Skip to content

Commit 2d8986d

Browse files
owen-mcowen-mc
committed
Fix test expectations for Cleartext Logging
One spurious alert was removed, one missing alert was added, and some source locations changed.
1 parent 694bb67 commit 2d8986d

File tree

5 files changed

+45
-68
lines changed

5 files changed

+45
-68
lines changed

‎go/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected‎

Lines changed: 28 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@
4141
| passwords.go:34:14:34:35 | ...+... | passwords.go:21:2:21:9 | definition of password | passwords.go:34:14:34:35 | ...+... | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password |
4242
| passwords.go:39:14:39:17 | obj1 | passwords.go:37:13:37:13 | x | passwords.go:39:14:39:17 | obj1 | $@ flows to a logging call. | passwords.go:37:13:37:13 | x | Sensitive data returned by an access to password |
4343
| passwords.go:44:14:44:17 | obj2 | passwords.go:21:2:21:9 | definition of password | passwords.go:44:14:44:17 | obj2 | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password |
44-
| passwords.go:47:14:47:17 | obj3 | passwords.go:21:2:21:9 | definition of password | passwords.go:47:14:47:17 | obj3 | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password |
4544
| passwords.go:51:14:51:27 | fixed_password | passwords.go:50:2:50:15 | definition of fixed_password | passwords.go:51:14:51:27 | fixed_password | $@ flows to a logging call. | passwords.go:50:2:50:15 | definition of fixed_password | Sensitive data returned by an access to fixed_password |
4645
| passwords.go:89:14:89:26 | utilityObject | passwords.go:87:16:87:36 | call to make | passwords.go:89:14:89:26 | utilityObject | $@ flows to a logging call. | passwords.go:87:16:87:36 | call to make | Sensitive data returned by an access to passwordSet |
4746
| passwords.go:92:23:92:28 | secret | passwords.go:21:2:21:9 | definition of password | passwords.go:92:23:92:28 | secret | $@ flows to a logging call. | passwords.go:21:2:21:9 | definition of password | Sensitive data returned by an access to password |
@@ -175,8 +174,8 @@ edges
175174
| main.go:80:17:80:24 | password | main.go:82:12:82:19 | password | provenance | |
176175
| main.go:80:17:80:24 | password | main.go:83:17:83:24 | password | provenance | |
177176
| main.go:80:17:80:24 | password | main.go:86:19:86:26 | password | provenance | |
178-
| main.go:85:2:85:7 | definition of fields | main.go:87:29:87:34 | fields | provenance | Sink:MaD:2 |
179-
| main.go:86:19:86:26 | password | main.go:85:2:85:7 | definition of fields | provenance | Config |
177+
| main.go:86:2:86:7 | fields [postupdate] | main.go:87:29:87:34 | fields | provenance | Sink:MaD:2 |
178+
| main.go:86:19:86:26 | password | main.go:86:2:86:7 | fields [postupdate] | provenance | Config |
180179
| main.go:86:19:86:26 | password | main.go:90:35:90:42 | password | provenance | Sink:MaD:1 |
181180
| overrides.go:8:2:8:9 | definition of password | overrides.go:9:9:9:16 | password | provenance | |
182181
| overrides.go:9:9:9:16 | password | overrides.go:13:14:13:23 | call to String | provenance | |
@@ -188,21 +187,19 @@ edges
188187
| passwords.go:30:8:30:15 | password | passwords.go:8:12:8:12 | definition of x | provenance | |
189188
| passwords.go:34:28:34:35 | password | passwords.go:34:14:34:35 | ...+... | provenance | Config |
190189
| passwords.go:34:28:34:35 | password | passwords.go:42:6:42:13 | password | provenance | |
191-
| passwords.go:36:10:38:2 | struct literal | passwords.go:39:14:39:17 | obj1 | provenance | |
192-
| passwords.go:37:13:37:13 | x | passwords.go:36:10:38:2 | struct literal | provenance | Config |
193-
| passwords.go:41:10:43:2 | struct literal | passwords.go:44:14:44:17 | obj2 | provenance | |
194-
| passwords.go:42:6:42:13 | password | passwords.go:41:10:43:2 | struct literal | provenance | Config |
190+
| passwords.go:36:10:38:2 | struct literal [postupdate] | passwords.go:39:14:39:17 | obj1 | provenance | |
191+
| passwords.go:37:13:37:13 | x | passwords.go:36:10:38:2 | struct literal [postupdate] | provenance | Config |
192+
