Skip to content

Commit c28c135

Browse files
marek-trtikmarek-trtik
authored
Merge pull request diffblue#303 from diffblue/enhancment/more_end_to_end_regression_tests
SEC-167: Introducing 4 failing end-to-end regression tests
2 parents 844ed31 + 6aa7a88 commit c28c135

File tree

16 files changed

+434
-0
lines changed

16 files changed

+434
-0
lines changed

‎regression/end_to_end/overloaded_source/build.xml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<project name="overloaded_source" basedir="." default="jar">
2+
3+
<property name="root.dir" value="./"/>
4+
<property name="src.dir" value="${root.dir}/src"/>
5+
<property name="classes.dir" value="${root.dir}/build"/>
6+
<property name="install.dir" value="${root.dir}/dist"/>
7+
8+
<target name="jar">
9+
<antcall target="compile" />
10+
<mkdir dir="${install.dir}"/>
11+
<jar destfile="${install.dir}/overloaded_source.jar" basedir="${classes.dir}" />
12+
</target>
13+
14+
<target name="compile">
15+
<antcall target="clean" />
16+
<mkdir dir="${classes.dir}"/>
17+
<javac srcdir="${src.dir}" destdir="${classes.dir}" includeantruntime="false" debug="on">
18+
</javac>
19+
</target>
20+
21+
<target name="clean">
22+
<delete dir="${classes.dir}"/>
23+
<delete dir="${install.dir}"/>
24+
</target>
25+
26+
27+
</project>

‎regression/end_to_end/overloaded_source/rules.json

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"comment": "Obtaining tainted data.",
7+
"class": "HTTPServletRequest",
8+
"method": "getTaintedData:()I",
9+
"result": {
10+
"location": "return_value",
11+
"taint": "Tainted string"
12+
}
13+
},
14+
{
15+
"comment": "Writing potentially tainted data to a sink.",
16+
"class": "Main",
17+
"method": "sink:(I)V",
18+
"sinkTarget": {
19+
"location": "arg0",
20+
"vulnerability": "Tainted string"
21+
}
22+
}
23+
]
24+
}

‎regression/end_to_end/overloaded_source/src/Main.java

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
interface HTTPServletRequest {
2+
public int getTaintedData();
3+
}
4+
5+
class MyHTTPServletRequest implements HTTPServletRequest {
6+
public int getTaintedData() {
7+
return 0;
8+
}
9+
}
10+
11+
public class Main {
12+
private static void sink(int o) {}
13+
14+
public static void main() {
15+
MyHTTPServletRequest source = new MyHTTPServletRequest();
16+
sink(source.getTaintedData());
17+
}
18+
}

‎regression/end_to_end/overloaded_source/test_overloaded_source.py

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
import regression.end_to_end.driver as pipeline_executor
2+
import os
3+
import subprocess
4+
import pytest
5+
import regression.utils as utils
6+
7+
8+
@pytest.mark.xfail(strict=True)
9+
def test_overloaded_source():
10+
"""
11+
The 'Obtaining tainted data.' rule is defined over the interface, but
12+
the data are taken from an implementation class. And so the rule is not
13+
applied.
14+
"""
15+
with utils.working_dir(os.path.abspath(os.path.dirname(__file__))):
16+
subprocess.call("ant")
17+
traces = pipeline_executor.run_security_analyser_pipeline(
18+
os.path.join("dist", "overloaded_source.jar"),
19+
"rules.json",
20+
os.path.realpath(os.path.dirname(__file__)))
21+
assert traces.count_traces() == 1
22+
assert traces.trace_exists("java::Main.main:()V", 16)

‎regression/end_to_end/taint_over_downcast/build.xml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<project name="taint_over_downcast" basedir="." default="jar">
2+
3+
<property name="root.dir" value="./"/>
4+
<property name="src.dir" value="${root.dir}/src"/>
5+
<property name="classes.dir" value="${root.dir}/build"/>
6+
<property name="install.dir" value="${root.dir}/dist"/>
7+
8+
<target name="jar">
9+
<antcall target="compile" />
10+
<mkdir dir="${install.dir}"/>
11+
<jar destfile="${install.dir}/taint_over_downcast.jar" basedir="${classes.dir}" />
12+
</target>
13+
14+
<target name="compile">
15+
<antcall target="clean" />
16+
<mkdir dir="${classes.dir}"/>
17+
<javac srcdir="${src.dir}" destdir="${classes.dir}" includeantruntime="false" debug="on">
18+
</javac>
19+
</target>
20+
21+
<target name="clean">
22+
<delete dir="${classes.dir}"/>
23+
<delete dir="${install.dir}"/>
24+
</target>
25+
26+
27+
</project>

