Skip to content

Commit aad8474

Browse files
owen-mcowen-mc
authored
Merge pull request #14962 from owen-mc/go/improve-tests-incorrect-integer-conversion
Go: Improve tests for Incorrect Integer Conversion
2 parents 6d24eb4 + d52b23d commit aad8474

8 files changed

+111
-115
lines changed

‎go/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.go

Lines changed: 97 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ func lab(s string) (*something, error) {
3333
}
3434
num = int(number)
3535
}
36-
target, err := lookupTarget(&config{}, int32(num)) // $ hasValueFlow="type conversion"
36+
target, err := lookupTarget(&config{}, int32(num)) // $ hasValueFlow="num"
3737
if err != nil {
3838
return nil, err
3939
}
@@ -67,8 +67,8 @@ func testParseInt() {
6767
if err != nil {
6868
panic(err)
6969
}
70-
_ = int8(parsed) // $ hasValueFlow="type conversion"
71-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
70+
_ = int8(parsed) // $ hasValueFlow="parsed"
71+
_ = uint8(parsed) // $ hasValueFlow="parsed"
7272
_ = int16(parsed)
7373
_ = uint16(parsed)
7474
_ = int32(parsed)
@@ -83,10 +83,10 @@ func testParseInt() {
8383
if err != nil {
8484
panic(err)
8585
}
86-
_ = int8(parsed) // $ hasValueFlow="type conversion"
87-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
88-
_ = int16(parsed) // $ hasValueFlow="type conversion"
89-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
86+
_ = int8(parsed) // $ hasValueFlow="parsed"
87+
_ = uint8(parsed) // $ hasValueFlow="parsed"
88+
_ = int16(parsed) // $ hasValueFlow="parsed"
89+
_ = uint16(parsed) // $ hasValueFlow="parsed"
9090
_ = int32(parsed)
9191
_ = uint32(parsed)
9292
_ = int64(parsed)
@@ -99,28 +99,28 @@ func testParseInt() {
9999
if err != nil {
100100
panic(err)
101101
}
102-
_ = int8(parsed) // $ hasValueFlow="type conversion"
103-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
104-
_ = int16(parsed) // $ hasValueFlow="type conversion"
105-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
106-
_ = int32(parsed) // $ hasValueFlow="type conversion"
107-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
102+
_ = int8(parsed) // $ hasValueFlow="parsed"
103+
_ = uint8(parsed) // $ hasValueFlow="parsed"
104+
_ = int16(parsed) // $ hasValueFlow="parsed"
105+
_ = uint16(parsed) // $ hasValueFlow="parsed"
106+
_ = int32(parsed) // $ hasValueFlow="parsed"
107+
_ = uint32(parsed) // $ hasValueFlow="parsed"
108108
_ = int64(parsed)
109109
_ = uint64(parsed)
110-
_ = int(parsed) // $ hasValueFlow="type conversion"
111-
_ = uint(parsed) // $ hasValueFlow="type conversion"
110+
_ = int(parsed) // $ hasValueFlow="parsed"
111+
_ = uint(parsed) // $ hasValueFlow="parsed"
112112
}
113113
{
114114
parsed, err := strconv.ParseInt("3456", 10, 0)
115115
if err != nil {
116116
panic(err)
117117
}
118-
_ = int8(parsed) // $ hasValueFlow="type conversion"
119-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
120-
_ = int16(parsed) // $ hasValueFlow="type conversion"
121-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
122-
_ = int32(parsed) // $ hasValueFlow="type conversion"
123-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
118+
_ = int8(parsed) // $ hasValueFlow="parsed"
119+
_ = uint8(parsed) // $ hasValueFlow="parsed"
120+
_ = int16(parsed) // $ hasValueFlow="parsed"
121+
_ = uint16(parsed) // $ hasValueFlow="parsed"
122+
_ = int32(parsed) // $ hasValueFlow="parsed"
123+
_ = uint32(parsed) // $ hasValueFlow="parsed"
124124
_ = int64(parsed)
125125
_ = uint64(parsed)
126126
_ = int(parsed)
@@ -134,7 +134,7 @@ func testParseUint() {
134134
if err != nil {
135135
panic(err)
136136
}
137-
_ = int8(parsed) // $ hasValueFlow="type conversion"
137+
_ = int8(parsed) // $ hasValueFlow="parsed"
138138
_ = uint8(parsed)
139139
_ = int16(parsed)
140140
_ = uint16(parsed)
@@ -150,9 +150,9 @@ func testParseUint() {
150150
if err != nil {
151151
panic(err)
152152
}
153-
_ = int8(parsed) // $ hasValueFlow="type conversion"
154-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
155-
_ = int16(parsed) // $ hasValueFlow="type conversion"
153+
_ = int8(parsed) // $ hasValueFlow="parsed"
154+
_ = uint8(parsed) // $ hasValueFlow="parsed"
155+
_ = int16(parsed) // $ hasValueFlow="parsed"
156156
_ = uint16(parsed)
157157
