2b3e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test5.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test5.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Other_Test5 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPag WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Other/Test5.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test6.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test6.cshtml.g.cs index fbbd4e99798b..c90a27f38392 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test6.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test6.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Other_Test6 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPag WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Other/Test6.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test8.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test8.cshtml.g.cs index c3643f4dd2f1..4dc0609afda4 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test8.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test8.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Other_Test8 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPag WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Other/Test8.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test9.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test9.cshtml.g.cs index 0a8391424502..6d01891394ee 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test9.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Other_Test9.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Other_Test9 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPag WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Other/Test9.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test14.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test14.cshtml.g.cs index d42efb18be2f..7576b670048e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test14.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test14.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Shared_Test14 : global::Microsoft.AspNetCore.Mvc.Razor.RazorP WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Shared/Test14.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test19.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test19.cshtml.g.cs index cd20980fb4d5..dbd85b4efca4 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test19.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test19.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Shared_Test19 : global::Microsoft.AspNetCore.Mvc.Razor.RazorP WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Shared/Test19.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test2.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test2.cshtml.g.cs index 0fbdbfd2f0fe..d82ceef1adf6 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test2.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test2.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Shared_Test2 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPa WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Shared/Test2.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test23.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test23.cshtml.g.cs index 218968593b9f..6bed92ac0751 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test23.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Shared_Test23.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Shared_Test23 : global::Microsoft.AspNetCore.Mvc.Razor.RazorP WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Shared/Test23.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test2_Test10.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test2_Test10.cshtml.g.cs index dbb7f68a284b..2c5e00cb75e4 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test2_Test10.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test2_Test10.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Test2_Test10 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPa WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Test2/Test10.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test2_Test11.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test2_Test11.cshtml.g.cs index 069bbd688f97..3513fdc4f7b1 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test2_Test11.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test2_Test11.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Test2_Test11 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPa WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Test2/Test11.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test1.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test1.cshtml.g.cs index 30123d044677..87a7400dcb9a 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test1.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test1.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Test_Test1 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPage WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Test/Test1.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test3.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test3.cshtml.g.cs index ade57ee34764..99381e47b128 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test3.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test3.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Test_Test3 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPage WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Test/Test3.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test4.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test4.cshtml.g.cs index 583c0a35b1a8..a88717593266 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test4.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test4.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Test_Test4 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPage WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Test/Test4.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test7.cshtml.g.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test7.cshtml.g.cs index 710cc34bd073..6a2379e80fe7 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test7.cshtml.g.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Generated/Views_Test_Test7.cshtml.g.cs @@ -34,7 +34,7 @@ public class Views_Test_Test7 : global::Microsoft.AspNetCore.Mvc.Razor.RazorPage WriteLiteral("

Hello \""); #nullable restore #line 8 "../Views/Test/Test7.cshtml" -Write(Html.Raw(Model.Name)); +Write(Html.Raw(Model.Name)); // $ Alert[cs/web/xss] #line default #line hidden diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/MyAreas/Test4/Test22.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/MyAreas/Test4/Test22.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/MyAreas/Test4/Test22.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/MyAreas/Test4/Test22.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Pages/Shared/Test21.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Pages/Shared/Test21.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Pages/Shared/Test21.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Pages/Shared/Test21.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Custom/Test3/Test15.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Custom/Test3/Test15.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Custom/Test3/Test15.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Custom/Test3/Test15.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Custom2/Test16.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Custom2/Test16.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Custom2/Test16.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Custom2/Test16.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test13.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test13.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test13.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test13.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test5.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test5.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test5.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test5.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test6.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test6.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test6.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test6.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test8.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test8.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test8.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test8.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test9.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test9.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test9.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Other/Test9.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test12.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test12.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test12.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test12.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test14.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test14.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test14.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test14.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test19.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test19.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test19.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test19.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test2.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test2.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test2.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test2.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test23.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test23.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test23.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test23.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test3.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test3.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test3.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Shared/Test3.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test1.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test1.cshtml index 74a8eab1c715..ec7a4fd58fff 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test1.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test1.cshtml @@ -3,7 +3,8 @@ @{ } -@if (Model != null) +@if (Model \!= null) { -

Hello "@Html.Raw(Model.Name)"

-} \ No newline at end of file +

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} +} diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test3.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test3.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test3.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test3.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test4.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test4.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test4.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test4.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test7.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test7.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test7.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test/Test7.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test1.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test1.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test1.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test1.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test10.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test10.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test10.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test10.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test11.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test11.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test11.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test11.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test12.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test12.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test12.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test12.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test14.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test14.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test14.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test14.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test2.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test2.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test2.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test2.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test3.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test3.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test3.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test2/Test3.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test4/Test20.cshtml b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test4/Test20.cshtml index 74a8eab1c715..1cb5d2b6bfac 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test4/Test20.cshtml +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Views/Test4/Test20.cshtml @@ -5,5 +5,6 @@ @if (Model != null) { -

Hello "@Html.Raw(Model.Name)"

+

Hello "@Html.Raw(Model.Name)"

