Skip to content

Commit c44cc9e

Browse files
owen-mcowen-mc
committed
Improve tests for Incorrect Integer Conversion
We changed the test query when the query was changed so that the comments in the test file would stay the same. I've reverted the test query and updated the comments in the test file. This avoids problems in the branch switching to use-use flow.
1 parent 104f4ee commit c44cc9e

8 files changed

+111
-115
lines changed

‎go/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.go‎

Lines changed: 97 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ func lab(s string) (*something, error) {
3333
}
3434
num = int(number)
3535
}
36-
target, err := lookupTarget(&config{}, int32(num)) // $ hasValueFlow="type conversion"
36+
target, err := lookupTarget(&config{}, int32(num)) // $ hasValueFlow="num"
3737
if err != nil {
3838
return nil, err
3939
}
@@ -67,8 +67,8 @@ func testParseInt() {
6767
if err != nil {
6868
panic(err)
6969
}
70-
_ = int8(parsed) // $ hasValueFlow="type conversion"
71-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
70+
_ = int8(parsed) // $ hasValueFlow="parsed"
71+
_ = uint8(parsed) // $ hasValueFlow="parsed"
7272
_ = int16(parsed)
7373
_ = uint16(parsed)
7474
_ = int32(parsed)
@@ -83,10 +83,10 @@ func testParseInt() {
8383
if err != nil {
8484
panic(err)
8585
}
86-
_ = int8(parsed) // $ hasValueFlow="type conversion"
87-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
88-
_ = int16(parsed) // $ hasValueFlow="type conversion"
89-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
86+
_ = int8(parsed) // $ hasValueFlow="parsed"
87+
_ = uint8(parsed) // $ hasValueFlow="parsed"
88+
_ = int16(parsed) // $ hasValueFlow="parsed"
89+
_ = uint16(parsed) // $ hasValueFlow="parsed"
9090
_ = int32(parsed)
9191
_ = uint32(parsed)
9292
_ = int64(parsed)
@@ -99,28 +99,28 @@ func testParseInt() {
9999
if err != nil {
100100
panic(err)
101101
}
102-
_ = int8(parsed) // $ hasValueFlow="type conversion"
103-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
104-
_ = int16(parsed) // $ hasValueFlow="type conversion"
105-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
106-
_ = int32(parsed) // $ hasValueFlow="type conversion"
107-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
102+
_ = int8(parsed) // $ hasValueFlow="parsed"
103+
_ = uint8(parsed) // $ hasValueFlow="parsed"
104+
_ = int16(parsed) // $ hasValueFlow="parsed"
105+
_ = uint16(parsed) // $ hasValueFlow="parsed"
106+
_ = int32(parsed) // $ hasValueFlow="parsed"
107+
_ = uint32(parsed) // $ hasValueFlow="parsed"
108108
_ = int64(parsed)
109109
_ = uint64(parsed)
110-
_ = int(parsed) // $ hasValueFlow="type conversion"
111-
_ = uint(parsed) // $ hasValueFlow="type conversion"
110+
_ = int(parsed) // $ hasValueFlow="parsed"
111+
_ = uint(parsed) // $ hasValueFlow="parsed"
112112
}
113113
{
114114
parsed, err := strconv.ParseInt("3456", 10, 0)
115115
if err != nil {
116116
panic(err)
117117
}
118-
_ = int8(parsed) // $ hasValueFlow="type conversion"
119-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
120-
_ = int16(parsed) // $ hasValueFlow="type conversion"
121-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
122-
_ = int32(parsed) // $ hasValueFlow="type conversion"
123-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
118+
_ = int8(parsed) // $ hasValueFlow="parsed"
119+
_ = uint8(parsed) // $ hasValueFlow="parsed"
120+
_ = int16(parsed) // $ hasValueFlow="parsed"
121+
_ = uint16(parsed) // $ hasValueFlow="parsed"
122+
_ = int32(parsed) // $ hasValueFlow="parsed"
123+
_ = uint32(parsed) // $ hasValueFlow="parsed"
124124
_ = int64(parsed)
125125
_ = uint64(parsed)
126126
_ = int(parsed)
@@ -134,7 +134,7 @@ func testParseUint() {
134134
if err != nil {
135135
panic(err)
136136
}
137-
_ = int8(parsed) // $ hasValueFlow="type conversion"
137+
_ = int8(parsed) // $ hasValueFlow="parsed"
138138
_ = uint8(parsed)
139139
_ = int16(parsed)
140140
_ = uint16(parsed)
@@ -150,9 +150,9 @@ func testParseUint() {
150150
if err != nil {
151151
panic(err)
152152
}
153-
_ = int8(parsed) // $ hasValueFlow="type conversion"
154-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
155-
_ = int16(parsed) // $ hasValueFlow="type conversion"
153+
_ = int8(parsed) // $ hasValueFlow="parsed"
154+
_ = uint8(parsed) // $ hasValueFlow="parsed"
155+
