Skip to content

Commit 1b3c870

Browse files
geoffw0CHMANG
geoffw0
authored and
CHMANG
committed
Rust: Add more test cases for barrier guards.
1 parent 35ccfb1 commit 1b3c870

2 files changed

Lines changed: 82 additions & 21 deletions

File tree

‎rust/ql/test/query-tests/security/CWE-078/CommandInjection.expected‎

Lines changed: 51 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,16 @@
66
| main.rs:53:18:53:46 | concatenated_command.as_str() | main.rs:5:25:5:69 | ...::get(...) | main.rs:53:18:53:46 | concatenated_command.as_str() | This command line depends on a $@. | main.rs:5:25:5:69 | ...::get(...) | user-provided value |
77
| main.rs:65:48:65:69 | remote_string.as_str() | main.rs:59:25:59:69 | ...::get(...) | main.rs:65:48:65:69 | remote_string.as_str() | This command line depends on a $@. | main.rs:59:25:59:69 | ...::get(...) | user-provided value |
88
| main.rs:73:14:73:35 | remote_string.as_str() | main.rs:59:25:59:69 | ...::get(...) | main.rs:73:14:73:35 | remote_string.as_str() | This command line depends on a $@. | main.rs:59:25:59:69 | ...::get(...) | user-provided value |
9-
| main.rs:86:18:86:27 | user_input | main.rs:108:22:108:37 | ...::args(...) | main.rs:86:18:86:27 | user_input | This command line depends on a $@. | main.rs:108:22:108:37 | ...::args(...) | user-provided value |
10-
| main.rs:100:22:100:29 | filename | main.rs:108:22:108:37 | ...::args(...) | main.rs:100:22:100:29 | filename | This command line depends on a $@. | main.rs:108:22:108:37 | ...::args(...) | user-provided value |
9+
| main.rs:86:18:86:27 | user_input | main.rs:138:22:138:37 | ...::args(...) | main.rs:86:18:86:27 | user_input | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
10+
| main.rs:100:22:100:29 | filename | main.rs:138:22:138:37 | ...::args(...) | main.rs:100:22:100:29 | filename | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
11+
| main.rs:111:22:111:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:111:22:111:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
12+
| main.rs:113:22:113:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:113:22:113:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
13+
| main.rs:119:22:119:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:119:22:119:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
14+
| main.rs:121:22:121:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:121:22:121:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
15+
| main.rs:125:22:125:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:125:22:125:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
16+
| main.rs:127:22:127:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:127:22:127:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
17+
| main.rs:131:22:131:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:131:22:131:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
18+
| main.rs:133:22:133:28 | command | main.rs:138:22:138:37 | ...::args(...) | main.rs:133:22:133:28 | command | This command line depends on a $@. | main.rs:138:22:138:37 | ...::args(...) | user-provided value |
1119
edges
1220
| main.rs:4:9:4:18 | arg_string | main.rs:27:18:27:27 | arg_string | provenance | |
1321
| main.rs:4:9:4:18 | arg_string | main.rs:40:14:40:23 | arg_string | provenance | |
@@ -54,16 +62,27 @@ edges
5462
| main.rs:73:14:73:35 | remote_string.as_str() [&ref] | main.rs:73:14:73:35 | remote_string.as_str() | provenance | Sink:MaD:4 |
5563
| main.rs:82:27:82:42 | ...: ... [&ref] | main.rs:86:18:86:27 | user_input | provenance | Sink:MaD:1 |
5664
| main.rs:95:27:95:40 | ...: ... [&ref] | main.rs:100:22:100:29 | filename | provenance | Sink:MaD:1 |
57-
| main.rs:108:9:108:18 | arg_string | main.rs:112:39:112:48 | arg_string | provenance | |
58-
| main.rs:108:9:108:18 | arg_string | main.rs:113:40:113:49 | arg_string | provenance | |
59-
| main.rs:108:22:108:37 | ...::args(...) | main.rs:108:22:108:37 | ...::args(...) [element] | provenance | Src:MaD:7 |
60-
| main.rs:108:22:108:37 | ...::args(...) [element] | main.rs:108:22:108:44 | ... .nth(...) [Some] | provenance | MaD:8 |
61-
| main.rs:108:22:108:44 | ... .nth(...) [Some] | main.rs:108:22:108:74 | ... .unwrap_or(...) | provenance | MaD:10 |
62-
| main.rs:108:22:108:74 | ... .unwrap_or(...) | main.rs:108:9:108:18 | arg_string | provenance | |
63-
| main.rs:112:39:112:48 | arg_string | main.rs:112:39:112:57 | arg_string.as_str() [&ref] | provenance | MaD:9 |
64-
| main.rs:112:39:112:57 | arg_string.as_str() [&ref] | main.rs:82:27:82:42 | ...: ... [&ref] | provenance | |
65-
| main.rs:113:40:113:49 | arg_string | main.rs:113:40:113:58 | arg_string.as_str() [&ref] | provenance | MaD:9 |
66-
| main.rs:113:40:113:58 | arg_string.as_str() [&ref] | main.rs:95:27:95:40 | ...: ... [&ref] | provenance | |
65+
| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:111:22:111:28 | command | provenance | Sink:MaD:3 |