@{// $ Alert[cs/web/xss] +} } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.expected b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.expected index 70c8dcfbd111..4688d46192fb 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.expected +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.expected @@ -1,3 +1,24 @@ +#select +| Areas/TestArea/Views/Shared/Test18.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:124:42:124:50 | tainted18 : UserData | Areas/TestArea/Views/Shared/Test18.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:124:42:124:50 | tainted18 : UserData | User-provided value | +| Areas/TestArea/Views/Test4/Test17.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:119:42:119:50 | tainted17 : UserData | Areas/TestArea/Views/Test4/Test17.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:119:42:119:50 | tainted17 : UserData | User-provided value | +| Pages/Shared/Test21.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:139:42:139:50 | tainted21 : UserData | Pages/Shared/Test21.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:139:42:139:50 | tainted21 : UserData | User-provided value | +| Views/Custom2/Test16.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:111:42:111:50 | tainted16 : UserData | Views/Custom2/Test16.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:111:42:111:50 | tainted16 : UserData | User-provided value | +| Views/Custom/Test3/Test15.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:106:42:106:50 | tainted15 : UserData | Views/Custom/Test3/Test15.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:106:42:106:50 | tainted15 : UserData | User-provided value | +| Views/Other/Test5.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:33:41:33:48 | tainted5 : UserData | Views/Other/Test5.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:33:41:33:48 | tainted5 : UserData | User-provided value | +| Views/Other/Test6.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:38:41:38:48 | tainted6 : UserData | Views/Other/Test6.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:38:41:38:48 | tainted6 : UserData | User-provided value | +| Views/Other/Test8.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:48:41:48:48 | tainted8 : UserData | Views/Other/Test8.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:48:41:48:48 | tainted8 : UserData | User-provided value | +| Views/Other/Test9.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:53:41:53:48 | tainted9 : UserData | Views/Other/Test9.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:53:41:53:48 | tainted9 : UserData | User-provided value | +| Views/Other/Test13.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:81:42:81:50 | tainted13 : UserData | Views/Other/Test13.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:81:42:81:50 | tainted13 : UserData | User-provided value | +| Views/Shared/Test2.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:18:41:18:48 | tainted2 : UserData | Views/Shared/Test2.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:18:41:18:48 | tainted2 : UserData | User-provided value | +| Views/Shared/Test14.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:86:42:86:50 | tainted14 : UserData | Views/Shared/Test14.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:86:42:86:50 | tainted14 : UserData | User-provided value | +| Views/Shared/Test19.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:129:42:129:50 | tainted19 : UserData | Views/Shared/Test19.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:129:42:129:50 | tainted19 : UserData | User-provided value | +| Views/Shared/Test23.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:149:40:149:48 | tainted23 : String | Views/Shared/Test23.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:149:40:149:48 | tainted23 : String | User-provided value | +| Views/Test2/Test10.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:60:42:60:50 | tainted10 : UserData | Views/Test2/Test10.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:60:42:60:50 | tainted10 : UserData | User-provided value | +| Views/Test2/Test11.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:65:42:65:50 | tainted11 : UserData | Views/Test2/Test11.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:65:42:65:50 | tainted11 : UserData | User-provided value | +| Views/Test/Test1.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:13:41:13:48 | tainted1 : UserData | Views/Test/Test1.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:13:41:13:48 | tainted1 : UserData | User-provided value | +| Views/Test/Test3.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:23:41:23:48 | tainted3 : UserData | Views/Test/Test3.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:23:41:23:48 | tainted3 : UserData | User-provided value | +| Views/Test/Test4.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:28:41:28:48 | tainted4 : UserData | Views/Test/Test4.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:28:41:28:48 | tainted4 : UserData | User-provided value | +| Views/Test/Test7.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:43:41:43:48 | tainted7 : UserData | Views/Test/Test7.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:43:41:43:48 | tainted7 : UserData | User-provided value | edges | Areas/TestArea/Views/Shared/Test18.cshtml:8:16:8:20 | access to property Model : UserData | Areas/TestArea/Views/Shared/Test18.cshtml:8:16:8:25 | access to property Name | provenance | | | Areas/TestArea/Views/Test4/Test17.cshtml:8:16:8:20 | access to property Model : UserData | Areas/TestArea/Views/Test4/Test17.cshtml:8:16:8:25 | access to property Name | provenance | | @@ -157,24 +178,3 @@ nodes | Views/Test/Test7.cshtml:8:16:8:20 | access to property Model : UserData | semmle.label | access to property Model : UserData | | Views/Test/Test7.cshtml:8:16:8:25 | access to property Name | semmle.label | access to property Name | subpaths -#select -| Areas/TestArea/Views/Shared/Test18.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:124:42:124:50 | tainted18 : UserData | Areas/TestArea/Views/Shared/Test18.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:124:42:124:50 | tainted18 : UserData | User-provided value | -| Areas/TestArea/Views/Test4/Test17.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:119:42:119:50 | tainted17 : UserData | Areas/TestArea/Views/Test4/Test17.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:119:42:119:50 | tainted17 : UserData | User-provided value | -| Pages/Shared/Test21.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:139:42:139:50 | tainted21 : UserData | Pages/Shared/Test21.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:139:42:139:50 | tainted21 : UserData | User-provided value | -| Views/Custom2/Test16.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:111:42:111:50 | tainted16 : UserData | Views/Custom2/Test16.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:111:42:111:50 | tainted16 : UserData | User-provided value | -| Views/Custom/Test3/Test15.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:106:42:106:50 | tainted15 : UserData | Views/Custom/Test3/Test15.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:106:42:106:50 | tainted15 : UserData | User-provided value | -| Views/Other/Test5.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:33:41:33:48 | tainted5 : UserData | Views/Other/Test5.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:33:41:33:48 | tainted5 : UserData | User-provided value | -| Views/Other/Test6.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:38:41:38:48 | tainted6 : UserData | Views/Other/Test6.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:38:41:38:48 | tainted6 : UserData | User-provided value | -| Views/Other/Test8.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:48:41:48:48 | tainted8 : UserData | Views/Other/Test8.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:48:41:48:48 | tainted8 : UserData | User-provided value | -| Views/Other/Test9.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:53:41:53:48 | tainted9 : UserData | Views/Other/Test9.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:53:41:53:48 | tainted9 : UserData | User-provided value | -| Views/Other/Test13.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:81:42:81:50 | tainted13 : UserData | Views/Other/Test13.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:81:42:81:50 | tainted13 : UserData | User-provided value | -| Views/Shared/Test2.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:18:41:18:48 | tainted2 : UserData | Views/Shared/Test2.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:18:41:18:48 | tainted2 : UserData | User-provided value | -| Views/Shared/Test14.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:86:42:86:50 | tainted14 : UserData | Views/Shared/Test14.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:86:42:86:50 | tainted14 : UserData | User-provided value | -| Views/Shared/Test19.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:129:42:129:50 | tainted19 : UserData | Views/Shared/Test19.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:129:42:129:50 | tainted19 : UserData | User-provided value | -| Views/Shared/Test23.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:149:40:149:48 | tainted23 : String | Views/Shared/Test23.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:149:40:149:48 | tainted23 : String | User-provided value | -| Views/Test2/Test10.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:60:42:60:50 | tainted10 : UserData | Views/Test2/Test10.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:60:42:60:50 | tainted10 : UserData | User-provided value | -| Views/Test2/Test11.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:65:42:65:50 | tainted11 : UserData | Views/Test2/Test11.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:65:42:65:50 | tainted11 : UserData | User-provided value | -| Views/Test/Test1.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:13:41:13:48 | tainted1 : UserData | Views/Test/Test1.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:13:41:13:48 | tainted1 : UserData | User-provided value | -| Views/Test/Test3.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:23:41:23:48 | tainted3 : UserData | Views/Test/Test3.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:23:41:23:48 | tainted3 : UserData | User-provided value | -| Views/Test/Test4.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:28:41:28:48 | tainted4 : UserData | Views/Test/Test4.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:28:41:28:48 | tainted4 : UserData | User-provided value | -| Views/Test/Test7.cshtml:8:16:8:25 | access to property Name | Controllers/TestController.cs:43:41:43:48 | tainted7 : UserData | Views/Test/Test7.cshtml:8:16:8:25 | access to property Name | $@ flows to here and is written to HTML or JavaScript: Microsoft.AspNetCore.Mvc.ViewFeatures.HtmlHelper.Raw() method. | Controllers/TestController.cs:43:41:43:48 | tainted7 : UserData | User-provided value | diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.qlref b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.qlref index faad1d6403c1..553ccc892d04 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.qlref @@ -1 +1,2 @@ -Security Features/CWE-079/XSS.ql \ No newline at end of file +query: Security Features/CWE-079/XSS.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.cs index ddd24e19729f..d1f5b7e4ae81 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.cs @@ -9,36 +9,36 @@ public class LDAPInjectionHandler : IHttpHandler { public void ProcessRequest(HttpContext ctx) { - string userName = ctx.Request.QueryString["username"]; + string userName = ctx.Request.QueryString["username"]; // $ Source=r1 Source=r2 Source=r3 Source=r4 Source=r5 Source=r6 // BAD: Filter includes user input without encoding - DirectorySearcher ds = new DirectorySearcher("accountname=" + userName); + DirectorySearcher ds = new DirectorySearcher("accountname=" + userName); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 DirectorySearcher ds2 = new DirectorySearcher(); - ds.Filter = "accountname=" + userName; + ds.Filter = "accountname=" + userName; // $ Alert=r2 Alert=r1 Alert=r3 Alert=r4 Alert=r5 Alert=r6 // GOOD: Filter includes user input with encoding DirectorySearcher ds3 = new DirectorySearcher("accountname=" + LDAPEncode(userName)); // BAD: SearchRequest Filter includes user input without encoding SearchRequest sr = new SearchRequest(); - sr.Filter = "accountname=" + userName; - SearchRequest sr2 = new SearchRequest(null, "accountname=" + userName, System.DirectoryServices.Protocols.SearchScope.Base, null); + sr.Filter = "accountname=" + userName; // $ Alert=r3 Alert=r1 Alert=r2 Alert=r4 Alert=r5 Alert=r6 + SearchRequest sr2 = new SearchRequest(null, "accountname=" + userName, System.DirectoryServices.Protocols.SearchScope.Base, null); // $ Alert=r4 Alert=r1 Alert=r2 Alert=r3 Alert=r5 Alert=r6 // BAD: Distinguished Name includes user input without encoding - DirectoryEntry de = new DirectoryEntry("LDAP://Cn=" + userName); + DirectoryEntry de = new DirectoryEntry("LDAP://Cn=" + userName); // $ Alert=r5 Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r6 DirectoryEntry de2 = new DirectoryEntry(); - de2.Path = "LDAP://Cn=" + userName; + de2.Path = "LDAP://Cn=" + userName; // $ Alert=r6 Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 using (SqlConnection connection = new SqlConnection("")) { connection.Open(); SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection); - SqlDataReader customerReader = customerCommand.ExecuteReader(); + SqlDataReader customerReader = customerCommand.ExecuteReader(); // $ Source=r7 while (customerReader.Read()) { // BAD: Read from database, write it straight to a response - DirectorySearcher ds4 = new DirectorySearcher("accountname=" + customerReader.GetString(1)); + DirectorySearcher ds4 = new DirectorySearcher("accountname=" + customerReader.GetString(1)); // $ Alert=r7 } customerReader.Close(); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.qlref index 06bd1eedc4f4..13eefd4645f9 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-090/LDAPInjection.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/Test.cs b/csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/Test.cs index f9dd6f3289e8..cf39ad9d397e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/Test.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/Test.cs @@ -5,14 +5,14 @@ public class XMLInjectionHandler : IHttpHandler { public void ProcessRequest(HttpContext ctx) { - string employeeName = ctx.Request.QueryString["employeeName"]; + string employeeName = ctx.Request.QueryString["employeeName"]; // $ Source=r1 using (XmlWriter writer = XmlWriter.Create("employees.xml")) { writer.WriteStartDocument(); // BAD: Insert user input directly into XML - writer.WriteRaw("" + employeeName + ""); + writer.WriteRaw("" + employeeName + ""); // $ Alert=r1 // GOOD: Escape user input before inserting into string writer.WriteRaw("" + SecurityElement.Escape(employeeName) + ""); diff --git a/csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/XMLInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/XMLInjection.qlref index e39297fce167..96779d60ccb0 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/XMLInjection.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-091/XMLInjection/XMLInjection.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-091/XMLInjection.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-094/CodeInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-094/CodeInjection.cs index e03bc9821f50..c0acbd2bb72b 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-094/CodeInjection.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-094/CodeInjection.cs @@ -20,13 +20,13 @@ public class CommandInjectionHandler : IHttpHandler { public void ProcessRequest(HttpContext ctx) { - string code = ctx.Request.QueryString["code"]; + string code = ctx.Request.QueryString["code"]; // $ Source=r1 Source=r2 CSharpCodeProvider c = new CSharpCodeProvider(); ICodeCompiler icc = c.CreateCompiler(); CompilerParameters cp = new CompilerParameters(); // BAD: Compiling unvalidated code from the user - CompilerResults cr = icc.CompileAssemblyFromSource(cp, code); + CompilerResults cr = icc.CompileAssemblyFromSource(cp, code); // $ Alert=r1 Alert=r2 System.Reflection.Assembly a = cr.CompiledAssembly; object o = a.CreateInstance("MyNamespace.MyClass"); @@ -37,7 +37,7 @@ public void ProcessRequest(HttpContext ctx) object s = mi.Invoke(o, null); // BAD: Use the Roslyn APIs to dynamically evaluate C# - CSharpScript.EvaluateAsync(code); + CSharpScript.EvaluateAsync(code); // $ Alert=r1 Alert=r2 } public bool IsReusable @@ -53,6 +53,6 @@ public bool IsReusable void OnButtonClicked() { // BAD: Use the Roslyn APIs to dynamically evaluate C# - CSharpScript.EvaluateAsync(box1.Text); + CSharpScript.EvaluateAsync(box1.Text); // $ Alert=r3 Alert=r3 } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-094/CodeInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-094/CodeInjection.qlref index 80eedc1b4c7c..53389dffbe49 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-094/CodeInjection.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-094/CodeInjection.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-094/CodeInjection.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-099/ResourceInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-099/ResourceInjection.cs index aed9219090a7..ad74e0f14130 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-099/ResourceInjection.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-099/ResourceInjection.cs @@ -5,12 +5,12 @@ public class ResourceInjectionHandler : IHttpHandler { public void ProcessRequest(HttpContext ctx) { - string userName = ctx.Request.QueryString["userName"]; + string userName = ctx.Request.QueryString["userName"]; // $ Source=r1 Source=r2 string connectionString = "server=(local);user id=" + userName + ";password= pass;"; // BAD: Direct use of user input in a connection string for the constructor - SqlConnection sqlConnection = new SqlConnection(connectionString); + SqlConnection sqlConnection = new SqlConnection(connectionString); // $ Alert=r1 Alert=r2 // BAD: Direct use of user input assigned to a connection string property - sqlConnection.ConnectionString = connectionString; + sqlConnection.ConnectionString = connectionString; // $ Alert=r1 Alert=r2 // GOOD: Use SqlConnectionStringBuilder SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(); builder["Data Source"] = "(local)"; diff --git a/csharp/ql/test/query-tests/Security Features/CWE-099/ResourceInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-099/ResourceInjection.qlref index 5292de5ee84f..e2e487631687 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-099/ResourceInjection.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-099/ResourceInjection.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-099/ResourceInjection.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs index 4ca87924c687..c0615d90bf2b 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs @@ -9,22 +9,22 @@ public class MissingXMLValidationHandler : IHttpHandler public void ProcessRequest(HttpContext ctx) { - String userProvidedXml = ctx.Request.QueryString["userProvidedXml"]; + String userProvidedXml = ctx.Request.QueryString["userProvidedXml"]; // $ Source=r1 Source=r2 Source=r3 Source=r4 Source=r5 // BAD: User provided XML is processed without any validation, // because there is no settings instance configured. - XmlReader.Create(new StringReader(userProvidedXml)); + XmlReader.Create(new StringReader(userProvidedXml)); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 // BAD: User provided XML is processed without any validation, // because the settings instance does not specify the ValidationType XmlReaderSettings badSettings1 = new XmlReaderSettings(); - XmlReader.Create(new StringReader(userProvidedXml), badSettings1); + XmlReader.Create(new StringReader(userProvidedXml), badSettings1); // $ Alert=r2 Alert=r1 Alert=r3 Alert=r4 Alert=r5 // BAD: User provided XML is processed without any validation, // because the settings instance specifies DTD as the ValidationType XmlReaderSettings badSettings2 = new XmlReaderSettings(); badSettings2.ValidationType = ValidationType.DTD; - XmlReader.Create(new StringReader(userProvidedXml), badSettings2); + XmlReader.Create(new StringReader(userProvidedXml), badSettings2); // $ Alert=r3 Alert=r1 Alert=r2 Alert=r4 Alert=r5 // GOOD: User provided XML is processed with validation XmlReaderSettings goodSettings = new XmlReaderSettings(); @@ -42,7 +42,7 @@ public void ProcessRequest(HttpContext ctx) XmlSchemaSet sc2 = new XmlSchemaSet(); sc2.Add("urn:my-schema", "my.xsd"); goodSettings.Schemas = sc2; - XmlReader.Create(new StringReader(userProvidedXml), badSettings3); + XmlReader.Create(new StringReader(userProvidedXml), badSettings3); // $ Alert=r4 Alert=r5 Alert=r1 Alert=r2 Alert=r3 } public bool IsReusable diff --git a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.qlref b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.qlref index 6f71112a01c1..3f8c9fe16878 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-112/MissingXMLValidation.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/AssemblyPathInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/AssemblyPathInjection.qlref index 5979609654f9..f789023c52dc 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/AssemblyPathInjection.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/AssemblyPathInjection.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-114/AssemblyPathInjection.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/Test.cs b/csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/Test.cs index e0217a6d4866..a1c257cce637 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/Test.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-114/AssemblyPathInjection/Test.cs @@ -4,10 +4,10 @@ public class DLLInjectionHandler : IHttpHandler { public void ProcessRequest(HttpContext ctx) { - string libraryName = ctx.Request.QueryString["libraryName"]; + string libraryName = ctx.Request.QueryString["libraryName"]; // $ Source=r1 // BAD: Load DLL based on user input - var badDLL = Assembly.LoadFile(libraryName); + var badDLL = Assembly.LoadFile(libraryName); // $ Alert=r1 // GOOD: Load DLL using fixed string var goodDLL = Assembly.LoadFile(@"C:\visual studio 2012\Projects\ConsoleApplication1\ConsoleApplication1\DLL.dll"); diff --git a/csharp/ql/test/query-tests/Security Features/CWE-119/LocalUnvalidatedArithmetic.cs b/csharp/ql/test/query-tests/Security Features/CWE-119/LocalUnvalidatedArithmetic.cs index 4fc60b899e67..42cc1062c2da 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-119/LocalUnvalidatedArithmetic.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-119/LocalUnvalidatedArithmetic.cs @@ -14,7 +14,7 @@ public unsafe void CalcPointer(PossiblyOverridableClass possiblyOverridable, cha fixed (char* charPointer = charArray) { // BAD: Unvalidate use in pointer arithmetic - char* newCharPointer = charPointer + possiblyOverridable.getNumber(); + char* newCharPointer = charPointer + possiblyOverridable.getNumber(); // $ Alert *newCharPointer = 'A'; // BAD: Unvalidate use in pointer arithmetic int number = possiblyOverridable.getNumber(); diff --git a/csharp/ql/test/query-tests/Security Features/CWE-119/LocalUnvalidatedArithmetic.qlref b/csharp/ql/test/query-tests/Security Features/CWE-119/LocalUnvalidatedArithmetic.qlref index c6b75e927954..13eea010dbe7 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-119/LocalUnvalidatedArithmetic.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-119/LocalUnvalidatedArithmetic.qlref @@ -1 +1,2 @@ -Security Features/CWE-119/LocalUnvalidatedArithmetic.ql \ No newline at end of file +query: Security Features/CWE-119/LocalUnvalidatedArithmetic.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-201/ExposureInTransmittedData/ExposureInTransmittedData.cs b/csharp/ql/test/query-tests/Security Features/CWE-201/ExposureInTransmittedData/ExposureInTransmittedData.cs index e993bc368ae7..3170f3a7913a 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-201/ExposureInTransmittedData/ExposureInTransmittedData.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-201/ExposureInTransmittedData/ExposureInTransmittedData.cs @@ -11,26 +11,26 @@ public void ProcessRequest(HttpContext ctx) try { var password = "123456"; - ctx.Response.Write(password); // BAD + ctx.Response.Write(password); // $ Alert=r1 Alert=r1 // BAD } catch (System.Data.SqlClient.SqlException ex) { - ctx.Response.Write(ex.ToString()); // BAD + ctx.Response.Write(ex.ToString()); // $ Alert=r2 Alert=r2 // BAD } catch (DbException ex) { - ctx.Response.Write(ex.Message); // BAD - ctx.Response.Write(ex.ToString()); // BAD - ctx.Response.Write(ex.Data["password"]); // BAD + ctx.Response.Write(ex.Message); // $ Alert=r3 Alert=r3 // BAD + ctx.Response.Write(ex.ToString()); // $ Alert=r4 Alert=r4 // BAD + ctx.Response.Write(ex.Data["password"]); // $ Alert=r5 Alert=r5 // BAD } } void SendPasswordToEmail() { - var p = GetField("password"); // p is now tainted - var message = new MailMessage("from", "to", p, p); // BAD - message.Body = "This is your password: " + p; // BAD - message.Subject = p; // BAD + var p = GetField("password"); // $ Source=r6 Source=r7 Source=r8 Source=r9 // p is now tainted + var message = new MailMessage("from", "to", p, p); // $ Alert=r6 Alert=r7 Alert=r8 Alert=r9 // BAD + message.Body = "This is your password: " + p; // $ Alert=r6 Alert=r7 Alert=r8 Alert=r9 // BAD + message.Subject = p; // $ Alert=r6 Alert=r7 Alert=r8 Alert=r9 // BAD } string GetField(string field) diff --git a/csharp/ql/test/query-tests/Security Features/CWE-201/ExposureInTransmittedData/ExposureInTransmittedData.qlref b/csharp/ql/test/query-tests/Security Features/CWE-201/ExposureInTransmittedData/ExposureInTransmittedData.qlref index 9ce9ee5643ef..0c2eb8d2b2cc 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-201/ExposureInTransmittedData/ExposureInTransmittedData.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-201/ExposureInTransmittedData/ExposureInTransmittedData.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-201/ExposureInTransmittedData.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-209/ExceptionInformationExposure.cs b/csharp/ql/test/query-tests/Security Features/CWE-209/ExceptionInformationExposure.cs index 74b3fc4dd4d0..e644fb9971a2 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-209/ExceptionInformationExposure.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-209/ExceptionInformationExposure.cs @@ -16,11 +16,11 @@ public void ProcessRequest(HttpContext ctx) catch (Exception ex) { // BAD: printing a stack trace back to the response - ctx.Response.Write(ex.ToString()); + ctx.Response.Write(ex.ToString()); // $ Alert=r1 $ Alert=r1 // BAD: implicitly printing a stack trace back to the response - ctx.Response.Write(ex); + ctx.Response.Write(ex); // $ Alert=r2 $ Alert=r2 // BAD: writing StackTrace property to response - ctx.Response.Write(ex.StackTrace); + ctx.Response.Write(ex.StackTrace); // $ Alert=r3 $ Alert=r3 // GOOD: writing Message property to response ctx.Response.Write(ex.Message); return; @@ -36,15 +36,15 @@ public void ProcessRequest(HttpContext ctx) log("Exception occurred", ex); ctx.Response.Write("Exception occurred"); - textBox.Text = ex.InnerException.StackTrace; // BAD - textBox.Text = ex.StackTrace; // BAD - textBox.Text = ex.ToString(); // BAD + textBox.Text = ex.InnerException.StackTrace; // $ Alert=r4 $ Alert=r4 // BAD + textBox.Text = ex.StackTrace; // $ Alert=r5 $ Alert=r5 // BAD + textBox.Text = ex.ToString(); // $ Alert=r6 $ Alert=r6 // BAD textBox.Text = ex.Message; // GOOD return; } // BAD: printing a stack trace back to the response for a custom exception - ctx.Response.Write(new MyException().ToString()); + ctx.Response.Write(new MyException().ToString()); // $ Alert=r7 $ Alert=r7 } class MyException : Exception diff --git a/csharp/ql/test/query-tests/Security Features/CWE-209/ExceptionInformationExposure.qlref b/csharp/ql/test/query-tests/Security Features/CWE-209/ExceptionInformationExposure.qlref index e8813fef7a81..295c9e8cc57b 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-209/ExceptionInformationExposure.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-209/ExceptionInformationExposure.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-209/ExceptionInformationExposure.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/MissingASPNETGlobalErrorHandler.qlref b/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/MissingASPNETGlobalErrorHandler.qlref index fa43c8d49bec..521ec9079e0e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/MissingASPNETGlobalErrorHandler.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/MissingASPNETGlobalErrorHandler.qlref @@ -1 +1,2 @@ -Security Features/CWE-248/MissingASPNETGlobalErrorHandler.ql \ No newline at end of file +query: Security Features/CWE-248/MissingASPNETGlobalErrorHandler.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/Web.config index 768c965080c1..d04829109d33 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOff/Web.config @@ -2,6 +2,6 @@ - + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOffButGlobal/MissingASPNETGlobalErrorHandler.qlref b/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOffButGlobal/MissingASPNETGlobalErrorHandler.qlref index fa43c8d49bec..521ec9079e0e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOffButGlobal/MissingASPNETGlobalErrorHandler.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-248/MissingASPNETGlobalErrorHandler/WebConfigOffButGlobal/MissingASPNETGlobalErrorHandler.qlref @@ -1 +1,2 @@ -Security Features/CWE-248/MissingASPNETGlobalErrorHandler.ql \ No newline at end of file +query: Security Features/CWE-248/MissingASPNETGlobalErrorHandler.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/MissingAccessControl.qlref b/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/MissingAccessControl.qlref index a4173778d9fa..8bfd3b626d1f 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/MissingAccessControl.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/MissingAccessControl.qlref @@ -1 +1,2 @@ -Security Features/CWE-285/MissingAccessControl.ql +query: Security Features/CWE-285/MissingAccessControl.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test1/EditProfile.aspx.cs b/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test1/EditProfile.aspx.cs index b023dc11e80f..cf1be0cfbfea 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test1/EditProfile.aspx.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test1/EditProfile.aspx.cs @@ -7,7 +7,7 @@ private void doThings() { } private bool isAuthorized() { return false; } // BAD: The class name indicates that this may be an Edit method, but there is no auth check - protected void btn1_Click(object sender, EventArgs e) { + protected void btn1_Click(object sender, EventArgs e) { // $ Alert doThings(); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test1/ViewProfile.aspx.cs b/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test1/ViewProfile.aspx.cs index f9d7316d50b2..4ed7b777d2bf 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test1/ViewProfile.aspx.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test1/ViewProfile.aspx.cs @@ -11,7 +11,7 @@ protected void btn_safe_Click(object sender, EventArgs e) { } // BAD: The name indicates a Delete method, but no auth is present. - protected void btn_delete1_Click(object sender, EventArgs e) { + protected void btn_delete1_Click(object sender, EventArgs e) { // $ Alert doThings(); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test3/B/EditProfile.aspx.cs b/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test3/B/EditProfile.aspx.cs index 4b7697f0f88d..13b9f4dd5b5e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test3/B/EditProfile.aspx.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-285/MissingAccessControl/WebFormsTests/Test3/B/EditProfile.aspx.cs @@ -5,7 +5,7 @@ class EditProfile4 : System.Web.UI.Page { private void doThings() { } // BAD: The Web.config file does not specify auth for this path. - protected void btn1_Click(object sender, EventArgs e) { + protected void btn1_Click(object sender, EventArgs e) { // $ Alert doThings(); } } \ No newline at end of file diff --git a/csharp/ql/test/query-tests/Security Features/CWE-312/CleartextStorage.cs b/csharp/ql/test/query-tests/Security Features/CWE-312/CleartextStorage.cs index 74a5568b6683..c5a6c95cd467 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-312/CleartextStorage.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-312/CleartextStorage.cs @@ -12,10 +12,10 @@ public class ClearTextStorageHandler : IHttpHandler public void ProcessRequest(HttpContext ctx) { // BAD: Setting a cookie value or values with sensitive data. - ctx.Response.Cookies["MyCookie"].Value = accountKey; - ctx.Response.Cookies["MyOtherCookie"]["Sensitive"] = GetPassword(); - ctx.Response.Cookies["MyOtherCookie"].Values["Sensitive"] = GetPassword(); - ctx.Response.Cookies["MyCookie"].Value = GetAccountID(); + ctx.Response.Cookies["MyCookie"].Value = accountKey; // $ Alert + ctx.Response.Cookies["MyOtherCookie"]["Sensitive"] = GetPassword(); // $ Alert + ctx.Response.Cookies["MyOtherCookie"].Values["Sensitive"] = GetPassword(); // $ Alert + ctx.Response.Cookies["MyCookie"].Value = GetAccountID(); // $ Alert // GOOD: Encoding the value before setting it. ctx.Response.Cookies["MyCookie"].Value = Encode(accountKey, "Account key"); @@ -23,15 +23,15 @@ public void ProcessRequest(HttpContext ctx) ctx.Response.Cookies["MyCookie"].Value = GetAccountName(); ILogger logger = new ILogger(); // BAD: Logging sensitive data - logger.Warn(GetPassword()); + logger.Warn(GetPassword()); // $ Alert // GOOD: Logging encrypted sensitive data logger.Warn(Encode(GetPassword(), "Password")); - // BAD: Storing sensitive data in local file + // BAD: Storing sensitive data in local file using (var writeStream = File.Open("passwords.txt", FileMode.Create)) { var writer = new StreamWriter(writeStream); - writer.Write(GetPassword()); + writer.Write(GetPassword()); // $ Alert writer.Close(); } @@ -91,9 +91,9 @@ public void OnButtonClicked() { box1.PasswordChar = '*'; box2.UseSystemPasswordChar = true; - logger.Warn(password.Text); // BAD - logger.Warn(box1.Text); // BAD - logger.Warn(box2.Text); // BAD + logger.Warn(password.Text); // $ Alert // BAD + logger.Warn(box1.Text); // $ Alert // BAD + logger.Warn(box2.Text); // $ Alert // BAD logger.Warn(box3.Text); // GOOD } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-312/CleartextStorage.qlref b/csharp/ql/test/query-tests/Security Features/CWE-312/CleartextStorage.qlref index 0fda4720f54a..78dc420e9c8e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-312/CleartextStorage.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-312/CleartextStorage.qlref @@ -1 +1,2 @@ -Security Features/CWE-312/CleartextStorage.ql \ No newline at end of file +query: Security Features/CWE-312/CleartextStorage.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.cs b/csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.cs index 0c9c58d0d230..d60d2a389b50 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.cs @@ -14,21 +14,21 @@ static void Main(string[] args) var a = new AesCryptoServiceProvider(); // BAD: explicit key assignment, hard-coded value - a.Key = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }; + a.Key = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }; // $ Alert=r1 var b = new AesCryptoServiceProvider() { // BAD: explicit key assignment, hard-coded value - Key = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 } + Key = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 } // $ Alert=r2 }; - var c = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }; + var c = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }; // $ Source=r3 Source=r4 Source=r5 Source=r6 var d = c; - var byteArrayFromString = Encoding.UTF8.GetBytes("Hello, world: here is a very bad way to create a key"); + var byteArrayFromString = Encoding.UTF8.GetBytes("Hello, world: here is a very bad way to create a key"); // $ Source=r7 // BAD: key assignment via variable, from hard-coded value - a.Key = d; + a.Key = d; // $ Alert=r3 Alert=r4 Alert=r5 Alert=r6 // GOOD (not really, but better than hard coding) a.Key = File.ReadAllBytes("secret.key"); @@ -65,7 +65,7 @@ public static string Decrypt(byte[] cipherText, byte[] password, byte[] IV) { using (MemoryStream ms = new MemoryStream()) { - using (CryptoStream cs = new CryptoStream(ms, aes.CreateDecryptor(password, IV), CryptoStreamMode.Write)) + using (CryptoStream cs = new CryptoStream(ms, aes.CreateDecryptor(password, IV), CryptoStreamMode.Write)) // $ Alert=r3 Alert=r4 Alert=r5 Alert=r6 { cs.Write(cipherText, 0, cipherText.Length); } @@ -105,7 +105,7 @@ static SymmetricAlgorithm CreateProvider(byte[] key) return new AesManaged() { // BAD: assignment from parameter - Key = key + Key = key // $ Alert=r3 Alert=r4 Alert=r5 Alert=r6 }; } @@ -118,7 +118,7 @@ public static byte[] Encrypt(string plaintext, byte[] key, byte[] IV) using (MemoryStream ms = new MemoryStream()) { // BAD: flow of hardcoded key to CreateEncryptor constructor - using (CryptoStream cs = new CryptoStream(ms, aes.CreateEncryptor(key, IV), CryptoStreamMode.Write)) + using (CryptoStream cs = new CryptoStream(ms, aes.CreateEncryptor(key, IV), CryptoStreamMode.Write)) // $ Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 { cs.Write(rawPlaintext, 0, rawPlaintext.Length); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.qlref b/csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.qlref index 5ec9c0d849c1..6006de2bd61b 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-321/HardcodedSymmetricEncryptionKey/HardcodedSymmetricEncryptionKey.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-321/HardcodedEncryptionKey.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-327/DontInstallRootCert/DontInstallRootCert.qlref b/csharp/ql/test/query-tests/Security Features/CWE-327/DontInstallRootCert/DontInstallRootCert.qlref index f023214a7848..da9f5248b379 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-327/DontInstallRootCert/DontInstallRootCert.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-327/DontInstallRootCert/DontInstallRootCert.qlref @@ -1 +1,2 @@ -Security Features/CWE-327/DontInstallRootCert.ql \ No newline at end of file +query: Security Features/CWE-327/DontInstallRootCert.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-327/DontInstallRootCert/Test.cs b/csharp/ql/test/query-tests/Security Features/CWE-327/DontInstallRootCert/Test.cs index 8323889cffdd..1c6e3d5e31ff 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-327/DontInstallRootCert/Test.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-327/DontInstallRootCert/Test.cs @@ -12,20 +12,20 @@ public class Class1 public void InstallRootCert() { string file = "mytest.pfx"; // Contains name of certificate file - X509Store store = new X509Store(StoreName.Root); + X509Store store = new X509Store(StoreName.Root); // $ Source store.Open(OpenFlags.ReadWrite); // BAD: adding a certificate to the Root store - store.Add(new X509Certificate2(X509Certificate2.CreateFromCertFile(file))); + store.Add(new X509Certificate2(X509Certificate2.CreateFromCertFile(file))); // $ Alert store.Close(); } public void InstallRootCert2() { string file = "mytest.pfx"; // Contains name of certificate file - X509Store store = new X509Store(StoreName.Root, StoreLocation.CurrentUser); + X509Store store = new X509Store(StoreName.Root, StoreLocation.CurrentUser); // $ Source store.Open(OpenFlags.ReadWrite); // BAD: adding a certificate to the Root store - store.Add(new X509Certificate2(X509Certificate2.CreateFromCertFile(file))); + store.Add(new X509Certificate2(X509Certificate2.CreateFromCertFile(file))); // $ Alert store.Close(); } @@ -67,10 +67,10 @@ public void InstallRootCertRange() new X509Certificate2(X509Certificate2.CreateFromCertFile(file1)), new X509Certificate2(X509Certificate2.CreateFromCertFile(file2)), }; - X509Store store = new X509Store(StoreName.Root, StoreLocation.CurrentUser); + X509Store store = new X509Store(StoreName.Root, StoreLocation.CurrentUser); // $ Source store.Open(OpenFlags.ReadWrite); // BAD: adding multiple certificates to the Root store - store.AddRange(new X509Certificate2Collection(certCollection)); + store.AddRange(new X509Certificate2Collection(certCollection)); // $ Alert store.Close(); } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-327/InsecureSQLConnection/InsecureSQLConnection.cs b/csharp/ql/test/query-tests/Security Features/CWE-327/InsecureSQLConnection/InsecureSQLConnection.cs index a433d5493851..755130ee32fa 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-327/InsecureSQLConnection/InsecureSQLConnection.