_ = int16(parsed) // $ hasValueFlow="parsed"
156156
_ = uint16(parsed)
157157
_ = int32(parsed)
158158
_ = uint32(parsed)
@@ -166,47 +166,47 @@ func testParseUint() {
166166
if err != nil {
167167
panic(err)
168168
}
169-
_ = int8(parsed) // $ hasValueFlow="type conversion"
170-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
171-
_ = int16(parsed) // $ hasValueFlow="type conversion"
172-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
173-
_ = int32(parsed) // $ hasValueFlow="type conversion"
169+
_ = int8(parsed) // $ hasValueFlow="parsed"
170+
_ = uint8(parsed) // $ hasValueFlow="parsed"
171+
_ = int16(parsed) // $ hasValueFlow="parsed"
172+
_ = uint16(parsed) // $ hasValueFlow="parsed"
173+
_ = int32(parsed) // $ hasValueFlow="parsed"
174174
_ = uint32(parsed)
175175
_ = int64(parsed)
176176
_ = uint64(parsed)
177-
_ = int(parsed) // $ hasValueFlow="type conversion"
177+
_ = int(parsed) // $ hasValueFlow="parsed"
178178
_ = uint(parsed)
179179
}
180180
{
181181
parsed, err := strconv.ParseUint("3456", 10, 64)
182182
if err != nil {
183183
panic(err)
184184
}
185-
_ = int8(parsed) // $ hasValueFlow="type conversion"
186-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
187-
_ = int16(parsed) // $ hasValueFlow="type conversion"
188-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
189-
_ = int32(parsed) // $ hasValueFlow="type conversion"
190-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
191-
_ = int64(parsed) // $ hasValueFlow="type conversion"
185+
_ = int8(parsed) // $ hasValueFlow="parsed"
186+
_ = uint8(parsed) // $ hasValueFlow="parsed"
187+
_ = int16(parsed) // $ hasValueFlow="parsed"
188+
_ = uint16(parsed) // $ hasValueFlow="parsed"
189+
_ = int32(parsed) // $ hasValueFlow="parsed"
190+
_ = uint32(parsed) // $ hasValueFlow="parsed"
191+
_ = int64(parsed) // $ hasValueFlow="parsed"
192192
_ = uint64(parsed)
193-
_ = int(parsed) // $ hasValueFlow="type conversion"
194-
_ = uint(parsed) // $ hasValueFlow="type conversion"
193+
_ = int(parsed) // $ hasValueFlow="parsed"
194+
_ = uint(parsed) // $ hasValueFlow="parsed"
195195
}
196196
{
197197
parsed, err := strconv.ParseUint("3456", 10, 0)
198198
if err != nil {
199199
panic(err)
200200
}
201-
_ = int8(parsed) // $ hasValueFlow="type conversion"
202-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
203-
_ = int16(parsed) // $ hasValueFlow="type conversion"
204-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
205-
_ = int32(parsed) // $ hasValueFlow="type conversion"
206-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
207-
_ = int64(parsed) // $ hasValueFlow="type conversion"
201+
_ = int8(parsed) // $ hasValueFlow="parsed"
202+
_ = uint8(parsed) // $ hasValueFlow="parsed"
203+
_ = int16(parsed) // $ hasValueFlow="parsed"
204+
_ = uint16(parsed) // $ hasValueFlow="parsed"
205+
_ = int32(parsed) // $ hasValueFlow="parsed"
206+
_ = uint32(parsed) // $ hasValueFlow="parsed"
207+
_ = int64(parsed) // $ hasValueFlow="parsed"
208208
_ = uint64(parsed)
209-
_ = int(parsed) // $ hasValueFlow="type conversion"
209+
_ = int(parsed) // $ hasValueFlow="parsed"
210210
_ = uint(parsed)
211211
}
212212
}
@@ -216,12 +216,12 @@ func testAtoi() {
216216
if err != nil {
217217
panic(err)
218218
}
219-
_ = int8(parsed) // $ hasValueFlow="type conversion"
220-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
221-
_ = int16(parsed) // $ hasValueFlow="type conversion"
222-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
223-
_ = int32(parsed) // $ hasValueFlow="type conversion"
224-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
219+
_ = int8(parsed) // $ hasValueFlow="parsed"
220+
_ = uint8(parsed) // $ hasValueFlow="parsed"
221+
_ = int16(parsed) // $ hasValueFlow="parsed"
222+
_ = uint16(parsed) // $ hasValueFlow="parsed"
223+
_ = int32(parsed) // $ hasValueFlow="parsed"
224+
_ = uint32(parsed) // $ hasValueFlow="parsed"
225225
_ = int64(parsed)
226226
_ = uint64(parsed)
227227
_ = int(parsed)
@@ -238,8 +238,8 @@ func typeAliases(input string) {
238238
panic(err)
239239
}
240240
// NOTE: byte is uint8
241-
_ = byte(parsed) // $ hasValueFlow="type conversion"
242-
_ = customInt(parsed) // $ hasValueFlow="type conversion"
241+
_ = byte(parsed) // $ hasValueFlow="parsed"
242+
_ = customInt(parsed) // $ hasValueFlow="parsed"
243243
}
244244
}
245245