| passwords.go:41:10:43:2 | struct literal [postupdate] | passwords.go:44:14:44:17 | obj2 | provenance | |
193+
| passwords.go:42:6:42:13 | password | passwords.go:41:10:43:2 | struct literal [postupdate] | provenance | Config |
195194
| passwords.go:42:6:42:13 | password | passwords.go:48:11:48:18 | password | provenance | |
196-
| passwords.go:46:6:46:9 | definition of obj3 | passwords.go:47:14:47:17 | obj3 | provenance | |
197-
| passwords.go:48:11:48:18 | password | passwords.go:46:6:46:9 | definition of obj3 | provenance | Config |
198195
| passwords.go:48:11:48:18 | password | passwords.go:92:23:92:28 | secret | provenance | |
199196
| passwords.go:48:11:48:18 | password | passwords.go:102:33:102:40 | password | provenance | |
200197
| passwords.go:48:11:48:18 | password | passwords.go:108:34:108:41 | password | provenance | |
201198
| passwords.go:48:11:48:18 | password | passwords.go:113:33:113:40 | password | provenance | |
202199
| passwords.go:48:11:48:18 | password | passwords.go:123:13:123:20 | password | provenance | |
203200
| passwords.go:50:2:50:15 | definition of fixed_password | passwords.go:51:14:51:27 | fixed_password | provenance | |
204-
| passwords.go:86:19:88:2 | struct literal | passwords.go:89:14:89:26 | utilityObject | provenance | |
205-
| passwords.go:87:16:87:36 | call to make | passwords.go:86:19:88:2 | struct literal | provenance | Config |
201+
| passwords.go:86:19:88:2 | struct literal [postupdate] | passwords.go:89:14:89:26 | utilityObject | provenance | |
202+
| passwords.go:87:16:87:36 | call to make | passwords.go:86:19:88:2 | struct literal [postupdate] | provenance | Config |
206203
| passwords.go:102:33:102:40 | password | passwords.go:102:15:102:40 | ...+... | provenance | Config |
207204
| passwords.go:102:33:102:40 | password | passwords.go:108:34:108:41 | password | provenance | |
208205
| passwords.go:102:33:102:40 | password | passwords.go:113:33:113:40 | password | provenance | |
@@ -215,22 +212,20 @@ edges
215212
| passwords.go:116:6:116:14 | definition of password1 | passwords.go:117:28:117:36 | password1 | provenance | |
216213
| passwords.go:117:28:117:36 | password1 | passwords.go:117:28:117:45 | call to String | provenance | Config |
217214
| passwords.go:117:28:117:45 | call to String | passwords.go:117:14:117:45 | ...+... | provenance | Config |
218-
| passwords.go:120:12:125:2 | struct literal | passwords.go:127:14:127:19 | config | provenance | |
219-
| passwords.go:120:12:125:2 | struct literal [x] | passwords.go:128:14:128:19 | config [x] | provenance | |
220-
| passwords.go:120:12:125:2 | struct literal [y] | passwords.go:129:14:129:19 | config [y] | provenance | |
221-
| passwords.go:121:13:121:14 | x3 | passwords.go:120:12:125:2 | struct literal | provenance | Config |
222-
| passwords.go:123:13:123:20 | password | passwords.go:120:12:125:2 | struct literal | provenance | Config |
223-
| passwords.go:123:13:123:20 | password | passwords.go:120:12:125:2 | struct literal [x] | provenance | |
224-
| passwords.go:124:13:124:25 | call to getPassword | passwords.go:120:12:125:2 | struct literal | provenance | Config |
225-
| passwords.go:124:13:124:25 | call to getPassword | passwords.go:120:12:125:2 | struct literal [y] | provenance | |
215+
| passwords.go:120:12:125:2 | struct literal [postupdate] | passwords.go:127:14:127:19 | config | provenance | |
216+
| passwords.go:120:12:125:2 | struct literal [postupdate] [x] | passwords.go:128:14:128:19 | config [x] | provenance | |
217+
| passwords.go:120:12:125:2 | struct literal [postupdate] [y] | passwords.go:129:14:129:19 | config [y] | provenance | |
218+
| passwords.go:121:13:121:14 | x3 | passwords.go:120:12:125:2 | struct literal [postupdate] | provenance | Config |
219+
| passwords.go:123:13:123:20 | password | passwords.go:120:12:125:2 | struct literal [postupdate] | provenance | Config |
220+
| passwords.go:123:13:123:20 | password | passwords.go:120:12:125:2 | struct literal [postupdate] [x] | provenance | |
221+
| passwords.go:124:13:124:25 | call to getPassword | passwords.go:120:12:125:2 | struct literal [postupdate] | provenance | Config |
222+