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-327/InsecureSQLConnection/InsecureSQLConnection.cs @@ -41,24 +41,24 @@ public void StringInInitializer() public void TriggerThis() { // BAD, Encrypt not specified - SqlConnection conn = new SqlConnection("Server=myServerName\\myInstanceName;Database=myDataBase;User Id=myUsername;"); + SqlConnection conn = new SqlConnection("Server=myServerName\\myInstanceName;Database=myDataBase;User Id=myUsername;"); // $ Alert } void Test4() { string connectString = - "Server=1.2.3.4;Database=Anything;UID=ab;Pwd=cd"; + "Server=1.2.3.4;Database=Anything;UID=ab;Pwd=cd"; // $ Source // BAD, Encrypt not specified - SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(connectString); + SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(connectString); // $ Alert var conn = new SqlConnection(builder.ConnectionString); } void Test5() { string connectString = - "Server=1.2.3.4;Database=Anything;UID=ab;Pwd=cd;Encrypt=false"; + "Server=1.2.3.4;Database=Anything;UID=ab;Pwd=cd;Encrypt=false"; // $ Source // BAD, Encrypt set to false - SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(connectString); + SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder(connectString); // $ Alert var conn = new SqlConnection(builder.ConnectionString); } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-327/InsecureSQLConnection/InsecureSQLConnection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-327/InsecureSQLConnection/InsecureSQLConnection.qlref index 9809e87e73c5..cd92f9704736 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-327/InsecureSQLConnection/InsecureSQLConnection.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-327/InsecureSQLConnection/InsecureSQLConnection.qlref @@ -1 +1,2 @@ -Security Features/CWE-327/InsecureSQLConnection.ql \ No newline at end of file +query: Security Features/CWE-327/InsecureSQLConnection.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.cs b/csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.cs index 56f600e3544d..1d4d4efa7baa 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.cs @@ -7,21 +7,21 @@ public class InsufficientKeySize public void CryptoMethod() { // BAD: Key size is less than 128 - new RC2CryptoServiceProvider().EffectiveKeySize = 64; + new RC2CryptoServiceProvider().EffectiveKeySize = 64; // $ Alert // GOOD: Key size defaults to 128 new RC2CryptoServiceProvider(); // GOOD: Key size is greater than 128 new RC2CryptoServiceProvider().EffectiveKeySize = 256; // BAD: Key size is less than 2048. - DSACryptoServiceProvider dsaBad = new DSACryptoServiceProvider(512); + DSACryptoServiceProvider dsaBad = new DSACryptoServiceProvider(512); // $ Alert // GOOD: Key size defaults to 2048. DSACryptoServiceProvider dsaGood1 = new DSACryptoServiceProvider(); // GOOD: Key size is greater than 2048. DSACryptoServiceProvider dsaGood2 = new DSACryptoServiceProvider(2048); // BAD: Key size is less than 2048. - RSACryptoServiceProvider rsaBad = new RSACryptoServiceProvider(512); + RSACryptoServiceProvider rsaBad = new RSACryptoServiceProvider(512); // $ Alert // GOOD: Key size defaults to 2048. RSACryptoServiceProvider rsaGood1 = new RSACryptoServiceProvider(); // GOOD: Key size is greater than 2048. diff --git a/csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.qlref b/csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.qlref index 9b9050c417b4..2e460bd79e19 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-327/InsufficientKeySize/InsufficientKeySize.qlref @@ -1 +1,2 @@ -Security Features/InsufficientKeySize.ql \ No newline at end of file +query: Security Features/InsufficientKeySize.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.cs b/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.cs index 58241499c66b..c49f0b81ed95 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.cs @@ -9,9 +9,9 @@ public class InsecureRandomness public void RandomTest() { // BAD: Using insecure RNG to generate password - string password = InsecureRandomString(10); - password = InsecureRandomStringFromSelection(10); - password = InsecureRandomStringFromIndexer(10); + string password = InsecureRandomString(10); // $ Alert=r1 + password = InsecureRandomStringFromSelection(10); // $ Alert=r2 + password = InsecureRandomStringFromIndexer(10); // $ Alert=r3 // IGNORE - do not track further than the first assignment to a tainted variable string passwd = password; // GOOD: Use cryptographically secure RNG @@ -25,7 +25,7 @@ public static string InsecureRandomString(int length) byte[] data = new byte[1]; while (result.Length < length) { - data[0] = (byte)r.Next(97, 122); + data[0] = (byte)r.Next(97, 122); // $ Source=r1 result.Append(new ASCIIEncoding().GetString(data)); } return result.ToString(); @@ -57,7 +57,7 @@ public static string InsecureRandomStringFromSelection(int length) Random r = new Random(); while (result.Length < length) { - result += letters[r.Next(3)]; + result += letters[r.Next(3)]; // $ Source=r2 } return result.ToString(); } @@ -69,7 +69,7 @@ public static string InsecureRandomStringFromIndexer(int length) Random r = new Random(); while (result.Length < length) { - result += letters[r.Next(3)]; + result += letters[r.Next(3)]; // $ Source=r3 } return result; } @@ -77,7 +77,7 @@ public static string InsecureRandomStringFromIndexer(int length) public static string BiasPasswordGeneration() { // BAD: Membership.GeneratePassword generates a password with a bias - string password = System.Web.Security.Membership.GeneratePassword(12, 3); + string password = System.Web.Security.Membership.GeneratePassword(12, 3); // $ Alert=r4 $ Alert=r4 return password; } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.qlref b/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.qlref index b2198beb2b45..a79d744ce61c 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-338/InsecureRandomness.qlref @@ -1,2 +1,4 @@ query: Security Features/InsecureRandomness.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-352/global/MissingAntiForgeryTokenValidation.qlref b/csharp/ql/test/query-tests/Security Features/CWE-352/global/MissingAntiForgeryTokenValidation.qlref index 38fdc5c57385..8948b9773a2d 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-352/global/MissingAntiForgeryTokenValidation.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-352/global/MissingAntiForgeryTokenValidation.qlref @@ -1 +1,2 @@ -Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql \ No newline at end of file +query: Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-352/missing-aspnetcore/MissingAntiForgeryTokenValidation.cs b/csharp/ql/test/query-tests/Security Features/CWE-352/missing-aspnetcore/MissingAntiForgeryTokenValidation.cs index e9e5202b40ab..febc12a61255 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-352/missing-aspnetcore/MissingAntiForgeryTokenValidation.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-352/missing-aspnetcore/MissingAntiForgeryTokenValidation.cs @@ -4,7 +4,7 @@ public class HomeController : Controller { // BAD: Anti forgery token has been forgotten [HttpPost] - public ActionResult Login() + public ActionResult Login() // $ Alert { return View(); } @@ -55,7 +55,7 @@ public class DerivedUnprotectedController : UnprotectedBaseController { // BAD: No antiforgery validation on this or any base class [HttpPost] - public ActionResult NoInheritedValidation() + public ActionResult NoInheritedValidation() // $ Alert { return View(); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-352/missing-aspnetcore/MissingAntiForgeryTokenValidation.qlref b/csharp/ql/test/query-tests/Security Features/CWE-352/missing-aspnetcore/MissingAntiForgeryTokenValidation.qlref index 5e1ab2426c65..8948b9773a2d 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-352/missing-aspnetcore/MissingAntiForgeryTokenValidation.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-352/missing-aspnetcore/MissingAntiForgeryTokenValidation.qlref @@ -1 +1,2 @@ query: Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-352/missing/MissingAntiForgeryTokenValidation.cs b/csharp/ql/test/query-tests/Security Features/CWE-352/missing/MissingAntiForgeryTokenValidation.cs index a86800e51529..ab258cddf3f7 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-352/missing/MissingAntiForgeryTokenValidation.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-352/missing/MissingAntiForgeryTokenValidation.cs @@ -4,7 +4,7 @@ public class HomeController : Controller { // BAD: Anti forgery token has been forgotten [HttpPost] - public ActionResult Login() + public ActionResult Login() // $ Alert { return View(); } @@ -55,7 +55,7 @@ public class DerivedUnprotectedController : UnprotectedBaseController { // BAD: No antiforgery validation on this or any base class [HttpPost] - public ActionResult NoInheritedValidation() + public ActionResult NoInheritedValidation() // $ Alert { return View(); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-352/missing/MissingAntiForgeryTokenValidation.qlref b/csharp/ql/test/query-tests/Security Features/CWE-352/missing/MissingAntiForgeryTokenValidation.qlref index 38fdc5c57385..8948b9773a2d 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-352/missing/MissingAntiForgeryTokenValidation.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-352/missing/MissingAntiForgeryTokenValidation.qlref @@ -1 +1,2 @@ -Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql \ No newline at end of file +query: Security Features/CWE-352/MissingAntiForgeryTokenValidation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-359/ExposureOfPrivateInformation.cs b/csharp/ql/test/query-tests/Security Features/CWE-359/ExposureOfPrivateInformation.cs index 675b05c29de3..21f925536d73 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-359/ExposureOfPrivateInformation.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-359/ExposureOfPrivateInformation.cs @@ -15,19 +15,19 @@ public class ExposureOfPrivateInformationHandler : IHttpHandler public void ProcessRequest(HttpContext ctx) { // BAD: Setting a cookie value or values with private data. - ctx.Response.Cookies["MyCookie"].Value = ctx.Request.QueryString["postcode"]; + ctx.Response.Cookies["MyCookie"].Value = ctx.Request.QueryString["postcode"]; // $ Alert Person p = new Person(); - ctx.Response.Cookies["MyCookie"].Value = p.getTelephone(); + ctx.Response.Cookies["MyCookie"].Value = p.getTelephone(); // $ Alert // BAD: Logging private data ILogger logger = new ILogger(); - logger.Warn(p.getTelephone()); + logger.Warn(p.getTelephone()); // $ Alert // BAD: Storing sensitive data in unencrypted local file using (var writeStream = File.Open("telephones.txt", FileMode.Create)) { var writer = new StreamWriter(writeStream); - writer.Write(p.getTelephone()); + writer.Write(p.getTelephone()); // $ Alert writer.Close(); } @@ -59,7 +59,7 @@ public bool IsReusable void OnButtonClicked() { ILogger logger = new ILogger(); - logger.Warn(postcode.Text); + logger.Warn(postcode.Text); // $ Alert } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-359/ExposureOfPrivateInformation.qlref b/csharp/ql/test/query-tests/Security Features/CWE-359/ExposureOfPrivateInformation.qlref index 9d578d17de89..fb1a58d5f9e6 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-359/ExposureOfPrivateInformation.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-359/ExposureOfPrivateInformation.qlref @@ -1 +1,2 @@ -Security Features/CWE-359/ExposureOfPrivateInformation.ql \ No newline at end of file +query: Security Features/CWE-359/ExposureOfPrivateInformation.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-384/AbandonSession.cs b/csharp/ql/test/query-tests/Security Features/CWE-384/AbandonSession.cs index d674b33a0365..e2a8411089a7 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-384/AbandonSession.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-384/AbandonSession.cs @@ -8,7 +8,7 @@ public void ProcessRequest(HttpContext ctx) if (FormsAuthentication.Authenticate("username", "password")) { - ctx.Session["foo"] = "bar"; // BAD: Session has not been abandoned + ctx.Session["foo"] = "bar"; // $ Alert // BAD: Session has not been abandoned ctx.Session.Abandon(); ctx.Session["foo"] = "bar"; // GOOD: Session is abandoned } @@ -48,9 +48,9 @@ public void ProcessRequest(HttpContext ctx) if (Membership.ValidateUser("username", "password")) { - ctx.Session["foo"] = "bar"; // BAD: Session not abandoned + ctx.Session["foo"] = "bar"; // $ Alert // BAD: Session not abandoned } - ctx.Session["foo"] = "bar"; // BAD: here as well + ctx.Session["foo"] = "bar"; // $ Alert // BAD: here as well } public bool IsReusable => true; diff --git a/csharp/ql/test/query-tests/Security Features/CWE-384/AbandonSession.qlref b/csharp/ql/test/query-tests/Security Features/CWE-384/AbandonSession.qlref index f67c9a36e202..c3ac664edb29 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-384/AbandonSession.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-384/AbandonSession.qlref @@ -1 +1,2 @@ -Security Features/CWE-384/AbandonSession.ql \ No newline at end of file +query: Security Features/CWE-384/AbandonSession.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/CodeAddedHeader/MissingXFrameOptions.qlref b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/CodeAddedHeader/MissingXFrameOptions.qlref index b8a963200e57..d0d38c4b0117 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/CodeAddedHeader/MissingXFrameOptions.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/CodeAddedHeader/MissingXFrameOptions.qlref @@ -1 +1,2 @@ -Security Features/CWE-451/MissingXFrameOptions.ql +query: Security Features/CWE-451/MissingXFrameOptions.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.qlref b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.qlref index b8a963200e57..d0d38c4b0117 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeader/MissingXFrameOptions.qlref @@ -1 +1,2 @@ -Security Features/CWE-451/MissingXFrameOptions.ql +query: Security Features/CWE-451/MissingXFrameOptions.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.qlref b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.qlref index b8a963200e57..d0d38c4b0117 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-451/MissingXFrameOptions/WebConfigAddedHeaderInLocation/MissingXFrameOptions.qlref @@ -1 +1,2 @@ -Security Features/CWE-451/MissingXFrameOptions.ql +query: Security Features/CWE-451/MissingXFrameOptions.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-539/PersistentCookie/PersistentCookie.cs b/csharp/ql/test/query-tests/Security Features/CWE-539/PersistentCookie/PersistentCookie.cs index 8370fe93ba0d..de23c3caddc9 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-539/PersistentCookie/PersistentCookie.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-539/PersistentCookie/PersistentCookie.cs @@ -4,8 +4,8 @@ class PersistentCookie { void M(System.Web.HttpCookie cookie) { - cookie.Expires = DateTime.Now.AddMonths(12); // BAD + cookie.Expires = DateTime.Now.AddMonths(12); // $ Alert // BAD cookie.Expires = DateTime.Now.AddMinutes(3); // GOOD - cookie.Expires = DateTime.Now.AddSeconds(301); // BAD + cookie.Expires = DateTime.Now.AddSeconds(301); // $ Alert // BAD } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-539/PersistentCookie/PersistentCookie.qlref b/csharp/ql/test/query-tests/Security Features/CWE-539/PersistentCookie/PersistentCookie.qlref index 1d2111ac3fe7..d321b853086e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-539/PersistentCookie/PersistentCookie.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-539/PersistentCookie/PersistentCookie.qlref @@ -1 +1,2 @@ -Security Features/PersistentCookie.ql \ No newline at end of file +query: Security Features/PersistentCookie.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-548/ASPNetDirectoryListing.qlref b/csharp/ql/test/query-tests/Security Features/CWE-548/ASPNetDirectoryListing.qlref index 40d1fce18b5c..c792e1fcbe42 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-548/ASPNetDirectoryListing.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-548/ASPNetDirectoryListing.qlref @@ -1 +1,2 @@ -Security Features/CWE-548/ASPNetDirectoryListing.ql \ No newline at end of file +query: Security Features/CWE-548/ASPNetDirectoryListing.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-548/web.config b/csharp/ql/test/query-tests/Security Features/CWE-548/web.config index b4276433838e..0631d8116609 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-548/web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-548/web.config @@ -1,6 +1,6 @@ - + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.cs b/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.cs index 3b3aae534adb..498b004505e3 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.cs @@ -10,7 +10,7 @@ public class UrlRedirectHandler : IHttpHandler public void ProcessRequest(HttpContext ctx) { // BAD: a request parameter is incorporated without validation into a URL redirect - ctx.Response.Redirect(ctx.Request.QueryString["page"]); + ctx.Response.Redirect(ctx.Request.QueryString["page"]); // $ Alert=r2 Alert=r2 // GOOD: the request parameter is validated against a known fixed string if (VALID_REDIRECT == ctx.Request.QueryString["page"]) @@ -20,7 +20,7 @@ public void ProcessRequest(HttpContext ctx) // GOOD: We check whether this is a local URL before redirecting, using UrlHelper. // As recommended by https://docs.microsoft.com/en-us/aspnet/mvc/overview/security/preventing-open-redirection-attacks - string url = ctx.Request.QueryString["page"]; + string url = ctx.Request.QueryString["page"]; // $ Source=r5 Source=r6 Source=r7 Source=r8 if (new UrlHelper(null).IsLocalUrl(url)) { ctx.Response.Redirect(url); @@ -35,8 +35,8 @@ public void ProcessRequest(HttpContext ctx) } // BAD: Adding or appending a header - ctx.Response.AddHeader("Location", ctx.Request.QueryString["page"]); - ctx.Response.AppendHeader("Location", ctx.Request.QueryString["page"]); + ctx.Response.AddHeader("Location", ctx.Request.QueryString["page"]); // $ Alert=r3 Alert=r3 + ctx.Response.AppendHeader("Location", ctx.Request.QueryString["page"]); // $ Alert=r4 Alert=r4 // GOOD: Redirecting to the RawUrl only reloads the current Url ctx.Response.Redirect(ctx.Request.RawUrl); @@ -45,7 +45,7 @@ public void ProcessRequest(HttpContext ctx) ctx.Response.Redirect("foo.asp?param=" + url); // BAD: Using Transfer with unvalidated user input - ctx.Server.Transfer(url); + ctx.Server.Transfer(url); // $ Alert=r5 Alert=r6 Alert=r7 Alert=r8 // GOOD: request parameter is URL encoded ctx.Response.Redirect(HttpUtility.UrlEncode(ctx.Request.QueryString["page"])); @@ -61,19 +61,19 @@ public void ProcessRequest(HttpContext ctx) ctx.Response.Redirect($"foo.asp?param={url}"); // BAD: The attacker can control the location - ctx.Response.Redirect($"{url}.asp?param=foo"); + ctx.Response.Redirect($"{url}.asp?param=foo"); // $ Alert=r6 Alert=r5 Alert=r7 Alert=r8 // GOOD: The attacker can only control the parameters, not the location ctx.Response.Redirect(string.Format("foo.asp?param={0}", url)); // BAD: The attacker can control the location - ctx.Response.Redirect(string.Format("{0}.asp?param=foo", url)); + ctx.Response.Redirect(string.Format("{0}.asp?param=foo", url)); // $ Alert=r7 Alert=r5 Alert=r6 Alert=r8 // GOOD: The attacker can only control the parameters, not the location ctx.Response.Redirect(string.Format("foo.asp?{1}param={0}", url, url)); // BAD: The attacker can control the location - ctx.Response.Redirect(string.Format("{1}.asp?{0}param=foo", url, url)); + ctx.Response.Redirect(string.Format("{1}.asp?{0}param=foo", url, url)); // $ Alert=r8 Alert=r5 Alert=r6 Alert=r7 } // Implementation as recommended by Microsoft. diff --git a/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.qlref b/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.qlref index fdb38b9ffc00..c24957fa4a02 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-601/UrlRedirect.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect2.cs b/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect2.cs index 83f499ea048d..43c1dcf0b9f6 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect2.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirect2.cs @@ -11,7 +11,7 @@ public class UrlRedirectHandler2 : IHttpHandler public void ProcessRequest(HttpContext ctx) { // BAD: a request parameter is incorporated without validation into a URL redirect - ctx.Response.Redirect(ctx.Request.QueryString["page"]); + ctx.Response.Redirect(ctx.Request.QueryString["page"]); // $ Alert=r1 $ Alert=r1 var redirectUrl = ctx.Request.QueryString["page"]; if (VALID_REDIRECTS.Contains(redirectUrl)) diff --git a/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirectCore.cs b/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirectCore.cs index 2da9652d8547..619373da0697 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirectCore.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-601/UrlRedirect/UrlRedirectCore.cs @@ -10,50 +10,50 @@ public class SomeController : ControllerBase private static string SomeValue = "HeaderValue"; [HttpPost] - public void Post([FromBody] string value) + public void Post([FromBody] string value) // $ Source=r9 Source=r10 Source=r11 Source=r12 Source=r13 Source=r14 Source=r15 { // BAD: straight up controller redirect - Redirect(value); + Redirect(value); // $ Alert=r9 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 Alert=r15 // BAD: Setting response headers collection, location = redirect - Response.Headers["location"] = value; + Response.Headers["location"] = value; // $ Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 Alert=r15 Alert=r9 // GOOD: Setting response header to a constant value Response.Headers["location"] = SomeValue; // BAD: Setting response headers collection, location = redirect via add method - Response.Headers.Add("location", value); + Response.Headers.Add("location", value); // $ Alert=r11 Alert=r10 Alert=r12 Alert=r13 Alert=r14 Alert=r15 Alert=r9 // GOOD: Setting response header to a constant value Response.Headers.Add("location", "foo"); // BAD: redirect via location - Response.Headers.SetCommaSeparatedValues("location", value); + Response.Headers.SetCommaSeparatedValues("location", value); // $ Alert=r12 Alert=r10 Alert=r11 Alert=r13 Alert=r14 Alert=r15 Alert=r9 // BAD = redirect via setting location value from tainted source - Response.Headers.Append("location", value); + Response.Headers.Append("location", value); // $ Alert=r13 Alert=r10 Alert=r11 Alert=r12 Alert=r14 Alert=r15 Alert=r9 // BAD: redirect via setting location header from comma-separated values - Response.Headers.AppendCommaSeparatedValues("location", value); + Response.Headers.AppendCommaSeparatedValues("location", value); // $ Alert=r14 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r15 Alert=r9 // BAD: tainted redirect to Action - RedirectToActionPermanent("Error" + value); + RedirectToActionPermanent("Error" + value); // $ Alert=r15 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 Alert=r9 } // PUT: api/Some/5 [HttpPut("{id}")] - public void Put(int id, [FromBody] string value) + public void Put(int id, [FromBody] string value) // $ Source=r16 Source=r17 Source=r18 { - RedirectToPage(value); + RedirectToPage(value); // $ Alert=r16 Alert=r17 Alert=r18 var headers = new ResponseHeaders(Response.Headers); // BAD: redirect via header helper class - headers.Location = new Uri(value); + headers.Location = new Uri(value); // $ Alert=r17 Alert=r16 Alert=r18 // BAD: response redirect - Response.Redirect(value); + Response.Redirect(value); // $ Alert=r18 Alert=r16 Alert=r17 // GOOD: whitelisted redirect if(Url.IsLocalUrl(value)) diff --git a/csharp/ql/test/query-tests/Security Features/CWE-611/Test.cs b/csharp/ql/test/query-tests/Security Features/CWE-611/Test.cs index 005e79a7fb4f..103d3cca4cc0 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-611/Test.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-611/Test.cs @@ -8,7 +8,7 @@ public class XMLHandler : IHttpHandler public void ProcessRequest(HttpContext ctx) { // BAD: XmlTextReader is insecure with these options, using user-provided data - XmlTextReader reader = new XmlTextReader(ctx.Request.QueryString["document"]) { DtdProcessing = DtdProcessing.Parse, XmlResolver = new XmlUrlResolver() }; + XmlTextReader reader = new XmlTextReader(ctx.Request.QueryString["document"]) { DtdProcessing = DtdProcessing.Parse, XmlResolver = new XmlUrlResolver() }; // $ Alert[cs/xml/insecure-dtd-handling]=r1 $ Alert[cs/xml/insecure-dtd-handling]=r1 $ Alert[cs/insecure-xml-read] } public void insecureXMLBad(string content) @@ -18,10 +18,10 @@ public void insecureXMLBad(string content) settings.XmlResolver = new XmlUrlResolver(); // BAD: insecure settings - XmlReader reader1 = XmlReader.Create(content, settings); + XmlReader reader1 = XmlReader.Create(content, settings); // $ Alert[cs/insecure-xml-read] // BAD: XmlTextReader is insecure with these options - XmlTextReader reader2 = new XmlTextReader(content) { DtdProcessing = DtdProcessing.Parse, XmlResolver = new XmlUrlResolver() }; + XmlTextReader reader2 = new XmlTextReader(content) { DtdProcessing = DtdProcessing.Parse, XmlResolver = new XmlUrlResolver() }; // $ Alert[cs/insecure-xml-read] } public void insecureXMLGood(string content) diff --git a/csharp/ql/test/query-tests/Security Features/CWE-611/UntrustedDataInsecureXml.qlref b/csharp/ql/test/query-tests/Security Features/CWE-611/UntrustedDataInsecureXml.qlref index 7f685106e250..8cc567d8a970 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-611/UntrustedDataInsecureXml.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-611/UntrustedDataInsecureXml.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-611/UntrustedDataInsecureXml.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-611/UseXmlSecureResolver.qlref b/csharp/ql/test/query-tests/Security Features/CWE-611/UseXmlSecureResolver.qlref index b11f53079246..851c79c15932 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-611/UseXmlSecureResolver.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-611/UseXmlSecureResolver.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-611/UseXmlSecureResolver.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/AddedInCode/RequireSSL.qlref b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/AddedInCode/RequireSSL.qlref index 73523f94fc09..1a762e07498e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/AddedInCode/RequireSSL.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/AddedInCode/RequireSSL.qlref @@ -1 +1,2 @@ -Security Features/CWE-614/RequireSSL.ql \ No newline at end of file +query: Security Features/CWE-614/RequireSSL.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/AddedInForms/RequireSSL.qlref b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/AddedInForms/RequireSSL.qlref index 73523f94fc09..1a762e07498e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/AddedInForms/RequireSSL.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/AddedInForms/RequireSSL.qlref @@ -1 +1,2 @@ -Security Features/CWE-614/RequireSSL.ql \ No newline at end of file +query: Security Features/CWE-614/RequireSSL.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/HttpCookiesCorrect/RequireSSL.qlref b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/HttpCookiesCorrect/RequireSSL.qlref index 73523f94fc09..1a762e07498e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/HttpCookiesCorrect/RequireSSL.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/HttpCookiesCorrect/RequireSSL.qlref @@ -1 +1,2 @@ -Security Features/CWE-614/RequireSSL.ql \ No newline at end of file +query: Security Features/CWE-614/RequireSSL.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/HttpCookiesCorrect/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/HttpCookiesCorrect/Web.config index 1ddaaf2b65f2..7755ae7462d4 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/HttpCookiesCorrect/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/HttpCookiesCorrect/Web.config @@ -2,7 +2,7 @@ - + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/RequireSSLMissing/RequireSSL.qlref b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/RequireSSLMissing/RequireSSL.qlref index 73523f94fc09..1a762e07498e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/RequireSSLMissing/RequireSSL.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/RequireSSLMissing/RequireSSL.qlref @@ -1 +1,2 @@ -Security Features/CWE-614/RequireSSL.ql \ No newline at end of file +query: Security Features/CWE-614/RequireSSL.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/RequireSSLMissing/Web.config b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/RequireSSLMissing/Web.config index 0ab64b1fcb62..45f9f219f096 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/RequireSSLMissing/Web.config +++ b/csharp/ql/test/query-tests/Security Features/CWE-614/RequireSSL/RequireSSLMissing/Web.config @@ -2,8 +2,8 @@ - + - + diff --git a/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/CommentController.cs b/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/CommentController.cs index d446c7ed4864..2508a7c159c3 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/CommentController.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/CommentController.cs @@ -12,7 +12,7 @@ public CommentController(IAuthorizationService authorizationService) } // BAD: Any user can access this. - public ActionResult Edit1(int commentId, string text) + public ActionResult Edit1(int commentId, string text) // $ Alert { editComment(commentId, text); return View(); @@ -39,7 +39,7 @@ public ActionResult Edit3(int commentId, string text) // BAD: The AllowAnonymous attribute overrides the Authorize attribute [Authorize] [AllowAnonymous] - public ActionResult Edit4(int commentId, string text) + public ActionResult Edit4(int commentId, string text) // $ Alert { editComment(commentId, text); return View(); diff --git a/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/InsecureDirectObjectReference.qlref b/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/InsecureDirectObjectReference.qlref index 4756d5a76a4f..8fb76298ac58 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/InsecureDirectObjectReference.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/InsecureDirectObjectReference.qlref @@ -1 +1,2 @@ -Security Features/CWE-639/InsecureDirectObjectReference.ql \ No newline at end of file +query: Security Features/CWE-639/InsecureDirectObjectReference.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/MiscTestControllers.cs b/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/MiscTestControllers.cs index 503b2955933d..5ff2e2187684 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/MiscTestControllers.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/MiscTestControllers.cs @@ -23,7 +23,7 @@ public class AController : BaseController { public class BaseAuthController : Controller { // BAD - A subclass of AllowAnonymous is used [MyAllowAnonymous] - public virtual ActionResult EditAnon(int id) { return View(); } + public virtual ActionResult EditAnon(int id) { return View(); } // $ Alert } public class BController : BaseAuthController { @@ -31,7 +31,7 @@ public class BController : BaseAuthController { public ActionResult Edit3(int id) { return View(); } // BAD - MyAllowAnonymous is inherited from overridden method - public override ActionResult EditAnon(int id) { return View(); } + public override ActionResult EditAnon(int id) { return View(); } // $ Alert } [AllowAnonymous] @@ -42,7 +42,7 @@ public class BaseAnonController : Controller { public class CController : BaseAnonController { // BAD - AllowAnonymous is inherited from base class and overrides Authorize [Authorize] - public ActionResult Edit4(int id) { return View(); } + public ActionResult Edit4(int id) { return View(); } // $ Alert } [Authorize] diff --git a/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/ProfileController.cs b/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/ProfileController.cs index a41c32db6411..adb24ce0c3c9 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/ProfileController.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-639/MVCTests/ProfileController.cs @@ -11,7 +11,7 @@ public ActionResult Edit1(int profileId, string text) { // BAD: The AllowAnonymous attribute overrides the Authorize attribute on the class. [AllowAnonymous] - public ActionResult Edit2(int profileId, string text) { + public ActionResult Edit2(int profileId, string text) { // $ Alert editProfileName(profileId, text); return View(); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-639/WebFormsTests/EditComment.aspx.cs b/csharp/ql/test/query-tests/Security Features/CWE-639/WebFormsTests/EditComment.aspx.cs index 974869a0af4b..bdcf80a010fe 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-639/WebFormsTests/EditComment.aspx.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-639/WebFormsTests/EditComment.aspx.cs @@ -4,7 +4,7 @@ class EditComment : System.Web.UI.Page { // BAD - Any user can access this method. - protected void btn1_Click(object sender, EventArgs e) { + protected void btn1_Click(object sender, EventArgs e) { // $ Alert string commentId = Request.QueryString["Id"]; Comment comment = getCommentById(commentId); comment.Text = "xyz"; diff --git a/csharp/ql/test/query-tests/Security Features/CWE-639/WebFormsTests/InsecureDirectObjectReference.qlref b/csharp/ql/test/query-tests/Security Features/CWE-639/WebFormsTests/InsecureDirectObjectReference.qlref index 4756d5a76a4f..8fb76298ac58 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-639/WebFormsTests/InsecureDirectObjectReference.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-639/WebFormsTests/InsecureDirectObjectReference.qlref @@ -1 +1,2 @@ -Security Features/CWE-639/InsecureDirectObjectReference.ql \ No newline at end of file +query: Security Features/CWE-639/InsecureDirectObjectReference.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.cs index a42a629cc7ec..a7656f26a73a 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.cs @@ -8,16 +8,16 @@ public class XPathInjectionHandler : IHttpHandler { public void ProcessRequest(HttpContext ctx) { - string userName = ctx.Request.QueryString["userName"]; - string password = ctx.Request.QueryString["password"]; + string userName = ctx.Request.QueryString["userName"]; // $ Source=r1 Source=r3 Source=r5 Source=r7 Source=r9 Source=r11 Source=r13 + string password = ctx.Request.QueryString["password"]; // $ Source=r2 Source=r4 Source=r6 Source=r8 Source=r10 Source=r12 Source=r14 var s = "//users/user[login/text()='" + userName + "' and password/text() = '" + password + "']/home_dir/text()"; // BAD: User input used directly in an XPath expression - XPathExpression.Compile(s); + XPathExpression.Compile(s); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 Alert=r8 Alert=r9 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 XmlNode xmlNode = null; // BAD: User input used directly in an XPath expression to SelectNodes - xmlNode.SelectNodes(s); + xmlNode.SelectNodes(s); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 Alert=r8 Alert=r9 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 // GOOD: Uses parameters to avoid including user input directly in XPath expression var expr = XPathExpression.Compile("//users/user[login/text()=$username]/home_dir/text()"); @@ -26,31 +26,31 @@ public void ProcessRequest(HttpContext ctx) var nav = doc.CreateNavigator(); // BAD - nav.Select(s); + nav.Select(s); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 Alert=r8 Alert=r9 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 // GOOD nav.Select(expr); // BAD - nav.SelectSingleNode(s); + nav.SelectSingleNode(s); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 Alert=r8 Alert=r9 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 // GOOD nav.SelectSingleNode(expr); // BAD - nav.Compile(s); + nav.Compile(s); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 Alert=r8 Alert=r9 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 // GOOD nav.Compile("//users/user[login/text()=$username]/home_dir/text()"); // BAD - nav.Evaluate(s); + nav.Evaluate(s); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 Alert=r8 Alert=r9 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 // Good nav.Evaluate(expr); // BAD - nav.Matches(s); + nav.Matches(s); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 Alert=r6 Alert=r7 Alert=r8 Alert=r9 Alert=r10 Alert=r11 Alert=r12 Alert=r13 Alert=r14 // GOOD nav.Matches(expr); @@ -71,17 +71,17 @@ public void ProcessStoredRequest() { connection.Open(); SqlCommand customerCommand = new SqlCommand("SELECT * FROM customers", connection); - SqlDataReader customerReader = customerCommand.ExecuteReader(); + SqlDataReader customerReader = customerCommand.ExecuteReader(); // $ Source=r15 Source=r16 while (customerReader.Read()) { string userName = customerReader.GetString(1); string password = customerReader.GetString(2); // BAD: User input used directly in an XPath expression - XPathExpression.Compile("//users/user[login/text()='" + userName + "' and password/text() = '" + password + "']/home_dir/text()"); + XPathExpression.Compile("//users/user[login/text()='" + userName + "' and password/text() = '" + password + "']/home_dir/text()"); // $ Alert=r15 Alert=r16 XmlNode xmlNode = null; // BAD: User input used directly in an XPath expression to SelectNodes - xmlNode.SelectNodes("//users/user[login/text()='" + userName + "' and password/text() = '" + password + "']/home_dir/text()"); + xmlNode.SelectNodes("//users/user[login/text()='" + userName + "' and password/text() = '" + password + "']/home_dir/text()"); // $ Alert=r16 Alert=r15 // GOOD: Uses parameters to avoid including user input directly in XPath expression XPathExpression.Compile("//users/user[login/text()=$username]/home_dir/text()"); diff --git a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.qlref index a0cdca4727ae..9ffeeb3a2929 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-643/XPathInjection.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-643/XPathInjection.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoS/ExponentialRegex.cs b/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoS/ExponentialRegex.cs index b54b3bbdf81f..0cb19d1f480e 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoS/ExponentialRegex.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoS/ExponentialRegex.cs @@ -8,20 +8,20 @@ public class RegexHandler : IHttpHandler public void ProcessRequest(HttpContext ctx) { - string userInput = ctx.Request.QueryString["userInput"]; + string userInput = ctx.Request.QueryString["userInput"]; // $ Source=r1 Source=r2 Source=r3 Source=r4 Source=r5 // BAD: // Artificial regexes - new Regex("^([a-z]+)+$").Match(userInput); - new Regex("^([a-z]*)*$").Replace(userInput, ""); + new Regex("^([a-z]+)+$").Match(userInput); // $ Alert=r1 Alert=r2 Alert=r3 Alert=r4 Alert=r5 + new Regex("^([a-z]*)*$").Replace(userInput, ""); // $ Alert=r2 Alert=r1 Alert=r3 Alert=r4 Alert=r5 // Known exponential blowup regex for e-mail address validation // Problematic part is: ([a-zA-Z0-9]+))* - new Regex("^([a-zA-Z0-9])(([\\-.]|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-z]{2,3}[.]{1}[a-z]{2,3}))$").Match(userInput); + new Regex("^([a-zA-Z0-9])(([\\-.]|[_]+)?([a-zA-Z0-9]+))*(@){1}[a-z0-9]+[.]{1}(([a-z]{2,3})|([a-z]{2,3}[.]