_ = int32(parsed)
158158
_ = uint32(parsed)
@@ -166,47 +166,47 @@ func testParseUint() {
166166
if err != nil {
167167
panic(err)
168168
}
169-
_ = int8(parsed) // $ hasValueFlow="type conversion"
170-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
171-
_ = int16(parsed) // $ hasValueFlow="type conversion"
172-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
173-
_ = int32(parsed) // $ hasValueFlow="type conversion"
169+
_ = int8(parsed) // $ hasValueFlow="parsed"
170+
_ = uint8(parsed) // $ hasValueFlow="parsed"
171+
_ = int16(parsed) // $ hasValueFlow="parsed"
172+
_ = uint16(parsed) // $ hasValueFlow="parsed"
173+
_ = int32(parsed) // $ hasValueFlow="parsed"
174174
_ = uint32(parsed)
175175
_ = int64(parsed)
176176
_ = uint64(parsed)
177-
_ = int(parsed) // $ hasValueFlow="type conversion"
177+
_ = int(parsed) // $ hasValueFlow="parsed"
178178
_ = uint(parsed)
179179
}
180180
{
181181
parsed, err := strconv.ParseUint("3456", 10, 64)
182182
if err != nil {
183183
panic(err)
184184
}
185-
_ = int8(parsed) // $ hasValueFlow="type conversion"
186-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
187-
_ = int16(parsed) // $ hasValueFlow="type conversion"
188-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
189-
_ = int32(parsed) // $ hasValueFlow="type conversion"
190-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
191-
_ = int64(parsed) // $ hasValueFlow="type conversion"
185+
_ = int8(parsed) // $ hasValueFlow="parsed"
186+
_ = uint8(parsed) // $ hasValueFlow="parsed"
187+
_ = int16(parsed) // $ hasValueFlow="parsed"
188+
_ = uint16(parsed) // $ hasValueFlow="parsed"
189+
_ = int32(parsed) // $ hasValueFlow="parsed"
190+
_ = uint32(parsed) // $ hasValueFlow="parsed"
191+
_ = int64(parsed) // $ hasValueFlow="parsed"
192192
_ = uint64(parsed)
193-
_ = int(parsed) // $ hasValueFlow="type conversion"
194-
_ = uint(parsed) // $ hasValueFlow="type conversion"
193+
_ = int(parsed) // $ hasValueFlow="parsed"
194+
_ = uint(parsed) // $ hasValueFlow="parsed"
195195
}
196196
{
197197
parsed, err := strconv.ParseUint("3456", 10, 0)
198198
if err != nil {
199199
panic(err)
200200
}
201-
_ = int8(parsed) // $ hasValueFlow="type conversion"
202-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
203-
_ = int16(parsed) // $ hasValueFlow="type conversion"
204-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
205-
_ = int32(parsed) // $ hasValueFlow="type conversion"
206-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
207-
_ = int64(parsed) // $ hasValueFlow="type conversion"
201+
_ = int8(parsed) // $ hasValueFlow="parsed"
202+
_ = uint8(parsed) // $ hasValueFlow="parsed"
203+
_ = int16(parsed) // $ hasValueFlow="parsed"
204+
_ = uint16(parsed) // $ hasValueFlow="parsed"
205+
_ = int32(parsed) // $ hasValueFlow="parsed"
206+
_ = uint32(parsed) // $ hasValueFlow="parsed"
207+
_ = int64(parsed) // $ hasValueFlow="parsed"
208208
_ = uint64(parsed)
209-
_ = int(parsed) // $ hasValueFlow="type conversion"
209+
_ = int(parsed) // $ hasValueFlow="parsed"
210210
_ = uint(parsed)
211211
}
212212
}
@@ -216,12 +216,12 @@ func testAtoi() {
216216
if err != nil {
217217
panic(err)
218218
}
219-
_ = int8(parsed) // $ hasValueFlow="type conversion"
220-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
221-
_ = int16(parsed) // $ hasValueFlow="type conversion"
222-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
223-
_ = int32(parsed) // $ hasValueFlow="type conversion"
224-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
219+
_ = int8(parsed) // $ hasValueFlow="parsed"
220+
_ = uint8(parsed) // $ hasValueFlow="parsed"
221+
_ = int16(parsed) // $ hasValueFlow="parsed"
222+
_ = uint16(parsed) // $ hasValueFlow="parsed"
223+
_ = int32(parsed) // $ hasValueFlow="parsed"
224+
_ = uint32(parsed) // $ hasValueFlow="parsed"
225225
_ = int64(parsed)
226226
_ = uint64(parsed)
227227
_ = int(parsed)
@@ -238,8 +238,8 @@ func typeAliases(input string) {
238238
panic(err)
239239
}
240240
// NOTE: byte is uint8
241-
_ = byte(parsed) // $ hasValueFlow="type conversion"
242-
_ = customInt(parsed) // $ hasValueFlow="type conversion"
241+
_ = byte(parsed) // $ hasValueFlow="parsed"
242+
_ = customInt(parsed) // $ hasValueFlow="parsed"
243243
}
244244
}
245245