| passwords.go:124:13:124:25 | call to getPassword | passwords.go:120:12:125:2 | struct literal [postupdate] [y] | provenance | |
226223
| passwords.go:128:14:128:19 | config [x] | passwords.go:128:14:128:21 | selection of x | provenance | |
227224
| passwords.go:129:14:129:19 | config [y] | passwords.go:129:14:129:21 | selection of y | provenance | |
228225
| protobuf.go:9:2:9:9 | definition of password | protobuf.go:12:22:12:29 | password | provenance | |
229-
| protobuf.go:11:2:11:6 | definition of query [pointer, Description] | protobuf.go:12:2:12:6 | query [pointer, Description] | provenance | |
230-
| protobuf.go:12:2:12:6 | implicit dereference [Description] | protobuf.go:11:2:11:6 | definition of query [pointer, Description] | provenance | |
231-
| protobuf.go:12:2:12:6 | query [pointer, Description] | protobuf.go:12:2:12:6 | implicit dereference [Description] | provenance | |
232-
| protobuf.go:12:2:12:6 | query [pointer, Description] | protobuf.go:14:14:14:18 | query [pointer, Description] | provenance | |
233-
| protobuf.go:12:22:12:29 | password | protobuf.go:12:2:12:6 | implicit dereference [Description] | provenance | |
226+
| protobuf.go:12:2:12:6 | implicit dereference [postupdate] [Description] | protobuf.go:12:2:12:6 | query [postupdate] [pointer, Description] | provenance | |
227+
| protobuf.go:12:2:12:6 | query [postupdate] [pointer, Description] | protobuf.go:14:14:14:18 | query [pointer, Description] | provenance | |
228+
| protobuf.go:12:22:12:29 | password | protobuf.go:12:2:12:6 | implicit dereference [postupdate] [Description] | provenance | |
234229
| protobuf.go:14:14:14:18 | query [pointer, Description] | protobuf.go:14:14:14:35 | call to GetDescription | provenance | |
235230
| protobuf.go:14:14:14:18 | query [pointer, Description] | protos/query/query.pb.go:117:7:117:7 | definition of x [pointer, Description] | provenance | |
236231
| protos/query/query.pb.go:117:7:117:7 | definition of x [pointer, Description] | protos/query/query.pb.go:119:10:119:10 | x [pointer, Description] | provenance | |
@@ -298,7 +293,7 @@ nodes
298293
| main.go:80:17:80:24 | password | semmle.label | password |
299294
| main.go:82:12:82:19 | password | semmle.label | password |
300295
| main.go:83:17:83:24 | password | semmle.label | password |
301-
| main.go:85:2:85:7 | definition of fields | semmle.label | definition of fields |
296+
| main.go:86:2:86:7 | fields [postupdate] | semmle.label | fields [postupdate] |
302297
| main.go:86:19:86:26 | password | semmle.label | password |
303298
| main.go:87:29:87:34 | fields | semmle.label | fields |
304299
| main.go:90:35:90:42 | password | semmle.label | password |
@@ -316,18 +311,16 @@ nodes
316311
| passwords.go:32:12:32:19 | password | semmle.label | password |
317312
| passwords.go:34:14:34:35 | ...+... | semmle.label | ...+... |
318313
| passwords.go:34:28:34:35 | password | semmle.label | password |
319-
| passwords.go:36:10:38:2 | struct literal | semmle.label | struct literal |
314+
| passwords.go:36:10:38:2 | struct literal [postupdate] | semmle.label | struct literal [postupdate] |
320315
| passwords.go:37:13:37:13 | x | semmle.label | x |
321316
| passwords.go:39:14:39:17 | obj1 | semmle.label | obj1 |
322-
| passwords.go:41:10:43:2 | struct literal | semmle.label | struct literal |
317+
| passwords.go:41:10:43:2 | struct literal [postupdate] | semmle.label | struct literal [postupdate] |
323318
| passwords.go:42:6:42:13 | password | semmle.label | password |
324319
| passwords.go:44:14:44:17 | obj2 | semmle.label | obj2 |
325-
| passwords.go:46:6:46:9 | definition of obj3 | semmle.label | definition of obj3 |
326-
| passwords.go:47:14:47:17 | obj3 | semmle.label | obj3 |
327320
| passwords.go:48:11:48:18 | password | semmle.label | password |
328321
| passwords.go:50:2:50:15 | definition of fixed_password | semmle.label | definition of fixed_password |
329322
| passwords.go:51:14:51:27 | fixed_password | semmle.label | fixed_password |
330-
| passwords.go:86:19:88:2 | struct literal | semmle.label | struct literal |
323+
| passwords.go:86:19:88:2 | struct literal [postupdate] | semmle.label | struct literal [postupdate] |
