Skip to content

Commit 2e0768f

Browse files
ESS-ENNESS-ENN
committed
Update file-access-before-action-c rule file
1 parent 26576c1 commit 2e0768f

13 files changed

+72
-115
lines changed

‎rules/c/security/file-access-before-action-c.yml

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,10 @@ utils:
2525
inside:
2626
stopBy: end
2727
kind: parenthesized_expression
28-
nthChild: 1
29-
inside:
30-
stopBy: end
31-
kind: if_statement
3228
inside:
3329
stopBy: end
3430
kind: compound_statement
3531
inside:
36-
stopBy: end
3732
kind: if_statement
3833
has:
3934
kind: parenthesized_expression
@@ -119,14 +114,10 @@ utils:
119114
inside:
120115
stopBy: end
121116
kind: parenthesized_expression
122-
inside:
123-
stopBy: end
124-
kind: if_statement
125117
inside:
126118
stopBy: end
127119
kind: compound_statement
128120
inside:
129-
stopBy: end
130121
kind: if_statement
131122
has:
132123
kind: parenthesized_expression

‎tests/__snapshots__/file-access-before-action-c-snapshot.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,6 @@ snapshots:
109109
const char *original_key = "path/to/file/filename";
110110

111111
if (access(original_key, W_OK) == 0){
112-
// ruleid: file-access-before-action
113112
File *fp = fopen(original_key, "wb");
114113
}
115114
}

‎tests/__snapshots__/file-stat-before-action-cpp-snapshot.yml

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ snapshots:
33
? |
44
if (stat(file.c_str(), &buf) == 0){
55
// Open the file for reading
6-
// ruleid: file-stat-before-action
76
fp = fopen(file.c_str(), "r");
87
if (fp == NULL)
98
{
@@ -39,16 +38,16 @@ snapshots:
3938
: labels:
4039
- source: fopen
4140
style: primary
42-
start: 111
43-
end: 116
41+
start: 74
42+
end: 79
4443
- source: file.c_str()
4544
style: secondary
46-
start: 117
47-
end: 129
45+
start: 80
46+
end: 92
4847
- source: (file.c_str(), "r")
4948
style: secondary
50-
start: 116
51-
end: 135
49+
start: 79
50+
end: 98
5251
- source: stat
5352
style: secondary
5453
start: 4
@@ -84,7 +83,6 @@ snapshots:
8483
- source: |-
8584
if (stat(file.c_str(), &buf) == 0){
8685
// Open the file for reading
87-
// ruleid: file-stat-before-action
8886
fp = fopen(file.c_str(), "r");
8987
if (fp == NULL)
9088
{
@@ -119,11 +117,10 @@ snapshots:
119117
}
120118
style: secondary
121119
start: 0
122-
end: 830
120+
end: 793
123121
- source: |-
124122
{
125123
// Open the file for reading
126-
// ruleid: file-stat-before-action
127124
fp = fopen(file.c_str(), "r");
128125
if (fp == NULL)
129126
{
@@ -158,8 +155,8 @@ snapshots:
158155
}
159156
style: secondary
160157
start: 34
161-
end: 830
158+
end: 793
162159
- source: fopen(file.c_str(), "r")
163160
style: secondary
164-
start: 111
165-
end: 135
161+
start: 74
162+
end: 98

‎tests/__snapshots__/jwt-simple-noverify-javascript-snapshot.yml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
id: jwt-simple-noverify-javascript
22
snapshots:
3-
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute1', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n // ruleid: jwt-simple-noverify \n const decoded = jwt.decode(token, secretKey, 'HS256', 12);\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
3+
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute1', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n const decoded = jwt.decode(token, secretKey, 'HS256', 12);\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
44
: labels:
55
- source: jwt.decode(token, secretKey, 'HS256', 12)
66
style: primary
7-
start: 287
8-
end: 328
7+
start: 250
8+
end: 291
99
- source: jwt
1010
style: secondary
1111
start: 6
@@ -22,12 +22,12 @@ snapshots:
2222
style: secondary
2323
start: 0
2424
end: 34
25-
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute2', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n // ruleid: jwt-simple-noverify \n const decoded = jwt.decode(token, secretKey, true);\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
25+
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute2', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n const decoded = jwt.decode(token, secretKey, true);\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
2626
: labels:
2727
- source: jwt.decode(token, secretKey, true)
2828
style: primary
29-
start: 289
30-
end: 323
29+
start: 251
30+
end: 285
3131
- source: jwt
3232
style: secondary
3333
start: 6
@@ -44,12 +44,12 @@ snapshots:
4444
style: secondary
4545
start: 0
4646
end: 34
47-
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute3', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n // ruleid: jwt-simple-noverify \n const decoded = jwt.decode(token, secretKey, 'false');\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
47+
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute3', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n const decoded = jwt.decode(token, secretKey, 'false');\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
4848
: labels:
4949
- source: jwt.decode(token, secretKey, 'false')
5050
style: primary
51-
start: 290
52-
end: 327
51+
start: 251
52+
end: 288
5353
- source: jwt
5454
style: secondary
5555
start: 6