‎regression/end_to_end/taint_over_downcast/rules.json

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"comment": "Obtaining tainted data.",
7+
"class": "Main",
8+
"method": "makeTainted:(LBase;)V",
9+
"result": {
10+
"location": "arg0",
11+
"taint": "Tainted data"
12+
}
13+
},
14+
{
15+
"comment": "Writing potentially tainted data to a sink.",
16+
"class": "Main",
17+
"method": "sink:(LDerived;)V",
18+
"sinkTarget": {
19+
"location": "arg0",
20+
"vulnerability": "Tainted data"
21+
}
22+
}
23+
]
24+
}

‎regression/end_to_end/taint_over_downcast/src/Main.java

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
class Base {}
2+
class Derived extends Base {}
3+
4+
public class Main {
5+
private static void makeTainted(Base o) {}
6+
private static void sink(Derived o) {}
7+
8+
public static void main() {
9+
Base a = new Derived();
10+
makeTainted(a);
11+
sink((Derived)a);
12+
}
13+
}

‎regression/end_to_end/taint_over_downcast/test_taint_over_downcast.py

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
import regression.end_to_end.driver as pipeline_executor
2+
import os
3+
import subprocess
4+
import pytest
5+
import regression.utils as utils
6+
7+
8+
@pytest.mark.xfail(strict=True)
9+
def test_taint_over_downcast():
10+
"""
11+
Wrong handling of down-casting. Here are related lines of the goto program:
12+
new_tmp0 = ALLOCATE(struct Derived, 5ul, false);
13+
a = (struct Base *)&new_tmp0->@Base;
14+
a->@__CPROVER_com_diffblue_security_Tainted_data = true;
15+
IF !((struct Derived *)a)->@__CPROVER_com_diffblue_security_Tainted_data THEN GOTO 2
16+
ASSERT false
17+
2: ...
18+
So, the access path to @__CPROVER_com_diffblue_security_Tainted in the IF
19+
statement should rather be
20+
(&(((struct Derived *)a)->@Base))->@__CPROVER_com_diffblue_security_Tainted
21+
"""
22+
with utils.working_dir(os.path.abspath(os.path.dirname(__file__))):
23+
subprocess.call("ant")
24+
traces = pipeline_executor.run_security_analyser_pipeline(
25+
os.path.join("dist", "taint_over_downcast.jar"),
26+
"rules.json",
27+
os.path.realpath(os.path.dirname(__file__)))
28+
assert traces.count_traces() == 1
29+
assert traces.trace_exists("java::Main.main:()V", 11)

‎regression/end_to_end/taint_over_list/build.xml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<project name="taint_over_list" basedir="." default="jar">
2+
3+
<property name="root.dir" value="./"/>
4+
<property name="src.dir" value="${root.dir}/src"/>
5+
<property name="classes.dir" value="${root.dir}/build"/>
6+
<property name="install.dir" value="${root.dir}/dist"/>
7+
8+
<target name="jar">
9+
<antcall target="compile" />
10+
<mkdir dir="${install.dir}"/>
11+
<jar destfile="${install.dir}/taint_over_list.jar" basedir="${classes.dir}" />
12+
</target>
13+
14+
<target name="compile">
15+
<antcall target="clean" />
16+
<mkdir dir="${classes.dir}"/>
17+
<javac srcdir="${src.dir}" destdir="${classes.dir}" includeantruntime="false" debug="on">
18+
</javac>
19+
</target>
20+
21+
<target name="clean">
22+
<delete dir="${classes.dir}"/>
23+
<delete dir="${install.dir}"/>
24+
</target>
25+
26+
27+
</project>