@@ -253,13 +253,13 @@ func testBoundsChecking(input string) {
253253
_ = int8(parsed)
254254
}
255255
if parsed < math.MaxInt8 {
256-
_ = int8(parsed) // $ MISSING: hasValueFlow="type conversion" // Not found because we only check for upper bounds
256+
_ = int8(parsed) // $ MISSING: hasValueFlow="parsed" // Not found because we only check for upper bounds
257257
if parsed >= 0 {
258258
_ = int16(parsed)
259259
}
260260
}
261261
if parsed >= math.MinInt8 {
262-
_ = int8(parsed) // $ hasValueFlow="type conversion"
262+
_ = int8(parsed) // $ hasValueFlow="parsed"
263263
if parsed <= 0 {
264264
_ = int16(parsed)
265265
}
@@ -276,46 +276,46 @@ func testBoundsChecking(input string) {
276276
panic(err)
277277
}
278278
if parsed <= math.MaxUint64 {
279-
_ = int8(parsed) // $ hasValueFlow="type conversion"
280-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
281-
_ = int16(parsed) // $ hasValueFlow="type conversion"
282-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
283-
_ = int32(parsed) // $ hasValueFlow="type conversion"
284-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
285-
_ = int64(parsed) // $ hasValueFlow="type conversion"
279+
_ = int8(parsed) // $ hasValueFlow="parsed"
280+
_ = uint8(parsed) // $ hasValueFlow="parsed"
281+
_ = int16(parsed) // $ hasValueFlow="parsed"
282+
_ = uint16(parsed) // $ hasValueFlow="parsed"
283+
_ = int32(parsed) // $ hasValueFlow="parsed"
284+
_ = uint32(parsed) // $ hasValueFlow="parsed"
285+
_ = int64(parsed) // $ hasValueFlow="parsed"
286286
_ = uint64(parsed)
287-
_ = int(parsed) // $ hasValueFlow="type conversion"
287+
_ = int(parsed) // $ hasValueFlow="parsed"
288288
_ = uint(parsed)
289289
}
290290
if parsed <= math.MaxInt64 {
291-
_ = int8(parsed) // $ hasValueFlow="type conversion"
292-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
293-
_ = int16(parsed) // $ hasValueFlow="type conversion"
294-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
295-
_ = int32(parsed) // $ hasValueFlow="type conversion"
296-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
291+
_ = int8(parsed) // $ hasValueFlow="parsed"
292+
_ = uint8(parsed) // $ hasValueFlow="parsed"
293+
_ = int16(parsed) // $ hasValueFlow="parsed"
294+
_ = uint16(parsed) // $ hasValueFlow="parsed"
295+
_ = int32(parsed) // $ hasValueFlow="parsed"
296+
_ = uint32(parsed) // $ hasValueFlow="parsed"
297297
_ = int64(parsed)
298298
_ = uint64(parsed)
299-
_ = int(parsed) // $ hasValueFlow="type conversion"
299+
_ = int(parsed) // $ hasValueFlow="parsed"
300300
_ = uint(parsed)
301301
}
302302
if parsed <= math.MaxUint32 {
303-
_ = int8(parsed) // $ hasValueFlow="type conversion"
304-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
305-
_ = int16(parsed) // $ hasValueFlow="type conversion"
306-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
307-
_ = int32(parsed) // $ hasValueFlow="type conversion"
303+
_ = int8(parsed) // $ hasValueFlow="parsed"
304+
_ = uint8(parsed) // $ hasValueFlow="parsed"