‎tests/__snapshots__/jwt-simple-noverify-typescript-snapshot.yml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
id: jwt-simple-noverify-typescript
22
snapshots:
3-
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute1', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n // ruleid: jwt-simple-noverify \n const decoded = jwt.decode(token, secretKey, 'HS256', 12);\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
3+
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute1', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n const decoded = jwt.decode(token, secretKey, 'HS256', 12);\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
44
: labels:
55
- source: jwt.decode(token, secretKey, 'HS256', 12)
66
style: primary
7-
start: 287
8-
end: 328
7+
start: 250
8+
end: 291
99
- source: jwt
1010
style: secondary
1111
start: 6
@@ -42,12 +42,12 @@ snapshots:
4242
style: secondary
4343
start: 0
4444
end: 34
45-
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute2', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n // ruleid: jwt-simple-noverify \n const decoded = jwt.decode(token, secretKey, true);\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
45+
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute2', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n const decoded = jwt.decode(token, secretKey, true);\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
4646
: labels:
4747
- source: jwt.decode(token, secretKey, true)
4848
style: primary
49-
start: 289
50-
end: 323
49+
start: 251
50+
end: 285
5151
- source: jwt
5252
style: secondary
5353
start: 6
@@ -84,12 +84,12 @@ snapshots:
8484
style: secondary
8585
start: 0
8686
end: 34
87-
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute3', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n // ruleid: jwt-simple-noverify \n const decoded = jwt.decode(token, secretKey, 'false');\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
87+
? "const jwt = require('jwt-simple'); \n\napp.get('/protectedRoute3', (req, res) => {\n const token = req.headers.authorization;\n\n if (!token) {\n return res.status(401).json({ error: 'Unauthorized. Token missing.' });\n }\n\n try {\n const decoded = jwt.decode(token, secretKey, 'false');\n res.json({ message: `Hello ${decoded.username}` });\n } catch (error) {\n res.status(401).json({ error: 'Unauthorized. Invalid token.' });\n }\n});\n"
8888
: labels:
8989
- source: jwt.decode(token, secretKey, 'false')
9090
style: primary
91-
start: 290
92-
end: 327
91+
start: 251
92+
end: 288
9393
- source: jwt
9494
style: secondary
9595
start: 6

‎tests/__snapshots__/ssl-v3-is-insecure-go-snapshot.yml

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ snapshots:
33
? |
44
client := &http.Client{
55
Transport: &http.Transport{
6-
// ruleid: ssl-v3-is-insecure
76
TLSClientConfig: &tls.Config{
87
KeyLogWriter: w,
98
MinVersion: tls.VersionSSL30,
@@ -21,36 +20,36 @@ snapshots:
2120
InsecureSkipVerify: true, // test server certificate is not trusted.
2221
}
2322
style: primary
24-
start: 107
25-
end: 358
23+
start: 74
24+
end: 325
2625
- source: tls.Config
2726
style: secondary
28-
start: 107
29-
end: 117
27+
start: 74
28+
end: 84
3029
- source: MinVersion
3130
style: secondary
32-
start: 152
33-
end: 162
31+
start: 119
32+
end: 129
3433
- source: tls
3534
style: secondary
36-
start: 172
37-
end: 175
35+
start: 139
36+
end: 142
3837
- source: VersionSSL30
3938
style: secondary
40-
start: 176
41-
end: 188
39+
start: 143
40+
end: 155
4241
- source: tls.VersionSSL30
4342
style: secondary
44-
start: 172
45-
end: 188
43+
start: 139
44+
end: 155
4645
- source: tls.VersionSSL30
4746
style: secondary
48-
start: 172
49-
end: 188
47+
start: 139
48+
end: 155
5049
- source: 'MinVersion: tls.VersionSSL30'
5150
style: secondary
52-
start: 152
53-
end: 188
51+
start: 119
52+
end: 155
5453
- source: |-
5554
{
5655
KeyLogWriter: w,
@@ -59,5 +58,5 @@ snapshots:
5958
InsecureSkipVerify: true, // test server certificate is not trusted.
6059
}
6160
style: secondary
62-
start: 117
63-
end: 358
61+
start: 84
62+
end: 325

