@@ -481,3 +481,37 @@ func testPathInjection2(s1: UnsafeMutablePointer<String>, s2: UnsafeMutablePoint
481481 _ = fm. fileAttributes ( atPath: remoteString, traverseLink: true ) // $ MISSING: hasPathInjection=445
482482 _ = try fm. attributesOfItem ( atPath: remoteString) // $ MISSING: hasPathInjection=445
483483}
484+
485+ // ---
486+
487+ func myOpenFile1( atPath path: String ) { }
488+ func myOpenFile2( _ filePath: String ) { }
489+ func myFindFiles( ofType type: Int , inDirectory dir: String ) { }
490+
491+ class MyClass {
492+ init ( contentsOfFile: String ) { }
493+ func doSomething( keyPath: String ) { }
494+ func write( toFile: String ) { }
495+ }
496+
497+ class MyFile {
498+ init ( path: String ) { }
499+ }
500+
501+ func testPathInjectionHeuristics( ) {
502+ let remoteString = String ( contentsOf: URL ( string: " http://example.com/ " ) !)
503+
504+ myOpenFile1 ( atPath: remoteString) // $ MISSING: hasPathInjection=
505+ myOpenFile2 ( remoteString) // $ MISSING: hasPathInjection=
506+ myFindFiles ( ofType: 0 , inDirectory: remoteString) // $ MISSING: hasPathInjection=
507+
508+ let mc = MyClass ( contentsOfFile: remoteString) // $ MISSING: hasPathInjection=
509+ mc. doSomething ( keyPath: remoteString) // good - not a path
510+ mc. write ( toFile: remoteString) // $ MISSING: hasPathInjection=
511+
512+ let mf1 = MyFile ( path: " " )
513+ let mf2 = MyFile ( path: remoteString) // $ MISSING: hasPathInjection=
514+
515+ _ = NSSortDescriptor ( key: remoteString, ascending: true ) // good - not a path
516+ _ = NSSortDescriptor ( keyPath: remoteString as! KeyPath < Int , Int > , ascending: true ) // good - not a path
517+ }
0 commit comments