331324
| passwords.go:87:16:87:36 | call to make | semmle.label | call to make |
332325
| passwords.go:89:14:89:26 | utilityObject | semmle.label | utilityObject |
333326
| passwords.go:92:23:92:28 | secret | semmle.label | secret |
@@ -341,9 +334,9 @@ nodes
341334
| passwords.go:117:14:117:45 | ...+... | semmle.label | ...+... |
342335
| passwords.go:117:28:117:36 | password1 | semmle.label | password1 |
343336
| passwords.go:117:28:117:45 | call to String | semmle.label | call to String |
344-
| passwords.go:120:12:125:2 | struct literal | semmle.label | struct literal |
345-
| passwords.go:120:12:125:2 | struct literal [x] | semmle.label | struct literal [x] |
346-
| passwords.go:120:12:125:2 | struct literal [y] | semmle.label | struct literal [y] |
337+
| passwords.go:120:12:125:2 | struct literal [postupdate] | semmle.label | struct literal [postupdate] |
338+
| passwords.go:120:12:125:2 | struct literal [postupdate] [x] | semmle.label | struct literal [postupdate] [x] |
339+
| passwords.go:120:12:125:2 | struct literal [postupdate] [y] | semmle.label | struct literal [postupdate] [y] |
347340
| passwords.go:121:13:121:14 | x3 | semmle.label | x3 |
348341
| passwords.go:123:13:123:20 | password | semmle.label | password |
349342
| passwords.go:124:13:124:25 | call to getPassword | semmle.label | call to getPassword |
@@ -353,9 +346,8 @@ nodes
353346
| passwords.go:129:14:129:19 | config [y] | semmle.label | config [y] |
354347
| passwords.go:129:14:129:21 | selection of y | semmle.label | selection of y |
355348
| protobuf.go:9:2:9:9 | definition of password | semmle.label | definition of password |
356-
| protobuf.go:11:2:11:6 | definition of query [pointer, Description] | semmle.label | definition of query [pointer, Description] |
357-
| protobuf.go:12:2:12:6 | implicit dereference [Description] | semmle.label | implicit dereference [Description] |
358-
| protobuf.go:12:2:12:6 | query [pointer, Description] | semmle.label | query [pointer, Description] |
349+
| protobuf.go:12:2:12:6 | implicit dereference [postupdate] [Description] | semmle.label | implicit dereference [postupdate] [Description] |
350+
| protobuf.go:12:2:12:6 | query [postupdate] [pointer, Description] | semmle.label | query [postupdate] [pointer, Description] |
359351
| protobuf.go:12:22:12:29 | password | semmle.label | password |
360352
| protobuf.go:14:14:14:18 | query [pointer, Description] | semmle.label | query [pointer, Description] |
361353
| protobuf.go:14:14:14:35 | call to GetDescription | semmle.label | call to GetDescription |
@@ -365,18 +357,3 @@ nodes
365357
| protos/query/query.pb.go:119:10:119:22 | selection of Description | semmle.label | selection of Description |
366358
subpaths
367359
| protobuf.go:14:14:14:18 | query [pointer, Description] | protos/query/query.pb.go:117:7:117:7 | definition of x [pointer, Description] | protos/query/query.pb.go:119:10:119:22 | selection of Description | protobuf.go:14:14:14:35 | call to GetDescription |
368-
testFailures
369-
| main.go:17:2:17:9 | definition of password | Unexpected result: Source |
370-
| main.go:87:29:87:34 | fields | Unexpected result: Alert |
371-
| overrides.go:8:2:8:9 | definition of password | Unexpected result: Source |
372-
| overrides.go:9:18:9:28 | comment | Missing result: Source |
373-
| passwords.go:21:2:21:9 | definition of password | Unexpected result: Source |
374-
| passwords.go:30:18:30:28 | comment | Missing result: Source |
375-
| passwords.go:42:16:42:26 | comment | Missing result: Source |
376-
| passwords.go:48:20:48:30 | comment | Missing result: Source |
377-
| passwords.go:50:2:50:15 | definition of fixed_password | Unexpected result: Source |
378-
| passwords.go:91:31:91:41 | comment | Missing result: Source |
379-
| passwords.go:116:6:116:14 | definition of password1 | Unexpected result: Source |
380-
| passwords.go:123:28:123:38 | comment | Missing result: Source |
381-
| protobuf.go:9:2:9:9 | definition of password | Unexpected result: Source |
382-
| protobuf.go:12:31:12:41 | comment | Missing result: Source |