305+
_ = int16(parsed) // $ hasValueFlow="parsed"
306+
_ = uint16(parsed) // $ hasValueFlow="parsed"
307+
_ = int32(parsed) // $ hasValueFlow="parsed"
308308
_ = uint32(parsed)
309309
_ = int64(parsed)
310310
_ = uint64(parsed)
311-
_ = int(parsed) // $ hasValueFlow="type conversion"
311+
_ = int(parsed) // $ hasValueFlow="parsed"
312312
_ = uint(parsed)
313313
}
314314
if parsed <= math.MaxInt32 {
315-
_ = int8(parsed) // $ hasValueFlow="type conversion"
316-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
317-
_ = int16(parsed) // $ hasValueFlow="type conversion"
318-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
315+
_ = int8(parsed) // $ hasValueFlow="parsed"
316+
_ = uint8(parsed) // $ hasValueFlow="parsed"
317+
_ = int16(parsed) // $ hasValueFlow="parsed"
318+
_ = uint16(parsed) // $ hasValueFlow="parsed"
319319
_ = int32(parsed)
320320
_ = uint32(parsed)
321321
_ = int64(parsed)
@@ -331,19 +331,19 @@ func testBoundsChecking(input string) {
331331
}
332332
if parsed <= math.MaxUint16 {
333333
_ = uint16(parsed)
334-
_ = int16(parsed) // $ hasValueFlow="type conversion"
334+
_ = int16(parsed) // $ hasValueFlow="parsed"
335335
}
336336
if parsed <= 255 {
337337
_ = uint8(parsed)
338338
}
339339
if parsed <= 256 {
340-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
340+
_ = uint8(parsed) // $ hasValueFlow="parsed"
341341
}
342342
if err == nil && 1 == 1 && parsed < math.MaxInt8 {
343343
_ = int8(parsed)
344344
}
345345
if parsed > 42 {
346-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
346+
_ = uint16(parsed) // $ hasValueFlow="parsed"
347347
}
348348
if parsed >= math.MaxUint8+1 {
349349
return
@@ -393,7 +393,7 @@ func testRightShifted(input string) {
393393
if err != nil {
394394
panic(err)
395395
}
396-
_ = byte(parsed) // $ hasValueFlow="type conversion"
396+
_ = byte(parsed) // $ hasValueFlow="parsed"
397397
_ = byte(parsed << 8)
398398
}
399399
}
@@ -404,15 +404,15 @@ func testPathWithMoreThanOneSink(input string) {
404404
if err != nil {
405405
panic(err)
406406
}
407-
v1 := int16(parsed) // $ hasValueFlow="type conversion"
407+
v1 := int16(parsed) // $ hasValueFlow="parsed"
408408
_ = int16(v1)
409409
}
410410
{
411411
parsed, err := strconv.ParseInt(input, 10, 32)
412412
if err != nil {
413413
panic(err)
414414
}
415-
v := int16(parsed) // $ hasValueFlow="type conversion"
415+
v := int16(parsed) // $ hasValueFlow="parsed"
416416
_ = int8(v)
417417
}
418418
{
@@ -421,7 +421,7 @@ func testPathWithMoreThanOneSink(input string) {
421421
panic(err)
422422
}
423423
v1 := int32(parsed)
424-
v2 := int16(v1) // $ hasValueFlow="type conversion"
424+
v2 := int16(v1) // $ hasValueFlow="v1"
425425
_ = int8(v2)
426426
}
427427
{
@@ -432,7 +432,7 @@ func testPathWithMoreThanOneSink(input string) {
432432
v1 := int64(parsed)
433433
v2 := int32(v1)
434434
v3 := int16(v2)
435-
_ = int8(v3) // $ hasValueFlow="type conversion"
435+
_ = int8(v3) // $ hasValueFlow="v3"
436436
}
437437
}
438438

