Skip to content

Commit 49265b6

Browse files
geoffw0geoffw0
committed
Rust: Update inline test annotations accordingly.
1 parent 2a19a17 commit 49265b6

File tree

2 files changed

+46
-78
lines changed

2 files changed

+46
-78
lines changed

‎rust/ql/test/query-tests/security/CWE-117/LogInjection.expected

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -109,35 +109,3 @@ nodes
109109
| main.rs:123:9:123:50 | ...::_eprint | semmle.label | ...::_eprint |
110110
| main.rs:123:19:123:49 | MacroExpr | semmle.label | MacroExpr |
111111
subpaths
112-
testFailures
113-
| main.rs:9:75:9:97 | //... | Missing result: Source=commandargs |
114-
| main.rs:11:23:11:44 | ...::get | Unexpected result: Source |
115-
| main.rs:12:64:12:81 | //... | Missing result: Source=remote |
116-
| main.rs:15:40:15:69 | //... | Missing result: Alert[rust/log-injection] |
117-
| main.rs:16:5:16:45 | ...::log | Unexpected result: Alert=environment |
118-
| main.rs:16:48:16:77 | //... | Missing result: Alert[rust/log-injection] |
119-
| main.rs:18:41:18:70 | //... | Missing result: Alert[rust/log-injection] |
120-
| main.rs:19:5:19:40 | ...::log | Unexpected result: Alert=environment |
121-
| main.rs:19:43:19:72 | //... | Missing result: Alert[rust/log-injection] |
122-
| main.rs:23:33:23:62 | //... | Missing result: Alert[rust/log-injection] |
123-
| main.rs:27:30:27:59 | //... | Missing result: Alert[rust/log-injection] |
124-
| main.rs:55:31:55:60 | //... | Missing result: Alert[rust/log-injection] |
125-
| main.rs:62:45:62:74 | //... | Missing result: Alert[rust/log-injection] |
126-
| main.rs:70:39:70:68 | //... | Missing result: Alert[rust/log-injection] |
127-
| main.rs:85:46:85:75 | //... | Missing result: Alert[rust/log-injection] |
128-
| main.rs:90:41:90:70 | //... | Missing result: Alert[rust/log-injection] |
129-
| main.rs:96:49:96:78 | //... | Missing result: Alert[rust/log-injection] |
130-
| main.rs:108:9:108:36 | ...::log | Unexpected result: Alert=commandargs |
131-
| main.rs:108:39:108:68 | //... | Missing result: Alert[rust/log-injection] |
132-
| main.rs:109:9:109:39 | ...::log | Unexpected result: Alert=commandargs |
133-
| main.rs:109:42:109:71 | //... | Missing result: Alert[rust/log-injection] |
134-
| main.rs:110:9:110:38 | ...::log | Unexpected result: Alert=commandargs |
135-
| main.rs:110:41:110:70 | //... | Missing result: Alert[rust/log-injection] |
136-
| main.rs:111:9:111:38 | ...::log | Unexpected result: Alert=commandargs |
137-
| main.rs:111:41:111:70 | //... | Missing result: Alert[rust/log-injection] |
138-
| main.rs:112:9:112:38 | ...::log | Unexpected result: Alert=commandargs |
139-
| main.rs:112:41:112:70 | //... | Missing result: Alert[rust/log-injection] |
140-
| main.rs:115:9:115:76 | ...::log | Unexpected result: Alert=commandargs |
141-
| main.rs:115:79:115:108 | //... | Missing result: Alert[rust/log-injection] |
142-
| main.rs:122:9:122:39 | ...::_print | Unexpected result: Alert=environment |
143-
| main.rs:123:9:123:50 | ...::_eprint | Unexpected result: Alert=environment |

‎rust/ql/test/query-tests/security/CWE-117/main.rs

Lines changed: 46 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -3,47 +3,47 @@ use log::{info, warn, error, debug, trace};
33