‎go/ql/test/query-tests/Security/CWE-312/main.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import (
1414
var i int = rand.Int()
1515

1616
func main() {
17-
password := "P4ssw0rd"
17+
password := "P4ssw0rd" // $ Source
1818

1919
log.Print(password) // $ Alert
2020
log.Printf("%s", password) // $ Alert
@@ -84,7 +84,7 @@ func main() {
8484

8585
fields := make(logrus.Fields)
8686
fields["pass"] = password
87-
entry := logrus.WithFields(fields)
87+
entry := logrus.WithFields(fields) // $ Alert
8888
entry.Errorf("")
8989

9090
entry = logrus.WithField("pass", password) // $ Alert

‎go/ql/test/query-tests/Security/CWE-312/overrides.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ import "fmt"
55
type s struct{}
66

77
func (_ s) String() string {
8-
password := "horsebatterystaplecorrect"
9-
return password // $ Source
8+
password := "horsebatterystaplecorrect" // $ Source
9+
return password
1010
}
1111

1212
func overrideTest(x s, y fmt.Stringer) {

‎go/ql/test/query-tests/Security/CWE-312/passwords.go‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ func redact(kind, value string) string {
1818

1919
func test() {
2020
name := "user"
21-
password := "P@ssw0rd"
21+
password := "P@ssw0rd" // $ Source
2222
x := "horsebatterystapleincorrect"
2323
var o passStruct
2424

@@ -27,7 +27,7 @@ func test() {
2727
log.Println(getPassword()) // $ Alert
2828
log.Println(o.getPassword()) // $ Alert
2929

30-
myLog(password) // $ Source
30+
myLog(password)
3131

3232
log.Panic(password) // $ Alert
3333

@@ -39,16 +39,16 @@ func test() {
3939
log.Println(obj1) // $ Alert
4040

4141
obj2 := xStruct{
42-
x: password, // $ Source
42+
x: password,
4343
}
4444
log.Println(obj2) // $ Alert
4545

4646
var obj3 xStruct
47-
log.Println(obj3) // $ SPURIOUS: Alert // caught because of the below line and def-use flow
48-
obj3.x = password // $ Source
47+
log.Println(obj3)
48+
obj3.x = password
4949

50-
fixed_password := "cowbatterystaplecorrect"
51-
log.Println(fixed_password) // $ Alert // Probably OK
50+
fixed_password := "cowbatterystaplecorrect" // $ Source
51+
log.Println(fixed_password) // $ Alert // Probably OK
5252

5353
log.Println(IncorrectPasswordError) // OK
5454

@@ -88,7 +88,7 @@ func test() {
8888
}
8989
log.Println(utilityObject) // $ Alert
9090

91-
secret := password // $ Source
91+
secret := password
9292
log.Printf("pw: %s", secret) // $ Alert
9393

9494
log.Println("Password is: " + redact("password", password))
@@ -113,14 +113,14 @@ func test() {
113113
log.Println("Password is: " + password) // $ SPURIOUS: Alert
114114
}
115115

116-
var password1 stringable = stringable{"arstneio"}
117-
log.Println(name + ", " + password1.String()) // $ Alert
116+
var password1 stringable = stringable{"arstneio"} // $ Source
117+
log.Println(name + ", " + password1.String()) // $ Alert
118118

119119
x3 := "sheepbatterystaplecorrect"
120120
config := Config{
121121
password: x3, // $ Source
122122
hostname: "tarski",
123-
x: password, // $ Source
123+
x: password,
124124
y: getPassword(), // $ Source
125125
}
126126
log.Println(config.hostname) // OK

‎go/ql/test/query-tests/Security/CWE-312/protobuf.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ import (
66
)
77

88
func testProtobuf() {
9-
password := "P@ssw0rd"
9+
password := "P@ssw0rd" // $ Source
1010

1111
query := &query.Query{}
12-
query.Description = password // $ Source
12+
query.Description = password
1313

1414
log.Println(query.GetDescription()) // $ Alert
1515
log.Println(query.GetId()) // OK

0 commit comments

Comments
 (0)