{1}[a-z]{2,3}))$").Match(userInput); // $ Alert=r3 Alert=r1 Alert=r2 Alert=r4 Alert=r5 // Known exponential blowup regex for Java class name validation // Problematic part is: (([a-z])+.)+ - new Regex(JAVA_CLASS_REGEX).Match(userInput); + new Regex(JAVA_CLASS_REGEX).Match(userInput); // $ Alert=r4 Alert=r1 Alert=r2 Alert=r3 Alert=r5 // Static use - Regex.Match(userInput, JAVA_CLASS_REGEX); + Regex.Match(userInput, JAVA_CLASS_REGEX); // $ Alert=r5 Alert=r1 Alert=r2 Alert=r3 Alert=r4 // GOOD: new Regex("^(([a-b]+[c-z]+)+$").Match(userInput); new Regex("^([a-z]+)+$", RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1)).Match(userInput); diff --git a/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoS/ReDoS.qlref b/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoS/ReDoS.qlref index de8c70102e05..e3f22da0ebeb 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoS/ReDoS.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoS/ReDoS.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-730/ReDoS.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoSGlobalTimeout/ReDoS.qlref b/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoSGlobalTimeout/ReDoS.qlref index de8c70102e05..e3f22da0ebeb 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoSGlobalTimeout/ReDoS.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-730/ReDoSGlobalTimeout/ReDoS.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-730/ReDoS.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.cs b/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.cs index d5f802a02687..5b4276d3af1d 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.cs @@ -7,11 +7,11 @@ public class RegexInjectionHandler : IHttpHandler public void ProcessRequest(HttpContext ctx) { - string regex = ctx.Request.QueryString["regex"]; + string regex = ctx.Request.QueryString["regex"]; // $ Source=r1 string userInput = ctx.Request.QueryString["userInput"]; // BAD: User input used as regex - new Regex(regex).Match(userInput); + new Regex(regex).Match(userInput); // $ Alert=r1 // GOOD: User input escaped before being used as regex new Regex(Regex.Escape(regex)).Match(userInput); } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.qlref b/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.qlref index bec7fbac79a5..82cad8aeb6bd 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-730/RegexInjection/RegexInjection.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-730/RegexInjection.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedConnectionString.qlref b/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedConnectionString.qlref index d240503b7731..da05cee17d43 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedConnectionString.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedConnectionString.qlref @@ -1 +1,2 @@ -Security Features/CWE-798/HardcodedConnectionString.ql \ No newline at end of file +query: Security Features/CWE-798/HardcodedConnectionString.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedCredentials.cs b/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedCredentials.cs index 840d65b19653..4a9bada259b2 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedCredentials.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedCredentials.cs @@ -13,7 +13,7 @@ public void ProcessRequest(HttpContext ctx) string password = ctx.Request.QueryString["password"]; // BAD: Inbound authentication made by comparison to string literal - if (password == "myPa55word") + if (password == "myPa55word") // $ Alert[cs/hardcoded-credentials] { ctx.Response.Redirect("login"); } @@ -29,7 +29,7 @@ public void ProcessRequest(HttpContext ctx) // BAD: Create a membership user with hardcoded username MembershipUser user = new MembershipUser( providerName: "provider", - name: "username", + name: "username", // $ Alert[cs/hardcoded-credentials] providerUserKey: "username", email: "foo@bar.com", passwordQuestion: "Hardcoded question.", @@ -43,18 +43,18 @@ public void ProcessRequest(HttpContext ctx) lastLockoutDate: DateTime.Now ); // BAD: Set the password to a hardcoded string literal - user.ChangePassword(password, "myNewPa55word"); + user.ChangePassword(password, "myNewPa55word"); // $ Alert[cs/hardcoded-credentials] - byte[] rawCertData = new byte[] { 0x20, 0x20, 0x20 }; + byte[] rawCertData = new byte[] { 0x20, 0x20, 0x20 }; // $ Alert[cs/hardcoded-credentials] // BAD: Passing a literal certificate and password to an X509 certificate constructor X509Certificate2 cert = new X509Certificate2( - rawCertData, - "myPa55word"); + rawCertData, // $ Sink[cs/hardcoded-credentials] + "myPa55word"); // $ Alert[cs/hardcoded-credentials] // BAD: Passing literal Password to connection string - SqlConnection conn = new SqlConnection("Password=12345"); + SqlConnection conn = new SqlConnection("Password=12345"); // $ Alert[cs/hardcoded-connection-string-credentials] // BAD: Passing literal User Id to connection string - SqlConnection conn2 = new SqlConnection("User Id=12345"); + SqlConnection conn2 = new SqlConnection("User Id=12345"); // $ Alert[cs/hardcoded-connection-string-credentials] // GOOD: Password is not specified literally SqlConnection conn3 = new SqlConnection("Password=" + LoadPasswordFromSecretConfig() + ";"); @@ -72,7 +72,7 @@ public void ProcessRequest(HttpContext ctx) conn = new SqlConnection($"Password={LoadPasswordFromSecretConfig()}"); // BAD: Hard-coded user - Membership.CreateUser("myusername", "mypassword"); + Membership.CreateUser("myusername", "mypassword"); // $ Alert[cs/hardcoded-credentials] var identityOptions = new IdentityOptions { diff --git a/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedCredentials.qlref b/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedCredentials.qlref index ce8fa7f9b286..d4792bd2fa24 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedCredentials.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-798/HardcodedCredentials.qlref @@ -1 +1,2 @@ -Security Features/CWE-798/HardcodedCredentials.ql \ No newline at end of file +query: Security Features/CWE-798/HardcodedCredentials.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-798/TestHardcodedCredentials.cs b/csharp/ql/test/query-tests/Security Features/CWE-798/TestHardcodedCredentials.cs index fa6d6f2b98af..997c1b7db795 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-798/TestHardcodedCredentials.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-798/TestHardcodedCredentials.cs @@ -23,7 +23,7 @@ public void TestUnsafe() // BAD: Create a membership user with hardcoded username MembershipUser user = new MembershipUser( providerName: "provider", - name: "username", + name: "username", // $ Alert[cs/hardcoded-credentials] providerUserKey: "username", email: "foo@bar.com", passwordQuestion: "Hardcoded question.", diff --git a/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs b/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs index 7ab297fbb686..39328ca7c174 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs @@ -9,22 +9,22 @@ public void ProcessRequest(HttpContext ctx) { string user = ctx.Request.QueryString["user"]; string password = ctx.Request.QueryString["password"]; - string isAdmin = ctx.Request.QueryString["isAdmin"]; + string isAdmin = ctx.Request.QueryString["isAdmin"]; // $ Source=r1 // BAD: login is only executed if isAdmin is false, but isAdmin // is controlled by the user - if (isAdmin == "false") + if (isAdmin == "false") // $ Alert=r1 login(user, password); - HttpCookie adminCookie = ctx.Request.Cookies["adminCookie"]; + HttpCookie adminCookie = ctx.Request.Cookies["adminCookie"]; // $ Source=r2 Source=r3 Source=r4 // BAD: login is only executed if the cookie value is false, but the cookie // is controlled by the user - if (adminCookie.Value.Equals("false")) + if (adminCookie.Value.Equals("false")) // $ Alert=r2 Alert=r3 Alert=r4 login(user, password); // FALSE POSITIVES: both methods are conditionally executed, but they probably // both perform the security-critical action - if (adminCookie.Value == "false") + if (adminCookie.Value == "false") // $ Alert=r3 Alert=r4 Alert=r2 { login(user, password); } @@ -39,14 +39,14 @@ public void ProcessRequest(HttpContext ctx) // BAD: DNS may be controlled by the user IPAddress hostIPAddress = IPAddress.Parse("1.2.3.4"); - IPHostEntry hostInfo = Dns.GetHostByAddress(hostIPAddress); + IPHostEntry hostInfo = Dns.GetHostByAddress(hostIPAddress); // $ Source=r5 Source=r6 // Exact comparison - if (hostInfo.HostName == "trustme.com") + if (hostInfo.HostName == "trustme.com") // $ Alert=r5 Alert=r6 { login(user, password); } // Substring comparison - if (hostInfo.HostName.EndsWith("trustme.com")) + if (hostInfo.HostName.EndsWith("trustme.com")) // $ Alert=r6 Alert=r5 { login(user, password); } @@ -67,9 +67,9 @@ public static void Test(HttpContext ctx, String user, String password) public static void Test2(HttpContext ctx, String user, String password) { - HttpCookie adminCookie = ctx.Request.Cookies["adminCookie"]; + HttpCookie adminCookie = ctx.Request.Cookies["adminCookie"]; // $ Source=r7 // BAD: login may happen once or twice - if (adminCookie.Value == "false") + if (adminCookie.Value == "false") // $ Alert=r7 login(user, password); else { @@ -80,8 +80,8 @@ public static void Test2(HttpContext ctx, String user, String password) public static void Test3(HttpContext ctx, String user, String password) { - HttpCookie adminCookie = ctx.Request.Cookies["adminCookie"]; - if (adminCookie.Value == "false") + HttpCookie adminCookie = ctx.Request.Cookies["adminCookie"]; // $ Source=r8 + if (adminCookie.Value == "false") // $ Alert=r8 login(user, password); else { diff --git a/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.qlref b/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.qlref index b0c208da3481..fe01c7557afa 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-807/ConditionalBypass.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-838/HtmlEncode.cs b/csharp/ql/test/query-tests/Security Features/CWE-838/HtmlEncode.cs index 8a5e378c8d13..fc86cc497ea4 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-838/HtmlEncode.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-838/HtmlEncode.cs @@ -7,7 +7,7 @@ public class HtmlEncode public static void Bad(HttpContext ctx) { var user = WebUtility.UrlDecode(ctx.Request.QueryString["user"]); - ctx.Response.Write("Hello, " + WebUtility.UrlEncode(user)); + ctx.Response.Write("Hello, " + WebUtility.UrlEncode(user)); // $ Alert=r1 $ Alert=r1 } public static void Good(HttpContext ctx) diff --git a/csharp/ql/test/query-tests/Security Features/CWE-838/InappropriateEncoding.cs b/csharp/ql/test/query-tests/Security Features/CWE-838/InappropriateEncoding.cs index 637988ddc84d..4896ed7c7ef6 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-838/InappropriateEncoding.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-838/InappropriateEncoding.cs @@ -10,12 +10,12 @@ public class InappropriateEncoding { public void Sql(string value) { - var encodedValue = Encode(value); + var encodedValue = Encode(value); // $ Source=r2 using (var connection = new SqlConnection("")) { var query1 = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + encodedValue + "' ORDER BY PRICE"; // BAD - var adapter = new SqlDataAdapter(query1, connection); + var adapter = new SqlDataAdapter(query1, connection); // $ Alert=r2 Alert=r3 var query2 = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY=@category ORDER BY PRICE"; // GOOD @@ -28,13 +28,13 @@ public void Sql(string value) public void Html(string value, Label label, System.Windows.Forms.HtmlElement html) { // BAD - label.Text = Encode(value); - label.Text = HttpUtility.UrlEncode(value); - label.Text = HttpUtility.UrlEncode(HttpUtility.HtmlEncode(value)); - var encodedValue = HttpUtility.UrlEncode(value); - html.SetAttribute("a", encodedValue); - label.Text = ""; - label.Text = string.Format("", encodedValue); + label.Text = Encode(value); // $ Alert=r4 Alert=r4 + label.Text = HttpUtility.UrlEncode(value); // $ Alert=r5 Alert=r5 + label.Text = HttpUtility.UrlEncode(HttpUtility.HtmlEncode(value)); // $ Alert=r6 Alert=r6 + var encodedValue = HttpUtility.UrlEncode(value); // $ Source=r7 Source=r8 Source=r9 + html.SetAttribute("a", encodedValue); // $ Alert=r7 Alert=r8 Alert=r9 + label.Text = ""; // $ Alert=r8 Alert=r7 Alert=r9 + label.Text = string.Format("", encodedValue); // $ Alert=r9 Alert=r7 Alert=r8 // GOOD label.Text = HttpUtility.HtmlEncode(value); @@ -52,8 +52,8 @@ public void Html(string value, Label label, System.Windows.Forms.HtmlElement htm public void Url(string value, HttpServerUtility util, HttpContext ctx) { // BAD - var encodedValue = HttpUtility.HtmlEncode(value); - ctx.Response.Redirect(encodedValue); + var encodedValue = HttpUtility.HtmlEncode(value); // $ Source=r10 + ctx.Response.Redirect(encodedValue); // $ Alert=r10 // GOOD ctx.Response.Redirect(HttpUtility.UrlEncode(encodedValue)); @@ -63,6 +63,6 @@ public void Url(string value, HttpServerUtility util, HttpContext ctx) static string Encode(string value) { - return value.Replace("\"", "\\\""); + return value.Replace("\"", "\\\""); // $ Source=r3 } } diff --git a/csharp/ql/test/query-tests/Security Features/CWE-838/InappropriateEncoding.qlref b/csharp/ql/test/query-tests/Security Features/CWE-838/InappropriateEncoding.qlref index d70d82f47195..99348351479a 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-838/InappropriateEncoding.qlref +++ b/csharp/ql/test/query-tests/Security Features/CWE-838/InappropriateEncoding.qlref @@ -1,2 +1,4 @@ query: Security Features/CWE-838/InappropriateEncoding.ql -postprocess: utils/test/PrettyPrintModels.ql +postprocess: + - utils/test/PrettyPrintModels.ql + - utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Security Features/CWE-838/SqlEncode.cs b/csharp/ql/test/query-tests/Security Features/CWE-838/SqlEncode.cs index dd3731cb1613..77cb8a4485dd 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-838/SqlEncode.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-838/SqlEncode.cs @@ -11,8 +11,8 @@ public static DataSet Bad(HttpContext ctx) var user = WebUtility.UrlDecode(ctx.Request.QueryString["user"]); using (var connection = new SqlConnection("")) { - var query = "select * from Users where Name='" + user.Replace("\"", "\"\"") + "'"; - var adapter = new SqlDataAdapter(query, connection); + var query = "select * from Users where Name='" + user.Replace("\"", "\"\"") + "'"; // $ Source=r11 + var adapter = new SqlDataAdapter(query, connection); // $ Alert=r11 var result = new DataSet(); adapter.Fill(result); return result; diff --git a/csharp/ql/test/query-tests/Security Features/CWE-838/UrlEncode.cs b/csharp/ql/test/query-tests/Security Features/CWE-838/UrlEncode.cs index c43ec2b675a8..a0576cd26a9c 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-838/UrlEncode.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-838/UrlEncode.cs @@ -7,7 +7,7 @@ public class UrlEncode public static void Bad(string value, HttpContext ctx) { var user = WebUtility.UrlDecode(ctx.Request.QueryString["user"]); - ctx.Response.Redirect("?param=" + WebUtility.HtmlEncode(user)); + ctx.Response.Redirect("?param=" + WebUtility.HtmlEncode(user)); // $ Alert=r12 $ Alert=r12 } public static void Good(string value, HttpContext ctx) diff --git a/csharp/ql/test/query-tests/Telemetry/LibraryUsage/ExternalLibraryUsage.qlref b/csharp/ql/test/query-tests/Telemetry/LibraryUsage/ExternalLibraryUsage.qlref index 98a6202f3eb5..918fe540c3bc 100644 --- a/csharp/ql/test/query-tests/Telemetry/LibraryUsage/ExternalLibraryUsage.qlref +++ b/csharp/ql/test/query-tests/Telemetry/LibraryUsage/ExternalLibraryUsage.qlref @@ -1 +1 @@ -Telemetry/ExternalLibraryUsage.ql +query: Telemetry/ExternalLibraryUsage.ql diff --git a/csharp/ql/test/query-tests/Telemetry/LibraryUsage/SupportedExternalTaint.qlref b/csharp/ql/test/query-tests/Telemetry/LibraryUsage/SupportedExternalTaint.qlref index ef9ddfadc00d..a8f8f4965efe 100644 --- a/csharp/ql/test/query-tests/Telemetry/LibraryUsage/SupportedExternalTaint.qlref +++ b/csharp/ql/test/query-tests/Telemetry/LibraryUsage/SupportedExternalTaint.qlref @@ -1 +1 @@ -Telemetry/SupportedExternalTaint.ql +query: Telemetry/SupportedExternalTaint.ql diff --git a/csharp/ql/test/query-tests/Telemetry/LibraryUsage/UnsupportedExternalAPIs.qlref b/csharp/ql/test/query-tests/Telemetry/LibraryUsage/UnsupportedExternalAPIs.qlref index b89f0a48e2e6..da704d4cbbe9 100644 --- a/csharp/ql/test/query-tests/Telemetry/LibraryUsage/UnsupportedExternalAPIs.qlref +++ b/csharp/ql/test/query-tests/Telemetry/LibraryUsage/UnsupportedExternalAPIs.qlref @@ -1 +1 @@ -Telemetry/UnsupportedExternalAPIs.ql +query: Telemetry/UnsupportedExternalAPIs.ql diff --git a/csharp/ql/test/query-tests/Telemetry/SupportedExternalApis/SupportedExternalApis.qlref b/csharp/ql/test/query-tests/Telemetry/SupportedExternalApis/SupportedExternalApis.qlref index 2e12499cf62b..f3e231b8a7aa 100644 --- a/csharp/ql/test/query-tests/Telemetry/SupportedExternalApis/SupportedExternalApis.qlref +++ b/csharp/ql/test/query-tests/Telemetry/SupportedExternalApis/SupportedExternalApis.qlref @@ -1 +1 @@ -Telemetry/SupportedExternalApis.ql +query: Telemetry/SupportedExternalApis.ql diff --git a/csharp/ql/test/query-tests/Telemetry/SupportedExternalSinks/SupportedExternalSinks.qlref b/csharp/ql/test/query-tests/Telemetry/SupportedExternalSinks/SupportedExternalSinks.qlref index e8bd57fad506..d454ef226b9d 100644 --- a/csharp/ql/test/query-tests/Telemetry/SupportedExternalSinks/SupportedExternalSinks.qlref +++ b/csharp/ql/test/query-tests/Telemetry/SupportedExternalSinks/SupportedExternalSinks.qlref @@ -1 +1 @@ -Telemetry/SupportedExternalSinks.ql \ No newline at end of file +query: Telemetry/SupportedExternalSinks.ql diff --git a/csharp/ql/test/query-tests/Telemetry/SupportedExternalSources/SupportedExternalSources.qlref b/csharp/ql/test/query-tests/Telemetry/SupportedExternalSources/SupportedExternalSources.qlref index c6819c7775f4..f6f3f1b972d1 100644 --- a/csharp/ql/test/query-tests/Telemetry/SupportedExternalSources/SupportedExternalSources.qlref +++ b/csharp/ql/test/query-tests/Telemetry/SupportedExternalSources/SupportedExternalSources.qlref @@ -1 +1 @@ -Telemetry/SupportedExternalSources.ql +query: Telemetry/SupportedExternalSources.ql diff --git a/csharp/ql/test/query-tests/UnusedPropertyValue/UnusedPropertyValue.cs b/csharp/ql/test/query-tests/UnusedPropertyValue/UnusedPropertyValue.cs index aabe43f2258d..36c79a9a1edc 100644 --- a/csharp/ql/test/query-tests/UnusedPropertyValue/UnusedPropertyValue.cs +++ b/csharp/ql/test/query-tests/UnusedPropertyValue/UnusedPropertyValue.cs @@ -6,12 +6,12 @@ class Program bool Prop1 { - set { x = true; } // BAD + set { x = true; } // $ Alert // BAD } bool Prop2 { - set { } // BAD + set { } // $ Alert // BAD } bool Prop3 @@ -55,7 +55,7 @@ class C3 : C2 { public bool Prop1 { - set { } // BAD: not override + set { } // $ Alert // BAD: not override } public override bool Prop2 diff --git a/csharp/ql/test/query-tests/UnusedPropertyValue/UnusedPropertyValue.qlref b/csharp/ql/test/query-tests/UnusedPropertyValue/UnusedPropertyValue.qlref index 199133fb534c..ca84e54c8278 100644 --- a/csharp/ql/test/query-tests/UnusedPropertyValue/UnusedPropertyValue.qlref +++ b/csharp/ql/test/query-tests/UnusedPropertyValue/UnusedPropertyValue.qlref @@ -1 +1,2 @@ -Language Abuse/UnusedPropertyValue.ql \ No newline at end of file +query: Language Abuse/UnusedPropertyValue.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/UseBraces/UseBraces.cs b/csharp/ql/test/query-tests/UseBraces/UseBraces.cs index c6036255062d..99d7c1b5ae6d 100644 --- a/csharp/ql/test/query-tests/UseBraces/UseBraces.cs +++ b/csharp/ql/test/query-tests/UseBraces/UseBraces.cs @@ -29,7 +29,7 @@ static void Main(string[] args) g(); // BAD if (1 == 1) - f(); g(); // BAD + f(); g(); // $ Alert // BAD // If-then-else statement @@ -63,7 +63,7 @@ static void Main(string[] args) f(); } else - f(); g(); // BAD + f(); g(); // $ Alert // BAD // While statement @@ -83,7 +83,7 @@ static void Main(string[] args) g(); // GOOD while (x > 1) - f(); g(); // BAD + f(); g(); // $ Alert // BAD while (x > 1) if (x != null) x = 1; @@ -111,7 +111,7 @@ static void Main(string[] args) g(); // BAD for (int i = 0; i < 10; ++i) - f(); g(); // BAD + f(); g(); // $ Alert // BAD // Foreach statement @@ -130,7 +130,7 @@ static void Main(string[] args) g(); // BAD foreach (var b in branches) - f(); g(); // BAD + f(); g(); // $ Alert // BAD // Nested ifs if (x > 1) diff --git a/csharp/ql/test/query-tests/UseBraces/UseBraces.qlref b/csharp/ql/test/query-tests/UseBraces/UseBraces.qlref index 5d1d4a063882..e89389461d72 100644 --- a/csharp/ql/test/query-tests/UseBraces/UseBraces.qlref +++ b/csharp/ql/test/query-tests/UseBraces/UseBraces.qlref @@ -1 +1,2 @@ -Likely Bugs/Statements/UseBraces.ql +query: Likely Bugs/Statements/UseBraces.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/Useless Code/PointlessForwardingMethod/PointlessForwardingMethod.cs b/csharp/ql/test/query-tests/Useless Code/PointlessForwardingMethod/PointlessForwardingMethod.cs index 096372e40985..04a2b3b68cad 100644 --- a/csharp/ql/test/query-tests/Useless Code/PointlessForwardingMethod/PointlessForwardingMethod.cs +++ b/csharp/ql/test/query-tests/Useless Code/PointlessForwardingMethod/PointlessForwardingMethod.cs @@ -8,7 +8,7 @@ class C : I public void f(int x) { } // BAD: This method is a forwarder - public void f() + public void f() // $ Alert { f(1); } @@ -38,7 +38,7 @@ void h() { } void i() { } // BAD: Forwarding method - void i(int a) + void i(int a) // $ Alert { i(); } diff --git a/csharp/ql/test/query-tests/Useless Code/PointlessForwardingMethod/PointlessForwardingMethod.qlref b/csharp/ql/test/query-tests/Useless Code/PointlessForwardingMethod/PointlessForwardingMethod.qlref index 2e42cbc75022..435314fa3738 100644 --- a/csharp/ql/test/query-tests/Useless Code/PointlessForwardingMethod/PointlessForwardingMethod.qlref +++ b/csharp/ql/test/query-tests/Useless Code/PointlessForwardingMethod/PointlessForwardingMethod.qlref @@ -1 +1,2 @@ -Useless code/PointlessForwardingMethod.ql +query: Useless code/PointlessForwardingMethod.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/WriteOnlyContainer/WriteOnlyContainer.cs b/csharp/ql/test/query-tests/WriteOnlyContainer/WriteOnlyContainer.cs index 6d870cad08bf..81360515922f 100644 --- a/csharp/ql/test/query-tests/WriteOnlyContainer/WriteOnlyContainer.cs +++ b/csharp/ql/test/query-tests/WriteOnlyContainer/WriteOnlyContainer.cs @@ -7,7 +7,7 @@ public class ContainerTest // Test 1: Variable scopes // Test 1a: Private field - private IList c1a = new List { 1, 2 }; // BAD: private + private IList c1a = new List { 1, 2 }; // $ Alert // BAD: private // Test 1b: protected field protected IList c1b = new List { 1, 2 }; // GOOD: protected @@ -16,7 +16,7 @@ public class ContainerTest public IList c1c = new List { 1, 2 }; // GOOD: public // Test 1d: internal field - internal IList c1d = new List { 1, 2 }; // BAD: internal + internal IList c1d = new List { 1, 2 }; // $ Alert // BAD: internal void TestScopes() { @@ -26,7 +26,7 @@ void TestScopes() c1d.Add(4); // Test 1e: Local variable - IList c1e = new List { 1, 2 }; // BAD: local + IList c1e = new List { 1, 2 }; // $ Alert // BAD: local c1e.Add(5); } @@ -35,7 +35,7 @@ void TestScopes() void TestMethodNames() { // Test 2a: Writeonly method names - IList c2a = new List { 1, 2 }; // BAD: writeonly methods + IList c2a = new List { 1, 2 }; // $ Alert // BAD: writeonly methods c2a.Add(1); c2a.Clear(); c2a.Insert(1, 2); @@ -47,14 +47,14 @@ void TestMethodNames() bool b = c2b.Contains(1); // Test 2c: Other method names - var c2c = new Stack(); // BAD + var c2c = new Stack(); // $ Alert // BAD c2c.Push(1); - var c2d = new BitArray(10); // BAD + var c2d = new BitArray(10); // $ Alert // BAD c2d.Set(1, true); c2d.SetAll(false); - var c2j = new LinkedList(); // BAD + var c2j = new LinkedList(); // $ Alert // BAD c2j.AddFirst(1); c2j.AddLast(2); c2j.RemoveFirst(); @@ -100,7 +100,7 @@ IList this[int i] void TestAccessTypes() { // 3a: Unused - IList c3a = new List { 4, 5 }; // BAD + IList c3a = new List { 4, 5 }; // $ Alert // BAD // 3b: Pass to function IList c3b = new List { }; // GOOD: used @@ -115,7 +115,7 @@ void TestAccessTypes() // Test 4: Initialization type - private IList c4a; // BAD: even though uninitialized + private IList c4a; // $ Alert // BAD: even though uninitialized void TestInitializationTypes() { @@ -123,11 +123,11 @@ void TestInitializationTypes() c4a.Add(1); // Test 4b: Constructed from new - var c4b = new List(); // BAD + var c4b = new List(); // $ Alert // BAD c4b.Add(1); // Test 4c: List initialized - var c4c = new List { 2, 3, 4 }; // BAD + var c4c = new List { 2, 3, 4 }; // $ Alert // BAD c4c.Add(1); // Test 4d: Constructed from other expression @@ -147,7 +147,7 @@ void TestInitializationTypes() void TestAssignment() { // Assigned from new container - IList c5a; // BAD + IList c5a; // $ Alert // BAD c5a = new List(); c5a.Add(1); @@ -162,7 +162,7 @@ void TestAssignment() c5d = c5c; // Assigned in an expression somewhere - IList c5e = new List(); // BAD: assigned in expr + IList c5e = new List(); // $ Alert // BAD: assigned in expr for (int i = 0; i < 10; c5e = new List(), ++i) c5e.Add(1); @@ -183,67 +183,67 @@ void TestCollections() var c6a = new NonCollection(); // GOOD: not a collection c6a.Add(1); - var c6b = new ArrayList(); // BAD + var c6b = new ArrayList(); // $ Alert // BAD c6b.Add(1); - var c6c = new BitArray(32); // BAD + var c6c = new BitArray(32); // $ Alert // BAD c6c.SetAll(true); - var c6d = new Hashtable(); // BAD + var c6d = new Hashtable(); // $ Alert // BAD c6d.Add(1, 2); - var c6e = new Queue(); // BAD + var c6e = new Queue(); // $ Alert // BAD c6e.Enqueue(1); - var c6f = new SortedList(); // BAD + var c6f = new SortedList(); // $ Alert // BAD c6f.Add(1, 2); - var c6g = new Stack(); // BAD + var c6g = new Stack(); // $ Alert // BAD c6g.Push(1); - var c6h = new Dictionary(); // BAD + var c6h = new Dictionary(); // $ Alert // BAD c6h.Add(1, 2); - var c6i = new HashSet(); // BAD + var c6i = new HashSet(); // $ Alert // BAD c6i.Add(1); - var c6j = new LinkedList(); // BAD + var c6j = new LinkedList(); // $ Alert // BAD c6j.AddFirst(1); - var c6k = new List(); // BAD + var c6k = new List(); // $ Alert // BAD c6k.Add(1); - var c6l = new Queue(); // BAD + var c6l = new Queue(); // $ Alert // BAD c6l.Enqueue(1); - var c6m = new SortedDictionary(); // BAD + var c6m = new SortedDictionary(); // $ Alert // BAD c6m.Add(1, 2); - var c6n = new SortedList(); // BAD + var c6n = new SortedList(); // $ Alert // BAD c6n.Add(1, 2); - var c6o = new SortedDictionary(); // BAD + var c6o = new SortedDictionary(); // $ Alert // BAD c6o.Add(1, 2); - var c6p = new SortedSet(); // BAD + var c6p = new SortedSet(); // $ Alert // BAD c6p.Add(1); - var c6q = new Stack(); // BAD + var c6q = new Stack(); // $ Alert // BAD c6q.Push(1); - ICollection c6u = new List(); // BAD + ICollection c6u = new List(); // $ Alert // BAD c6u.Add(1); - IDictionary c6v = new Dictionary(); // BAD + IDictionary c6v = new Dictionary(); // $ Alert // BAD c6v.Add(1, 2); IEnumerable c6w = new List(); // GOOD c6w.GetEnumerator(); - IList c6x = new List(); // BAD + IList c6x = new List(); // $ Alert // BAD c6x.Add(12); - ISet c6y = new HashSet(); // BAD + ISet c6y = new HashSet(); // $ Alert // BAD c6y.Add(1); } @@ -264,7 +264,7 @@ void TestDynamicAccess() t.InvokeMember("Add", System.Reflection.BindingFlags.InvokeMethod, null, c7c, new Object[] { 1 }); } - IList c8a = new List(); // BAD: no attribute + IList c8a = new List(); // $ Alert // BAD: no attribute [Obsolete()] IList c8b = new List(); // GOOD: has attribute diff --git a/csharp/ql/test/query-tests/WriteOnlyContainer/WriteOnlyContainer.qlref b/csharp/ql/test/query-tests/WriteOnlyContainer/WriteOnlyContainer.qlref index ddd3e9fb1cb8..9d2057a3d375 100644 --- a/csharp/ql/test/query-tests/WriteOnlyContainer/WriteOnlyContainer.qlref +++ b/csharp/ql/test/query-tests/WriteOnlyContainer/WriteOnlyContainer.qlref @@ -1 +1,2 @@ -Likely Bugs/Collections/WriteOnlyContainer.ql +query: Likely Bugs/Collections/WriteOnlyContainer.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/standalone/Likely Bugs/IncomparableEquals/IncomparableEquals.cs b/csharp/ql/test/query-tests/standalone/Likely Bugs/IncomparableEquals/IncomparableEquals.cs index 1b550cacf8ac..a4541e2ba24d 100644 --- a/csharp/ql/test/query-tests/standalone/Likely Bugs/IncomparableEquals/IncomparableEquals.cs +++ b/csharp/ql/test/query-tests/standalone/Likely Bugs/IncomparableEquals/IncomparableEquals.cs @@ -3,9 +3,9 @@ class Test static void Main(string[] args) { // BAD - c3.Equals(c4); - c2.Equals(c3); - c7.Equals(c6); + c3.Equals(c4); // $ Alert + c2.Equals(c3); // $ Alert + c7.Equals(c6); // $ Alert // GOOD c1.Equals(c2); diff --git a/csharp/ql/test/query-tests/standalone/Likely Bugs/IncomparableEquals/IncomparableEquals.qlref b/csharp/ql/test/query-tests/standalone/Likely Bugs/IncomparableEquals/IncomparableEquals.qlref index 96eae4e2eac5..91b47c6ddd94 100644 --- a/csharp/ql/test/query-tests/standalone/Likely Bugs/IncomparableEquals/IncomparableEquals.qlref +++ b/csharp/ql/test/query-tests/standalone/Likely Bugs/IncomparableEquals/IncomparableEquals.qlref @@ -1 +1,2 @@ -Likely Bugs/IncomparableEquals.ql \ No newline at end of file +query: Likely Bugs/IncomparableEquals.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/query-tests/standalone/Likely Bugs/ObjectComparison/ObjectComparison.cs b/csharp/ql/test/query-tests/standalone/Likely Bugs/ObjectComparison/ObjectComparison.cs index f717fe662c6b..756b667a055d 100644 --- a/csharp/ql/test/query-tests/standalone/Likely Bugs/ObjectComparison/ObjectComparison.cs +++ b/csharp/ql/test/query-tests/standalone/Likely Bugs/ObjectComparison/ObjectComparison.cs @@ -14,9 +14,9 @@ void test() result = (object)unknownValue = someValue; // BAD: Explicit cast - result = (object)unknownValue == (object)someValue; + result = (object)unknownValue == (object)someValue; // $ Alert // BAD: Type information known - result = this == (object)this; + result = this == (object)this; // $ Alert } } diff --git a/csharp/ql/test/query-tests/standalone/Likely Bugs/ObjectComparison/ObjectComparison.qlref b/csharp/ql/test/query-tests/standalone/Likely Bugs/ObjectComparison/ObjectComparison.qlref index 6f834d6d6548..e47228487204 100644 --- a/csharp/ql/test/query-tests/standalone/Likely Bugs/ObjectComparison/ObjectComparison.qlref +++ b/csharp/ql/test/query-tests/standalone/Likely Bugs/ObjectComparison/ObjectComparison.qlref @@ -1 +1,2 @@ -Likely Bugs/ObjectComparison.ql \ No newline at end of file +query: Likely Bugs/ObjectComparison.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql diff --git a/csharp/ql/test/utils/modeleditor/ApplicationModeEndpoints.qlref b/csharp/ql/test/utils/modeleditor/ApplicationModeEndpoints.qlref index 4787fa5d4b2e..1255164237c6 100644 --- a/csharp/ql/test/utils/modeleditor/ApplicationModeEndpoints.qlref +++ b/csharp/ql/test/utils/modeleditor/ApplicationModeEndpoints.qlref @@ -1 +1 @@ -utils/modeleditor/ApplicationModeEndpoints.ql \ No newline at end of file +query: utils/modeleditor/ApplicationModeEndpoints.ql diff --git a/csharp/ql/test/utils/modeleditor/FrameworkModeEndpoints.qlref b/csharp/ql/test/utils/modeleditor/FrameworkModeEndpoints.qlref index 5ae87455edd6..ec216021687b 100644 --- a/csharp/ql/test/utils/modeleditor/FrameworkModeEndpoints.qlref +++ b/csharp/ql/test/utils/modeleditor/FrameworkModeEndpoints.qlref @@ -1 +1 @@ -utils/modeleditor/FrameworkModeEndpoints.ql \ No newline at end of file +query: utils/modeleditor/FrameworkModeEndpoints.ql From f67b7299f9bebafa469e4b9b87ea2eb00849e724 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Mon, 6 Jul 2026 14:37:46 +0100 Subject: [PATCH 28/44] Update query example (synced file) --- .../ql/src/Security Features/CWE-020/RuntimeChecksBypassBad.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/csharp/ql/src/Security Features/CWE-020/RuntimeChecksBypassBad.cs b/csharp/ql/src/Security Features/CWE-020/RuntimeChecksBypassBad.cs index 8777e35874a2..c41bbf776b10 100644 --- a/csharp/ql/src/Security Features/CWE-020/RuntimeChecksBypassBad.cs +++ b/csharp/ql/src/Security Features/CWE-020/RuntimeChecksBypassBad.cs @@ -16,6 +16,6 @@ public PersonBad(int age) [OnDeserializing] void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context) { - Age = info.GetInt32("age"); // $ Alert // BAD - write is unsafe + Age = info.GetInt32("age"); // $ Alert[cs/serialization-check-bypass] // BAD - write is unsafe } } From 117a0bb87e5efaa4c9aa2ae0258af9c2a9ed3dad Mon Sep 17 00:00:00 2001 From: Geoffrey White <40627776+geoffw0@users.noreply.github.com> Date: Tue, 7 Jul 2026 15:30:41 +0100 Subject: [PATCH 29/44] Copilot fix for missing module pygments - regenerating the lockfile fully. --- misc/codegen/requirements_lock.txt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/misc/codegen/requirements_lock.txt b/misc/codegen/requirements_lock.txt index 7a2021a364a9..46ff281c3083 100644 --- a/misc/codegen/requirements_lock.txt +++ b/misc/codegen/requirements_lock.txt @@ -12,9 +12,11 @@ packaging==24.2 # via pytest pluggy==1.5.0 # via pytest +pygments==2.20.0 + # via pytest pystache==0.6.8 # via -r misc/codegen/requirements_in.txt -pytest==9.0.3 +pytest==9.1.1 # via -r misc/codegen/requirements_in.txt pyyaml==6.0.2 # via -r misc/codegen/requirements_in.txt From 9d9590623d120b4534234e21f6b8c1b2fe14c440 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 7 Jul 2026 20:32:49 +0100 Subject: [PATCH 30/44] Address review comments --- .../CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp | 6 +++--- .../CWE/CWE-190/AllocMultiplicationOverflow/test.cpp | 2 +- .../query-tests/Security/CWE/CWE-295/CurlSSL.cpp | 7 +++---- .../CommaBeforeMisleadingIndentation/test.cpp | 2 +- .../Best Practices/Unused Entities/UnusedLocals/code2.cpp | 4 ++-- .../Format/WrongNumberOfFormatArguments/syntax_errors.c | 2 +- .../Linux_signed_chars/pri_macros.h | 2 +- .../Linux_unsigned_chars/pri_macros.h | 2 +- .../WrongTypeFormatArguments/Microsoft/pri_macros.h | 2 +- .../Microsoft_no_wchar/pri_macros.h | 2 +- .../CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp | 8 ++++---- .../Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp | 4 ++-- 12 files changed, 21 insertions(+), 22 deletions(-) diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp index 287e1c674495..e03aa656db1d 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp @@ -19,7 +19,7 @@ void test1(int p) { sys_somesystemcall(&p); - unsafe_put_user(123, &p); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED] + unsafe_put_user(123, &p); // $ MISSING: Alert // BAD [NOT DETECTED] } void test2(int p) @@ -40,7 +40,7 @@ void test3() sys_somesystemcall(&v); - unsafe_put_user(123, &v); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED] + unsafe_put_user(123, &v); // $ MISSING: Alert // BAD [NOT DETECTED] } void test4() @@ -68,7 +68,7 @@ void test5() sys_somesystemcall(&myData); - unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED] + unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // BAD [NOT DETECTED] } void test6() diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp index 8065679ec2d2..6d16f5a0281b 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp @@ -24,7 +24,7 @@ void test() size_t size2 = x; size2 *= y; - char *buffer6 = (char *)malloc(size2); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED] + char *buffer6 = (char *)malloc(size2); // $ MISSING: Alert // BAD [NOT DETECTED] char *buffer7 = new char[x * 10]; // GOOD char *buffer8 = new char[x * y]; // $ Alert // BAD diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp index 451ce5423e64..aa04e798efe1 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-295/CurlSSL.cpp @@ -7,7 +7,7 @@ namespace std{ CURLOPT_URL, CURLOPT_SSL_VERIFYHOST, CURLOPT_SSL_VERIFYPEER - }; + }; CURL *curl_easy_init(); void curl_easy_cleanup(CURL *handle); @@ -23,7 +23,7 @@ char host[] = "codeql.com"; void bad(void) { std::unique_ptr curl = std::unique_ptr(curl_easy_init()); curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); // $ Alert - curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); // $ Alert + curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0); // $ Alert curl_easy_setopt(curl.get(), CURLOPT_URL, host); curl_easy_perform(curl.get()); } @@ -31,7 +31,7 @@ void bad(void) { void good(void) { std::unique_ptr curl = std::unique_ptr(curl_easy_init()); curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 2); - curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 2); + curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 2); curl_easy_setopt(curl.get(), CURLOPT_URL, host); curl_easy_perform(curl.get()); } @@ -40,4 +40,3 @@ int main(int c, char** argv){ bad(); good(); } - diff --git a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp index eaf539c5c8fd..1780a5d92e74 100644 --- a/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Likely Errors/CommaBeforeMisleadingIndentation/test.cpp @@ -175,7 +175,7 @@ int Foo::test(int (*baz)(int)) return i++ , i++ // GOOD(?) [FALSE POSITIVE] -- can't exclude w/o source code text :/ ? 1 - : 2; // $ Alert + : 2; // $ SPURIOUS: Alert int quux = (tata->titi.tutu(), diff --git a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp index 98a77d4d40be..b0e00dc8fbe1 100644 --- a/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp +++ b/cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp @@ -6,7 +6,7 @@ int test_const_init() int v2; // GOOD int v3 = 0; // $ Alert // BAD: unused int v4 = 0; // GOOD - const int v5 = 0; // BAD: unused [NOT DETECTED] + const int v5 = 0; // $ MISSING: Alert // BAD: unused [NOT DETECTED] const int v6 = 0; // GOOD constexpr int v7 = 0; // $ Alert // BAD: unused constexpr int v8 = 0; // GOOD @@ -126,7 +126,7 @@ int test_lambdas1() int test_lambdas2() { int a, b; // $ Alert // BAD: b is not used - auto myLambda = [=]() -> int // BAD: myLambda is not used [NOT DETECTED] (due to containing a Constructor) + auto myLambda = [=]() -> int // $ MISSING: Alert // BAD: myLambda is not used [NOT DETECTED] (due to containing a Constructor) { return a; }; diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/syntax_errors.c b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/syntax_errors.c index df4cd972f502..c77ffd813189 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/syntax_errors.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/syntax_errors.c @@ -12,7 +12,7 @@ void test_syntax_error() { (UNDEFINED_MACRO)2); // GOOD [FALSE POSITIVE] - printf("%d%d" // $ Alert[cpp/wrong-number-format-arguments] + printf("%d%d" // $ SPURIOUS: Alert[cpp/wrong-number-format-arguments] UNDEFINED_MACRO, 1, 2); } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/pri_macros.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/pri_macros.h index 36c1dc4206a9..2e49f6c263a1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/pri_macros.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/pri_macros.h @@ -11,6 +11,6 @@ void test_PRI_macros() { printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD - printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED] + printf("my_u64 = %" PRIi64 "\n", my_u64); // $ MISSING: Alert // BAD: uint64_t read as int64_t [NOT DETECTED] printf("my_u64 = %" PRIu32 "\n", my_u64); // $ Alert // BAD: uint64_t read as uint32_t } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/pri_macros.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/pri_macros.h index 36c1dc4206a9..2e49f6c263a1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/pri_macros.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/pri_macros.h @@ -11,6 +11,6 @@ void test_PRI_macros() { printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD - printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED] + printf("my_u64 = %" PRIi64 "\n", my_u64); // $ MISSING: Alert // BAD: uint64_t read as int64_t [NOT DETECTED] printf("my_u64 = %" PRIu32 "\n", my_u64); // $ Alert // BAD: uint64_t read as uint32_t } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/pri_macros.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/pri_macros.h index 36c1dc4206a9..2e49f6c263a1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/pri_macros.