@@ -253,13 +253,13 @@ func testBoundsChecking(input string) {
253253
_ = int8(parsed)
254254
}
255255
if parsed < math.MaxInt8 {
256-
_ = int8(parsed) // $ MISSING: hasValueFlow="type conversion" // Not found because we only check for upper bounds
256+
_ = int8(parsed) // $ MISSING: hasValueFlow="parsed" // Not found because we only check for upper bounds
257257
if parsed >= 0 {
258258
_ = int16(parsed)
259259
}
260260
}
261261
if parsed >= math.MinInt8 {
262-
_ = int8(parsed) // $ hasValueFlow="type conversion"
262+
_ = int8(parsed) // $ hasValueFlow="parsed"
263263
if parsed <= 0 {
264264
_ = int16(parsed)
265265
}
@@ -276,46 +276,46 @@ func testBoundsChecking(input string) {
276276
panic(err)
277277
}
278278
if parsed <= math.MaxUint64 {
279-
_ = int8(parsed) // $ hasValueFlow="type conversion"
280-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
281-
_ = int16(parsed) // $ hasValueFlow="type conversion"
282-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
283-
_ = int32(parsed) // $ hasValueFlow="type conversion"
284-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
285-
_ = int64(parsed) // $ hasValueFlow="type conversion"
279+
_ = int8(parsed) // $ hasValueFlow="parsed"
280+
_ = uint8(parsed) // $ hasValueFlow="parsed"
281+
_ = int16(parsed) // $ hasValueFlow="parsed"
282+
_ = uint16(parsed) // $ hasValueFlow="parsed"
283+
_ = int32(parsed) // $ hasValueFlow="parsed"
284+
_ = uint32(parsed) // $ hasValueFlow="parsed"
285+
_ = int64(parsed) // $ hasValueFlow="parsed"
286286
_ = uint64(parsed)
287-
_ = int(parsed) // $ hasValueFlow="type conversion"
287+
_ = int(parsed) // $ hasValueFlow="parsed"
288288
_ = uint(parsed)
289289
}
290290
if parsed <= math.MaxInt64 {
291-
_ = int8(parsed) // $ hasValueFlow="type conversion"
292-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
293-
_ = int16(parsed) // $ hasValueFlow="type conversion"
294-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
295-
_ = int32(parsed) // $ hasValueFlow="type conversion"
296-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
291+
_ = int8(parsed) // $ hasValueFlow="parsed"
292+
_ = uint8(parsed) // $ hasValueFlow="parsed"
293+
_ = int16(parsed) // $ hasValueFlow="parsed"
294+
_ = uint16(parsed) // $ hasValueFlow="parsed"
295+
_ = int32(parsed) // $ hasValueFlow="parsed"
296+
_ = uint32(parsed) // $ hasValueFlow="parsed"
297297
_ = int64(parsed)
298298
_ = uint64(parsed)
299-
_ = int(parsed) // $ hasValueFlow="type conversion"
299+
_ = int(parsed) // $ hasValueFlow="parsed"
300300
_ = uint(parsed)
301301
}
302302
if parsed <= math.MaxUint32 {
303-
_ = int8(parsed) // $ hasValueFlow="type conversion"
304-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
305-
_ = int16(parsed) // $ hasValueFlow="type conversion"
306-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
307-
_ = int32(parsed) // $ hasValueFlow="type conversion"
303+
_ = int8(parsed) // $ hasValueFlow="parsed"
304+
_ = uint8(parsed) // $ hasValueFlow="parsed"
305+
_ = int16(parsed) // $ hasValueFlow="parsed"
306+
_ = uint16(parsed) // $ hasValueFlow="parsed"
307+
_ = int32(parsed) // $ hasValueFlow="parsed"
308308
_ = uint32(parsed)
309309
_ = int64(parsed)
310310
_ = uint64(parsed)
311-
_ = int(parsed) // $ hasValueFlow="type conversion"
311+
_ = int(parsed) // $ hasValueFlow="parsed"
312312
_ = uint(parsed)
313313
}
314314
if parsed <= math.MaxInt32 {
315-
_ = int8(parsed) // $ hasValueFlow="type conversion"
316-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
317-
_ = int16(parsed) // $ hasValueFlow="type conversion"
318-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
315+
_ = int8(parsed) // $ hasValueFlow="parsed"
316+
_ = uint8(parsed) // $ hasValueFlow="parsed"
317+
_ = int16(parsed) // $ hasValueFlow="parsed"
318+
_ = uint16(parsed) // $ hasValueFlow="parsed"
319319
_ = int32(parsed)
320320
_ = uint32(parsed)
321321
_ = int64(parsed)
@@ -331,19 +331,19 @@ func testBoundsChecking(input string) {
331331
}
332332
if parsed <= math.MaxUint16 {
333333
_ = uint16(parsed)
334-
_ = int16(parsed) // $ hasValueFlow="type conversion"
334+
_ = int16(parsed) // $ hasValueFlow="parsed"
335335
}
336336
if parsed <= 255 {
337337
_ = uint8(parsed)
338338
}
339339
if parsed <= 256 {
340-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
340+
_ = uint8(parsed) // $ hasValueFlow="parsed"
341341
}
342342
if err == nil && 1 == 1 && parsed < math.MaxInt8 {
343343
_ = int8(parsed)
344344
}
345345
if parsed > 42 {
346-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
346+
_ = uint16(parsed) // $ hasValueFlow="parsed"
347347
}
348348
if parsed >= math.MaxUint8+1 {
349349
return
@@ -393,7 +393,7 @@ func testRightShifted(input string) {
393393
if err != nil {
394394
panic(err)
395395
}
396-
_ = byte(parsed) // $ hasValueFlow="type conversion"
396+
_ = byte(parsed) // $ hasValueFlow="parsed"
397397
_ = byte(parsed << 8)
398398
}
399399
}
@@ -404,15 +404,15 @@ func testPathWithMoreThanOneSink(input string) {
404404
if err != nil {
405405
panic(err)
406406
}
407-
v1 := int16(parsed) // $ hasValueFlow="type conversion"
407+
v1 := int16(parsed) // $ hasValueFlow="parsed"
408408
_ = int16(v1)
409409
}
410410
{
411411
parsed, err := strconv.ParseInt(input, 10, 32)
412412
if err != nil {
413413
panic(err)
414414
}
415-
v := int16(parsed) // $ hasValueFlow="type conversion"
415+
v := int16(parsed) // $ hasValueFlow="parsed"
416416
_ = int8(v)
417417
}
418418
{
@@ -421,7 +421,7 @@ func testPathWithMoreThanOneSink(input string) {
421421
panic(err)
422422
}
423423
v1 := int32(parsed)
424-
v2 := int16(v1) // $ hasValueFlow="type conversion"
424+
v2 := int16(v1) // $ hasValueFlow="v1"
425425
_ = int8(v2)
426426
}
427427
{
@@ -432,7 +432,7 @@ func testPathWithMoreThanOneSink(input string) {
432432
v1 := int64(parsed)
433433
v2 := int32(v1)
434434
v3 := int16(v2)
435-
_ = int8(v3) // $ hasValueFlow="type conversion"
435+
_ = int8(v3) // $ hasValueFlow="v3"
436436
}
437437
}
438438

