Skip to content

Commit c0baa61

Browse files
geoffw0geoffw0
committed
Rust: Additional test case for arrays.
1 parent fcdb89c commit c0baa61

2 files changed

Lines changed: 43 additions & 20 deletions

File tree

‎rust/ql/test/query-tests/security/CWE-798/HardcodedCryptographicValue.expected‎

Lines changed: 35 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,10 @@
99
| test_cookie.rs:17:28:17:34 | [0; 64] | test_cookie.rs:17:28:17:34 | [0; 64] | test_cookie.rs:18:26:18:32 | &array1 | This hard-coded value is used as $@. | test_cookie.rs:18:26:18:32 | &array1 | a key |
1010
| test_cookie.rs:21:28:21:34 | [0; 64] | test_cookie.rs:21:28:21:34 | [0; 64] | test_cookie.rs:22:26:22:32 | &array2 | This hard-coded value is used as $@. | test_cookie.rs:22:26:22:32 | &array2 | a key |
1111
| test_cookie.rs:25:16:29:5 | match ... { ... } | test_cookie.rs:25:16:29:5 | match ... { ... } | test_cookie.rs:30:26:30:40 | str3.as_bytes() | This hard-coded value is used as $@. | test_cookie.rs:30:26:30:40 | str3.as_bytes() | a key |
12-
| test_cookie.rs:46:28:46:36 | [0u8; 64] | test_cookie.rs:46:28:46:36 | [0u8; 64] | test_cookie.rs:50:34:50:39 | array2 | This hard-coded value is used as $@. | test_cookie.rs:50:34:50:39 | array2 | a key |
13-
| test_cookie.rs:57:23:57:25 | 0u8 | test_cookie.rs:57:23:57:25 | 0u8 | test_cookie.rs:61:34:61:39 | array3 | This hard-coded value is used as $@. | test_cookie.rs:61:34:61:39 | array3 | a key |
12+
| test_cookie.rs:34:9:34:9 | 1 | test_cookie.rs:34:9:34:9 | 1 | test_cookie.rs:38:26:38:32 | &array4 | This hard-coded value is used as $@. | test_cookie.rs:38:26:38:32 | &array4 | a key |
13+
| test_cookie.rs:35:9:35:9 | 2 | test_cookie.rs:35:9:35:9 | 2 | test_cookie.rs:38:26:38:32 | &array4 | This hard-coded value is used as $@. | test_cookie.rs:38:26:38:32 | &array4 | a key |
14+
| test_cookie.rs:54:28:54:36 | [0u8; 64] | test_cookie.rs:54:28:54:36 | [0u8; 64] | test_cookie.rs:58:34:58:39 | array2 | This hard-coded value is used as $@. | test_cookie.rs:58:34:58:39 | array2 | a key |
15+
| test_cookie.rs:65:23:65:25 | 0u8 | test_cookie.rs:65:23:65:25 | 0u8 | test_cookie.rs:69:34:69:39 | array3 | This hard-coded value is used as $@. | test_cookie.rs:69:34:69:39 | array3 | a key |
1416
| test_heuristic.rs:38:25:38:30 | 0xFFFF | test_heuristic.rs:38:25:38:30 | 0xFFFF | test_heuristic.rs:81:22:81:31 | MY_CONST_1 | This hard-coded value is used as $@. | test_heuristic.rs:81:22:81:31 | MY_CONST_1 | a salt |
1517
| test_heuristic.rs:39:25:39:59 | ... as u64 | test_heuristic.rs:39:25:39:59 | ... as u64 | test_heuristic.rs:82:22:82:31 | MY_CONST_2 | This hard-coded value is used as $@. | test_heuristic.rs:82:22:82:31 | MY_CONST_2 | a salt |
1618
| test_heuristic.rs:40:27:40:32 | 0xFFFF | test_heuristic.rs:40:27:40:32 | 0xFFFF | test_heuristic.rs:83:22:83:32 | MY_STATIC_3 | This hard-coded value is used as $@. | test_heuristic.rs:83:22:83:32 | MY_STATIC_3 | a salt |
@@ -70,16 +72,22 @@ edges
7072
| test_cookie.rs:25:16:29:5 | match ... { ... } | test_cookie.rs:25:9:25:12 | str3 | provenance | |
7173
| test_cookie.rs:30:26:30:29 | str3 | test_cookie.rs:30:26:30:40 | str3.as_bytes() [&ref] | provenance | MaD:13 |
7274