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/pri_macros.h @@ -11,6 +11,6 @@ void test_PRI_macros() { printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD - printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED] + printf("my_u64 = %" PRIi64 "\n", my_u64); // $ MISSING: Alert // BAD: uint64_t read as int64_t [NOT DETECTED] printf("my_u64 = %" PRIu32 "\n", my_u64); // $ Alert // BAD: uint64_t read as uint32_t } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/pri_macros.h b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/pri_macros.h index 36c1dc4206a9..2e49f6c263a1 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/pri_macros.h +++ b/cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/pri_macros.h @@ -11,6 +11,6 @@ void test_PRI_macros() { printf("my_u64 = %" PRIu64 "\n", my_u64); // GOOD printf("my_u64 = %" PRIx64 "\n", my_u64); // GOOD - printf("my_u64 = %" PRIi64 "\n", my_u64); // BAD: uint64_t read as int64_t [NOT DETECTED] + printf("my_u64 = %" PRIi64 "\n", my_u64); // $ MISSING: Alert // BAD: uint64_t read as int64_t [NOT DETECTED] printf("my_u64 = %" PRIu32 "\n", my_u64); // $ Alert // BAD: uint64_t read as uint32_t } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp index 7efaa43ab3be..0a8fc647ff5c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp @@ -39,8 +39,8 @@ namespace std //// Test code ///// static void bad1(char *str) { - // $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED] - char *buffer = (char *)malloc(strlen(str)); + // BAD -- Not allocating space for '\0' terminator [NOT DETECTED] + char *buffer = (char *)malloc(strlen(str)); // $ MISSING: Alert std::string str2(buffer); free(buffer); } @@ -53,8 +53,8 @@ static void good1(char *str) { } static void bad2(wchar_t *str) { - // $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED] - wchar_t *buffer = (wchar_t *)calloc(wcslen(str), sizeof(wchar_t)); + // BAD -- Not allocating space for '\0' terminator [NOT DETECTED] + wchar_t *buffer = (wchar_t *)calloc(wcslen(str), sizeof(wchar_t)); // $ MISSING: Alert wcscpy(buffer, str); free(buffer); } diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp index 8df97d9afd37..dab883ae3c06 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp @@ -35,10 +35,10 @@ void processRequest() adminPrivileges = 0; // OK, since it's a 0 and not a 1 } - // $ MISSING: Alert // BAD (requires pointer analysis to catch) [NOT DETECTED] + // BAD (requires pointer analysis to catch) [NOT DETECTED] const char** userp = ¤tUser; *userp = userName; - if (!strcmp(currentUser, "admin")) { + if (!strcmp(currentUser, "admin")) { // $ MISSING: Alert adminPrivileges = 1; } } From 19745e13b502c9b690b7d004af01153aac29a4c6 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Tue, 7 Jul 2026 20:42:18 +0100 Subject: [PATCH 31/44] Fix some lines with `// $ ... // $ MISSING:` Note that when a line is marked `// BAD [NOT DETECTED]` but actually has an alert, I assume that the `[NOT DETECTED]` is outdated and should be deleted. --- .../Critical/MemoryFreed/test_free.cpp | 2 +- .../StrncpyFlippedArgs/test.cpp | 2 +- .../query-tests/Security/CWE/CWE-193/test.cpp | 16 ++++++++-------- .../CWE-416/semmle/tests/UseAfterFree/test.cpp | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp index 75ecfcf3d6d6..894a3d4d90f0 100644 --- a/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp +++ b/cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp @@ -41,7 +41,7 @@ void test_post_dominance1(int *a) { if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] if (condition()) a[2] = 5; // $ MISSING: Alert // BAD [NOT DETECTED] - if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] // $ MISSING: Alert // BAD [NOT DETECTED] + if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] MISSING: Alert // BAD [NOT DETECTED] a[2] = 5; // $ Alert[cpp/use-after-free] // BAD free(a); // $ Alert[cpp/double-free] // BAD } diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp index 5cc20a6b70ba..b6c55a4617b2 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp @@ -34,7 +34,7 @@ void test2() wcsncpy(buf1, str, wcslen(str)); // $ Alert // BAD wcsncpy(buf1, str, wcslen(str) + 1); // $ Alert // BAD wcsncpy(buf1, buf2, sizeof(buf2)); // $ Alert // BAD - wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // $ Alert // $ MISSING: Alert // BAD [NOT DETECTED] + wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // $ Alert // BAD } void test3() diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp index 586c3abd6c18..a884701a8764 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp @@ -39,9 +39,9 @@ void test3(int size) { void test4(int size) { char* p = (char*)malloc(size - 1); char* q = p + (size - 1); // $ MISSING: alloc=L40-1 - char a = *q; // $ MISSING: deref=L42 // $ MISSING: Alert // BAD [NOT DETECTED] + char a = *q; // $ MISSING: deref=L42 Alert // BAD [NOT DETECTED] char b = *(q - 1); // GOOD - char c = *(q + 1); // $ MISSING: deref=L44+1 // $ MISSING: Alert // BAD [NOT DETECTED] + char c = *(q + 1); // $ MISSING: deref=L44+1 Alert // BAD [NOT DETECTED] char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED] char e = *(q - size); // GOOD char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED] @@ -93,7 +93,7 @@ void test6(int size) { } for (char* p = arr.begin; p <= arr.end; ++p) { - *p = 0; // $ MISSING: deref=L83->L91->L96 deref=L83->L95->L96 // $ MISSING: Alert // BAD [NOT DETECTED] + *p = 0; // $ MISSING: deref=L83->L91->L96 deref=L83->L95->L96 Alert // BAD [NOT DETECTED] } for (char* p = arr.begin; p < arr.end; ++p) { @@ -107,7 +107,7 @@ void test7_callee(array_t arr) { } for (char* p = arr.begin; p <= arr.end; ++p) { - *p = 0; // $ MISSING: deref=L83->L105->L110 deref=L83->L109->L110 // $ MISSING: Alert // BAD [NOT DETECTED] + *p = 0; // $ MISSING: deref=L83->L105->L110 deref=L83->L109->L110 Alert // BAD [NOT DETECTED] } for (char* p = arr.begin; p < arr.end; ++p) { @@ -154,7 +154,7 @@ void test9(int size) { } for (char* p = arr->begin; p <= arr->end; ++p) { - *p = 0; // $ MISSING: deref=L144->L156->L157 // $ MISSING: Alert // BAD [NOT DETECTED] + *p = 0; // $ MISSING: deref=L144->L156->L157 Alert // BAD [NOT DETECTED] } for (char* p = arr->begin; p < arr->end; ++p) { @@ -168,7 +168,7 @@ void test10_callee(array_t *arr) { } for (char* p = arr->begin; p <= arr->end; ++p) { - *p = 0; // $ MISSING: deref=L144->L166->L171 deref=L144->L170->L171 // $ MISSING: Alert // BAD [NOT DETECTED] + *p = 0; // $ MISSING: deref=L144->L166->L171 deref=L144->L170->L171 Alert // BAD [NOT DETECTED] } for (char* p = arr->begin; p < arr->end; ++p) { @@ -198,7 +198,7 @@ void test12(unsigned len, unsigned index) { return; } - p[index] = '\0'; // $ MISSING: deref=L195->L201 // $ MISSING: Alert // BAD [NOT DETECTED] + p[index] = '\0'; // $ MISSING: deref=L195->L201 Alert // BAD [NOT DETECTED] } void test13(unsigned len, unsigned index) { @@ -703,7 +703,7 @@ void test34(unsigned size) { } void deref(char* q) { - char x = *q; // $ MISSING: deref=L714->L705->L706 // $ MISSING: Alert // BAD [NOT DETECTED] + char x = *q; // $ MISSING: deref=L714->L705->L706 Alert // BAD [NOT DETECTED] } void test35(size_t size, char* q) diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp index da0371dfe25a..5ada39f673e7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp @@ -214,7 +214,7 @@ template T test15() T* x; use(x); // GOOD delete x; // $ Source - use(x); // $ Alert // $ MISSING: Alert // BAD [NOT DETECTED] + use(x); // $ Alert // BAD } void test15runner(void) { From 1db31327a74ea716e578cec72e0dcbc7f7393911 Mon Sep 17 00:00:00 2001 From: Luis Azanza Date: Tue, 7 Jul 2026 13:30:48 -0700 Subject: [PATCH 32/44] Java: Model Spring reactive `WebClient.uri` as a request forgery sink --- .../2026-06-30-spring-webclient-uri-ssrf.md | 4 + ...ork.web.reactive.function.client.model.yml | 2 + .../CWE-918/ReactiveWebClientSSRF.java | 23 + .../security/CWE-918/RequestForgery.expected | 693 +++++++++--------- .../reactive/function/client/WebClient.java | 1 + 5 files changed, 383 insertions(+), 340 deletions(-) create mode 100644 java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md diff --git a/java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md b/java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md new file mode 100644 index 000000000000..f35a3386e728 --- /dev/null +++ b/java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The `uri` method of Spring's reactive `WebClient` is now considered a request forgery sink. Previously only the `create` and `baseUrl` methods were considered. This may lead to more alerts for the query `java/ssrf` (Server-side request forgery). diff --git a/java/ql/lib/ext/org.springframework.web.reactive.function.client.model.yml b/java/ql/lib/ext/org.springframework.web.reactive.function.client.model.yml index a76582b5e807..263ffbaa0b23 100644 --- a/java/ql/lib/ext/org.springframework.web.reactive.function.client.model.yml +++ b/java/ql/lib/ext/org.springframework.web.reactive.function.client.model.yml @@ -1,3 +1,4 @@ +# Copyright © 2026 Apple Inc. extensions: - addsTo: pack: codeql/java-all @@ -5,3 +6,4 @@ extensions: data: - ["org.springframework.web.reactive.function.client", "WebClient", False, "create", "", "", "Argument[0]", "request-forgery", "manual"] - ["org.springframework.web.reactive.function.client", "WebClient$Builder", False, "baseUrl", "", "", "Argument[0]", "request-forgery", "manual"] + - ["org.springframework.web.reactive.function.client", "WebClient$UriSpec", True, "uri", "", "", "Argument[0]", "request-forgery", "manual"] diff --git a/java/ql/test/query-tests/security/CWE-918/ReactiveWebClientSSRF.java b/java/ql/test/query-tests/security/CWE-918/ReactiveWebClientSSRF.java index e7e350b054af..31667b22a8d6 100644 --- a/java/ql/test/query-tests/security/CWE-918/ReactiveWebClientSSRF.java +++ b/java/ql/test/query-tests/security/CWE-918/ReactiveWebClientSSRF.java @@ -46,4 +46,27 @@ protected void doPost(HttpServletRequest request, HttpServletResponse response) // Ignore } } + + protected void doPut(HttpServletRequest request, HttpServletResponse response) + throws ServletException, IOException { + try { + WebClient webClient = WebClient.create("https://example.com"); + + String p = request.getParameter("uri"); // $ Source + webClient.get() + .uri(p) // $ Alert + .retrieve() + .bodyToMono(String.class) + .block(); + + String p2 = request.getParameter("uri"); // $ Source + webClient.get() + .uri(java.net.URI.create("https://example.com" + p2)) // $ Alert + .retrieve() + .bodyToMono(String.class) + .block(); + } catch (Exception e) { + // Ignore + } + } } diff --git a/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected b/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected index 1a36fba94c72..cd1481bcd440 100644 --- a/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected +++ b/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected @@ -237,6 +237,8 @@ | JdbcUrlSSRF.java:88:19:88:25 | jdbcUrl | JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:88:19:88:25 | jdbcUrl | Potential server-side request forgery due to a $@. | JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) | user-provided value | | ReactiveWebClientSSRF.java:16:52:16:54 | url | ReactiveWebClientSSRF.java:15:26:15:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:16:52:16:54 | url | Potential server-side request forgery due to a $@. | ReactiveWebClientSSRF.java:15:26:15:52 | getParameter(...) | user-provided value | | ReactiveWebClientSSRF.java:35:30:35:32 | url | ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:35:30:35:32 | url | Potential server-side request forgery due to a $@. | ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) | user-provided value | +| ReactiveWebClientSSRF.java:57:26:57:26 | p | ReactiveWebClientSSRF.java:55:24:55:50 | getParameter(...) : String | ReactiveWebClientSSRF.java:57:26:57:26 | p | Potential server-side request forgery due to a $@. | ReactiveWebClientSSRF.java:55:24:55:50 | getParameter(...) | user-provided value | +| ReactiveWebClientSSRF.java:64:26:64:72 | create(...) | ReactiveWebClientSSRF.java:62:25:62:51 | getParameter(...) : String | ReactiveWebClientSSRF.java:64:26:64:72 | create(...) | Potential server-side request forgery due to a $@. | ReactiveWebClientSSRF.java:62:25:62:51 | getParameter(...) | user-provided value | | SanitizationTests.java:25:52:25:54 | uri | SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:25:52:25:54 | uri | Potential server-side request forgery due to a $@. | SanitizationTests.java:22:31:22:57 | getParameter(...) | user-provided value | | SanitizationTests.java:26:25:26:25 | r | SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:26:25:26:25 | r | Potential server-side request forgery due to a $@. | SanitizationTests.java:22:31:22:57 | getParameter(...) | user-provided value | | SanitizationTests.java:79:59:79:77 | new URI(...) | SanitizationTests.java:78:33:78:63 | getParameter(...) : String | SanitizationTests.java:79:59:79:77 | new URI(...) | Potential server-side request forgery due to a $@. | SanitizationTests.java:78:33:78:63 | getParameter(...) | user-provided value | @@ -386,21 +388,21 @@ | mad/Test.java:107:15:107:31 | (...)... | mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:107:15:107:31 | (...)... | Potential server-side request forgery due to a $@. | mad/Test.java:26:16:26:41 | getParameter(...) | user-provided value | | mad/Test.java:112:15:112:31 | (...)... | mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:112:15:112:31 | (...)... | Potential server-side request forgery due to a $@. | mad/Test.java:26:16:26:41 | getParameter(...) | user-provided value | edges -| ApacheHttpClientExecuteSSRF.java:23:29:23:56 | getParameter(...) : String | ApacheHttpClientExecuteSSRF.java:25:42:25:47 | source : String | provenance | Src:MaD:285 | -| ApacheHttpClientExecuteSSRF.java:23:29:23:56 | getParameter(...) : String | ApacheHttpClientExecuteSSRF.java:27:56:27:61 | source | provenance | Src:MaD:285 Sink:MaD:220 | -| ApacheHttpClientExecuteSSRF.java:23:29:23:56 | getParameter(...) : String | ApacheHttpClientExecuteSSRF.java:27:56:27:61 | source : String | provenance | Src:MaD:285 | +| ApacheHttpClientExecuteSSRF.java:23:29:23:56 | getParameter(...) : String | ApacheHttpClientExecuteSSRF.java:25:42:25:47 | source : String | provenance | Src:MaD:286 | +| ApacheHttpClientExecuteSSRF.java:23:29:23:56 | getParameter(...) : String | ApacheHttpClientExecuteSSRF.java:27:56:27:61 | source | provenance | Src:MaD:286 Sink:MaD:220 | +| ApacheHttpClientExecuteSSRF.java:23:29:23:56 | getParameter(...) : String | ApacheHttpClientExecuteSSRF.java:27:56:27:61 | source : String | provenance | Src:MaD:286 | | ApacheHttpClientExecuteSSRF.java:25:29:25:48 | new HttpHost(...) : HttpHost | ApacheHttpClientExecuteSSRF.java:32:28:32:31 | host | provenance | Sink:MaD:228 | | ApacheHttpClientExecuteSSRF.java:25:29:25:48 | new HttpHost(...) : HttpHost | ApacheHttpClientExecuteSSRF.java:33:28:33:31 | host | provenance | Sink:MaD:229 | | ApacheHttpClientExecuteSSRF.java:25:29:25:48 | new HttpHost(...) : HttpHost | ApacheHttpClientExecuteSSRF.java:34:28:34:31 | host | provenance | Sink:MaD:230 | | ApacheHttpClientExecuteSSRF.java:25:29:25:48 | new HttpHost(...) : HttpHost | ApacheHttpClientExecuteSSRF.java:35:28:35:31 | host | provenance | Sink:MaD:231 | -| ApacheHttpClientExecuteSSRF.java:25:42:25:47 | source : String | ApacheHttpClientExecuteSSRF.java:25:29:25:48 | new HttpHost(...) : HttpHost | provenance | MaD:307 | -| ApacheHttpClientExecuteSSRF.java:27:37:27:62 | get(...) : RequestBuilder | ApacheHttpClientExecuteSSRF.java:27:37:27:70 | build(...) : HttpUriRequest | provenance | MaD:304 | +| ApacheHttpClientExecuteSSRF.java:25:42:25:47 | source : String | ApacheHttpClientExecuteSSRF.java:25:29:25:48 | new HttpHost(...) : HttpHost | provenance | MaD:309 | +| ApacheHttpClientExecuteSSRF.java:27:37:27:62 | get(...) : RequestBuilder | ApacheHttpClientExecuteSSRF.java:27:37:27:70 | build(...) : HttpUriRequest | provenance | MaD:306 | | ApacheHttpClientExecuteSSRF.java:27:37:27:70 | build(...) : HttpUriRequest | ApacheHttpClientExecuteSSRF.java:36:28:36:33 | uriReq | provenance | Sink:MaD:232 | | ApacheHttpClientExecuteSSRF.java:27:37:27:70 | build(...) : HttpUriRequest | ApacheHttpClientExecuteSSRF.java:37:28:37:33 | uriReq | provenance | Sink:MaD:233 | | ApacheHttpClientExecuteSSRF.java:27:37:27:70 | build(...) : HttpUriRequest | ApacheHttpClientExecuteSSRF.java:38:28:38:33 | uriReq | provenance | Sink:MaD:234 | | ApacheHttpClientExecuteSSRF.java:27:37:27:70 | build(...) : HttpUriRequest | ApacheHttpClientExecuteSSRF.java:39:28:39:33 | uriReq | provenance | Sink:MaD:235 | -| ApacheHttpClientExecuteSSRF.java:27:56:27:61 | source : String | ApacheHttpClientExecuteSSRF.java:27:37:27:62 | get(...) : RequestBuilder | provenance | MaD:305 | -| ApacheHttpSSRF.java:27:27:27:53 | getParameter(...) : String | ApacheHttpSSRF.java:28:31:28:34 | sink : String | provenance | Src:MaD:285 | +| ApacheHttpClientExecuteSSRF.java:27:56:27:61 | source : String | ApacheHttpClientExecuteSSRF.java:27:37:27:62 | get(...) : RequestBuilder | provenance | MaD:307 | +| ApacheHttpSSRF.java:27:27:27:53 | getParameter(...) : String | ApacheHttpSSRF.java:28:31:28:34 | sink : String | provenance | Src:MaD:286 | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:30:43:30:45 | uri | provenance | Sink:MaD:211 | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:32:29:32:31 | uri | provenance | Sink:MaD:217 | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:34:26:34:28 | uri | provenance | Sink:MaD:212 | @@ -426,16 +428,16 @@ edges | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:57:34:57:36 | uri | provenance | Sink:MaD:223 | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:58:43:58:45 | uri | provenance | Sink:MaD:226 | | ApacheHttpSSRF.java:28:31:28:34 | sink : String | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRF.java:28:31:28:34 | sink : String | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | provenance | MaD:293 | -| ApacheHttpSSRF.java:42:62:42:64 | uri : URI | ApacheHttpSSRF.java:42:62:42:75 | toString(...) : String | provenance | MaD:295 | -| ApacheHttpSSRF.java:42:62:42:75 | toString(...) : String | ApacheHttpSSRF.java:42:34:42:82 | new BasicRequestLine(...) | provenance | MaD:306 Sink:MaD:239 | -| ApacheHttpSSRF.java:43:41:43:43 | uri : URI | ApacheHttpSSRF.java:43:41:43:54 | toString(...) | provenance | MaD:295 Sink:MaD:240 | -| ApacheHttpSSRF.java:44:41:44:43 | uri : URI | ApacheHttpSSRF.java:44:41:44:54 | toString(...) | provenance | MaD:295 Sink:MaD:241 | -| ApacheHttpSSRF.java:46:77:46:79 | uri : URI | ApacheHttpSSRF.java:46:77:46:90 | toString(...) : String | provenance | MaD:295 | -| ApacheHttpSSRF.java:46:77:46:90 | toString(...) : String | ApacheHttpSSRF.java:46:49:46:97 | new BasicRequestLine(...) | provenance | MaD:306 Sink:MaD:236 | -| ApacheHttpSSRF.java:47:56:47:58 | uri : URI | ApacheHttpSSRF.java:47:56:47:69 | toString(...) | provenance | MaD:295 Sink:MaD:237 | -| ApacheHttpSSRF.java:48:56:48:58 | uri : URI | ApacheHttpSSRF.java:48:56:48:69 | toString(...) | provenance | MaD:295 Sink:MaD:238 | -| ApacheHttpSSRFVersion5.java:41:30:41:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRF.java:28:31:28:34 | sink : String | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | provenance | MaD:294 | +| ApacheHttpSSRF.java:42:62:42:64 | uri : URI | ApacheHttpSSRF.java:42:62:42:75 | toString(...) : String | provenance | MaD:297 | +| ApacheHttpSSRF.java:42:62:42:75 | toString(...) : String | ApacheHttpSSRF.java:42:34:42:82 | new BasicRequestLine(...) | provenance | MaD:308 Sink:MaD:239 | +| ApacheHttpSSRF.java:43:41:43:43 | uri : URI | ApacheHttpSSRF.java:43:41:43:54 | toString(...) | provenance | MaD:297 Sink:MaD:240 | +| ApacheHttpSSRF.java:44:41:44:43 | uri : URI | ApacheHttpSSRF.java:44:41:44:54 | toString(...) | provenance | MaD:297 Sink:MaD:241 | +| ApacheHttpSSRF.java:46:77:46:79 | uri : URI | ApacheHttpSSRF.java:46:77:46:90 | toString(...) : String | provenance | MaD:297 | +| ApacheHttpSSRF.java:46:77:46:90 | toString(...) : String | ApacheHttpSSRF.java:46:49:46:97 | new BasicRequestLine(...) | provenance | MaD:308 Sink:MaD:236 | +| ApacheHttpSSRF.java:47:56:47:58 | uri : URI | ApacheHttpSSRF.java:47:56:47:69 | toString(...) | provenance | MaD:297 Sink:MaD:237 | +| ApacheHttpSSRF.java:48:56:48:58 | uri : URI | ApacheHttpSSRF.java:48:56:48:69 | toString(...) | provenance | MaD:297 Sink:MaD:238 | +| ApacheHttpSSRFVersion5.java:41:30:41:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:49:54:49:56 | uri : URI | provenance | | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:50:54:50:56 | uri | provenance | Sink:MaD:40 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:51:48:51:50 | uri : URI | provenance | | @@ -501,8 +503,8 @@ edges | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:167:40:167:42 | uri : URI | provenance | | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:168:40:168:42 | uri | provenance | Sink:MaD:121 | | ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | provenance | MaD:293 | -| ApacheHttpSSRFVersion5.java:44:31:44:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:45:42:45:49 | hostSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | provenance | MaD:294 | +| ApacheHttpSSRFVersion5.java:44:31:44:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:45:42:45:49 | hostSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:48:54:48:57 | host | provenance | Sink:MaD:38 | | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:54:38:54:41 | host | provenance | Sink:MaD:43 | | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:58:35:58:38 | host | provenance | Sink:MaD:46 | @@ -526,38 +528,38 @@ edges | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:132:36:132:39 | host | provenance | Sink:MaD:100 | | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:136:38:136:41 | host | provenance | Sink:MaD:103 | | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:162:52:162:55 | host | provenance | Sink:MaD:204 | -| ApacheHttpSSRFVersion5.java:45:42:45:49 | hostSink : String | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | provenance | MaD:303 | -| ApacheHttpSSRFVersion5.java:49:54:49:56 | uri : URI | ApacheHttpSSRFVersion5.java:49:54:49:67 | toString(...) | provenance | MaD:295 Sink:MaD:39 | -| ApacheHttpSSRFVersion5.java:51:48:51:50 | uri : URI | ApacheHttpSSRFVersion5.java:51:48:51:61 | toString(...) | provenance | MaD:295 Sink:MaD:41 | -| ApacheHttpSSRFVersion5.java:55:38:55:40 | uri : URI | ApacheHttpSSRFVersion5.java:55:38:55:51 | toString(...) | provenance | MaD:295 Sink:MaD:44 | -| ApacheHttpSSRFVersion5.java:59:35:59:37 | uri : URI | ApacheHttpSSRFVersion5.java:59:35:59:48 | toString(...) | provenance | MaD:295 Sink:MaD:47 | -| ApacheHttpSSRFVersion5.java:63:36:63:38 | uri : URI | ApacheHttpSSRFVersion5.java:63:36:63:49 | toString(...) | provenance | MaD:295 Sink:MaD:50 | -| ApacheHttpSSRFVersion5.java:67:39:67:41 | uri : URI | ApacheHttpSSRFVersion5.java:67:39:67:52 | toString(...) | provenance | MaD:295 Sink:MaD:53 | -| ApacheHttpSSRFVersion5.java:71:37:71:39 | uri : URI | ApacheHttpSSRFVersion5.java:71:37:71:50 | toString(...) | provenance | MaD:295 Sink:MaD:56 | -| ApacheHttpSSRFVersion5.java:75:36:75:38 | uri : URI | ApacheHttpSSRFVersion5.java:75:36:75:49 | toString(...) | provenance | MaD:295 Sink:MaD:59 | -| ApacheHttpSSRFVersion5.java:79:35:79:37 | uri : URI | ApacheHttpSSRFVersion5.java:79:35:79:48 | toString(...) | provenance | MaD:295 Sink:MaD:62 | -| ApacheHttpSSRFVersion5.java:83:37:83:39 | uri : URI | ApacheHttpSSRFVersion5.java:83:37:83:50 | toString(...) | provenance | MaD:295 Sink:MaD:65 | -| ApacheHttpSSRFVersion5.java:98:48:98:50 | uri : URI | ApacheHttpSSRFVersion5.java:98:48:98:61 | toString(...) | provenance | MaD:295 Sink:MaD:75 | -| ApacheHttpSSRFVersion5.java:103:55:103:57 | uri : URI | ApacheHttpSSRFVersion5.java:103:55:103:68 | toString(...) | provenance | MaD:295 Sink:MaD:78 | -| ApacheHttpSSRFVersion5.java:105:49:105:51 | uri : URI | ApacheHttpSSRFVersion5.java:105:49:105:62 | toString(...) | provenance | MaD:295 Sink:MaD:80 | -| ApacheHttpSSRFVersion5.java:109:39:109:41 | uri : URI | ApacheHttpSSRFVersion5.java:109:39:109:52 | toString(...) | provenance | MaD:295 Sink:MaD:83 | -| ApacheHttpSSRFVersion5.java:113:36:113:38 | uri : URI | ApacheHttpSSRFVersion5.java:113:36:113:49 | toString(...) | provenance | MaD:295 Sink:MaD:86 | -| ApacheHttpSSRFVersion5.java:117:37:117:39 | uri : URI | ApacheHttpSSRFVersion5.java:117:37:117:50 | toString(...) | provenance | MaD:295 Sink:MaD:89 | -| ApacheHttpSSRFVersion5.java:121:40:121:42 | uri : URI | ApacheHttpSSRFVersion5.java:121:40:121:53 | toString(...) | provenance | MaD:295 Sink:MaD:92 | -| ApacheHttpSSRFVersion5.java:125:38:125:40 | uri : URI | ApacheHttpSSRFVersion5.java:125:38:125:51 | toString(...) | provenance | MaD:295 Sink:MaD:95 | -| ApacheHttpSSRFVersion5.java:129:37:129:39 | uri : URI | ApacheHttpSSRFVersion5.java:129:37:129:50 | toString(...) | provenance | MaD:295 Sink:MaD:98 | -| ApacheHttpSSRFVersion5.java:133:36:133:38 | uri : URI | ApacheHttpSSRFVersion5.java:133:36:133:49 | toString(...) | provenance | MaD:295 Sink:MaD:101 | -| ApacheHttpSSRFVersion5.java:137:38:137:40 | uri : URI | ApacheHttpSSRFVersion5.java:137:38:137:51 | toString(...) | provenance | MaD:295 Sink:MaD:104 | -| ApacheHttpSSRFVersion5.java:141:41:141:43 | uri : URI | ApacheHttpSSRFVersion5.java:141:41:141:54 | toString(...) | provenance | MaD:295 Sink:MaD:106 | -| ApacheHttpSSRFVersion5.java:144:38:144:40 | uri : URI | ApacheHttpSSRFVersion5.java:144:38:144:51 | toString(...) | provenance | MaD:295 Sink:MaD:108 | -| ApacheHttpSSRFVersion5.java:147:39:147:41 | uri : URI | ApacheHttpSSRFVersion5.java:147:39:147:52 | toString(...) | provenance | MaD:295 Sink:MaD:110 | -| ApacheHttpSSRFVersion5.java:150:42:150:44 | uri : URI | ApacheHttpSSRFVersion5.java:150:42:150:55 | toString(...) | provenance | MaD:295 Sink:MaD:112 | -| ApacheHttpSSRFVersion5.java:153:40:153:42 | uri : URI | ApacheHttpSSRFVersion5.java:153:40:153:53 | toString(...) | provenance | MaD:295 Sink:MaD:114 | -| ApacheHttpSSRFVersion5.java:156:39:156:41 | uri : URI | ApacheHttpSSRFVersion5.java:156:39:156:52 | toString(...) | provenance | MaD:295 Sink:MaD:116 | -| ApacheHttpSSRFVersion5.java:159:38:159:40 | uri : URI | ApacheHttpSSRFVersion5.java:159:38:159:51 | toString(...) | provenance | MaD:295 Sink:MaD:118 | -| ApacheHttpSSRFVersion5.java:164:47:164:49 | uri : URI | ApacheHttpSSRFVersion5.java:164:47:164:60 | toString(...) | provenance | MaD:295 Sink:MaD:205 | -| ApacheHttpSSRFVersion5.java:167:40:167:42 | uri : URI | ApacheHttpSSRFVersion5.java:167:40:167:53 | toString(...) | provenance | MaD:295 Sink:MaD:120 | -| ApacheHttpSSRFVersion5.java:180:30:180:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:45:42:45:49 | hostSink : String | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | provenance | MaD:305 | +| ApacheHttpSSRFVersion5.java:49:54:49:56 | uri : URI | ApacheHttpSSRFVersion5.java:49:54:49:67 | toString(...) | provenance | MaD:297 Sink:MaD:39 | +| ApacheHttpSSRFVersion5.java:51:48:51:50 | uri : URI | ApacheHttpSSRFVersion5.java:51:48:51:61 | toString(...) | provenance | MaD:297 Sink:MaD:41 | +| ApacheHttpSSRFVersion5.java:55:38:55:40 | uri : URI | ApacheHttpSSRFVersion5.java:55:38:55:51 | toString(...) | provenance | MaD:297 Sink:MaD:44 | +| ApacheHttpSSRFVersion5.java:59:35:59:37 | uri : URI | ApacheHttpSSRFVersion5.java:59:35:59:48 | toString(...) | provenance | MaD:297 Sink:MaD:47 | +| ApacheHttpSSRFVersion5.java:63:36:63:38 | uri : URI | ApacheHttpSSRFVersion5.java:63:36:63:49 | toString(...) | provenance | MaD:297 Sink:MaD:50 | +| ApacheHttpSSRFVersion5.java:67:39:67:41 | uri : URI | ApacheHttpSSRFVersion5.java:67:39:67:52 | toString(...) | provenance | MaD:297 Sink:MaD:53 | +| ApacheHttpSSRFVersion5.java:71:37:71:39 | uri : URI | ApacheHttpSSRFVersion5.java:71:37:71:50 | toString(...) | provenance | MaD:297 Sink:MaD:56 | +| ApacheHttpSSRFVersion5.java:75:36:75:38 | uri : URI | ApacheHttpSSRFVersion5.java:75:36:75:49 | toString(...) | provenance | MaD:297 Sink:MaD:59 | +| ApacheHttpSSRFVersion5.java:79:35:79:37 | uri : URI | ApacheHttpSSRFVersion5.java:79:35:79:48 | toString(...) | provenance | MaD:297 Sink:MaD:62 | +| ApacheHttpSSRFVersion5.java:83:37:83:39 | uri : URI | ApacheHttpSSRFVersion5.java:83:37:83:50 | toString(...) | provenance | MaD:297 Sink:MaD:65 | +| ApacheHttpSSRFVersion5.java:98:48:98:50 | uri : URI | ApacheHttpSSRFVersion5.java:98:48:98:61 | toString(...) | provenance | MaD:297 Sink:MaD:75 | +| ApacheHttpSSRFVersion5.java:103:55:103:57 | uri : URI | ApacheHttpSSRFVersion5.java:103:55:103:68 | toString(...) | provenance | MaD:297 Sink:MaD:78 | +| ApacheHttpSSRFVersion5.java:105:49:105:51 | uri : URI | ApacheHttpSSRFVersion5.java:105:49:105:62 | toString(...) | provenance | MaD:297 Sink:MaD:80 | +| ApacheHttpSSRFVersion5.java:109:39:109:41 | uri : URI | ApacheHttpSSRFVersion5.java:109:39:109:52 | toString(...) | provenance | MaD:297 Sink:MaD:83 | +| ApacheHttpSSRFVersion5.java:113:36:113:38 | uri : URI | ApacheHttpSSRFVersion5.java:113:36:113:49 | toString(...) | provenance | MaD:297 Sink:MaD:86 | +| ApacheHttpSSRFVersion5.java:117:37:117:39 | uri : URI | ApacheHttpSSRFVersion5.java:117:37:117:50 | toString(...) | provenance | MaD:297 Sink:MaD:89 | +| ApacheHttpSSRFVersion5.java:121:40:121:42 | uri : URI | ApacheHttpSSRFVersion5.java:121:40:121:53 | toString(...) | provenance | MaD:297 Sink:MaD:92 | +| ApacheHttpSSRFVersion5.java:125:38:125:40 | uri : URI | ApacheHttpSSRFVersion5.java:125:38:125:51 | toString(...) | provenance | MaD:297 Sink:MaD:95 | +| ApacheHttpSSRFVersion5.java:129:37:129:39 | uri : URI | ApacheHttpSSRFVersion5.java:129:37:129:50 | toString(...) | provenance | MaD:297 Sink:MaD:98 | +| ApacheHttpSSRFVersion5.java:133:36:133:38 | uri : URI | ApacheHttpSSRFVersion5.java:133:36:133:49 | toString(...) | provenance | MaD:297 Sink:MaD:101 | +| ApacheHttpSSRFVersion5.java:137:38:137:40 | uri : URI | ApacheHttpSSRFVersion5.java:137:38:137:51 | toString(...) | provenance | MaD:297 Sink:MaD:104 | +| ApacheHttpSSRFVersion5.java:141:41:141:43 | uri : URI | ApacheHttpSSRFVersion5.java:141:41:141:54 | toString(...) | provenance | MaD:297 Sink:MaD:106 | +| ApacheHttpSSRFVersion5.java:144:38:144:40 | uri : URI | ApacheHttpSSRFVersion5.java:144:38:144:51 | toString(...) | provenance | MaD:297 Sink:MaD:108 | +| ApacheHttpSSRFVersion5.java:147:39:147:41 | uri : URI | ApacheHttpSSRFVersion5.java:147:39:147:52 | toString(...) | provenance | MaD:297 Sink:MaD:110 | +| ApacheHttpSSRFVersion5.java:150:42:150:44 | uri : URI | ApacheHttpSSRFVersion5.java:150:42:150:55 | toString(...) | provenance | MaD:297 Sink:MaD:112 | +| ApacheHttpSSRFVersion5.java:153:40:153:42 | uri : URI | ApacheHttpSSRFVersion5.java:153:40:153:53 | toString(...) | provenance | MaD:297 Sink:MaD:114 | +| ApacheHttpSSRFVersion5.java:156:39:156:41 | uri : URI | ApacheHttpSSRFVersion5.java:156:39:156:52 | toString(...) | provenance | MaD:297 Sink:MaD:116 | +| ApacheHttpSSRFVersion5.java:159:38:159:40 | uri : URI | ApacheHttpSSRFVersion5.java:159:38:159:51 | toString(...) | provenance | MaD:297 Sink:MaD:118 | +| ApacheHttpSSRFVersion5.java:164:47:164:49 | uri : URI | ApacheHttpSSRFVersion5.java:164:47:164:60 | toString(...) | provenance | MaD:297 Sink:MaD:205 | +| ApacheHttpSSRFVersion5.java:167:40:167:42 | uri : URI | ApacheHttpSSRFVersion5.java:167:40:167:53 | toString(...) | provenance | MaD:297 Sink:MaD:120 | +| ApacheHttpSSRFVersion5.java:180:30:180:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:184:56:184:58 | uri : URI | provenance | | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:185:56:185:58 | uri | provenance | Sink:MaD:123 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:186:50:186:52 | uri : URI | provenance | | @@ -596,26 +598,26 @@ edges | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:236:27:236:29 | uri | provenance | Sink:MaD:157 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:239:46:239:48 | uri | provenance | Sink:MaD:158 | | ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | provenance | MaD:293 | -| ApacheHttpSSRFVersion5.java:184:56:184:58 | uri : URI | ApacheHttpSSRFVersion5.java:184:56:184:69 | toString(...) | provenance | MaD:295 Sink:MaD:122 | -| ApacheHttpSSRFVersion5.java:186:50:186:52 | uri : URI | ApacheHttpSSRFVersion5.java:186:50:186:63 | toString(...) | provenance | MaD:295 Sink:MaD:124 | -| ApacheHttpSSRFVersion5.java:189:40:189:42 | uri : URI | ApacheHttpSSRFVersion5.java:189:40:189:53 | toString(...) | provenance | MaD:295 Sink:MaD:126 | -| ApacheHttpSSRFVersion5.java:192:37:192:39 | uri : URI | ApacheHttpSSRFVersion5.java:192:37:192:50 | toString(...) | provenance | MaD:295 Sink:MaD:128 | -| ApacheHttpSSRFVersion5.java:195:38:195:40 | uri : URI | ApacheHttpSSRFVersion5.java:195:38:195:51 | toString(...) | provenance | MaD:295 Sink:MaD:130 | -| ApacheHttpSSRFVersion5.java:198:41:198:43 | uri : URI | ApacheHttpSSRFVersion5.java:198:41:198:54 | toString(...) | provenance | MaD:295 Sink:MaD:132 | -| ApacheHttpSSRFVersion5.java:201:39:201:41 | uri : URI | ApacheHttpSSRFVersion5.java:201:39:201:52 | toString(...) | provenance | MaD:295 Sink:MaD:134 | -| ApacheHttpSSRFVersion5.java:204:38:204:40 | uri : URI | ApacheHttpSSRFVersion5.java:204:38:204:51 | toString(...) | provenance | MaD:295 Sink:MaD:136 | -| ApacheHttpSSRFVersion5.java:207:37:207:39 | uri : URI | ApacheHttpSSRFVersion5.java:207:37:207:50 | toString(...) | provenance | MaD:295 Sink:MaD:138 | -| ApacheHttpSSRFVersion5.java:210:39:210:41 | uri : URI | ApacheHttpSSRFVersion5.java:210:39:210:52 | toString(...) | provenance | MaD:295 Sink:MaD:140 | -| ApacheHttpSSRFVersion5.java:214:28:214:30 | uri : URI | ApacheHttpSSRFVersion5.java:214:28:214:41 | toString(...) | provenance | MaD:295 Sink:MaD:142 | -| ApacheHttpSSRFVersion5.java:217:25:217:27 | uri : URI | ApacheHttpSSRFVersion5.java:217:25:217:38 | toString(...) | provenance | MaD:295 Sink:MaD:144 | -| ApacheHttpSSRFVersion5.java:220:26:220:28 | uri : URI | ApacheHttpSSRFVersion5.java:220:26:220:39 | toString(...) | provenance | MaD:295 Sink:MaD:146 | -| ApacheHttpSSRFVersion5.java:223:29:223:31 | uri : URI | ApacheHttpSSRFVersion5.java:223:29:223:42 | toString(...) | provenance | MaD:295 Sink:MaD:148 | -| ApacheHttpSSRFVersion5.java:226:27:226:29 | uri : URI | ApacheHttpSSRFVersion5.java:226:27:226:40 | toString(...) | provenance | MaD:295 Sink:MaD:150 | -| ApacheHttpSSRFVersion5.java:229:26:229:28 | uri : URI | ApacheHttpSSRFVersion5.java:229:26:229:39 | toString(...) | provenance | MaD:295 Sink:MaD:152 | -| ApacheHttpSSRFVersion5.java:232:25:232:27 | uri : URI | ApacheHttpSSRFVersion5.java:232:25:232:38 | toString(...) | provenance | MaD:295 Sink:MaD:154 | -| ApacheHttpSSRFVersion5.java:235:27:235:29 | uri : URI | ApacheHttpSSRFVersion5.java:235:27:235:40 | toString(...) | provenance | MaD:295 Sink:MaD:156 | -| ApacheHttpSSRFVersion5.java:251:30:251:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | provenance | MaD:294 | +| ApacheHttpSSRFVersion5.java:184:56:184:58 | uri : URI | ApacheHttpSSRFVersion5.java:184:56:184:69 | toString(...) | provenance | MaD:297 Sink:MaD:122 | +| ApacheHttpSSRFVersion5.java:186:50:186:52 | uri : URI | ApacheHttpSSRFVersion5.java:186:50:186:63 | toString(...) | provenance | MaD:297 Sink:MaD:124 | +| ApacheHttpSSRFVersion5.java:189:40:189:42 | uri : URI | ApacheHttpSSRFVersion5.java:189:40:189:53 | toString(...) | provenance | MaD:297 Sink:MaD:126 | +| ApacheHttpSSRFVersion5.java:192:37:192:39 | uri : URI | ApacheHttpSSRFVersion5.java:192:37:192:50 | toString(...) | provenance | MaD:297 Sink:MaD:128 | +| ApacheHttpSSRFVersion5.java:195:38:195:40 | uri : URI | ApacheHttpSSRFVersion5.java:195:38:195:51 | toString(...) | provenance | MaD:297 Sink:MaD:130 | +| ApacheHttpSSRFVersion5.java:198:41:198:43 | uri : URI | ApacheHttpSSRFVersion5.java:198:41:198:54 | toString(...) | provenance | MaD:297 Sink:MaD:132 | +| ApacheHttpSSRFVersion5.java:201:39:201:41 | uri : URI | ApacheHttpSSRFVersion5.java:201:39:201:52 | toString(...) | provenance | MaD:297 Sink:MaD:134 | +| ApacheHttpSSRFVersion5.java:204:38:204:40 | uri : URI | ApacheHttpSSRFVersion5.java:204:38:204:51 | toString(...) | provenance | MaD:297 Sink:MaD:136 | +| ApacheHttpSSRFVersion5.java:207:37:207:39 | uri : URI | ApacheHttpSSRFVersion5.java:207:37:207:50 | toString(...) | provenance | MaD:297 Sink:MaD:138 | +| ApacheHttpSSRFVersion5.java:210:39:210:41 | uri : URI | ApacheHttpSSRFVersion5.java:210:39:210:52 | toString(...) | provenance | MaD:297 Sink:MaD:140 | +| ApacheHttpSSRFVersion5.java:214:28:214:30 | uri : URI | ApacheHttpSSRFVersion5.java:214:28:214:41 | toString(...) | provenance | MaD:297 Sink:MaD:142 | +| ApacheHttpSSRFVersion5.java:217:25:217:27 | uri : URI | ApacheHttpSSRFVersion5.java:217:25:217:38 | toString(...) | provenance | MaD:297 Sink:MaD:144 | +| ApacheHttpSSRFVersion5.java:220:26:220:28 | uri : URI | ApacheHttpSSRFVersion5.java:220:26:220:39 | toString(...) | provenance | MaD:297 Sink:MaD:146 | +| ApacheHttpSSRFVersion5.java:223:29:223:31 | uri : URI | ApacheHttpSSRFVersion5.java:223:29:223:42 | toString(...) | provenance | MaD:297 Sink:MaD:148 | +| ApacheHttpSSRFVersion5.java:226:27:226:29 | uri : URI | ApacheHttpSSRFVersion5.java:226:27:226:40 | toString(...) | provenance | MaD:297 Sink:MaD:150 | +| ApacheHttpSSRFVersion5.java:229:26:229:28 | uri : URI | ApacheHttpSSRFVersion5.java:229:26:229:39 | toString(...) | provenance | MaD:297 Sink:MaD:152 | +| ApacheHttpSSRFVersion5.java:232:25:232:27 | uri : URI | ApacheHttpSSRFVersion5.java:232:25:232:38 | toString(...) | provenance | MaD:297 Sink:MaD:154 | +| ApacheHttpSSRFVersion5.java:235:27:235:29 | uri : URI | ApacheHttpSSRFVersion5.java:235:27:235:40 | toString(...) | provenance | MaD:297 Sink:MaD:156 | +| ApacheHttpSSRFVersion5.java:251:30:251:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:255:44:255:46 | uri | provenance | Sink:MaD:159 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:256:38:256:40 | uri : URI | provenance | | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:257:38:257:40 | uri | provenance | Sink:MaD:161 | @@ -636,30 +638,30 @@ edges | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:280:27:280:29 | uri : URI | provenance | | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:281:27:281:29 | uri | provenance | Sink:MaD:177 | | ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | provenance | MaD:293 | -| ApacheHttpSSRFVersion5.java:256:38:256:40 | uri : URI | ApacheHttpSSRFVersion5.java:256:38:256:51 | toString(...) | provenance | MaD:295 Sink:MaD:160 | -| ApacheHttpSSRFVersion5.java:259:28:259:30 | uri : URI | ApacheHttpSSRFVersion5.java:259:28:259:41 | toString(...) | provenance | MaD:295 Sink:MaD:162 | -| ApacheHttpSSRFVersion5.java:262:25:262:27 | uri : URI | ApacheHttpSSRFVersion5.java:262:25:262:38 | toString(...) | provenance | MaD:295 Sink:MaD:164 | -| ApacheHttpSSRFVersion5.java:265:26:265:28 | uri : URI | ApacheHttpSSRFVersion5.java:265:26:265:39 | toString(...) | provenance | MaD:295 Sink:MaD:166 | -| ApacheHttpSSRFVersion5.java:268:29:268:31 | uri : URI | ApacheHttpSSRFVersion5.java:268:29:268:42 | toString(...) | provenance | MaD:295 Sink:MaD:168 | -| ApacheHttpSSRFVersion5.java:271:27:271:29 | uri : URI | ApacheHttpSSRFVersion5.java:271:27:271:40 | toString(...) | provenance | MaD:295 Sink:MaD:170 | -| ApacheHttpSSRFVersion5.java:274:26:274:28 | uri : URI | ApacheHttpSSRFVersion5.java:274:26:274:39 | toString(...) | provenance | MaD:295 Sink:MaD:172 | -| ApacheHttpSSRFVersion5.java:277:25:277:27 | uri : URI | ApacheHttpSSRFVersion5.java:277:25:277:38 | toString(...) | provenance | MaD:295 Sink:MaD:174 | -| ApacheHttpSSRFVersion5.java:280:27:280:29 | uri : URI | ApacheHttpSSRFVersion5.java:280:27:280:40 | toString(...) | provenance | MaD:295 Sink:MaD:176 | -| ApacheHttpSSRFVersion5.java:295:30:295:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | provenance | MaD:294 | +| ApacheHttpSSRFVersion5.java:256:38:256:40 | uri : URI | ApacheHttpSSRFVersion5.java:256:38:256:51 | toString(...) | provenance | MaD:297 Sink:MaD:160 | +| ApacheHttpSSRFVersion5.java:259:28:259:30 | uri : URI | ApacheHttpSSRFVersion5.java:259:28:259:41 | toString(...) | provenance | MaD:297 Sink:MaD:162 | +| ApacheHttpSSRFVersion5.java:262:25:262:27 | uri : URI | ApacheHttpSSRFVersion5.java:262:25:262:38 | toString(...) | provenance | MaD:297 Sink:MaD:164 | +| ApacheHttpSSRFVersion5.java:265:26:265:28 | uri : URI | ApacheHttpSSRFVersion5.java:265:26:265:39 | toString(...) | provenance | MaD:297 Sink:MaD:166 | +| ApacheHttpSSRFVersion5.java:268:29:268:31 | uri : URI | ApacheHttpSSRFVersion5.java:268:29:268:42 | toString(...) | provenance | MaD:297 Sink:MaD:168 | +| ApacheHttpSSRFVersion5.java:271:27:271:29 | uri : URI | ApacheHttpSSRFVersion5.java:271:27:271:40 | toString(...) | provenance | MaD:297 Sink:MaD:170 | +| ApacheHttpSSRFVersion5.java:274:26:274:28 | uri : URI | ApacheHttpSSRFVersion5.java:274:26:274:39 | toString(...) | provenance | MaD:297 Sink:MaD:172 | +| ApacheHttpSSRFVersion5.java:277:25:277:27 | uri : URI | ApacheHttpSSRFVersion5.java:277:25:277:38 | toString(...) | provenance | MaD:297 Sink:MaD:174 | +| ApacheHttpSSRFVersion5.java:280:27:280:29 | uri : URI | ApacheHttpSSRFVersion5.java:280:27:280:40 | toString(...) | provenance | MaD:297 Sink:MaD:176 | +| ApacheHttpSSRFVersion5.java:295:30:295:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:308:60:308:62 | uri : URI | provenance | | | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:309:60:309:62 | uri | provenance | Sink:MaD:209 | | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:313:53:313:55 | uri : URI | provenance | | | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:314:53:314:55 | uri | provenance | Sink:MaD:209 | | ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | provenance | MaD:293 | -| ApacheHttpSSRFVersion5.java:298:31:298:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:299:42:299:49 | hostSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | provenance | MaD:294 | +| ApacheHttpSSRFVersion5.java:298:31:298:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:299:42:299:49 | hostSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:303:34:303:37 | host | provenance | Sink:MaD:178 | | ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:304:34:304:37 | host | provenance | Sink:MaD:179 | -| ApacheHttpSSRFVersion5.java:299:42:299:49 | hostSink : String | ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | provenance | MaD:303 | -| ApacheHttpSSRFVersion5.java:308:60:308:62 | uri : URI | ApacheHttpSSRFVersion5.java:308:60:308:73 | toString(...) | provenance | MaD:295 Sink:MaD:208 | -| ApacheHttpSSRFVersion5.java:313:53:313:55 | uri : URI | ApacheHttpSSRFVersion5.java:313:53:313:66 | toString(...) | provenance | MaD:295 Sink:MaD:208 | -| ApacheHttpSSRFVersion5.java:326:30:326:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:299:42:299:49 | hostSink : String | ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | provenance | MaD:305 | +| ApacheHttpSSRFVersion5.java:308:60:308:62 | uri : URI | ApacheHttpSSRFVersion5.java:308:60:308:73 | toString(...) | provenance | MaD:297 Sink:MaD:208 | +| ApacheHttpSSRFVersion5.java:313:53:313:55 | uri : URI | ApacheHttpSSRFVersion5.java:313:53:313:66 | toString(...) | provenance | MaD:297 Sink:MaD:208 | +| ApacheHttpSSRFVersion5.java:326:30:326:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:333:42:333:44 | uri : URI | provenance | | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:334:42:334:44 | uri | provenance | Sink:MaD:181 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:336:39:336:41 | uri : URI | provenance | | @@ -679,20 +681,20 @@ edges | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:359:41:359:43 | uri : URI | provenance | | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:360:41:360:43 | uri | provenance | Sink:MaD:195 | | ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | provenance | MaD:293 | -| ApacheHttpSSRFVersion5.java:329:31:329:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:330:42:330:49 | hostSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | provenance | MaD:294 | +| ApacheHttpSSRFVersion5.java:329:31:329:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:330:42:330:49 | hostSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:330:29:330:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:354:53:354:56 | host | provenance | Sink:MaD:204 | -| ApacheHttpSSRFVersion5.java:330:42:330:49 | hostSink : String | ApacheHttpSSRFVersion5.java:330:29:330:50 | new HttpHost(...) : HttpHost | provenance | MaD:303 | -| ApacheHttpSSRFVersion5.java:333:42:333:44 | uri : URI | ApacheHttpSSRFVersion5.java:333:42:333:55 | toString(...) | provenance | MaD:295 Sink:MaD:180 | -| ApacheHttpSSRFVersion5.java:336:39:336:41 | uri : URI | ApacheHttpSSRFVersion5.java:336:39:336:52 | toString(...) | provenance | MaD:295 Sink:MaD:182 | -| ApacheHttpSSRFVersion5.java:339:40:339:42 | uri : URI | ApacheHttpSSRFVersion5.java:339:40:339:53 | toString(...) | provenance | MaD:295 Sink:MaD:184 | -| ApacheHttpSSRFVersion5.java:342:43:342:45 | uri : URI | ApacheHttpSSRFVersion5.java:342:43:342:56 | toString(...) | provenance | MaD:295 Sink:MaD:186 | -| ApacheHttpSSRFVersion5.java:345:41:345:43 | uri : URI | ApacheHttpSSRFVersion5.java:345:41:345:54 | toString(...) | provenance | MaD:295 Sink:MaD:188 | -| ApacheHttpSSRFVersion5.java:348:40:348:42 | uri : URI | ApacheHttpSSRFVersion5.java:348:40:348:53 | toString(...) | provenance | MaD:295 Sink:MaD:190 | -| ApacheHttpSSRFVersion5.java:351:39:351:41 | uri : URI | ApacheHttpSSRFVersion5.java:351:39:351:52 | toString(...) | provenance | MaD:295 Sink:MaD:192 | -| ApacheHttpSSRFVersion5.java:356:48:356:50 | uri : URI | ApacheHttpSSRFVersion5.java:356:48:356:61 | toString(...) | provenance | MaD:295 Sink:MaD:205 | -| ApacheHttpSSRFVersion5.java:359:41:359:43 | uri : URI | ApacheHttpSSRFVersion5.java:359:41:359:54 | toString(...) | provenance | MaD:295 Sink:MaD:194 | -| ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:330:42:330:49 | hostSink : String | ApacheHttpSSRFVersion5.java:330:29:330:50 | new HttpHost(...) : HttpHost | provenance | MaD:305 | +| ApacheHttpSSRFVersion5.java:333:42:333:44 | uri : URI | ApacheHttpSSRFVersion5.java:333:42:333:55 | toString(...) | provenance | MaD:297 Sink:MaD:180 | +| ApacheHttpSSRFVersion5.java:336:39:336:41 | uri : URI | ApacheHttpSSRFVersion5.java:336:39:336:52 | toString(...) | provenance | MaD:297 Sink:MaD:182 | +| ApacheHttpSSRFVersion5.java:339:40:339:42 | uri : URI | ApacheHttpSSRFVersion5.java:339:40:339:53 | toString(...) | provenance | MaD:297 Sink:MaD:184 | +| ApacheHttpSSRFVersion5.java:342:43:342:45 | uri : URI | ApacheHttpSSRFVersion5.java:342:43:342:56 | toString(...) | provenance | MaD:297 Sink:MaD:186 | +| ApacheHttpSSRFVersion5.java:345:41:345:43 | uri : URI | ApacheHttpSSRFVersion5.java:345:41:345:54 | toString(...) | provenance | MaD:297 Sink:MaD:188 | +| ApacheHttpSSRFVersion5.java:348:40:348:42 | uri : URI | ApacheHttpSSRFVersion5.java:348:40:348:53 | toString(...) | provenance | MaD:297 Sink:MaD:190 | +| ApacheHttpSSRFVersion5.java:351:39:351:41 | uri : URI | ApacheHttpSSRFVersion5.java:351:39:351:52 | toString(...) | provenance | MaD:297 Sink:MaD:192 | +| ApacheHttpSSRFVersion5.java:356:48:356:50 | uri : URI | ApacheHttpSSRFVersion5.java:356:48:356:61 | toString(...) | provenance | MaD:297 Sink:MaD:205 | +| ApacheHttpSSRFVersion5.java:359:41:359:43 | uri : URI | ApacheHttpSSRFVersion5.java:359:41:359:54 | toString(...) | provenance | MaD:297 Sink:MaD:194 | +| ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:380:57:380:59 | uri | provenance | Sink:MaD:197 | | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:382:51:382:53 | uri | provenance | Sink:MaD:199 | | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:386:50:386:52 | uri | provenance | Sink:MaD:201 | @@ -700,220 +702,224 @@ edges | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:390:24:390:26 | uri | provenance | Sink:MaD:207 | | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:394:24:394:26 | uri | provenance | Sink:MaD:207 | | ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | provenance | MaD:293 | -| ApacheHttpSSRFVersion5.java:375:31:375:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:376:42:376:49 | hostSink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | provenance | MaD:294 | +| ApacheHttpSSRFVersion5.java:375:31:375:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:376:42:376:49 | hostSink : String | provenance | Src:MaD:286 | | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:379:57:379:60 | host | provenance | Sink:MaD:196 | | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:381:51:381:54 | host | provenance | Sink:MaD:198 | | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:385:50:385:53 | host | provenance | Sink:MaD:200 | | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:387:44:387:47 | host | provenance | Sink:MaD:202 | -| ApacheHttpSSRFVersion5.java:376:42:376:49 | hostSink : String | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | provenance | MaD:303 | -| JakartaWsSSRF.java:14:22:14:48 | getParameter(...) : String | JakartaWsSSRF.java:15:23:15:25 | url | provenance | Src:MaD:285 Sink:MaD:3 | -| JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) : String | JavaNetHttpSSRF.java:26:31:26:34 | sink : String | provenance | Src:MaD:285 | +| ApacheHttpSSRFVersion5.java:376:42:376:49 | hostSink : String | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | provenance | MaD:305 | +| JakartaWsSSRF.java:14:22:14:48 | getParameter(...) : String | JakartaWsSSRF.java:15:23:15:25 | url | provenance | Src:MaD:286 Sink:MaD:3 | +| JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) : String | JavaNetHttpSSRF.java:26:31:26:34 | sink : String | provenance | Src:MaD:286 | | JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | JavaNetHttpSSRF.java:39:59:39:61 | uri | provenance | Sink:MaD:6 | | JavaNetHttpSSRF.java:26:31:26:34 | sink : String | JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | provenance | Config | -| JavaNetHttpSSRF.java:26:31:26:34 | sink : String | JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | provenance | MaD:293 | +| JavaNetHttpSSRF.java:26:31:26:34 | sink : String | JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | provenance | MaD:294 | | JavaNetHttpSSRF.java:26:31:26:34 | sink : String | JavaNetHttpSSRF.java:27:40:27:43 | sink : String | provenance | | | JavaNetHttpSSRF.java:27:24:27:57 | new URI(...) : URI | JavaNetHttpSSRF.java:38:65:38:68 | uri2 | provenance | Sink:MaD:5 | | JavaNetHttpSSRF.java:27:40:27:43 | sink : String | JavaNetHttpSSRF.java:27:24:27:57 | new URI(...) : URI | provenance | Config | -| JavaNetHttpSSRF.java:27:40:27:43 | sink : String | JavaNetHttpSSRF.java:27:24:27:57 | new URI(...) : URI | provenance | MaD:294 | +| JavaNetHttpSSRF.java:27:40:27:43 | sink : String | JavaNetHttpSSRF.java:27:24:27:57 | new URI(...) : URI | provenance | MaD:295 | | JavaNetHttpSSRF.java:27:40:27:43 | sink : String | JavaNetHttpSSRF.java:28:32:28:35 | sink : String | provenance | | | JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | JavaNetHttpSSRF.java:30:32:30:35 | url1 | provenance | Sink:MaD:9 | | JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | JavaNetHttpSSRF.java:33:32:33:35 | url1 | provenance | Sink:MaD:9 | | JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | JavaNetHttpSSRF.java:34:30:34:33 | url1 | provenance | Sink:MaD:10 | | JavaNetHttpSSRF.java:28:32:28:35 | sink : String | JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | provenance | Config | -| JavaNetHttpSSRF.java:28:32:28:35 | sink : String | JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | provenance | MaD:297 | -| JaxWsSSRF.java:14:22:14:48 | getParameter(...) : String | JaxWsSSRF.java:15:23:15:25 | url | provenance | Src:MaD:285 Sink:MaD:23 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:26:28:26:34 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:17 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:28:41:28:47 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:18 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:29:41:29:47 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:20 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:30:41:30:47 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:19 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:32:27:32:33 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:250 | -| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:43:27:43:33 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:2 | -| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:48:23:48:29 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:2 | -| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | provenance | Src:MaD:285 | +| JavaNetHttpSSRF.java:28:32:28:35 | sink : String | JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | provenance | MaD:299 | +| JaxWsSSRF.java:14:22:14:48 | getParameter(...) : String | JaxWsSSRF.java:15:23:15:25 | url | provenance | Src:MaD:286 Sink:MaD:23 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:26:28:26:34 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:17 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:28:41:28:47 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:18 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:29:41:29:47 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:20 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:30:41:30:47 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:19 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:32:27:32:33 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:250 | +| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:43:27:43:33 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:2 | +| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:48:23:48:29 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:2 | +| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | provenance | Src:MaD:286 | | JdbcUrlSSRF.java:52:9:52:13 | props : Properties | JdbcUrlSSRF.java:54:49:54:53 | props | provenance | Sink:MaD:1 | | JdbcUrlSSRF.java:52:9:52:13 | props [post update] : Properties [] : String | JdbcUrlSSRF.java:54:49:54:53 | props | provenance | Sink:MaD:1 | | JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | JdbcUrlSSRF.java:52:9:52:13 | props : Properties | provenance | Config | -| JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | JdbcUrlSSRF.java:52:9:52:13 | props [post update] : Properties [] : String | provenance | MaD:302 | -| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:65:27:65:33 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:265 | -| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:67:75:67:81 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:266 | -| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:70:75:70:81 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:268 | -| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:73:75:73:81 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:267 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:82:21:82:27 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:243 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:83:21:83:27 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:244 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:84:21:84:27 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:245 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:86:19:86:25 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:246 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:87:19:87:25 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:247 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:88:19:88:25 | jdbcUrl | provenance | Src:MaD:285 Sink:MaD:248 | -| ReactiveWebClientSSRF.java:15:26:15:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:16:52:16:54 | url | provenance | Src:MaD:285 Sink:MaD:282 | -| ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:35:30:35:32 | url | provenance | Src:MaD:285 Sink:MaD:281 | +| JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | JdbcUrlSSRF.java:52:9:52:13 | props [post update] : Properties [] : String | provenance | MaD:304 | +| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:65:27:65:33 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:265 | +| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:67:75:67:81 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:266 | +| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:70:75:70:81 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:268 | +| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:73:75:73:81 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:267 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:82:21:82:27 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:243 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:83:21:83:27 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:244 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:84:21:84:27 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:245 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:86:19:86:25 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:246 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:87:19:87:25 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:247 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:88:19:88:25 | jdbcUrl | provenance | Src:MaD:286 Sink:MaD:248 | +| ReactiveWebClientSSRF.java:15:26:15:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:16:52:16:54 | url | provenance | Src:MaD:286 Sink:MaD:283 | +| ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:35:30:35:32 | url | provenance | Src:MaD:286 Sink:MaD:281 | +| ReactiveWebClientSSRF.java:55:24:55:50 | getParameter(...) : String | ReactiveWebClientSSRF.java:57:26:57:26 | p | provenance | Src:MaD:286 Sink:MaD:282 | +| ReactiveWebClientSSRF.java:62:25:62:51 | getParameter(...) : String | ReactiveWebClientSSRF.java:64:46:64:71 | ... + ... : String | provenance | Src:MaD:286 | +| ReactiveWebClientSSRF.java:64:46:64:71 | ... + ... : String | ReactiveWebClientSSRF.java:64:26:64:72 | create(...) | provenance | Config Sink:MaD:282 | +| ReactiveWebClientSSRF.java:64:46:64:71 | ... + ... : String | ReactiveWebClientSSRF.java:64:26:64:72 | create(...) | provenance | MaD:296 Sink:MaD:282 | | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | SanitizationTests.java:25:52:25:54 | uri | provenance | Sink:MaD:6 | | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | SanitizationTests.java:25:52:25:54 | uri : URI | provenance | | -| SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | provenance | Src:MaD:285 Config | -| SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | provenance | Src:MaD:285 MaD:293 | -| SanitizationTests.java:25:29:25:55 | newBuilder(...) : Builder | SanitizationTests.java:25:29:25:63 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | provenance | Src:MaD:286 Config | +| SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | provenance | Src:MaD:286 MaD:294 | +| SanitizationTests.java:25:29:25:55 | newBuilder(...) : Builder | SanitizationTests.java:25:29:25:63 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:25:29:25:63 | build(...) : HttpRequest | SanitizationTests.java:26:25:26:25 | r | provenance | Sink:MaD:4 | -| SanitizationTests.java:25:52:25:54 | uri : URI | SanitizationTests.java:25:29:25:55 | newBuilder(...) : Builder | provenance | MaD:292 | -| SanitizationTests.java:78:33:78:63 | getParameter(...) : String | SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | provenance | Src:MaD:285 | -| SanitizationTests.java:79:36:79:78 | newBuilder(...) : Builder | SanitizationTests.java:79:36:79:86 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:25:52:25:54 | uri : URI | SanitizationTests.java:25:29:25:55 | newBuilder(...) : Builder | provenance | MaD:293 | +| SanitizationTests.java:78:33:78:63 | getParameter(...) : String | SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | provenance | Src:MaD:286 | +| SanitizationTests.java:79:36:79:78 | newBuilder(...) : Builder | SanitizationTests.java:79:36:79:86 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:79:36:79:86 | build(...) : HttpRequest | SanitizationTests.java:80:25:80:32 | unsafer3 | provenance | Sink:MaD:4 | -| SanitizationTests.java:79:59:79:77 | new URI(...) : URI | SanitizationTests.java:79:36:79:78 | newBuilder(...) : Builder | provenance | MaD:292 | +| SanitizationTests.java:79:59:79:77 | new URI(...) : URI | SanitizationTests.java:79:36:79:78 | newBuilder(...) : Builder | provenance | MaD:293 | | SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) : URI | provenance | MaD:293 | -| SanitizationTests.java:82:49:82:79 | getParameter(...) : String | SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | provenance | Src:MaD:285 | -| SanitizationTests.java:83:36:83:78 | newBuilder(...) : Builder | SanitizationTests.java:83:36:83:86 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) : URI | provenance | MaD:294 | +| SanitizationTests.java:82:49:82:79 | getParameter(...) : String | SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | provenance | Src:MaD:286 | +| SanitizationTests.java:83:36:83:78 | newBuilder(...) : Builder | SanitizationTests.java:83:36:83:86 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:83:36:83:86 | build(...) : HttpRequest | SanitizationTests.java:84:25:84:32 | unsafer4 | provenance | Sink:MaD:4 | -| SanitizationTests.java:83:59:83:77 | new URI(...) : URI | SanitizationTests.java:83:36:83:78 | newBuilder(...) : Builder | provenance | MaD:292 | +| SanitizationTests.java:83:59:83:77 | new URI(...) : URI | SanitizationTests.java:83:36:83:78 | newBuilder(...) : Builder | provenance | MaD:293 | | SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) : URI | provenance | MaD:293 | +| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) : URI | provenance | MaD:294 | | SanitizationTests.java:87:13:87:22 | unsafeUri5 [post update] : StringBuilder | SanitizationTests.java:88:67:88:76 | unsafeUri5 : StringBuilder | provenance | | -| SanitizationTests.java:87:31:87:61 | getParameter(...) : String | SanitizationTests.java:87:13:87:22 | unsafeUri5 [post update] : StringBuilder | provenance | Src:MaD:285 MaD:286 | -| SanitizationTests.java:88:36:88:89 | newBuilder(...) : Builder | SanitizationTests.java:88:36:88:97 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:87:31:87:61 | getParameter(...) : String | SanitizationTests.java:87:13:87:22 | unsafeUri5 [post update] : StringBuilder | provenance | Src:MaD:286 MaD:287 | +| SanitizationTests.java:88:36:88:89 | newBuilder(...) : Builder | SanitizationTests.java:88:36:88:97 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:88:36:88:97 | build(...) : HttpRequest | SanitizationTests.java:89:25:89:32 | unsafer5 | provenance | Sink:MaD:4 | -| SanitizationTests.java:88:59:88:88 | new URI(...) : URI | SanitizationTests.java:88:36:88:89 | newBuilder(...) : Builder | provenance | MaD:292 | -| SanitizationTests.java:88:67:88:76 | unsafeUri5 : StringBuilder | SanitizationTests.java:88:67:88:87 | toString(...) : String | provenance | MaD:288 | +| SanitizationTests.java:88:59:88:88 | new URI(...) : URI | SanitizationTests.java:88:36:88:89 | newBuilder(...) : Builder | provenance | MaD:293 | +| SanitizationTests.java:88:67:88:76 | unsafeUri5 : StringBuilder | SanitizationTests.java:88:67:88:87 | toString(...) : String | provenance | MaD:289 | | SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) : URI | provenance | MaD:293 | +| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) : URI | provenance | MaD:294 | | SanitizationTests.java:91:40:91:87 | new StringBuilder(...) : StringBuilder | SanitizationTests.java:93:68:93:77 | unafeUri5a : StringBuilder | provenance | | -| SanitizationTests.java:91:58:91:86 | getParameter(...) : String | SanitizationTests.java:91:40:91:87 | new StringBuilder(...) : StringBuilder | provenance | Src:MaD:285 MaD:290 | -| SanitizationTests.java:93:37:93:90 | newBuilder(...) : Builder | SanitizationTests.java:93:37:93:98 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:91:58:91:86 | getParameter(...) : String | SanitizationTests.java:91:40:91:87 | new StringBuilder(...) : StringBuilder | provenance | Src:MaD:286 MaD:291 | +| SanitizationTests.java:93:37:93:90 | newBuilder(...) : Builder | SanitizationTests.java:93:37:93:98 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:93:37:93:98 | build(...) : HttpRequest | SanitizationTests.java:94:25:94:33 | unsafer5a | provenance | Sink:MaD:4 | -| SanitizationTests.java:93:60:93:89 | new URI(...) : URI | SanitizationTests.java:93:37:93:90 | newBuilder(...) : Builder | provenance | MaD:292 | -| SanitizationTests.java:93:68:93:77 | unafeUri5a : StringBuilder | SanitizationTests.java:93:68:93:88 | toString(...) : String | provenance | MaD:288 | +| SanitizationTests.java:93:60:93:89 | new URI(...) : URI | SanitizationTests.java:93:37:93:90 | newBuilder(...) : Builder | provenance | MaD:293 | +| SanitizationTests.java:93:68:93:77 | unafeUri5a : StringBuilder | SanitizationTests.java:93:68:93:88 | toString(...) : String | provenance | MaD:289 | | SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) : URI | provenance | MaD:293 | +| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) : URI | provenance | MaD:294 | | SanitizationTests.java:96:41:96:105 | append(...) : StringBuilder | SanitizationTests.java:98:68:98:78 | unsafeUri5b : StringBuilder | provenance | | -| SanitizationTests.java:96:42:96:89 | new StringBuilder(...) : StringBuilder | SanitizationTests.java:96:41:96:105 | append(...) : StringBuilder | provenance | MaD:287 | -| SanitizationTests.java:96:60:96:88 | getParameter(...) : String | SanitizationTests.java:96:42:96:89 | new StringBuilder(...) : StringBuilder | provenance | Src:MaD:285 MaD:290 | -| SanitizationTests.java:98:37:98:91 | newBuilder(...) : Builder | SanitizationTests.java:98:37:98:99 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:96:42:96:89 | new StringBuilder(...) : StringBuilder | SanitizationTests.java:96:41:96:105 | append(...) : StringBuilder | provenance | MaD:288 | +| SanitizationTests.java:96:60:96:88 | getParameter(...) : String | SanitizationTests.java:96:42:96:89 | new StringBuilder(...) : StringBuilder | provenance | Src:MaD:286 MaD:291 | +| SanitizationTests.java:98:37:98:91 | newBuilder(...) : Builder | SanitizationTests.java:98:37:98:99 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:98:37:98:99 | build(...) : HttpRequest | SanitizationTests.java:99:25:99:33 | unsafer5b | provenance | Sink:MaD:4 | -| SanitizationTests.java:98:60:98:90 | new URI(...) : URI | SanitizationTests.java:98:37:98:91 | newBuilder(...) : Builder | provenance | MaD:292 | -| SanitizationTests.java:98:68:98:78 | unsafeUri5b : StringBuilder | SanitizationTests.java:98:68:98:89 | toString(...) : String | provenance | MaD:288 | +| SanitizationTests.java:98:60:98:90 | new URI(...) : URI | SanitizationTests.java:98:37:98:91 | newBuilder(...) : Builder | provenance | MaD:293 | +| SanitizationTests.java:98:68:98:78 | unsafeUri5b : StringBuilder | SanitizationTests.java:98:68:98:89 | toString(...) : String | provenance | MaD:289 | | SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) : URI | provenance | MaD:293 | +| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) : URI | provenance | MaD:294 | | SanitizationTests.java:101:41:101:106 | append(...) : StringBuilder | SanitizationTests.java:103:68:103:78 | unsafeUri5c : StringBuilder | provenance | | -| SanitizationTests.java:101:77:101:105 | getParameter(...) : String | SanitizationTests.java:101:41:101:106 | append(...) : StringBuilder | provenance | Src:MaD:285 MaD:286+MaD:287 | -| SanitizationTests.java:103:37:103:91 | newBuilder(...) : Builder | SanitizationTests.java:103:37:103:99 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:101:77:101:105 | getParameter(...) : String | SanitizationTests.java:101:41:101:106 | append(...) : StringBuilder | provenance | Src:MaD:286 MaD:287+MaD:288 | +| SanitizationTests.java:103:37:103:91 | newBuilder(...) : Builder | SanitizationTests.java:103:37:103:99 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:103:37:103:99 | build(...) : HttpRequest | SanitizationTests.java:104:25:104:33 | unsafer5c | provenance | Sink:MaD:4 | -| SanitizationTests.java:103:60:103:90 | new URI(...) : URI | SanitizationTests.java:103:37:103:91 | newBuilder(...) : Builder | provenance | MaD:292 | -| SanitizationTests.java:103:68:103:78 | unsafeUri5c : StringBuilder | SanitizationTests.java:103:68:103:89 | toString(...) : String | provenance | MaD:288 | +| SanitizationTests.java:103:60:103:90 | new URI(...) : URI | SanitizationTests.java:103:37:103:91 | newBuilder(...) : Builder | provenance | MaD:293 | +| SanitizationTests.java:103:68:103:78 | unsafeUri5c : StringBuilder | SanitizationTests.java:103:68:103:89 | toString(...) : String | provenance | MaD:289 | | SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) : URI | provenance | MaD:293 | +| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) : URI | provenance | MaD:294 | | SanitizationTests.java:106:33:106:104 | format(...) : String | SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | provenance | | -| SanitizationTests.java:106:33:106:104 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:106:33:106:104 | format(...) : String | provenance | MaD:289 | -| SanitizationTests.java:106:73:106:103 | getParameter(...) : String | SanitizationTests.java:106:33:106:104 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:285 | -| SanitizationTests.java:107:36:107:78 | newBuilder(...) : Builder | SanitizationTests.java:107:36:107:86 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:106:33:106:104 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:106:33:106:104 | format(...) : String | provenance | MaD:290 | +| SanitizationTests.java:106:73:106:103 | getParameter(...) : String | SanitizationTests.java:106:33:106:104 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:286 | +| SanitizationTests.java:107:36:107:78 | newBuilder(...) : Builder | SanitizationTests.java:107:36:107:86 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:107:36:107:86 | build(...) : HttpRequest | SanitizationTests.java:108:25:108:32 | unsafer6 | provenance | Sink:MaD:4 | -| SanitizationTests.java:107:59:107:77 | new URI(...) : URI | SanitizationTests.java:107:36:107:78 | newBuilder(...) : Builder | provenance | MaD:292 | +| SanitizationTests.java:107:59:107:77 | new URI(...) : URI | SanitizationTests.java:107:36:107:78 | newBuilder(...) : Builder | provenance | MaD:293 | | SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) : URI | provenance | MaD:293 | +| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) : URI | provenance | MaD:294 | | SanitizationTests.java:110:33:110:110 | format(...) : String | SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | provenance | | -| SanitizationTests.java:110:33:110:110 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:110:33:110:110 | format(...) : String | provenance | MaD:289 | -| SanitizationTests.java:110:56:110:86 | getParameter(...) : String | SanitizationTests.java:110:33:110:110 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:285 | -| SanitizationTests.java:111:36:111:78 | newBuilder(...) : Builder | SanitizationTests.java:111:36:111:86 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:110:33:110:110 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:110:33:110:110 | format(...) : String | provenance | MaD:290 | +| SanitizationTests.java:110:56:110:86 | getParameter(...) : String | SanitizationTests.java:110:33:110:110 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:286 | +| SanitizationTests.java:111:36:111:78 | newBuilder(...) : Builder | SanitizationTests.java:111:36:111:86 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:111:36:111:86 | build(...) : HttpRequest | SanitizationTests.java:112:25:112:32 | unsafer7 | provenance | Sink:MaD:4 | -| SanitizationTests.java:111:59:111:77 | new URI(...) : URI | SanitizationTests.java:111:36:111:78 | newBuilder(...) : Builder | provenance | MaD:292 | +| SanitizationTests.java:111:59:111:77 | new URI(...) : URI | SanitizationTests.java:111:36:111:78 | newBuilder(...) : Builder | provenance | MaD:293 | | SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) : URI | provenance | MaD:293 | +| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) : URI | provenance | MaD:294 | | SanitizationTests.java:114:33:114:110 | format(...) : String | SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | provenance | | -| SanitizationTests.java:114:33:114:110 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:114:33:114:110 | format(...) : String | provenance | MaD:289 | -| SanitizationTests.java:114:55:114:85 | getParameter(...) : String | SanitizationTests.java:114:33:114:110 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:285 | -| SanitizationTests.java:115:36:115:78 | newBuilder(...) : Builder | SanitizationTests.java:115:36:115:86 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:114:33:114:110 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:114:33:114:110 | format(...) : String | provenance | MaD:290 | +| SanitizationTests.java:114:55:114:85 | getParameter(...) : String | SanitizationTests.java:114:33:114:110 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:286 | +| SanitizationTests.java:115:36:115:78 | newBuilder(...) : Builder | SanitizationTests.java:115:36:115:86 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:115:36:115:86 | build(...) : HttpRequest | SanitizationTests.java:116:25:116:32 | unsafer8 | provenance | Sink:MaD:4 | -| SanitizationTests.java:115:59:115:77 | new URI(...) : URI | SanitizationTests.java:115:36:115:78 | newBuilder(...) : Builder | provenance | MaD:292 | +| SanitizationTests.java:115:59:115:77 | new URI(...) : URI | SanitizationTests.java:115:36:115:78 | newBuilder(...) : Builder | provenance | MaD:293 | | SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) : URI | provenance | MaD:293 | -| SanitizationTests.java:118:33:118:63 | getParameter(...) : String | SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | provenance | Src:MaD:285 | -| SanitizationTests.java:119:36:119:78 | newBuilder(...) : Builder | SanitizationTests.java:119:36:119:86 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) : URI | provenance | MaD:294 | +| SanitizationTests.java:118:33:118:63 | getParameter(...) : String | SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | provenance | Src:MaD:286 | +| SanitizationTests.java:119:36:119:78 | newBuilder(...) : Builder | SanitizationTests.java:119:36:119:86 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:119:36:119:86 | build(...) : HttpRequest | SanitizationTests.java:120:25:120:32 | unsafer9 | provenance | Sink:MaD:4 | -| SanitizationTests.java:119:59:119:77 | new URI(...) : URI | SanitizationTests.java:119:36:119:78 | newBuilder(...) : Builder | provenance | MaD:292 | +| SanitizationTests.java:119:59:119:77 | new URI(...) : URI | SanitizationTests.java:119:36:119:78 | newBuilder(...) : Builder | provenance | MaD:293 | | SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) : URI | provenance | MaD:293 | +| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) : URI | provenance | MaD:294 | | SanitizationTests.java:122:34:122:126 | format(...) : String | SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | provenance | | -| SanitizationTests.java:122:34:122:126 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:122:34:122:126 | format(...) : String | provenance | MaD:289 | -| SanitizationTests.java:122:94:122:125 | getParameter(...) : String | SanitizationTests.java:122:34:122:126 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:285 | -| SanitizationTests.java:123:37:123:80 | newBuilder(...) : Builder | SanitizationTests.java:123:37:123:88 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:122:34:122:126 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:122:34:122:126 | format(...) : String | provenance | MaD:290 | +| SanitizationTests.java:122:94:122:125 | getParameter(...) : String | SanitizationTests.java:122:34:122:126 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:286 | +| SanitizationTests.java:123:37:123:80 | newBuilder(...) : Builder | SanitizationTests.java:123:37:123:88 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:123:37:123:88 | build(...) : HttpRequest | SanitizationTests.java:124:25:124:33 | unsafer10 | provenance | Sink:MaD:4 | -| SanitizationTests.java:123:60:123:79 | new URI(...) : URI | SanitizationTests.java:123:37:123:80 | newBuilder(...) : Builder | provenance | MaD:292 | +| SanitizationTests.java:123:60:123:79 | new URI(...) : URI | SanitizationTests.java:123:37:123:80 | newBuilder(...) : Builder | provenance | MaD:293 | | SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) : URI | provenance | MaD:293 | -| SanitizationTests.java:177:31:177:114 | newBuilder(...) : Builder | SanitizationTests.java:177:31:177:122 | build(...) : HttpRequest | provenance | MaD:291 | +| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) : URI | provenance | MaD:294 | +| SanitizationTests.java:177:31:177:114 | newBuilder(...) : Builder | SanitizationTests.java:177:31:177:122 | build(...) : HttpRequest | provenance | MaD:292 | | SanitizationTests.java:177:31:177:122 | build(...) : HttpRequest | SanitizationTests.java:178:25:178:27 | r18 | provenance | Sink:MaD:4 | -| SanitizationTests.java:177:54:177:113 | new URI(...) : URI | SanitizationTests.java:177:31:177:114 | newBuilder(...) : Builder | provenance | MaD:292 | +| SanitizationTests.java:177:54:177:113 | new URI(...) : URI | SanitizationTests.java:177:31:177:114 | newBuilder(...) : Builder | provenance | MaD:293 | | SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) | provenance | Config Sink:MaD:6 | -| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) | provenance | MaD:293 Sink:MaD:6 | +| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) | provenance | MaD:294 Sink:MaD:6 | | SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) : URI | provenance | MaD:293 | -| SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | SanitizationTests.java:177:62:177:112 | getFromList(...) : String | provenance | MaD:299 | +| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) : URI | provenance | MaD:294 | +| SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | SanitizationTests.java:177:62:177:112 | getFromList(...) : String | provenance | MaD:301 | | SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | SanitizationTests.java:199:31:199:112 | list : List [] : String | provenance | | -| SanitizationTests.java:177:82:177:110 | getParameter(...) : String | SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | provenance | Src:MaD:285 MaD:298 | +| SanitizationTests.java:177:82:177:110 | getParameter(...) : String | SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | provenance | Src:MaD:286 MaD:300 | | SanitizationTests.java:199:31:199:112 | list : List [] : String | SanitizationTests.java:200:16:200:19 | list : List [] : String | provenance | | -| SanitizationTests.java:200:16:200:19 | list : List [] : String | SanitizationTests.java:200:16:200:26 | get(...) : String | provenance | MaD:299 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:32:39:32:59 | ... + ... | provenance | Src:MaD:285 Sink:MaD:272 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:33:69:33:82 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:34:73:34:86 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:35:87:35:100 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:38:83:38:96 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:40:105:40:118 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:43:35:43:48 | fooResourceUrl | provenance | Src:MaD:285 Sink:MaD:270 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:44:91:44:104 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:45:95:45:108 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:46:109:46:122 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:49:105:49:118 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:51:127:51:140 