‎regression/end_to_end/taint_over_list/rules.json

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"namespace": "com.diffblue.security",
3+
"rules":
4+
[
5+
{
6+
"comment": "Obtaining tainted data.",
7+
"class": "Main",
8+
"method": "makeTainted:(LA;)V",
9+
"result": {
10+
"location": "arg0",
11+
"taint": "Tainted data"
12+
}
13+
},
14+
{
15+
"comment": "Put tainted data to list",
16+
"class": "ArrayList",
17+
"method": "add:(LA;)V",
18+
"input": {
19+
"location": "arg1",
20+
"taint": "Tainted data"
21+
},
22+
"result": {
23+
"location": "this",
24+
"taint": "Tainted list"
25+
}
26+
},
27+
{
28+
"comment": "Get tainted data from list",
29+
"class": "ArrayList",
30+
"method": "get:(I)LA;",
31+
"input": {
32+
"location": "this",
33+
"taint": "Tainted list"
34+
},
35+
"result": {
36+
"location": "returns",
37+
"taint": "Tainted data"
38+
}
39+
},
40+
{
41+
"comment": "Writing potentially tainted data to a sink.",
42+
"class": "Main",
43+
"method": "sink:(LA;)V",
44+
"sinkTarget": {
45+
"location": "arg0",
46+
"vulnerability": "Tainted data"
47+
}
48+
}
49+
]
50+
}

‎regression/end_to_end/taint_over_list/src/Main.java

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
interface List<T> {
2+
public T get(int idx);
3+
public void add(T o);
4+
}
5+
6+
class ArrayList<T> implements List<T> {
7+
ArrayList() {
8+
this.data = (T[])new Object[10];
9+
last = 0;
10+
}
11+
public T get(int idx) {
12+
return (T)data[idx];
13+
}
14+
public void add(T o) {
15+
data[last] = o;
16+
last += 1;
17+
}
18+
19+
private T[] data;
20+
private int last;
21+
}
22+
23+
class A {}
24+
25+
public class Main {
26+
private static void makeTainted(A o) {}
27+
private static void sink(A o) {}
28+
29+
public static void main() {
30+
ArrayList<A> L = new ArrayList<A>();
31+
L.add(new A());
32+
makeTainted(L.get(0));
33+
sink(L.get(0));
34+
}
35+
}

‎regression/end_to_end/taint_over_list/test_taint_over_list.py

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
import regression.end_to_end.driver as pipeline_executor
2+
import os
3+
import subprocess
4+
import pytest
5+
import regression.utils as utils
6+
7+
8+
@pytest.mark.xfail(strict=True)
9+
def test_taint_over_list():
10+
"""
11+
The problem is in the full-slicer. It removes code from ArrayList.add.
12+
When the slicer is disabled (skipped) the results is correct.
13+
"""
14+
with utils.working_dir(os.path.abspath(os.path.dirname(__file__))):
15+
subprocess.call("ant")
16+
traces = pipeline_executor.run_security_analyser_pipeline(
17+
os.path.join("dist", "taint_over_list.jar"),
18+
"rules.json",
19+
os.path.realpath(os.path.dirname(__file__)))
20+
assert traces.count_traces() == 1
21+
assert traces.trace_exists("java::Main.main:()V", 33)

‎regression/end_to_end/taint_over_list_models/build.xml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<project name="taint_over_list_models" basedir="." default="jar">
2+
3+
<property name="root.dir" value="./"/>
4+
<property name="src.dir" value="${root.dir}/src"/>
5+
<property name="classes.dir" value="${root.dir}/build"/>
6+
<property name="install.dir" value="${root.dir}/dist"/>
7+
8+
<target name="jar">
9+
<antcall target="compile" />
10+
<mkdir dir="${install.dir}"/>
11+
<jar destfile="${install.dir}/taint_over_list_models.jar" basedir="${classes.dir}" />
12+
</target>
13+
14+
<target name="compile">
15+
<antcall target="clean" />
16+
<mkdir dir="${classes.dir}"/>
17+
<javac srcdir="${src.dir}" destdir="${classes.dir}" includeantruntime="false" debug="on">
18+
</javac>
19+
</target>
20+
21+
<target name="clean">
22+
<delete dir="${classes.dir}"/>
23+
<delete dir="${install.dir}"/>
24+
</target>
25+
26+
27+
</project>

0 commit comments

Comments
 (0)