@@ -441,12 +441,12 @@ func testUsingStrConvIntSize(input string) {
441441
if err != nil {
442442
panic(err)
443443
}
444-
_ = int8(parsed) // $ hasValueFlow="type conversion"
445-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
446-
_ = int16(parsed) // $ hasValueFlow="type conversion"
447-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
448-
_ = int32(parsed) // $ hasValueFlow="type conversion"
449-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
444+
_ = int8(parsed) // $ hasValueFlow="parsed"
445+
_ = uint8(parsed) // $ hasValueFlow="parsed"
446+
_ = int16(parsed) // $ hasValueFlow="parsed"
447+
_ = uint16(parsed) // $ hasValueFlow="parsed"
448+
_ = int32(parsed) // $ hasValueFlow="parsed"
449+
_ = uint32(parsed) // $ hasValueFlow="parsed"
450450
_ = int64(parsed)
451451
_ = uint64(parsed)
452452
_ = int(parsed)

‎go/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.ql‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,11 @@ module TestIncorrectIntegerConversion implements TestSig {
77

88
predicate hasActualResult(Location location, string element, string tag, string value) {
99
tag = "hasValueFlow" and
10-
exists(DataFlow::Node sink, DataFlow::Node sinkConverted |
11-
Flow::flowTo(sink) and
12-
sinkConverted = sink.getASuccessor()
13-
|
14-
sinkConverted
15-
.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
16-
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
17-
element = sinkConverted.toString() and
18-
value = "\"" + sinkConverted.toString() + "\""
10+
exists(DataFlow::Node sink | Flow::flowTo(sink) |
11+
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
12+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
13+
element = sink.toString() and
14+
value = "\"" + sink.toString() + "\""
1915
)
2016
}
2117
}

0 commit comments

Comments
 (0)