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:54:34:54:47 | fooResourceUrl | provenance | Src:MaD:285 Sink:MaD:271 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:55:79:55:92 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:56:83:56:96 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:57:97:57:110 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:60:93:60:106 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:62:115:62:128 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:65:39:65:52 | fooResourceUrl | provenance | Src:MaD:285 Sink:MaD:273 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:66:69:66:82 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:67:73:67:86 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:68:87:68:100 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:71:83:71:96 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:73:105:73:118 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:76:41:76:54 | fooResourceUrl | provenance | Src:MaD:285 Sink:MaD:276 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:77:93:77:106 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:78:97:78:110 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:79:111:79:124 | fooResourceUrl | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:82:107:82:120 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:84:129:84:142 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | provenance | Src:MaD:285 | -| SpringSSRF.java:38:83:38:96 | fooResourceUrl : String | SpringSSRF.java:38:69:38:97 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:40:105:40:118 | fooResourceUrl : String | SpringSSRF.java:40:69:40:119 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:49:105:49:118 | fooResourceUrl : String | SpringSSRF.java:49:91:49:119 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:51:127:51:140 | fooResourceUrl : String | SpringSSRF.java:51:91:51:141 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:60:93:60:106 | fooResourceUrl : String | SpringSSRF.java:60:79:60:107 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:62:115:62:128 | fooResourceUrl : String | SpringSSRF.java:62:79:62:129 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:71:83:71:96 | fooResourceUrl : String | SpringSSRF.java:71:69:71:97 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:73:105:73:118 | fooResourceUrl : String | SpringSSRF.java:73:69:73:119 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:82:107:82:120 | fooResourceUrl : String | SpringSSRF.java:82:93:82:121 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:84:129:84:142 | fooResourceUrl : String | SpringSSRF.java:84:93:84:143 | of(...) | provenance | MaD:301 | +| SanitizationTests.java:200:16:200:19 | list : List [] : String | SanitizationTests.java:200:16:200:26 | get(...) : String | provenance | MaD:301 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:32:39:32:59 | ... + ... | provenance | Src:MaD:286 Sink:MaD:272 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:33:69:33:82 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:34:73:34:86 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:35:87:35:100 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:38:83:38:96 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:40:105:40:118 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:43:35:43:48 | fooResourceUrl | provenance | Src:MaD:286 Sink:MaD:270 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:44:91:44:104 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:45:95:45:108 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:46:109:46:122 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:49:105:49:118 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:51:127:51:140 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:54:34:54:47 | fooResourceUrl | provenance | Src:MaD:286 Sink:MaD:271 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:55:79:55:92 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:56:83:56:96 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:57:97:57:110 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:60:93:60:106 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:62:115:62:128 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:65:39:65:52 | fooResourceUrl | provenance | Src:MaD:286 Sink:MaD:273 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:66:69:66:82 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:67:73:67:86 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:68:87:68:100 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:71:83:71:96 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:73:105:73:118 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:76:41:76:54 | fooResourceUrl | provenance | Src:MaD:286 Sink:MaD:276 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:77:93:77:106 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:78:97:78:110 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:79:111:79:124 | fooResourceUrl | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:82:107:82:120 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:84:129:84:142 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | provenance | Src:MaD:286 | +| SpringSSRF.java:38:83:38:96 | fooResourceUrl : String | SpringSSRF.java:38:69:38:97 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:40:105:40:118 | fooResourceUrl : String | SpringSSRF.java:40:69:40:119 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:49:105:49:118 | fooResourceUrl : String | SpringSSRF.java:49:91:49:119 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:51:127:51:140 | fooResourceUrl : String | SpringSSRF.java:51:91:51:141 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:60:93:60:106 | fooResourceUrl : String | SpringSSRF.java:60:79:60:107 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:62:115:62:128 | fooResourceUrl : String | SpringSSRF.java:62:79:62:129 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:71:83:71:96 | fooResourceUrl : String | SpringSSRF.java:71:69:71:97 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:73:105:73:118 | fooResourceUrl : String | SpringSSRF.java:73:69:73:119 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:82:107:82:120 | fooResourceUrl : String | SpringSSRF.java:82:93:82:121 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:84:129:84:142 | fooResourceUrl : String | SpringSSRF.java:84:93:84:143 | of(...) | provenance | MaD:303 | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:87:40:87:62 | new URI(...) | provenance | Config Sink:MaD:277 | -| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:87:40:87:62 | new URI(...) | provenance | MaD:293 Sink:MaD:277 | +| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:87:40:87:62 | new URI(...) | provenance | MaD:294 Sink:MaD:277 | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:88:92:88:105 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:89:96:89:109 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:90:110:90:123 | fooResourceUrl | provenance | | @@ -956,20 +962,20 @@ edges | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:159:72:159:85 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:161:94:161:107 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | provenance | | -| SpringSSRF.java:93:106:93:119 | fooResourceUrl : String | SpringSSRF.java:93:92:93:120 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:95:128:95:141 | fooResourceUrl : String | SpringSSRF.java:95:92:95:142 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:104:94:104:107 | fooResourceUrl : String | SpringSSRF.java:104:80:104:108 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:106:116:106:129 | fooResourceUrl : String | SpringSSRF.java:106:80:106:130 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:115:106:115:119 | fooResourceUrl : String | SpringSSRF.java:115:92:115:120 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:117:128:117:141 | fooResourceUrl : String | SpringSSRF.java:117:92:117:142 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:126:82:126:95 | fooResourceUrl : String | SpringSSRF.java:126:68:126:96 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:128:104:128:117 | fooResourceUrl : String | SpringSSRF.java:128:68:128:118 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:137:63:137:76 | fooResourceUrl : String | SpringSSRF.java:137:49:137:77 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:139:85:139:98 | fooResourceUrl : String | SpringSSRF.java:139:49:139:99 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:148:71:148:84 | fooResourceUrl : String | SpringSSRF.java:148:57:148:85 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:150:93:150:106 | fooResourceUrl : String | SpringSSRF.java:150:57:150:107 | of(...) | provenance | MaD:301 | -| SpringSSRF.java:159:72:159:85 | fooResourceUrl : String | SpringSSRF.java:159:58:159:86 | of(...) | provenance | MaD:300 | -| SpringSSRF.java:161:94:161:107 | fooResourceUrl : String | SpringSSRF.java:161:58:161:108 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:93:106:93:119 | fooResourceUrl : String | SpringSSRF.java:93:92:93:120 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:95:128:95:141 | fooResourceUrl : String | SpringSSRF.java:95:92:95:142 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:104:94:104:107 | fooResourceUrl : String | SpringSSRF.java:104:80:104:108 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:106:116:106:129 | fooResourceUrl : String | SpringSSRF.java:106:80:106:130 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:115:106:115:119 | fooResourceUrl : String | SpringSSRF.java:115:92:115:120 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:117:128:117:141 | fooResourceUrl : String | SpringSSRF.java:117:92:117:142 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:126:82:126:95 | fooResourceUrl : String | SpringSSRF.java:126:68:126:96 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:128:104:128:117 | fooResourceUrl : String | SpringSSRF.java:128:68:128:118 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:137:63:137:76 | fooResourceUrl : String | SpringSSRF.java:137:49:137:77 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:139:85:139:98 | fooResourceUrl : String | SpringSSRF.java:139:49:139:99 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:148:71:148:84 | fooResourceUrl : String | SpringSSRF.java:148:57:148:85 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:150:93:150:106 | fooResourceUrl : String | SpringSSRF.java:150:57:150:107 | of(...) | provenance | MaD:303 | +| SpringSSRF.java:159:72:159:85 | fooResourceUrl : String | SpringSSRF.java:159:58:159:86 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:161:94:161:107 | fooResourceUrl : String | SpringSSRF.java:161:58:161:108 | of(...) | provenance | MaD:303 | | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:168:44:168:46 | uri | provenance | Sink:MaD:263 | | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:170:35:170:37 | uri | provenance | Sink:MaD:258 | | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:171:35:171:37 | uri | provenance | Sink:MaD:264 | @@ -979,7 +985,7 @@ edges | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:175:36:175:38 | uri | provenance | Sink:MaD:259 | | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:176:44:176:46 | uri | provenance | Sink:MaD:260 | | SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | provenance | Config | -| SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | provenance | MaD:293 | +| SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | provenance | MaD:294 | | SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | SpringSSRF.java:179:35:179:48 | fooResourceUrl : String | provenance | | | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:182:49:182:51 | uri | provenance | Sink:MaD:251 | | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:183:58:183:60 | uri | provenance | Sink:MaD:252 | @@ -988,84 +994,84 @@ edges | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:186:57:186:59 | uri | provenance | Sink:MaD:254 | | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:187:66:187:68 | uri | provenance | Sink:MaD:256 | | SpringSSRF.java:179:35:179:48 | fooResourceUrl : String | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | provenance | Config | -| SpringSSRF.java:179:35:179:48 | fooResourceUrl : String | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | provenance | MaD:293 | -| URLClassLoaderSSRF.java:16:26:16:52 | getParameter(...) : String | URLClassLoaderSSRF.java:17:31:17:33 | url : String | provenance | Src:MaD:285 | +| SpringSSRF.java:179:35:179:48 | fooResourceUrl : String | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | provenance | MaD:294 | +| URLClassLoaderSSRF.java:16:26:16:52 | getParameter(...) : String | URLClassLoaderSSRF.java:17:31:17:33 | url : String | provenance | Src:MaD:286 | | URLClassLoaderSSRF.java:17:23:17:34 | new URI(...) : URI | URLClassLoaderSSRF.java:18:74:18:76 | uri : URI | provenance | | | URLClassLoaderSSRF.java:17:31:17:33 | url : String | URLClassLoaderSSRF.java:17:23:17:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:17:31:17:33 | url : String | URLClassLoaderSSRF.java:17:23:17:34 | new URI(...) : URI | provenance | MaD:293 | +| URLClassLoaderSSRF.java:17:31:17:33 | url : String | URLClassLoaderSSRF.java:17:23:17:34 | new URI(...) : URI | provenance | MaD:294 | | URLClassLoaderSSRF.java:18:64:18:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:18:64:18:85 | new URL[] | provenance | Sink:MaD:13 | | URLClassLoaderSSRF.java:18:64:18:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:18:64:18:85 | new URL[] | provenance | Sink:MaD:13 | -| URLClassLoaderSSRF.java:18:74:18:76 | uri : URI | URLClassLoaderSSRF.java:18:74:18:84 | toURL(...) : URL | provenance | MaD:296 | +| URLClassLoaderSSRF.java:18:74:18:76 | uri : URI | URLClassLoaderSSRF.java:18:74:18:84 | toURL(...) : URL | provenance | MaD:298 | | URLClassLoaderSSRF.java:18:74:18:84 | toURL(...) : URL | URLClassLoaderSSRF.java:18:64:18:85 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:28:26:28:52 | getParameter(...) : String | URLClassLoaderSSRF.java:29:31:29:33 | url : String | provenance | Src:MaD:285 | +| URLClassLoaderSSRF.java:28:26:28:52 | getParameter(...) : String | URLClassLoaderSSRF.java:29:31:29:33 | url : String | provenance | Src:MaD:286 | | URLClassLoaderSSRF.java:29:23:29:34 | new URI(...) : URI | URLClassLoaderSSRF.java:30:74:30:76 | uri : URI | provenance | | | URLClassLoaderSSRF.java:29:31:29:33 | url : String | URLClassLoaderSSRF.java:29:23:29:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:29:31:29:33 | url : String | URLClassLoaderSSRF.java:29:23:29:34 | new URI(...) : URI | provenance | MaD:293 | +| URLClassLoaderSSRF.java:29:31:29:33 | url : String | URLClassLoaderSSRF.java:29:23:29:34 | new URI(...) : URI | provenance | MaD:294 | | URLClassLoaderSSRF.java:30:64:30:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:30:64:30:85 | new URL[] | provenance | Sink:MaD:14 | | URLClassLoaderSSRF.java:30:64:30:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:30:64:30:85 | new URL[] | provenance | Sink:MaD:14 | -| URLClassLoaderSSRF.java:30:74:30:76 | uri : URI | URLClassLoaderSSRF.java:30:74:30:84 | toURL(...) : URL | provenance | MaD:296 | +| URLClassLoaderSSRF.java:30:74:30:76 | uri : URI | URLClassLoaderSSRF.java:30:74:30:84 | toURL(...) : URL | provenance | MaD:298 | | URLClassLoaderSSRF.java:30:74:30:84 | toURL(...) : URL | URLClassLoaderSSRF.java:30:64:30:85 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:40:26:40:52 | getParameter(...) : String | URLClassLoaderSSRF.java:41:31:41:33 | url : String | provenance | Src:MaD:285 | +| URLClassLoaderSSRF.java:40:26:40:52 | getParameter(...) : String | URLClassLoaderSSRF.java:41:31:41:33 | url : String | provenance | Src:MaD:286 | | URLClassLoaderSSRF.java:41:23:41:34 | new URI(...) : URI | URLClassLoaderSSRF.java:44:74:44:76 | uri : URI | provenance | | | URLClassLoaderSSRF.java:41:31:41:33 | url : String | URLClassLoaderSSRF.java:41:23:41:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:41:31:41:33 | url : String | URLClassLoaderSSRF.java:41:23:41:34 | new URI(...) : URI | provenance | MaD:293 | +| URLClassLoaderSSRF.java:41:31:41:33 | url : String | URLClassLoaderSSRF.java:41:23:41:34 | new URI(...) : URI | provenance | MaD:294 | | URLClassLoaderSSRF.java:44:64:44:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:44:64:44:85 | new URL[] | provenance | Sink:MaD:15 | | URLClassLoaderSSRF.java:44:64:44:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:44:64:44:85 | new URL[] | provenance | Sink:MaD:15 | -| URLClassLoaderSSRF.java:44:74:44:76 | uri : URI | URLClassLoaderSSRF.java:44:74:44:84 | toURL(...) : URL | provenance | MaD:296 | +| URLClassLoaderSSRF.java:44:74:44:76 | uri : URI | URLClassLoaderSSRF.java:44:74:44:84 | toURL(...) : URL | provenance | MaD:298 | | URLClassLoaderSSRF.java:44:74:44:84 | toURL(...) : URL | URLClassLoaderSSRF.java:44:64:44:85 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:54:26:54:52 | getParameter(...) : String | URLClassLoaderSSRF.java:55:31:55:33 | url : String | provenance | Src:MaD:285 | +| URLClassLoaderSSRF.java:54:26:54:52 | getParameter(...) : String | URLClassLoaderSSRF.java:55:31:55:33 | url : String | provenance | Src:MaD:286 | | URLClassLoaderSSRF.java:55:23:55:34 | new URI(...) : URI | URLClassLoaderSSRF.java:56:82:56:84 | uri : URI | provenance | | | URLClassLoaderSSRF.java:55:31:55:33 | url : String | URLClassLoaderSSRF.java:55:23:55:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:55:31:55:33 | url : String | URLClassLoaderSSRF.java:55:23:55:34 | new URI(...) : URI | provenance | MaD:293 | +| URLClassLoaderSSRF.java:55:31:55:33 | url : String | URLClassLoaderSSRF.java:55:23:55:34 | new URI(...) : URI | provenance | MaD:294 | | URLClassLoaderSSRF.java:56:72:56:93 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:56:72:56:93 | new URL[] | provenance | Sink:MaD:16 | -| URLClassLoaderSSRF.java:56:82:56:84 | uri : URI | URLClassLoaderSSRF.java:56:82:56:92 | toURL(...) : URL | provenance | MaD:296 | +| URLClassLoaderSSRF.java:56:82:56:84 | uri : URI | URLClassLoaderSSRF.java:56:82:56:92 | toURL(...) : URL | provenance | MaD:298 | | URLClassLoaderSSRF.java:56:82:56:92 | toURL(...) : URL | URLClassLoaderSSRF.java:56:72:56:93 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:66:26:66:52 | getParameter(...) : String | URLClassLoaderSSRF.java:67:31:67:33 | url : String | provenance | Src:MaD:285 | +| URLClassLoaderSSRF.java:66:26:66:52 | getParameter(...) : String | URLClassLoaderSSRF.java:67:31:67:33 | url : String | provenance | Src:MaD:286 | | URLClassLoaderSSRF.java:67:23:67:34 | new URI(...) : URI | URLClassLoaderSSRF.java:70:31:70:33 | uri : URI | provenance | | | URLClassLoaderSSRF.java:67:31:67:33 | url : String | URLClassLoaderSSRF.java:67:23:67:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:67:31:67:33 | url : String | URLClassLoaderSSRF.java:67:23:67:34 | new URI(...) : URI | provenance | MaD:293 | +| URLClassLoaderSSRF.java:67:31:67:33 | url : String | URLClassLoaderSSRF.java:67:23:67:34 | new URI(...) : URI | provenance | MaD:294 | | URLClassLoaderSSRF.java:70:21:70:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:70:21:70:42 | new URL[] | provenance | Sink:MaD:11 | | URLClassLoaderSSRF.java:70:21:70:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:70:21:70:42 | new URL[] | provenance | Sink:MaD:11 | -| URLClassLoaderSSRF.java:70:31:70:33 | uri : URI | URLClassLoaderSSRF.java:70:31:70:41 | toURL(...) : URL | provenance | MaD:296 | +| URLClassLoaderSSRF.java:70:31:70:33 | uri : URI | URLClassLoaderSSRF.java:70:31:70:41 | toURL(...) : URL | provenance | MaD:298 | | URLClassLoaderSSRF.java:70:31:70:41 | toURL(...) : URL | URLClassLoaderSSRF.java:70:21:70:42 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:83:26:83:52 | getParameter(...) : String | URLClassLoaderSSRF.java:84:31:84:33 | url : String | provenance | Src:MaD:285 | +| URLClassLoaderSSRF.java:83:26:83:52 | getParameter(...) : String | URLClassLoaderSSRF.java:84:31:84:33 | url : String | provenance | Src:MaD:286 | | URLClassLoaderSSRF.java:84:23:84:34 | new URI(...) : URI | URLClassLoaderSSRF.java:89:31:89:33 | uri : URI | provenance | | | URLClassLoaderSSRF.java:84:31:84:33 | url : String | URLClassLoaderSSRF.java:84:23:84:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:84:31:84:33 | url : String | URLClassLoaderSSRF.java:84:23:84:34 | new URI(...) : URI | provenance | MaD:293 | +| URLClassLoaderSSRF.java:84:31:84:33 | url : String | URLClassLoaderSSRF.java:84:23:84:34 | new URI(...) : URI | provenance | MaD:294 | | URLClassLoaderSSRF.java:89:21:89:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:89:21:89:42 | new URL[] | provenance | Sink:MaD:12 | | URLClassLoaderSSRF.java:89:21:89:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:89:21:89:42 | new URL[] | provenance | Sink:MaD:12 | -| URLClassLoaderSSRF.java:89:31:89:33 | uri : URI | URLClassLoaderSSRF.java:89:31:89:41 | toURL(...) : URL | provenance | MaD:296 | +| URLClassLoaderSSRF.java:89:31:89:33 | uri : URI | URLClassLoaderSSRF.java:89:31:89:41 | toURL(...) : URL | provenance | MaD:298 | | URLClassLoaderSSRF.java:89:31:89:41 | toURL(...) : URL | URLClassLoaderSSRF.java:89:21:89:42 | {...} : URL[] [[]] : URL | provenance | | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:31:40:31:47 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:36:16:36:23 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:38:36:38:43 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:40:16:40:23 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:45:40:45:47 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:47:40:47:47 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:49:36:49:43 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:51:36:51:43 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:53:36:53:43 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:55:44:55:51 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:57:38:57:45 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:59:44:59:51 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:61:53:61:60 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:63:32:63:39 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:65:44:65:51 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:67:32:67:39 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:69:33:69:40 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:71:53:71:60 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:74:58:74:65 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:76:62:76:69 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:78:52:78:59 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:80:34:80:41 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:82:40:82:47 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:84:40:84:47 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:86:50:86:57 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:92:33:92:40 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:97:35:97:42 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:102:32:102:39 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:107:24:107:31 | source(...) : String | provenance | Src:MaD:285 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:112:24:112:31 | source(...) : String | provenance | Src:MaD:285 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:31:40:31:47 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:36:16:36:23 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:38:36:38:43 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:40:16:40:23 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:45:40:45:47 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:47:40:47:47 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:49:36:49:43 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:51:36:51:43 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:53:36:53:43 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:55:44:55:51 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:57:38:57:45 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:59:44:59:51 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:61:53:61:60 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:63:32:63:39 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:65:44:65:51 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:67:32:67:39 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:69:33:69:40 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:71:53:71:60 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:74:58:74:65 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:76:62:76:69 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:78:52:78:59 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:80:34:80:41 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:82:40:82:47 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:84:40:84:47 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:86:50:86:57 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:92:33:92:40 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:97:35:97:42 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:102:32:102:39 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:107:24:107:31 | source(...) : String | provenance | Src:MaD:286 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:112:24:112:31 | source(...) : String | provenance | Src:MaD:286 | | mad/Test.java:31:40:31:47 | source(...) : String | mad/Test.java:31:24:31:47 | (...)... | provenance | Sink:MaD:7 | | mad/Test.java:36:16:36:23 | source(...) : String | mad/Test.java:36:10:36:23 | (...)... | provenance | Sink:MaD:9 | | mad/Test.java:38:36:38:43 | source(...) : String | mad/Test.java:38:28:38:43 | (...)... | provenance | Sink:MaD:8 | @@ -1099,8 +1105,8 @@ edges | mad/Test.java:92:33:92:40 | source(...) : String | mad/Test.java:92:24:92:40 | (...)... | provenance | Sink:MaD:21 | | mad/Test.java:97:35:97:42 | source(...) : String | mad/Test.java:97:29:97:42 | (...)... | provenance | Sink:MaD:242 | | mad/Test.java:102:32:102:39 | source(...) : String | mad/Test.java:102:26:102:39 | (...)... | provenance | Sink:MaD:249 | -| mad/Test.java:107:24:107:31 | source(...) : String | mad/Test.java:107:15:107:31 | (...)... | provenance | Sink:MaD:284 | -| mad/Test.java:112:24:112:31 | source(...) : String | mad/Test.java:112:15:112:31 | (...)... | provenance | Sink:MaD:283 | +| mad/Test.java:107:24:107:31 | source(...) : String | mad/Test.java:107:15:107:31 | (...)... | provenance | Sink:MaD:285 | +| mad/Test.java:112:24:112:31 | source(...) : String | mad/Test.java:112:15:112:31 | (...)... | provenance | Sink:MaD:284 | models | 1 | Sink: com.zaxxer.hikari; HikariConfig; false; HikariConfig; (Properties); ; Argument[0]; request-forgery; manual | | 2 | Sink: com.zaxxer.hikari; HikariConfig; false; setJdbcUrl; (String); ; Argument[0]; request-forgery; manual | @@ -1383,32 +1389,34 @@ models | 279 | Sink: org.springframework.web.client; RestTemplate; false; postForObject; ; ; Argument[0]; request-forgery; manual | | 280 | Sink: org.springframework.web.client; RestTemplate; false; put; ; ; Argument[0]; request-forgery; manual | | 281 | Sink: org.springframework.web.reactive.function.client; WebClient$Builder; false; baseUrl; ; ; Argument[0]; request-forgery; manual | -| 282 | Sink: org.springframework.web.reactive.function.client; WebClient; false; create; ; ; Argument[0]; request-forgery; manual | -| 283 | Sink: play.libs.ws; StandaloneWSClient; true; url; ; ; Argument[0]; request-forgery; manual | -| 284 | Sink: play.libs.ws; WSClient; true; url; ; ; Argument[0]; request-forgery; manual | -| 285 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual | -| 286 | Summary: java.lang; AbstractStringBuilder; true; append; ; ; Argument[0]; Argument[this]; taint; manual | -| 287 | Summary: java.lang; AbstractStringBuilder; true; append; ; ; Argument[this]; ReturnValue; value; manual | -| 288 | Summary: java.lang; CharSequence; true; toString; ; ; Argument[this]; ReturnValue; taint; manual | -| 289 | Summary: java.lang; String; false; format; (String,Object[]); ; Argument[1].ArrayElement; ReturnValue; taint; manual | -| 290 | Summary: java.lang; StringBuilder; true; StringBuilder; ; ; Argument[0]; Argument[this]; taint; manual | -| 291 | Summary: java.net.http; HttpRequest$Builder; true; build; (); ; Argument[this]; ReturnValue; taint; df-generated | -| 292 | Summary: java.net.http; HttpRequest; true; newBuilder; (URI); ; Argument[0]; ReturnValue; taint; df-generated | -| 293 | Summary: java.net; URI; false; URI; (String); ; Argument[0]; Argument[this]; taint; manual | -| 294 | Summary: java.net; URI; false; URI; (String,String,String); ; Argument[1]; Argument[this]; taint; ai-manual | -| 295 | Summary: java.net; URI; false; toString; ; ; Argument[this]; ReturnValue; taint; manual | -| 296 | Summary: java.net; URI; false; toURL; ; ; Argument[this]; ReturnValue; taint; manual | -| 297 | Summary: java.net; URL; false; URL; (String); ; Argument[0]; Argument[this]; taint; manual | -| 298 | Summary: java.util; List; false; of; (Object); ; Argument[0]; ReturnValue.Element; value; manual | -| 299 | Summary: java.util; List; true; get; (int); ; Argument[this].Element; ReturnValue; value; manual | -| 300 | Summary: java.util; Map; false; of; ; ; Argument[1]; ReturnValue.MapValue; value; manual | -| 301 | Summary: java.util; Map; false; of; ; ; Argument[3]; ReturnValue.MapValue; value; manual | -| 302 | Summary: java.util; Properties; true; setProperty; (String,String); ; Argument[1]; Argument[this].MapValue; value; manual | -| 303 | Summary: org.apache.hc.core5.http; HttpHost; true; HttpHost; (String); ; Argument[0]; Argument[this]; taint; hq-manual | -| 304 | Summary: org.apache.http.client.methods; RequestBuilder; true; build; (); ; Argument[this]; ReturnValue; taint; ai-manual | -| 305 | Summary: org.apache.http.client.methods; RequestBuilder; true; get; (String); ; Argument[0]; ReturnValue; taint; ai-manual | -| 306 | Summary: org.apache.http.message; BasicRequestLine; false; BasicRequestLine; ; ; Argument[1]; Argument[this]; taint; manual | -| 307 | Summary: org.apache.http; HttpHost; true; HttpHost; (String); ; Argument[0]; Argument[this]; taint; hq-manual | +| 282 | Sink: org.springframework.web.reactive.function.client; WebClient$UriSpec; true; uri; ; ; Argument[0]; request-forgery; manual | +| 283 | Sink: org.springframework.web.reactive.function.client; WebClient; false; create; ; ; Argument[0]; request-forgery; manual | +| 284 | Sink: play.libs.ws; StandaloneWSClient; true; url; ; ; Argument[0]; request-forgery; manual | +| 285 | Sink: play.libs.ws; WSClient; true; url; ; ; Argument[0]; request-forgery; manual | +| 286 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual | +| 287 | Summary: java.lang; AbstractStringBuilder; true; append; ; ; Argument[0]; Argument[this]; taint; manual | +| 288 | Summary: java.lang; AbstractStringBuilder; true; append; ; ; Argument[this]; ReturnValue; value; manual | +| 289 | Summary: java.lang; CharSequence; true; toString; ; ; Argument[this]; ReturnValue; taint; manual | +| 290 | Summary: java.lang; String; false; format; (String,Object[]); ; Argument[1].ArrayElement; ReturnValue; taint; manual | +| 291 | Summary: java.lang; StringBuilder; true; StringBuilder; ; ; Argument[0]; Argument[this]; taint; manual | +| 292 | Summary: java.net.http; HttpRequest$Builder; true; build; (); ; Argument[this]; ReturnValue; taint; df-generated | +| 293 | Summary: java.net.http; HttpRequest; true; newBuilder; (URI); ; Argument[0]; ReturnValue; taint; df-generated | +| 294 | Summary: java.net; URI; false; URI; (String); ; Argument[0]; Argument[this]; taint; manual | +| 295 | Summary: java.net; URI; false; URI; (String,String,String); ; Argument[1]; Argument[this]; taint; ai-manual | +| 296 | Summary: java.net; URI; false; create; ; ; Argument[0]; ReturnValue; taint; manual | +| 297 | Summary: java.net; URI; false; toString; ; ; Argument[this]; ReturnValue; taint; manual | +| 298 | Summary: java.net; URI; false; toURL; ; ; Argument[this]; ReturnValue; taint; manual | +| 299 | Summary: java.net; URL; false; URL; (String); ; Argument[0]; Argument[this]; taint; manual | +| 300 | Summary: java.util; List; false; of; (Object); ; Argument[0]; ReturnValue.Element; value; manual | +| 301 | Summary: java.util; List; true; get; (int); ; Argument[this].Element; ReturnValue; value; manual | +| 302 | Summary: java.util; Map; false; of; ; ; Argument[1]; ReturnValue.MapValue; value; manual | +| 303 | Summary: java.util; Map; false; of; ; ; Argument[3]; ReturnValue.MapValue; value; manual | +| 304 | Summary: java.util; Properties; true; setProperty; (String,String); ; Argument[1]; Argument[this].MapValue; value; manual | +| 305 | Summary: org.apache.hc.core5.http; HttpHost; true; HttpHost; (String); ; Argument[0]; Argument[this]; taint; hq-manual | +| 306 | Summary: org.apache.http.client.methods; RequestBuilder; true; build; (); ; Argument[this]; ReturnValue; taint; ai-manual | +| 307 | Summary: org.apache.http.client.methods; RequestBuilder; true; get; (String); ; Argument[0]; ReturnValue; taint; ai-manual | +| 308 | Summary: org.apache.http.message; BasicRequestLine; false; BasicRequestLine; ; ; Argument[1]; Argument[this]; taint; manual | +| 309 | Summary: org.apache.http; HttpHost; true; HttpHost; (String); ; Argument[0]; Argument[this]; taint; hq-manual | nodes | ApacheHttpClientExecuteSSRF.java:23:29:23:56 | getParameter(...) : String | semmle.label | getParameter(...) : String | | ApacheHttpClientExecuteSSRF.java:25:29:25:48 | new HttpHost(...) : HttpHost | semmle.label | new HttpHost(...) : HttpHost | @@ -1781,6 +1789,11 @@ nodes | ReactiveWebClientSSRF.java:16:52:16:54 | url | semmle.label | url | | ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) : String | semmle.label | getParameter(...) : String | | ReactiveWebClientSSRF.java:35:30:35:32 | url | semmle.label | url | +| ReactiveWebClientSSRF.java:55:24:55:50 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| ReactiveWebClientSSRF.java:57:26:57:26 | p | semmle.label | p | +| ReactiveWebClientSSRF.java:62:25:62:51 | getParameter(...) : String | semmle.label | getParameter(...) : String | +| ReactiveWebClientSSRF.java:64:26:64:72 | create(...) | semmle.label | create(...) | +| ReactiveWebClientSSRF.java:64:46:64:71 | ... + ... : String | semmle.label | ... + ... : String | | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | semmle.label | new URI(...) : URI | | SanitizationTests.java:22:31:22:57 | getParameter(...) : String | semmle.label | getParameter(...) : String | | SanitizationTests.java:25:29:25:55 | newBuilder(...) : Builder | semmle.label | newBuilder(...) : Builder | diff --git a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/reactive/function/client/WebClient.java b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/reactive/function/client/WebClient.java index 13f207dd711b..2f8925ff9d0f 100644 --- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/reactive/function/client/WebClient.java +++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/reactive/function/client/WebClient.java @@ -51,6 +51,7 @@ interface Builder { interface UriSpec> { S uri(String uri, Object... uriVariables); + S uri(java.net.URI uri); } interface RequestBodySpec extends RequestHeadersSpec { From 6ff2a4c0d6ab2dd33109a6cdba8be43df7da23e5 Mon Sep 17 00:00:00 2001 From: Luis Azanza Date: Tue, 7 Jul 2026 16:10:05 -0700 Subject: [PATCH 33/44] Apply suggestion from @owen-mc Removing Apple Inc notice per feedback provided by GitHub Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com> --- .../org.springframework.web.reactive.function.client.model.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/java/ql/lib/ext/org.springframework.web.reactive.function.client.model.yml b/java/ql/lib/ext/org.springframework.web.reactive.function.client.model.yml index 263ffbaa0b23..bff40e5f534c 100644 --- a/java/ql/lib/ext/org.springframework.web.reactive.function.client.model.yml +++ b/java/ql/lib/ext/org.springframework.web.reactive.function.client.model.yml @@ -1,4 +1,3 @@ -# Copyright © 2026 Apple Inc. extensions: - addsTo: pack: codeql/java-all From b8f8370c33ee55d89d08d8814c24ac0b06cd9c04 Mon Sep 17 00:00:00 2001 From: Luis Azanza Date: Tue, 7 Jul 2026 16:21:09 -0700 Subject: [PATCH 34/44] Update java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md Update change note to be more technically accurate Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com> --- .../ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md b/java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md index f35a3386e728..d0474959b9cd 100644 --- a/java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md +++ b/java/ql/lib/change-notes/2026-06-30-spring-webclient-uri-ssrf.md @@ -1,4 +1,4 @@ --- category: minorAnalysis --- -* The `uri` method of Spring's reactive `WebClient` is now considered a request forgery sink. Previously only the `create` and `baseUrl` methods were considered. This may lead to more alerts for the query `java/ssrf` (Server-side request forgery). +* The first argument of the `uri` method of `WebClient$UriSpec` in `org.springframework.web.reactive.function.client` is now considered a request forgery sink. Previously only the first arguments of the `WebClient.create` and `WebClient$Builder.baseUrl` methods were considered. This may lead to more alerts for the query `java/ssrf` (Server-side request forgery). From 5ba1fe315dbb16b05cd36190cc50fac277765753 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 8 Jul 2026 00:56:16 +0100 Subject: [PATCH 35/44] Accept updated .expected output --- csharp/ql/integration-tests/all-platforms/blazor/XSS.expected | 1 + .../ql/integration-tests/all-platforms/blazor_net_8/XSS.expected | 1 + 2 files changed, 2 insertions(+) diff --git a/csharp/ql/integration-tests/all-platforms/blazor/XSS.expected b/csharp/ql/integration-tests/all-platforms/blazor/XSS.expected index d4f4f7cdd736..23580f2fe761 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor/XSS.expected +++ b/csharp/ql/integration-tests/all-platforms/blazor/XSS.expected @@ -16,3 +16,4 @@ nodes | BlazorTest/Components/Pages/TestPage.razor:85:23:85:32 | access to property QueryParam : String | semmle.label | access to property QueryParam : String | | BlazorTest/obj/Debug/net10.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components/Pages/TestPage_razor.g.cs:553:16:561:13 | call to method TypeCheck : String | semmle.label | call to method TypeCheck : String | subpaths +testFailures diff --git a/csharp/ql/integration-tests/all-platforms/blazor_net_8/XSS.expected b/csharp/ql/integration-tests/all-platforms/blazor_net_8/XSS.expected index dbf056053b30..80461b4f8510 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_net_8/XSS.expected +++ b/csharp/ql/integration-tests/all-platforms/blazor_net_8/XSS.expected @@ -16,3 +16,4 @@ nodes | BlazorTest/Components/Pages/TestPage.razor:85:23:85:32 | access to property QueryParam : String | semmle.label | access to property QueryParam : String | | BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_TestPage_razor.g.cs:497:59:505:13 | call to method TypeCheck : String | semmle.label | call to method TypeCheck : String | subpaths +testFailures From b6d588c1a8ce4d7453c4a38313b3d3301c1e527b Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 8 Jul 2026 00:56:43 +0100 Subject: [PATCH 36/44] Revert inline expectations for blazor integration tests with BMN --- .../BlazorTest/Components/MyOutput.razor | 2 +- .../BlazorTest/Components/Pages/TestPage.razor | 6 +++--- .../all-platforms/blazor_build_mode_none/XSS.qlref | 4 +--- 3 files changed, 5 insertions(+), 7 deletions(-) diff --git a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/MyOutput.razor b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/MyOutput.razor index 5476d75ccf9b..e583e6b2e9c6 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/MyOutput.razor +++ b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/MyOutput.razor @@ -2,7 +2,7 @@