@@ -441,12 +441,12 @@ func testUsingStrConvIntSize(input string) {
441441
if err != nil {
442442
panic(err)
443443
}
444-
_ = int8(parsed) // $ hasValueFlow="type conversion"
445-
_ = uint8(parsed) // $ hasValueFlow="type conversion"
446-
_ = int16(parsed) // $ hasValueFlow="type conversion"
447-
_ = uint16(parsed) // $ hasValueFlow="type conversion"
448-
_ = int32(parsed) // $ hasValueFlow="type conversion"
449-
_ = uint32(parsed) // $ hasValueFlow="type conversion"
444+
_ = int8(parsed) // $ hasValueFlow="parsed"
445+
_ = uint8(parsed) // $ hasValueFlow="parsed"
446+
_ = int16(parsed) // $ hasValueFlow="parsed"
447+
_ = uint16(parsed) // $ hasValueFlow="parsed"
448+
_ = int32(parsed) // $ hasValueFlow="parsed"
449+
_ = uint32(parsed) // $ hasValueFlow="parsed"
450450
_ = int64(parsed)
451451
_ = uint64(parsed)
452452
_ = int(parsed)

‎go/ql/test/query-tests/Security/CWE-681/IncorrectIntegerConversion.ql

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,11 @@ module TestIncorrectIntegerConversion implements TestSig {
77

88
predicate hasActualResult(Location location, string element, string tag, string value) {
99
tag = "hasValueFlow" and
10-
exists(DataFlow::Node sink, DataFlow::Node sinkConverted |
11-
Flow::flowTo(sink) and
12-
sinkConverted = sink.getASuccessor()
13-
|
14-
sinkConverted
15-
.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
16-
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
17-
element = sinkConverted.toString() and
18-
value = "\"" + sinkConverted.toString() + "\""
10+
exists(DataFlow::Node sink | Flow::flowTo(sink) |
11+
sink.hasLocationInfo(location.getFile().getAbsolutePath(), location.getStartLine(),
12+
location.getStartColumn(), location.getEndLine(), location.getEndColumn()) and
13+
element = sink.toString() and
14+
value = "\"" + sink.toString() + "\""
1915
)
2016
}
2117
}

0 commit comments

Comments
 (0)