66+
| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:113:22:113:28 | command | provenance | Sink:MaD:3 |
67+
| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:119:22:119:28 | command | provenance | Sink:MaD:3 |
68+
| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:121:22:121:28 | command | provenance | Sink:MaD:3 |
69+
| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:125:22:125:28 | command | provenance | Sink:MaD:3 |
70+
| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:127:22:127:28 | command | provenance | Sink:MaD:3 |
71+
| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:131:22:131:28 | command | provenance | Sink:MaD:3 |
72+
| main.rs:107:30:107:42 | ...: ... [&ref] | main.rs:133:22:133:28 | command | provenance | Sink:MaD:3 |
73+
| main.rs:138:9:138:18 | arg_string | main.rs:142:39:142:48 | arg_string | provenance | |
74+
| main.rs:138:9:138:18 | arg_string | main.rs:143:40:143:49 | arg_string | provenance | |
75+
| main.rs:138:9:138:18 | arg_string | main.rs:144:31:144:40 | arg_string | provenance | |
76+
| main.rs:138:22:138:37 | ...::args(...) | main.rs:138:22:138:37 | ...::args(...) [element] | provenance | Src:MaD:7 |
77+
| main.rs:138:22:138:37 | ...::args(...) [element] | main.rs:138:22:138:44 | ... .nth(...) [Some] | provenance | MaD:8 |
78+
| main.rs:138:22:138:44 | ... .nth(...) [Some] | main.rs:138:22:138:74 | ... .unwrap_or(...) | provenance | MaD:10 |
79+
| main.rs:138:22:138:74 | ... .unwrap_or(...) | main.rs:138:9:138:18 | arg_string | provenance | |
80+
| main.rs:142:39:142:48 | arg_string | main.rs:142:39:142:57 | arg_string.as_str() [&ref] | provenance | MaD:9 |
81+
| main.rs:142:39:142:57 | arg_string.as_str() [&ref] | main.rs:82:27:82:42 | ...: ... [&ref] | provenance | |
82+
| main.rs:143:40:143:49 | arg_string | main.rs:143:40:143:58 | arg_string.as_str() [&ref] | provenance | MaD:9 |
83+
| main.rs:143:40:143:58 | arg_string.as_str() [&ref] | main.rs:95:27:95:40 | ...: ... [&ref] | provenance | |
84+
| main.rs:144:31:144:40 | arg_string | main.rs:144:31:144:49 | arg_string.as_str() [&ref] | provenance | MaD:9 |
85+
| main.rs:144:31:144:49 | arg_string.as_str() [&ref] | main.rs:107:30:107:42 | ...: ... [&ref] | provenance | |
6786
models
6887
| 1 | Sink: <std::process::Command>::arg; Argument[0]; command-injection |
6988
| 2 | Sink: <std::process::Command>::args; Argument[0]; command-injection |
@@ -130,13 +149,24 @@ nodes
130149
| main.rs:86:18:86:27 | user_input | semmle.label | user_input |
131150
| main.rs:95:27:95:40 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
132151
| main.rs:100:22:100:29 | filename | semmle.label | filename |
133-
| main.rs:108:9:108:18 | arg_string | semmle.label | arg_string |
134-
| main.rs:108:22:108:37 | ...::args(...) | semmle.label | ...::args(...) |
135-
| main.rs:108:22:108:37 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
136-
| main.rs:108:22:108:44 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
137-
| main.rs:108:22:108:74 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
138-
| main.rs:112:39:112:48 | arg_string | semmle.label | arg_string |
139-
| main.rs:112:39:112:57 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
140-
| main.rs:113:40:113:49 | arg_string | semmle.label | arg_string |
141-
| main.rs:113:40:113:58 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
152+
| main.rs:107:30:107:42 | ...: ... [&ref] | semmle.label | ...: ... [&ref] |
153+
| main.rs:111:22:111:28 | command | semmle.label | command |
154+
| main.rs:113:22:113:28 | command | semmle.label | command |
155+
| main.rs:119:22:119:28 | command | semmle.label | command |
156+
| main.rs:121:22:121:28 | command | semmle.label | command |
157+
| main.rs:125:22:125:28 | command | semmle.label | command |
158+
| main.rs:127:22:127:28 | command | semmle.label | command |
159+
| main.rs:131:22:131:28 | command | semmle.label | command |
160+
| main.rs:133:22:133:28 | command | semmle.label | command |
161+
| main.rs:138:9:138:18 | arg_string | semmle.label | arg_string |
162+
| main.rs:138:22:138:37 | ...::args(...) | semmle.label | ...::args(...) |
163+
| main.rs:138:22:138:37 | ...::args(...) [element] | semmle.label | ...::args(...) [element] |
164+
| main.rs:138:22:138:44 | ... .nth(...) [Some] | semmle.label | ... .nth(...) [Some] |
165+
| main.rs:138:22:138:74 | ... .unwrap_or(...) | semmle.label | ... .unwrap_or(...) |
166+
| main.rs:142:39:142:48 | arg_string | semmle.label | arg_string |
167+
| main.rs:142:39:142:57 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
168+
| main.rs:143:40:143:49 | arg_string | semmle.label | arg_string |
169+
| main.rs:143:40:143:58 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
170+
| main.rs:144:31:144:40 | arg_string | semmle.label | arg_string |
171+
| main.rs:144:31:144:49 | arg_string.as_str() [&ref] | semmle.label | arg_string.as_str() [&ref] |
142172
subpaths