44
fn main() {
55
env_logger::init();
6-
6+
77
// Sources of user input
88
let args: Vec<String> = env::args().collect();
9-
let username = args.get(1).unwrap_or(&String::from("Guest")).clone(); // $ Source=commandargs
9+
let username = args.get(1).unwrap_or(&String::from("Guest")).clone(); // $ MISSING: Source=commandargs
1010
let user_input = std::env::var("USER_INPUT").unwrap_or("default".to_string()); // $ Source=environment
11-
let remote_data = reqwest::blocking::get("http://example.com/user")
12-
.unwrap().text().unwrap_or("remote_user".to_string()); // $ Source=remote
13-
11+
let remote_data = reqwest::blocking::get("http://example.com/user") // $ Source=remote
12+
.unwrap().text().unwrap_or("remote_user".to_string());
13+
1414
// BAD: Direct logging of user input
15-
info!("User login: {}", username); // $ Alert[rust/log-injection]
16-
warn!("Warning for user: {}", user_input); // $ Alert[rust/log-injection]
17-
error!("Error processing: {}", remote_data); // $ Alert[rust/log-injection]
18-
debug!("Debug info: {}", username); // $ Alert[rust/log-injection]
19-
trace!("Trace data: {}", user_input); // $ Alert[rust/log-injection]
20-
15+
info!("User login: {}", username); // $ MISSING: Alert[rust/log-injection]
16+
warn!("Warning for user: {}", user_input); // $ Alert[rust/log-injection]=environment
17+
error!("Error processing: {}", remote_data); // $ Alert[rust/log-injection]=remote
18+
debug!("Debug info: {}", username); // $ MISSING: Alert[rust/log-injection]
19+
trace!("Trace data: {}", user_input); // $ Alert[rust/log-injection]=environment
20+
2121
// BAD: Formatted strings with user input
2222
let formatted_msg = format!("Processing user: {}", username);
23-
info!("{}", formatted_msg); // $ Alert[rust/log-injection]
24-
23+
info!("{}", formatted_msg); // $ MISSING: Alert[rust/log-injection]
24+
2525
// BAD: String concatenation with user input
2626
let concat_msg = "User activity: ".to_string() + &username;
27-
info!("{}", concat_msg); // $ Alert[rust/log-injection]
28-
27+
info!("{}", concat_msg); // $ MISSING: Alert[rust/log-injection]
28+
2929
// BAD: Complex formatting
30-
info!("User {} accessed resource at {}", username, remote_data); // $ Alert[rust/log-injection]
31-
30+
info!("User {} accessed resource at {}", username, remote_data); // $ Alert[rust/log-injection]=remote
31+
3232
// GOOD: Sanitized input
3333
let sanitized_username = username.replace('\n', "").replace('\r', "");
3434
info!("Sanitized user login: {}", sanitized_username);
35-
35+
3636
// GOOD: Constant strings
3737
info!("System startup complete");
38-
38+
3939
// GOOD: Non-user-controlled data
4040
let system_time = std::time::SystemTime::now();
4141
info!("Current time: {:?}", system_time);
42-
42+
4343
// GOOD: Numeric data derived from user input (not directly logged)
4444
let user_id = username.len();
4545
info!("User ID length: {}", user_id);
46-
46+
4747
// More complex test cases
4848
test_complex_scenarios(&username, &user_input);
4949
test_indirect_flows(&remote_data);
@@ -52,22 +52,22 @@ fn main() {
5252
fn test_complex_scenarios(username: &str, user_input: &str) {
5353
// BAD: Indirect logging through variables
5454
let log_message = format!("Activity for {}", username);
55-
info!("{}", log_message); // $ Alert[rust/log-injection]
56-
55+
info!("{}", log_message); // $ MISSING: Alert[rust/log-injection]
56+
5757
// BAD: Through function parameters
5858
log_user_activity(username); // Function call - should be tracked
59-
59+
6060
// BAD: Through struct fields
6161
let user_info = UserInfo { name: username.to_string() };
62-
info!("User info: {}", user_info.name); // $ Alert[rust/log-injection]
63-
62+
info!("User info: {}", user_info.name); // $ MISSING: Alert[rust/log-injection]
63+
6464
// GOOD: After sanitization
6565
let clean_input = sanitize_input(user_input);
6666
info!("Clean input: {}", clean_input);
6767
}
6868