| test_cookie.rs:30:26:30:40 | str3.as_bytes() [&ref] | test_cookie.rs:30:26:30:40 | str3.as_bytes() | provenance | Sink:MaD:5 |
73-
| test_cookie.rs:46:9:46:14 | array2 | test_cookie.rs:50:34:50:39 | array2 | provenance | Sink:MaD:1 |
74-
| test_cookie.rs:46:18:46:37 | ...::from(...) | test_cookie.rs:46:9:46:14 | array2 | provenance | |
75-
| test_cookie.rs:46:28:46:36 | [0u8; 64] | test_cookie.rs:46:18:46:37 | ...::from(...) | provenance | MaD:8 |
76-
| test_cookie.rs:46:28:46:36 | [0u8; 64] | test_cookie.rs:46:18:46:37 | ...::from(...) | provenance | MaD:9 |
77-
| test_cookie.rs:46:28:46:36 | [0u8; 64] | test_cookie.rs:46:18:46:37 | ...::from(...) | provenance | MaD:10 |
78-
| test_cookie.rs:46:28:46:36 | [0u8; 64] | test_cookie.rs:46:18:46:37 | ...::from(...) | provenance | MaD:11 |
79-
| test_cookie.rs:46:28:46:36 | [0u8; 64] | test_cookie.rs:46:18:46:37 | ...::from(...) | provenance | MaD:12 |
80-
| test_cookie.rs:57:9:57:14 | array3 [element] | test_cookie.rs:61:34:61:39 | array3 | provenance | Sink:MaD:1 |
81-
| test_cookie.rs:57:23:57:25 | 0u8 | test_cookie.rs:57:23:57:29 | ...::from_elem(...) [element] | provenance | MaD:15 |
82-
| test_cookie.rs:57:23:57:29 | ...::from_elem(...) [element] | test_cookie.rs:57:9:57:14 | array3 [element] | provenance | |
75+
| test_cookie.rs:33:9:33:14 | array4 [element] | test_cookie.rs:38:27:38:32 | array4 [element] | provenance | |
76+
| test_cookie.rs:33:27:37:5 | [...] [element] | test_cookie.rs:33:9:33:14 | array4 [element] | provenance | |
77+
| test_cookie.rs:34:9:34:9 | 1 | test_cookie.rs:33:27:37:5 | [...] [element] | provenance | |
78+
| test_cookie.rs:35:9:35:9 | 2 | test_cookie.rs:33:27:37:5 | [...] [element] | provenance | |
79+
| test_cookie.rs:38:26:38:32 | &array4 [&ref, element] | test_cookie.rs:38:26:38:32 | &array4 | provenance | Sink:MaD:5 |
80+
| test_cookie.rs:38:27:38:32 | array4 [element] | test_cookie.rs:38:26:38:32 | &array4 [&ref, element] | provenance | |
81+
| test_cookie.rs:54:9:54:14 | array2 | test_cookie.rs:58:34:58:39 | array2 | provenance | Sink:MaD:1 |
82+
| test_cookie.rs:54:18:54:37 | ...::from(...) | test_cookie.rs:54:9:54:14 | array2 | provenance | |
83+
| test_cookie.rs:54:28:54:36 | [0u8; 64] | test_cookie.rs:54:18:54:37 | ...::from(...) | provenance | MaD:8 |
84+
| test_cookie.rs:54:28:54:36 | [0u8; 64] | test_cookie.rs:54:18:54:37 | ...::from(...) | provenance | MaD:9 |
85+
| test_cookie.rs:54:28:54:36 | [0u8; 64] | test_cookie.rs:54:18:54:37 | ...::from(...) | provenance | MaD:10 |
86+
| test_cookie.rs:54:28:54:36 | [0u8; 64] | test_cookie.rs:54:18:54:37 | ...::from(...) | provenance | MaD:11 |
87+
| test_cookie.rs:54:28:54:36 | [0u8; 64] | test_cookie.rs:54:18:54:37 | ...::from(...) | provenance | MaD:12 |
88+
| test_cookie.rs:65:9:65:14 | array3 [element] | test_cookie.rs:69:34:69:39 | array3 | provenance | Sink:MaD:1 |
89+
| test_cookie.rs:65:23:65:25 | 0u8 | test_cookie.rs:65:23:65:29 | ...::from_elem(...) [element] | provenance | MaD:15 |
90+
| test_cookie.rs:65:23:65:29 | ...::from_elem(...) [element] | test_cookie.rs:65:9:65:14 | array3 [element] | provenance | |
8391
| test_heuristic.rs:38:25:38:30 | 0xFFFF | test_heuristic.rs:81:22:81:31 | MY_CONST_1 | provenance | |
8492
