Skip to content

Commit 05d5c1d

Browse files
paldepindpaldepind
authored
Merge pull request #20398 from paldepind/rust/warp-model
Rust: Add tests and models for Warp
2 parents e1d27f3 + c1ebe92 commit 05d5c1d

File tree

5 files changed

+203
-0
lines changed

5 files changed

+203
-0
lines changed

‎rust/ql/lib/codeql/rust/frameworks/warp.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sourceModel
5+
data:
6+
- ["<_ as warp::filter::Filter>::then", "Argument[0].Parameter[0..7]", "remote", "manual"]
7+
- ["<_ as warp::filter::Filter>::map", "Argument[0].Parameter[0..7]", "remote", "manual"]
8+
- ["<_ as warp::filter::Filter>::and_then", "Argument[0].Parameter[0..7]", "remote", "manual"]

‎rust/ql/test/library-tests/dataflow/sources/Cargo.lock‎

Lines changed: 72 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎rust/ql/test/library-tests/dataflow/sources/TaintSources.expected‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,3 +100,67 @@
100100
| web_frameworks.rs:58:14:58:15 | ms | Flow source 'RemoteSource' of type remote (DEFAULT). |
101101
| web_frameworks.rs:68:15:68:15 | a | Flow source 'RemoteSource' of type remote (DEFAULT). |
102102
| web_frameworks.rs:68:15:68:15 | a | Flow source 'RemoteSource' of type remote (DEFAULT). |
103+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
104+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
105+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
106+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
107+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
108+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
109+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
110+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
111+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
112+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
113+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
114+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
115+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
116+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
117+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
118+
| web_frameworks.rs:242:33:242:35 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
119+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
120+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
121+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
122+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
123+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
124+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
125+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
126+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
127+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
128+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
129+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
130+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
131+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
132+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
133+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
134+
| web_frameworks.rs:250:46:250:49 | then | Flow source 'RemoteSource' of type remote (DEFAULT). |
135+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
136+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
137+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
138+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
139+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
140+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
141+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
142+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
143+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
144+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
145+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
146+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
147+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
148+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
149+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
150+
| web_frameworks.rs:259:50:259:57 | and_then | Flow source 'RemoteSource' of type remote (DEFAULT). |
151+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
152+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
153+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
154+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
155+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
156+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
157+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
158+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
159+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
160+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
161+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
162+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
163+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
164+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
165+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |
166+
| web_frameworks.rs:272:75:272:77 | map | Flow source 'RemoteSource' of type remote (DEFAULT). |

‎rust/ql/test/library-tests/dataflow/sources/options.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,4 @@ qltest_dependencies:
1616
- rustls = { version = "0.23.27" }
1717
- futures-rustls = { version = "0.26.0" }
1818
- async-std = { version = "1.13.1" }
19+
- warp = { version = "0.4.2", features = ["server"] }

‎rust/ql/test/library-tests/dataflow/sources/web_frameworks.rs‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,3 +229,61 @@ mod axum_test {
229229
// ...
230230
}
231231
}
232+
233+
mod warp_test {
234+
use super::sink;
235+
use warp::Filter;
236+
237+
#[tokio::main]
238+
#[rustfmt::skip]
239+
async fn test_warp() {
240+
// A route with parameter and `map`
241+
let map_route =
242+
warp::path::param().map(|a: String| // $ Alert[rust/summary/taint-sources]
243+
{
244+
sink(a); // $ MISSING: hasTaintFlow
245+
246+
"".to_string()
247+
});
248+
249+
// A route with parameter and `then`
250+
let then_route = warp::path::param().then( // $ Alert[rust/summary/taint-sources]
251+
async move |a: String| {
252+
sink(a); // $ MISSING: hasTaintFlow
253+
254+
"".to_string()
255+
},
256+
);
257+
258+
// A route with parameter and `and_then`
259+
let and_then_route = warp::path::param().and_then( // $ Alert[rust/summary/taint-sources]
260+
async move | id: u64 |
261+
{
262+
if id != 0 {
263+
sink(id); // $ MISSING: hasTaintFlow
264+
Ok("".to_string())
265+
} else {
266+
Err(warp::reject::not_found())
267+
}
268+
},
269+
);
270+
271+
// A route with path, parameter, and `and_then`
272+
let path_and_map_route = warp::path("1").and(warp::path::param()).map( // $ Alert[rust/summary/taint-sources]
273+
| a: String |
274+
{
275+
sink(a); // $ MISSING: hasTaintFlow
276+
277+
"".to_string()
278+
},
279+
);
280+
281+
let routes = warp::get().and(
282+
map_route
283+
.or(then_route)
284+
.or(and_then_route)
285+
.or(path_and_map_route),
286+
);
287+
warp::serve(routes).run(([127, 0, 0, 1], 3030)).await;
288+
}
289+
}

0 commit comments

Comments
 (0)