6969
fn log_user_activity(user: &str) {
70-
info!("User activity: {}", user); // $ Alert[rust/log-injection]
70+
info!("User activity: {}", user); // $ MISSING: Alert[rust/log-injection]
7171
}
7272

7373
fn sanitize_input(input: &str) -> String {
@@ -82,44 +82,44 @@ fn test_indirect_flows(data: &str) {
8282
// BAD: Flow through intermediate variables
8383
let temp_var = data;
8484
let another_var = temp_var;
85-
info!("Indirect flow: {}", another_var); // $ Alert[rust/log-injection]
86-
85+
info!("Indirect flow: {}", another_var); // $ MISSING: Alert[rust/log-injection]
86+
8787
// BAD: Flow through collections
8888
let data_vec = vec![data];
8989
if let Some(item) = data_vec.first() {
90-
info!("Vector item: {}", item); // $ Alert[rust/log-injection]
90+
info!("Vector item: {}", item); // $ MISSING: Alert[rust/log-injection]
9191
}
92-
92+
9393
// BAD: Flow through Option/Result
9494
let optional_data = Some(data);
9595
if let Some(unwrapped) = optional_data {
96-
info!("Unwrapped data: {}", unwrapped); // $ Alert[rust/log-injection]
96+
info!("Unwrapped data: {}", unwrapped); // $ MISSING: Alert[rust/log-injection]
9797
}
9898
}
9999

100100
// Additional test patterns for different logging scenarios
101101
mod additional_tests {
102102
use log::*;
103-
103+
104104
pub fn test_macro_variations() {
105105
let user_data = std::env::args().nth(1).unwrap_or_default(); // $ Source=commandargs
106-
106+
107107
// BAD: Different log macro variations
108-
info!("Info: {}", user_data); // $ Alert[rust/log-injection]
109-
warn!("Warning: {}", user_data); // $ Alert[rust/log-injection]
110-
error!("Error: {}", user_data); // $ Alert[rust/log-injection]
111-
debug!("Debug: {}", user_data); // $ Alert[rust/log-injection]
112-
trace!("Trace: {}", user_data); // $ Alert[rust/log-injection]
113-
108+
info!("Info: {}", user_data); // $ Alert[rust/log-injection]=commandargs
109+
warn!("Warning: {}", user_data); // $ Alert[rust/log-injection]=commandargs
110+
error!("Error: {}", user_data); // $ Alert[rust/log-injection]=commandargs
111+
debug!("Debug: {}", user_data); // $ Alert[rust/log-injection]=commandargs
112+
trace!("Trace: {}", user_data); // $ Alert[rust/log-injection]=commandargs
113+
114114
// BAD: Complex format strings
115-
info!("User {} did action {} at time {}", user_data, "login", "now"); // $ Alert[rust/log-injection]
115+
info!("User {} did action {} at time {}", user_data, "login", "now"); // $ Alert[rust/log-injection]=commandargs
116116
}
117-
117+
118118
pub fn test_println_patterns() {
119119
let user_data = std::env::var("USER").unwrap_or_default(); // $ Source=environment
120-
120+
121121
// These might not be caught depending on model coverage, but are potential logging sinks
122-
println!("User: {}", user_data);
123-
eprintln!("Error for user: {}", user_data);
122+
println!("User: {}", user_data); // $ Alert[rust/log-injection]=environment
123+
eprintln!("Error for user: {}", user_data); // $ Alert[rust/log-injection]=environment
124124
}
125-
}
125+
}

0 commit comments

Comments
 (0)