‎tests/__snapshots__/std-vector-invalidation-cpp-snapshot.yml

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
id: std-vector-invalidation-cpp
22
snapshots:
3-
? "void loop_variant_5(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.begin(); it != vec.end(); ++it) {\n if (should_erase(*it)) {\n // ruleid: std-vector-invalidation\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_6(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.begin(); it != vec.end(); it++) {\n if (should_erase(*it)) {\n // ruleid: std-vector-invalidation\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_7(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.rbegin(); it != vec.rend(); ++it) {\n if (should_erase(*it)) {\n // ruleid: std-vector-invalidation\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_8(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.rbegin(); it != vec.rend(); it++) {\n if (should_erase(*it)) {\n // ruleid: std-vector-invalidation\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_9(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.begin(), end = vec.end(); it != end; ++it) {\n if (should_erase(*it)) {\n // ruleid: std-vector-invalidation\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_10(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.begin(), end = vec.end(); it != end; it++) {\n if (should_erase(*it)) {\n // ruleid: std-vector-invalidation\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_11(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.rbegin(), end = vec.rend(); it != end; ++it) {\n if (should_erase(*it)) {\n // ruleid: std-vector-invalidation\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_12(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.rbegin(), end = vec.rend(); it != end; it++) {\n if (should_erase(*it)) {\n // ruleid: std-vector-invalidation\n vec.erase(it);\n }\n }\n} \nvoid f(std::vector<int> &vec, std::vector<int> &other_vec) {\n for(std::vector<int>::iterator it = vec.begin(); it != vec.end(); it++) {\n if (foo()) {\n // ruleid: std-vector-invalidation\n vec.push_back(0);\n\n // Modifying a different container is OK\n // ok: std-vector-invalidation\n other_vec.push_back(0);\n }\n }\n}\n"
3+
? "void loop_variant_5(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.begin(); it != vec.end(); ++it) {\n if (should_erase(*it)) {\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_6(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.begin(); it != vec.end(); it++) {\n if (should_erase(*it)) {\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_7(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.rbegin(); it != vec.rend(); ++it) {\n if (should_erase(*it)) {\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_8(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.rbegin(); it != vec.rend(); it++) {\n if (should_erase(*it)) {\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_9(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.begin(), end = vec.end(); it != end; ++it) {\n if (should_erase(*it)) {\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_10(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.begin(), end = vec.end(); it != end; it++) {\n if (should_erase(*it)) {\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_11(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.rbegin(), end = vec.rend(); it != end; ++it) {\n if (should_erase(*it)) {\n vec.erase(it);\n }\n }\n}\nvoid loop_variant_12(std::vector<int> &vec) {\n for(std::vector<int>::iterator it = vec.rbegin(), end = vec.rend(); it != end; it++) {\n if (should_erase(*it)) {\n vec.erase(it);\n }\n }\n} \nvoid f(std::vector<int> &vec, std::vector<int> &other_vec) {\n for(std::vector<int>::iterator it = vec.begin(); it != vec.end(); it++) {\n if (foo()) {\n vec.push_back(0);\n // Modifying a different container is OK\n other_vec.push_back(0);\n }\n }\n}\n"
44
: labels:
55
- source: vec.erase(it)
66
style: primary
7-
start: 197
8-
end: 210
7+
start: 156
8+
end: 169
99
- source: std::vector<int>::iterator it = vec.begin();
1010
style: secondary
1111
start: 51
@@ -21,10 +21,9 @@ snapshots:
2121
- source: |-
2222
for(std::vector<int>::iterator it = vec.begin(); it != vec.end(); ++it) {
2323
if (should_erase(*it)) {
24-
// ruleid: std-vector-invalidation
2524
vec.erase(it);
2625
}
2726
}
2827
style: secondary
2928
start: 47
30-
end: 221
29+
end: 180

‎tests/cpp/file-stat-before-action-cpp-test.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ invalid:
66
- |
77
if (stat(file.c_str(), &buf) == 0){
88
// Open the file for reading
9-
// ruleid: file-stat-before-action
109
fp = fopen(file.c_str(), "r");
1110
if (fp == NULL)
1211
{

‎tests/cpp/return-c-str-cpp-test.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ id: return-c-str-cpp
22
valid:
33
- |
44
std::string return_directly() {
5-
// ok: return-c-str
65
return std::string("foo");
76
}
87
invalid:

0 commit comments

Comments
 (0)