| test_heuristic.rs:39:25:39:59 | ... as u64 | test_heuristic.rs:82:22:82:31 | MY_CONST_2 | provenance | |
8593
| test_heuristic.rs:39:62:40:33 | static MY_STATIC_3 | test_heuristic.rs:83:22:83:32 | MY_STATIC_3 | provenance | |
@@ -163,14 +171,21 @@ nodes
163171
| test_cookie.rs:30:26:30:29 | str3 | semmle.label | str3 |
164172
| test_cookie.rs:30:26:30:40 | str3.as_bytes() | semmle.label | str3.as_bytes() |
165173
| test_cookie.rs:30:26:30:40 | str3.as_bytes() [&ref] | semmle.label | str3.as_bytes() [&ref] |
166-
| test_cookie.rs:46:9:46:14 | array2 | semmle.label | array2 |
167-
| test_cookie.rs:46:18:46:37 | ...::from(...) | semmle.label | ...::from(...) |
168-
| test_cookie.rs:46:28:46:36 | [0u8; 64] | semmle.label | [0u8; 64] |
169-
| test_cookie.rs:50:34:50:39 | array2 | semmle.label | array2 |
170-
| test_cookie.rs:57:9:57:14 | array3 [element] | semmle.label | array3 [element] |
171-
| test_cookie.rs:57:23:57:25 | 0u8 | semmle.label | 0u8 |
172-
| test_cookie.rs:57:23:57:29 | ...::from_elem(...) [element] | semmle.label | ...::from_elem(...) [element] |
173-
| test_cookie.rs:61:34:61:39 | array3 | semmle.label | array3 |
174+
| test_cookie.rs:33:9:33:14 | array4 [element] | semmle.label | array4 [element] |
175+
| test_cookie.rs:33:27:37:5 | [...] [element] | semmle.label | [...] [element] |
176+
| test_cookie.rs:34:9:34:9 | 1 | semmle.label | 1 |
177+
| test_cookie.rs:35:9:35:9 | 2 | semmle.label | 2 |
178+
| test_cookie.rs:38:26:38:32 | &array4 | semmle.label | &array4 |
179+
| test_cookie.rs:38:26:38:32 | &array4 [&ref, element] | semmle.label | &array4 [&ref, element] |
180+
| test_cookie.rs:38:27:38:32 | array4 [element] | semmle.label | array4 [element] |
181+
| test_cookie.rs:54:9:54:14 | array2 | semmle.label | array2 |
182+
| test_cookie.rs:54:18:54:37 | ...::from(...) | semmle.label | ...::from(...) |
183+
| test_cookie.rs:54:28:54:36 | [0u8; 64] | semmle.label | [0u8; 64] |
184+
| test_cookie.rs:58:34:58:39 | array2 | semmle.label | array2 |
185+
| test_cookie.rs:65:9:65:14 | array3 [element] | semmle.label | array3 [element] |
186+
| test_cookie.rs:65:23:65:25 | 0u8 | semmle.label | 0u8 |
187+
| test_cookie.rs:65:23:65:29 | ...::from_elem(...) [element] | semmle.label | ...::from_elem(...) [element] |
188+
| test_cookie.rs:69:34:69:39 | array3 | semmle.label | array3 |
174189
| test_heuristic.rs:38:25:38:30 | 0xFFFF | semmle.label | 0xFFFF |
175190
| test_heuristic.rs:39:25:39:59 | ... as u64 | semmle.label | ... as u64 |
176191
| test_heuristic.rs:39:62:40:33 | static MY_STATIC_3 | semmle.label | static MY_STATIC_3 |

‎rust/ql/test/query-tests/security/CWE-798/test_cookie.rs‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,14 @@ fn test_cookie_jar(array_var: &[u8], val: u64) {
2929
}; // $ Alert[rust/hard-coded-cryptographic-value]
3030
let key3 = Key::from(str3.as_bytes()); // $ Sink
3131
_ = jar.signed_mut(&key3);
32+
33+
let array4: [u8; 3] = [
34+
1, // $ Alert[rust/hard-coded-cryptographic-value]
35+
2, // $ Alert[rust/hard-coded-cryptographic-value]
36+
val as u8
37+
];
38+
let key4 = Key::from(&array4); // $ Sink
39+
_ = jar.signed_mut(&key4);
3240
}
3341

3442
fn test_biscotti_crypto(array_var: &[u8]) {

0 commit comments

Comments
 (0)