Value from InputText: @Value

-

Raw value from InputText: @(new MarkupString(Value))

@* $ Alert[cs/web/xss]=r1 *@ +

Raw value from InputText: @(new MarkupString(Value))

@code { diff --git a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/Pages/TestPage.razor b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/Pages/TestPage.razor index 7a7a02ec222d..ac3ccbe19207 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/Pages/TestPage.razor +++ b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/BlazorTest/Components/Pages/TestPage.razor @@ -8,7 +8,7 @@

Route parameter

Go to: /test/@XssUrl

Parameter from URL: @UrlParam

-

Raw parameter from URL: @((MarkupString)UrlParam)

@* $ Alert[cs/web/xss]=r2 $ Alert[cs/web/xss]=r2 *@ +

Raw parameter from URL: @((MarkupString)UrlParam)

@@ -17,7 +17,7 @@

Query parameter

Go to: /test/?qs=@XssUrl

Parameter from query string: @QueryParam

-

Raw parameter from query string: @(new MarkupString(QueryParam))

@* $ Alert[cs/web/xss]=r3 $ Alert[cs/web/xss]=r3 *@ +

Raw parameter from query string: @(new MarkupString(QueryParam))

@@ -82,7 +82,7 @@
- @* $ Source[cs/web/xss]=r1 *@ +
@code { diff --git a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/XSS.qlref b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/XSS.qlref index a71d47846701..89b5b951bdb6 100644 --- a/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/XSS.qlref +++ b/csharp/ql/integration-tests/all-platforms/blazor_build_mode_none/XSS.qlref @@ -1,4 +1,2 @@ query: Security Features/CWE-079/XSS.ql -postprocess: - - utils/test/PrettyPrintModels.ql - - utils/test/InlineExpectationsTestQuery.ql +postprocess: utils/test/PrettyPrintModels.ql From bc966f62e277b96ec25bc0c0673df1e5c530f5c3 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 8 Jul 2026 00:38:59 +0000 Subject: [PATCH 37/44] Add changed framework coverage reports --- java/documentation/library-coverage/coverage.csv | 2 +- java/documentation/library-coverage/coverage.rst | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/java/documentation/library-coverage/coverage.csv b/java/documentation/library-coverage/coverage.csv index 7a4f6ce91ce7..75c6ca1da780 100644 --- a/java/documentation/library-coverage/coverage.csv +++ b/java/documentation/library-coverage/coverage.csv @@ -262,7 +262,7 @@ org.springframework.web.client,13,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,, org.springframework.web.context.request,,8,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,, org.springframework.web.multipart,,12,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,12,12, org.springframework.web.portlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,, -org.springframework.web.reactive.function.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,, +org.springframework.web.reactive.function.client,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,,,, org.springframework.web.servlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,, org.springframework.web.socket,,8,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,6, org.springframework.web.util,,9,159,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,134,25 diff --git a/java/documentation/library-coverage/coverage.rst b/java/documentation/library-coverage/coverage.rst index 3f4432d1b8e3..28f862d87432 100644 --- a/java/documentation/library-coverage/coverage.rst +++ b/java/documentation/library-coverage/coverage.rst @@ -37,9 +37,9 @@ Java framework & library support `Retrofit `_,``retrofit2``,,1,1,,,,,,1 `SLF4J `_,``org.slf4j``,,6,55,,,,,, `SnakeYAML `_,``org.yaml.snakeyaml``,,1,,,,,,, - `Spring `_,``org.springframework.*``,46,494,143,26,,28,14,,35 + `Spring `_,``org.springframework.*``,46,494,144,26,,28,14,,36 `Thymeleaf `_,``org.thymeleaf``,,2,2,,,,,, `jOOQ `_,``org.jooq``,,,1,,,1,,, Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.com.caucho.hessian.io``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.caucho.burlap.io``, ``com.caucho.hessian.io``, ``com.cedarsoftware.util.io``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.esotericsoftware.yamlbeans``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.opensymphony.xwork2``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``hudson``, ``io.jsonwebtoken``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.avro``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.fileupload``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hc.client5.http.protocol``, ``org.apache.hc.client5.http.utils``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.codehaus.cargo.container.installer``, ``org.dom4j``, ``org.exolab.castor.xml``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.ho.yaml``, ``org.influxdb``, ``org.jabsorb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",127,6042,775,148,6,14,18,,186 - Totals,,382,26411,2707,421,16,137,33,1,415 + Totals,,382,26411,2708,421,16,137,33,1,416 From 6c7b9f71d61d4ec203057d8369e1409aa61f30dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jack=20N=C3=B8rskov=20J=C3=B8rgensen?= Date: Wed, 8 Jul 2026 09:28:47 +0200 Subject: [PATCH 38/44] Remove `main` entries --- .../llmgenerator/org.apache.poi.hssf.extractor.model.yml | 1 - .../llmgenerator/org.apache.poi.poifs.dev.model.yml | 8 -------- .../org.apache.poi.poifs.eventfilesystem.model.yml | 1 - .../org.apache.poi.poifs.filesystem.model.yml | 2 -- .../llmgenerator/org.apache.poi.poifs.macros.model.yml | 1 - .../generated/llmgenerator/org.apache.poi.util.model.yml | 2 -- 6 files changed, 15 deletions(-) diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.extractor.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.extractor.model.yml index c36edfab9608..90973cbee85a 100644 --- a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.extractor.model.yml +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.hssf.extractor.model.yml @@ -11,7 +11,6 @@ extensions: extensible: sourceModel data: - ["org.apache.poi.hssf.extractor", "OldExcelExtractor", True, "OldExcelExtractor", "(File)", "", "Argument[this]", "file", "ai-generated"] - - ["org.apache.poi.hssf.extractor", "OldExcelExtractor", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] - addsTo: pack: codeql/java-all extensible: summaryModel diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.dev.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.dev.model.yml index 9301b0164088..238f69227ae6 100644 --- a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.dev.model.yml +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.dev.model.yml @@ -11,14 +11,6 @@ extensions: - ["org.apache.poi.poifs.dev", "POIFSDump", True, "dump", "(POIFSFileSystem,int,String,File)", "", "Argument[3]", "path-injection", "ai-generated"] - ["org.apache.poi.poifs.dev", "POIFSLister", True, "viewFile", "(String,boolean)", "", "Argument[0]", "path-injection", "ai-generated"] - ["org.apache.poi.poifs.dev", "POIFSLister", True, "viewFileOld", "(String,boolean)", "", "Argument[0]", "path-injection", "ai-generated"] - - ["org.apache.poi.poifs.dev", "POIFSViewer", True, "main", "(String[])", "", "Argument[0].Element", "path-injection", "ai-generated"] - - addsTo: - pack: codeql/java-all - extensible: sourceModel - data: - - ["org.apache.poi.poifs.dev", "POIFSDump", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] - - ["org.apache.poi.poifs.dev", "POIFSLister", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] - - ["org.apache.poi.poifs.dev", "POIFSViewer", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] - addsTo: pack: codeql/java-all extensible: summaryModel diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.eventfilesystem.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.eventfilesystem.model.yml index 49e3b7883d32..32834e231e00 100644 --- a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.eventfilesystem.model.yml +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.eventfilesystem.model.yml @@ -10,7 +10,6 @@ extensions: pack: codeql/java-all extensible: sourceModel data: - - ["org.apache.poi.poifs.eventfilesystem", "POIFSReader", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] - ["org.apache.poi.poifs.eventfilesystem", "POIFSReaderListener", True, "processPOIFSReaderEvent", "(POIFSReaderEvent)", "", "Parameter[0]", "file", "ai-generated"] - addsTo: pack: codeql/java-all diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.filesystem.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.filesystem.model.yml index 9b8fd10635f7..5531e9d37692 100644 --- a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.filesystem.model.yml +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.filesystem.model.yml @@ -9,14 +9,12 @@ extensions: - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File,boolean)", "", "Argument[0]", "path-injection", "ai-generated"] - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "create", "(File)", "", "Argument[0]", "path-injection", "ai-generated"] - - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "main", "(String[])", "", "Argument[0]", "path-injection", "ai-generated"] - addsTo: pack: codeql/java-all extensible: sourceModel data: - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File)", "", "Argument[this]", "file", "ai-generated"] - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "POIFSFileSystem", "(File,boolean)", "", "Argument[this]", "file", "ai-generated"] - - ["org.apache.poi.poifs.filesystem", "POIFSFileSystem", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] - addsTo: pack: codeql/java-all extensible: summaryModel diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.macros.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.macros.model.yml index 0d7e58f8608d..6219536a72f9 100644 --- a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.macros.model.yml +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.poifs.macros.model.yml @@ -15,7 +15,6 @@ extensions: pack: codeql/java-all extensible: sourceModel data: - - ["org.apache.poi.poifs.macros", "VBAMacroExtractor", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] - ["org.apache.poi.poifs.macros", "VBAMacroReader", True, "VBAMacroReader", "(File)", "", "Argument[this]", "file", "ai-generated"] - addsTo: pack: codeql/java-all diff --git a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.util.model.yml b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.util.model.yml index 17d26b26656b..71db1b7466ab 100644 --- a/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.util.model.yml +++ b/java/ql/lib/ext/generated/llmgenerator/org.apache.poi.util.model.yml @@ -15,8 +15,6 @@ extensions: extensible: sourceModel data: - ["org.apache.poi.util", "DefaultTempFileCreationStrategy", True, "getJavaIoTmpDir", "()", "", "ReturnValue", "environment", "ai-generated"] - - ["org.apache.poi.util", "DrawingDump", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] - - ["org.apache.poi.util", "FontMetricsDumper", True, "main", "(String[])", "", "Parameter[0]", "commandargs", "ai-generated"] - ["org.apache.poi.util", "HexRead", True, "readData", "(String)", "", "ReturnValue", "file", "ai-generated"] - ["org.apache.poi.util", "HexRead", True, "readData", "(String,String)", "", "ReturnValue", "file", "ai-generated"] - addsTo: From 85d800f317332d3fadc9afb08418a8116a122622 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com> Date: Wed, 8 Jul 2026 13:02:20 +0100 Subject: [PATCH 39/44] Apply suggestions from code review Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com> --- csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs | 4 ++-- .../Security Features/JsonWebTokenHandler/delegation-test.cs | 4 ++-- .../Language Abuse/UselessCastToSelf/UselessCastToSelf.cs | 4 ++-- .../Security Features/CWE-807/ConditionalBypass.cs | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs b/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs index 2530492ef74d..1e6c66fd0dbd 100644 --- a/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs +++ b/csharp/ql/campaigns/Solorigate/test/Solorigate/test.cs @@ -6,12 +6,12 @@ class FalsePositiveCases // regular FVN ulong GetRegularFvnHash(string s) { - ulong num = 14695981039346656037UL; /* FNV base offset */ // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + ulong num = 14695981039346656037UL; /* FNV base offset */ // $ SPURIOUS: Alert[cs/solorigate/number-of-known-hashes-above-threshold] foreach (byte b in Encoding.UTF8.GetBytes(s)) { num ^= (ulong)b; - num *= 1099511628211UL; /* FNV prime */ // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold] + num *= 1099511628211UL; /* FNV prime */ // $ SPURIOUS: Alert[cs/solorigate/number-of-known-hashes-above-threshold] } return num; diff --git a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs index 95118a986d3c..5e0e69119d4b 100644 --- a/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs +++ b/csharp/ql/test/experimental/Security Features/JsonWebTokenHandler/delegation-test.cs @@ -98,8 +98,8 @@ public void TestCase01() SaveSigninToken = true }; - tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG delegated-security-validations-always-return-true - tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => true; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG delegated-security-validations-always-return-true + tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] + tokenValidationParamsBaseline.AudienceValidator = (IEnumerable audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => true; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] tokenValidationParamsBaseline.TokenReplayValidator = (DateTime? expirationTime, string securityToken, TokenValidationParameters validationParameters) => // GOOD { if (securityToken is null) diff --git a/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs b/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs index 3b3f06ded0f0..bcfe712413e3 100644 --- a/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs +++ b/csharp/ql/test/query-tests/Language Abuse/UselessCastToSelf/UselessCastToSelf.cs @@ -9,7 +9,7 @@ void f() var bad1 = (int)1; // $ Alert var bad2 = (Test)this; // $ Alert var bad3 = this as Test; // $ Alert - func = (Func)(x => x); // MISSING + func = (Func)(x => x); // $ MISSING: Alert exprFunc = (Expression>)(x => x); // $ Alert // GOOD @@ -22,7 +22,7 @@ void f() var good7 = (Action)((int x) => { }); func = x => x; exprFunc = x => x; - exprFuncUntyped = (Expression>)(x => x); // $ Alert // FP + exprFuncUntyped = (Expression>)(x => x); // $ SPURIOUS: Alert } enum Enum diff --git a/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs b/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs index 39328ca7c174..b3e9c842ac63 100644 --- a/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs +++ b/csharp/ql/test/query-tests/Security Features/CWE-807/ConditionalBypass.cs @@ -24,7 +24,7 @@ public void ProcessRequest(HttpContext ctx) // FALSE POSITIVES: both methods are conditionally executed, but they probably // both perform the security-critical action - if (adminCookie.Value == "false") // $ Alert=r3 Alert=r4 Alert=r2 + if (adminCookie.Value == "false") // $ SPURIOUS: Alert=r3 Alert=r4 Alert=r2 { login(user, password); } From 7b96f66d34686b1194b89efaa0a1c3d973db2e8b Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 8 Jul 2026 13:18:37 +0100 Subject: [PATCH 40/44] Also run cs/constant-condition on test for cs/comparison-of-identical-expressions --- .../CompareIdenticalValues.cs | 60 +++++++++---------- .../ConstantCondition.expected | 6 ++ .../ConstantCondition.qlref | 2 + 3 files changed, 38 insertions(+), 30 deletions(-) create mode 100644 csharp/ql/test/query-tests/CSI/CompareIdenticalValues/ConstantCondition.expected create mode 100644 csharp/ql/test/query-tests/CSI/CompareIdenticalValues/ConstantCondition.qlref diff --git a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs index 540ce6bb8146..68e95de15dc2 100644 --- a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs +++ b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs @@ -11,54 +11,54 @@ class CompareIdenticalValues : Super { public void M() { - if (this.Foo == Foo) ; // $ Alert - if (base.Foo == Foo) ; // $ Alert + if (this.Foo == Foo) ; // $ Alert[cs/comparison-of-identical-expressions] + if (base.Foo == Foo) ; // $ Alert[cs/comparison-of-identical-expressions] if (Foo == new CompareIdenticalValues().Foo) ; var x = "Abc"; if (x == "Abc") ; - var temp = x == x; // BAD: but flagged by cs/constant-comparison + var temp = x == x; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition double d = double.NaN; - if (d == d) ; // $ Alert // !double.IsNan(d) - if (d <= d) ; // $ Alert // !double.IsNan(d), but unlikely to be intentional - if (d >= d) ; // $ Alert // !double.IsNan(d), but unlikely to be intentional - if (d != d) ; // $ Alert // double.IsNan(d) - if (d > d) ; // $ Alert // always false - if (d < d) ; // $ Alert // always false + if (d == d) ; // $ Alert[cs/comparison-of-identical-expressions] // !double.IsNan(d) + if (d <= d) ; // $ Alert[cs/comparison-of-identical-expressions] // !double.IsNan(d), but unlikely to be intentional + if (d >= d) ; // $ Alert[cs/comparison-of-identical-expressions] // !double.IsNan(d), but unlikely to be intentional + if (d != d) ; // $ Alert[cs/comparison-of-identical-expressions] // double.IsNan(d) + if (d > d) ; // $ Alert[cs/comparison-of-identical-expressions] // always false + if (d < d) ; // $ Alert[cs/comparison-of-identical-expressions] // always false float f = float.NaN; - if (f == f) ; // $ Alert // !float.IsNan(f) - if (f <= f) ; // $ Alert // !float.IsNan(f), but unlikely to be intentional - if (f >= f) ; // $ Alert // !float.IsNan(f), but unlikely to be intentional - if (f != f) ; // $ Alert // float.IsNan(f) - if (f > f) ; // $ Alert // always false - if (f < f) ; // $ Alert // always false + if (f == f) ; // $ Alert[cs/comparison-of-identical-expressions] // !float.IsNan(f) + if (f <= f) ; // $ Alert[cs/comparison-of-identical-expressions] // !float.IsNan(f), but unlikely to be intentional + if (f >= f) ; // $ Alert[cs/comparison-of-identical-expressions] // !float.IsNan(f), but unlikely to be intentional + if (f != f) ; // $ Alert[cs/comparison-of-identical-expressions] // float.IsNan(f) + if (f > f) ; // $ Alert[cs/comparison-of-identical-expressions] // always false + if (f < f) ; // $ Alert[cs/comparison-of-identical-expressions] // always false int i = 0; - if (i == i) ; // BAD: but flagged by cs/constant-condition - if (i != i) ; // BAD: but flagged by cs/constant-condition + if (i == i) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition + if (i != i) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition CompareIdenticalValues c = null; - c.Prop.Equals(c.Prop); // $ Alert - Equals(c.Prop.Prop.Prop.Foo + 2, c.Prop.Prop.Prop.Foo + 2); // $ Alert + c.Prop.Equals(c.Prop); // $ Alert[cs/comparison-of-identical-expressions] + Equals(c.Prop.Prop.Prop.Foo + 2, c.Prop.Prop.Prop.Foo + 2); // $ Alert[cs/comparison-of-identical-expressions] Equals(c.Prop.Prop.Prop.Foo, c.Prop.Prop.Foo); if (base.Bar == Bar) ; - if (Bar == this.Bar) ; // $ Alert - Equals(this); // $ Alert + if (Bar == this.Bar) ; // $ Alert[cs/comparison-of-identical-expressions] + Equals(this); // $ Alert[cs/comparison-of-identical-expressions] - if (1 + 1 == 2) ; // BAD: but flagged by cs/constant-condition - if (1 + 1 == 3) ; - if (0 == 1) ; + if (1 + 1 == 2) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition + if (1 + 1 == 3) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition + if (0 == 1) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition var a = new int[0]; - if (a[0] == a[0]) ; // $ Alert + if (a[0] == a[0]) ; // $ Alert[cs/comparison-of-identical-expressions] - if (this.Bar[0] == Bar[1 - 1]) ; // $ Alert + if (this.Bar[0] == Bar[1 - 1]) ; // $ Alert[cs/comparison-of-identical-expressions] if (this.Bar[0] == Bar[1]) ; - if (this.Prop[Foo] == Prop[this.Foo]) ; // $ Alert + if (this.Prop[Foo] == Prop[this.Foo]) ; // $ Alert[cs/comparison-of-identical-expressions] if (this.Prop[0] == Prop[1]) ; } @@ -73,17 +73,17 @@ public void IsBoxed(T x) where T : I public void IsBoxedWrong1(T x) where T : struct { - ReferenceEquals(x, x); // $ Alert + ReferenceEquals(x, x); // $ Alert[cs/comparison-of-identical-expressions] } public void IsBoxedWrong2(T x) where T : class { - ReferenceEquals(x, x); // $ Alert + ReferenceEquals(x, x); // $ Alert[cs/comparison-of-identical-expressions] } public void IsBoxedWrong3(T x) where T : Super { - ReferenceEquals(x, x); // $ Alert + ReferenceEquals(x, x); // $ Alert[cs/comparison-of-identical-expressions] } public int this[int i] { get { return 0; } } diff --git a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/ConstantCondition.expected b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/ConstantCondition.expected new file mode 100644 index 000000000000..e54ba7f25d74 --- /dev/null +++ b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/ConstantCondition.expected @@ -0,0 +1,6 @@ +| CompareIdenticalValues.cs:20:20:20:25 | ... == ... | Condition always evaluates to 'true'. | CompareIdenticalValues.cs:20:20:20:25 | ... == ... | dummy | +| CompareIdenticalValues.cs:39:13:39:18 | ... == ... | Condition always evaluates to 'true'. | CompareIdenticalValues.cs:39:13:39:18 | ... == ... | dummy | +| CompareIdenticalValues.cs:40:13:40:18 | ... != ... | Condition always evaluates to 'false'. | CompareIdenticalValues.cs:40:13:40:18 | ... != ... | dummy | +| CompareIdenticalValues.cs:51:13:51:22 | ... == ... | Condition always evaluates to 'true'. | CompareIdenticalValues.cs:51:13:51:22 | ... == ... | dummy | +| CompareIdenticalValues.cs:52:13:52:22 | ... == ... | Condition always evaluates to 'false'. | CompareIdenticalValues.cs:52:13:52:22 | ... == ... | dummy | +| CompareIdenticalValues.cs:53:13:53:18 | ... == ... | Condition always evaluates to 'false'. | CompareIdenticalValues.cs:53:13:53:18 | ... == ... | dummy | diff --git a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/ConstantCondition.qlref b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/ConstantCondition.qlref new file mode 100644 index 000000000000..6692217230e0 --- /dev/null +++ b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/ConstantCondition.qlref @@ -0,0 +1,2 @@ +query: Bad Practices/Control-Flow/ConstantCondition.ql +postprocess: utils/test/InlineExpectationsTestQuery.ql From aba008dcd721471052027d42ecdc7cf1fcdbb36a Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 8 Jul 2026 13:19:25 +0100 Subject: [PATCH 41/44] Remove comments "// BAD: but flagged by cs/constant-condition" --- .../CompareIdenticalValues/CompareIdenticalValues.cs | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs index 68e95de15dc2..55aafe64d284 100644 --- a/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs +++ b/csharp/ql/test/query-tests/CSI/CompareIdenticalValues/CompareIdenticalValues.cs @@ -17,7 +17,7 @@ public void M() var x = "Abc"; if (x == "Abc") ; - var temp = x == x; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition + var temp = x == x; // $ Alert[cs/constant-condition] double d = double.NaN; if (d == d) ; // $ Alert[cs/comparison-of-identical-expressions] // !double.IsNan(d) @@ -36,8 +36,8 @@ public void M() if (f < f) ; // $ Alert[cs/comparison-of-identical-expressions] // always false int i = 0; - if (i == i) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition - if (i != i) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition + if (i == i) ; // $ Alert[cs/constant-condition] + if (i != i) ; // $ Alert[cs/constant-condition] CompareIdenticalValues c = null; c.Prop.Equals(c.Prop); // $ Alert[cs/comparison-of-identical-expressions] @@ -48,9 +48,9 @@ public void M() if (Bar == this.Bar) ; // $ Alert[cs/comparison-of-identical-expressions] Equals(this); // $ Alert[cs/comparison-of-identical-expressions] - if (1 + 1 == 2) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition - if (1 + 1 == 3) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition - if (0 == 1) ; // $ Alert[cs/constant-condition] // BAD: but flagged by cs/constant-condition + if (1 + 1 == 2) ; // $ Alert[cs/constant-condition] + if (1 + 1 == 3) ; // $ Alert[cs/constant-condition] + if (0 == 1) ; // $ Alert[cs/constant-condition] var a = new int[0]; if (a[0] == a[0]) ; // $ Alert[cs/comparison-of-identical-expressions] From 15c7428593aa13f73b3bfd454a1164bb69ee5f66 Mon Sep 17 00:00:00 2001 From: Tom Hvitved Date: Wed, 8 Jul 2026 15:08:46 +0200 Subject: [PATCH 42/44] Address review comment --- .../codeql/typeinference/internal/TypeInference.qll | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/shared/typeinference/codeql/typeinference/internal/TypeInference.qll b/shared/typeinference/codeql/typeinference/internal/TypeInference.qll index 4e9ea9c0502b..b90c53ebdbaa 100644 --- a/shared/typeinference/codeql/typeinference/internal/TypeInference.qll +++ b/shared/typeinference/codeql/typeinference/internal/TypeInference.qll @@ -1529,7 +1529,8 @@ module Make1 Input1> { SatisfiesParameterConstraint::satisfiesConstraint(MkRelevantAccess(a, pragma[only_bind_into](apos), e), MkRelevantTarget(target, pragma[only_bind_into](apos)), pathToTp.appendInverse(path), - t) + t) and + not exists(getTypeArgument(a, target, tp, _)) ) } } From 47ea9b49cc736df7ee5727ee1b348ac623158530 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 8 Jul 2026 15:46:33 +0000 Subject: [PATCH 43/44] update codeql documentation --- .../codeql-changelog/codeql-cli-2.26.0.rst | 177 ++++++++++++++++++ .../codeql-changelog/index.rst | 1 + 2 files changed, 178 insertions(+) create mode 100644 docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.26.0.rst diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.26.0.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.26.0.rst new file mode 100644 index 000000000000..5b5746bf26c9 --- /dev/null +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.26.0.rst @@ -0,0 +1,177 @@ +.. _codeql-cli-2.26.0: + +========================== +CodeQL 2.26.0 (2026-07-08) +========================== + +.. contents:: Contents + :depth: 2 + :local: + :backlinks: none + +This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog `__, `relevant GitHub Changelog updates `__, `changes in the CodeQL extension for Visual Studio Code `__, and the `CodeQL Action changelog `__. + +Security Coverage +----------------- + +CodeQL 2.26.0 runs a total of 497 security queries when configured with the Default suite (covering 170 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE). 1 security query has been added with this release. + +CodeQL CLI +---------- + +Improvements +~~~~~~~~~~~~ + +* Improved the performance of commands that interact with Git repositories by checking whether the :code:`git` command-line tool is available at most once per CodeQL CLI invocation. + +Query Packs +----------- + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Golang +"""""" + +* The query :code:`go/unhandled-writable-file-close` ("Writable file handle closed without error handling") now produces fewer false positives. A deferred call to :code:`Close` that is preceded on every execution path by a handled call to :code:`Sync` on the same file handle is no longer flagged. + +Python +"""""" + +* The :code:`py/modification-of-locals` query no longer flags modifications of a :code:`locals()` dictionary that has been passed out of the scope in which :code:`locals()` was called (for example, by passing it to another function or storing it in an instance attribute). In such cases the dictionary is used as an ordinary mapping and modifying it is meaningful, so these were false positives. The "modification has no effect" claim only applies within the scope that called :code:`locals()`, which is now the only case reported. + +Swift +""""" + +* Fixed an issue where common usage patterns for :code:`CryptoKit` weren't being recognized as hashing sinks for the :code:`swift/weak-sensitive-data-hashing` and :code:`swift/weak-password-hashing` queries. These queries may find additional results after this change. + +New Queries +~~~~~~~~~~~ + +JavaScript/TypeScript +""""""""""""""""""""" + +* Added a new query, :code:`js/system-prompt-injection`, to detect cases where untrusted, user-provided values flow into the system prompt of an AI model, allowing an attacker to manipulate the model's behavior. +* Added a new experimental query, :code:`javascript/ssrf-ipv6-transition-incomplete-guard`, to detect SSRF host-validation guards that reject private IPv4 ranges but fail to unwrap IPv6-transition forms (IPv4-mapped :code:`::ffff:`, NAT64 :code:`64:ff9b::`, 6to4 :code:`2002::`), allowing the guard to be bypassed by wrapping an internal IPv4 address in a transition literal. + +Query Metadata Changes +~~~~~~~~~~~~~~~~~~~~~~ + +GitHub Actions +"""""""""""""" + +* The name, description, and alert message of :code:`actions/untrusted-checkout/medium` have been corrected to describe a non-privileged context. + +Language Libraries +------------------ + +Bug Fixes +~~~~~~~~~ + +GitHub Actions +"""""""""""""" + +* GitHub Actions queries now better account for permission checks on jobs that call reusable workflows. +* The query :code:`actions/pr-on-self-hosted-runner` was updated to the latest standard runner labels reducing false positive results. + +Breaking Changes +~~~~~~~~~~~~~~~~ + +C/C++ +""""" + +* Removed the deprecated :code:`overrideReturnsNull` predicate from :code:`Options.qll`. Use :code:`CustomOptions.overrideReturnsNull` instead. +* Removed the deprecated :code:`returnsNull` predicate from :code:`Options.qll`. Use :code:`CustomOptions.returnsNull` instead. +* Removed the deprecated :code:`exits` predicate from :code:`Options.qll`. Use :code:`CustomOptions.exits` instead. +* Removed the deprecated :code:`exprExits` predicate from :code:`Options.qll`. Use :code:`CustomOptions.exprExits` instead. +* Removed the deprecated :code:`alwaysCheckReturnValue` predicate from :code:`Options.qll`. Use :code:`CustomOptions.alwaysCheckReturnValue` instead. +* Removed the deprecated :code:`okToIgnoreReturnValue` predicate from :code:`Options.qll`. Use :code:`CustomOptions.okToIgnoreReturnValue` instead. +* Removed the deprecated :code:`semmle.code.cpp.Member`. Import :code:`semmle.code.cpp.Element` and/or :code:`semmle.code.cpp.Type` directly. +* Removed the deprecated :code:`UnknownDefaultLocation` class. Use :code:`UnknownLocation` instead. +* Removed the deprecated :code:`UnknownExprLocation` class. Use :code:`UnknownLocation` instead. +* Removed the deprecated :code:`UnknownStmtLocation` class. Use :code:`UnknownLocation` instead. +* Removed the deprecated :code:`TemplateParameter` class. Use :code:`TypeTemplateParameter` instead. +* Support for class resolution across link targets has been removed for databases which were created with CodeQL versions before 1.23.0. + +C# +"" + +* Renamed types related to *operation* expressions. The QL classes :code:`BinaryArithmeticOperation`, :code:`BinaryBitwiseOperation`, and :code:`BinaryLogicalOperation` now include compound assignments; for example, :code:`BinaryArithmeticOperation` now includes :code:`a += b`. + +Ruby +"""" + +* The :code:`else` branch of a :code:`case` expression is no longer represented as a :code:`StmtSequence` directly. Instead, a new :code:`CaseElseBranch` AST node wraps the body (a :code:`StmtSequence`). :code:`CaseExpr.getElseBranch()` now returns a :code:`CaseElseBranch`, and the body of the else branch can be accessed via :code:`CaseElseBranch.getBody()`. + +Major Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +C# +"" + +* Added Razor Page handler method parameters (e.g., :code:`OnGet`, :code:`OnPost`, :code:`OnPostAsync`) as remote flow sources, enabling security queries such as :code:`cs/sql-injection` to detect vulnerabilities in :code:`PageModel` subclasses. + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +C# +"" + +* Improved property and indexer call target resolution for partially overridden properties and indexers. +* Improved extraction of range-access expressions on spans and strings (for example, :code:`a[0..3]`). These expressions are now extracted as :code:`Slice` (span) or :code:`Substring` (string) calls. +* Improved call target resolution for ref-return properties and indexers. + +Golang +"""""" + +* Added models for the :code:`log/slog` package (Go 1.21+). Its logging functions and + :code:`*slog.Logger` methods (:code:`Debug`\ /\ :code:`Info`\ /\ :code:`Warn`\ /\ :code:`Error`, their :code:`Context` variants, and :code:`Log`\ /\ :code:`LogAttrs`) are now recognized as logging sinks, so the + :code:`go/log-injection` and :code:`go/clear-text-logging` queries cover code that logs through :code:`slog`. +* :code:`DataFlow::ResultNode`\ s are no longer created for returned expressions in functions with named result parameters. In this case there are already result nodes corresponding to :code:`IR::ReadResultInstruction`\ s at the end of the function body. +* :code:`FuncTypeExpr.getNumResult()` now gets the number of result parameters. It previously got the number of result declarations, which is different when one result declaration declares more than one variable, as in :code:`x, y int`. All uses of it expected the number of result parameters. Its QLDoc has been updated. +* More logging functions are now recognized as not returning or panicking. + +Java/Kotlin +""""""""""" + +* Improved modeling of Apache HttpClient :code:`execute` method sinks for :code:`java/ssrf` and :code:`java/non-https-url`. + +JavaScript/TypeScript +""""""""""""""""""""" + +* Added more prompt-injection sinks for the OpenAI, Anthropic, and Google GenAI SDKs: OpenAI :code:`videos.create`\ /\ :code:`edit`\ /\ :code:`extend`\ /\ :code:`remix` (Sora) prompts and :code:`beta.realtime.sessions.create` instructions, Anthropic legacy :code:`completions.create` prompts, and Google GenAI :code:`caches.create` cached contents and system instructions. +* The OpenAI legacy :code:`completions.create` prompt is now treated as a user-prompt-injection sink instead of a system-prompt-injection sink, since the legacy :code:`/v1/completions` endpoint takes a single free-form prompt with no role separation. + +Python +"""""" + +* Python type tracking now follows values stored in instance attributes such as :code:`self.attr` across instance methods, including across a class hierarchy (for example, a value stored on :code:`self.attr` in a base class and read in a subclass, or vice versa). As a result, analysis is more likely to recognize user-defined objects that are stored on :code:`self` and used later in other methods, which may produce additional results. +* Simplified the internal predicates that detect :code:`@staticmethod`, :code:`@classmethod` and :code:`@property` decorators to match the decorator's AST :code:`Name` directly, rather than going through the CFG and requiring the name to resolve globally. Code that shadows these three builtin decorators at the module-scope will now be classified by the decorator name alone; in practice, shadowing these names is extremely rare and the call-graph results are unchanged. +* Python taint tracking is now more precise for values flowing through container contents, such as list, set, tuple, and dictionary elements. This may remove some false positive alerts. + +Deprecated APIs +~~~~~~~~~~~~~~~ + +Golang +"""""" + +* :code:`FuncTypeExpr.getResultDecl()` has been deprecated. Use :code:`FuncTypeExpr.getResultDecl(int i)` instead. + +Python +"""""" + +* The :code:`Function.getAReturnValueFlowNode()` predicate has been deprecated. Bind a :code:`Return` node explicitly instead — :code:`exists(Return ret | ret.getScope() = f and n.getNode() = ret.getValue())`. This is a preparatory step towards migrating the dataflow library off the legacy CFG; it has no semantic effect. +* The :code:`AstNode.getAFlowNode()` predicate has been deprecated. Use :code:`ControlFlowNode.getNode()` from the other direction instead: replace :code:`e.getAFlowNode() = n` with :code:`n.getNode() = e`. This is a preparatory step towards migrating the dataflow library off the legacy CFG; it has no semantic effect. + +New Features +~~~~~~~~~~~~ + +Java/Kotlin +""""""""""" + +* Kotlin 2.4.0 can now be analysed. + +JavaScript/TypeScript +""""""""""""""""""""" + +* Added :code:`UseMemoDirective` and :code:`UseNoMemoDirective` classes to model the React compiler directives :code:`"use memo"` and :code:`"use no memo"`. diff --git a/docs/codeql/codeql-overview/codeql-changelog/index.rst b/docs/codeql/codeql-overview/codeql-changelog/index.rst index ac4a8041faa4..301adddeedbc 100644 --- a/docs/codeql/codeql-overview/codeql-changelog/index.rst +++ b/docs/codeql/codeql-overview/codeql-changelog/index.rst @@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here Date: Thu, 9 Jul 2026 03:03:43 +0000 Subject: [PATCH 44/44] Bump golang.org/x/mod Bumps the extractor-dependencies group in /go/extractor with 1 update: [golang.org/x/mod](https://github.com/golang/mod). Updates `golang.org/x/mod` from 0.37.0 to 0.38.0 - [Commits](https://github.com/golang/mod/compare/v0.37.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: extractor-dependencies ... Signed-off-by: dependabot[bot] --- go/extractor/go.mod | 2 +- go/extractor/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go/extractor/go.mod b/go/extractor/go.mod index cea20f1bd4a4..b95ec78da344 100644 --- a/go/extractor/go.mod +++ b/go/extractor/go.mod @@ -9,7 +9,7 @@ toolchain go1.26.4 // when adding or removing dependencies, run // bazel mod tidy require ( - golang.org/x/mod v0.37.0 + golang.org/x/mod v0.38.0 golang.org/x/tools v0.47.0 ) diff --git a/go/extractor/go.sum b/go/extractor/go.sum index a928a105f684..de0d26d035b8 100644 --- a/go/extractor/go.sum +++ b/go/extractor/go.sum @@ -6,8 +6,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=