‎rust/ql/test/query-tests/security/CWE-078/main.rs‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,11 +104,42 @@ mod qhelp_example_good {
104104
}
105105
}
106106

107+
fn test_allowlist_sanitizers(command: &str) {
108+
let allowed_commands_array = ["cat", "git", "ls"];
109+
110+
if allowed_commands_array.contains(&command) {
111+
Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
112+
} else {
113+
Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
114+
}
115+
116+
let allowed_commands_vec = vec!["cat", "git", "ls"];
117+
118+
if allowed_commands_vec.contains(&command) {
119+
Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
120+
} else {
121+
Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
122+
}
123+
124+
if command == "ls" {
125+
Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
126+
} else {
127+
Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
128+
}
129+
130+
if command != "ls" {
131+
Command::new(command).output().expect("failed"); // $ Alert[rust/command-line-injection]=args2
132+
} else {
133+
Command::new(command).output().expect("failed"); // $ SPURIOUS: Alert[rust/command-line-injection]=args2
134+
}
135+
}
136+
107137
fn main() {
108138
let arg_string = std::env::args().nth(1).unwrap_or(String::from("ls")); // $ Source=args2
109139

110140
test_std_command_injection();
111141
test_tokio_command_injection();
112142
qhelp_example_bad::handle_request(arg_string.as_str());
113143
qhelp_example_good::handle_request(arg_string.as_str());
144+
test_allowlist_sanitizers(arg_string.as_str());
114145
}

0 commit comments

Comments
 (0)