Skip to content

Commit 21274d3

Browse files
geoffw0geoffw0
committed
Rust: Add tests of poem CookieConfig.
1 parent e5933d0 commit 21274d3

File tree

5 files changed

+94
-67
lines changed

5 files changed

+94
-67
lines changed

‎rust/ql/test/query-tests/security/CWE-614/Cargo.lock‎

Lines changed: 14 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎rust/ql/test/query-tests/security/CWE-614/CookieSet.expected‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -59,10 +59,10 @@
5959
| main.rs:205:5:205:39 | ...::build(...) | secure | true |
6060
| main.rs:208:5:208:11 | [SSA] cookie2 | secure | true |
6161
| main.rs:208:5:208:11 | cookie2 | secure | true |
62-
| main.rs:242:5:242:43 | ...::build(...) | secure | false |
63-
| main.rs:243:5:243:43 | ...::build(...) | secure | false |
64-
| main.rs:246:5:246:11 | [SSA] cookie1 | secure | false |
65-
| main.rs:246:5:246:11 | cookie1 | secure | false |
66-
| main.rs:250:5:250:43 | ...::build(...) | secure | true |
67-
| main.rs:253:5:253:11 | [SSA] cookie2 | secure | true |
68-
| main.rs:253:5:253:11 | cookie2 | secure | true |
62+
| main.rs:255:5:255:43 | ...::build(...) | secure | false |
63+
| main.rs:256:5:256:43 | ...::build(...) | secure | false |
64+
| main.rs:259:5:259:11 | [SSA] cookie1 | secure | false |
65+
| main.rs:259:5:259:11 | cookie1 | secure | false |
66+
| main.rs:263:5:263:43 | ...::build(...) | secure | true |
67+
| main.rs:266:5:266:11 | [SSA] cookie2 | secure | true |
68+
| main.rs:266:5:266:11 | cookie2 | secure | true |

‎rust/ql/test/query-tests/security/CWE-614/InsecureCookie.expected‎

Lines changed: 59 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -87,15 +87,15 @@
8787
| main.rs:202:9:202:11 | add | main.rs:201:5:201:11 | cookie1 | main.rs:202:9:202:11 | add | Cookie attribute 'Secure' is not set to true. |
8888
| main.rs:212:41:212:46 | finish | main.rs:212:5:212:22 | ...::build | main.rs:212:41:212:46 | finish | Cookie attribute 'Secure' is not set to true. |
8989
| main.rs:215:9:215:11 | add | main.rs:214:19:214:34 | ...::new | main.rs:215:9:215:11 | add | Cookie attribute 'Secure' is not set to true. |
90-
| main.rs:242:59:242:64 | finish | main.rs:242:5:242:26 | ...::build | main.rs:242:59:242:64 | finish | Cookie attribute 'Secure' is not set to true. |
91-
| main.rs:242:59:242:64 | finish | main.rs:242:5:242:43 | ...::build(...) | main.rs:242:59:242:64 | finish | Cookie attribute 'Secure' is not set to true. |
92-
| main.rs:243:69:243:74 | finish | main.rs:243:5:243:26 | ...::build | main.rs:243:69:243:74 | finish | Cookie attribute 'Secure' is not set to true. |
93-
| main.rs:243:69:243:74 | finish | main.rs:243:5:243:43 | ...::build(...) | main.rs:243:69:243:74 | finish | Cookie attribute 'Secure' is not set to true. |
94-
| main.rs:247:9:247:11 | add | main.rs:245:23:245:42 | ...::new | main.rs:247:9:247:11 | add | Cookie attribute 'Secure' is not set to true. |
95-
| main.rs:247:9:247:11 | add | main.rs:246:5:246:11 | [SSA] cookie1 | main.rs:247:9:247:11 | add | Cookie attribute 'Secure' is not set to true. |
96-
| main.rs:247:9:247:11 | add | main.rs:246:5:246:11 | cookie1 | main.rs:247:9:247:11 | add | Cookie attribute 'Secure' is not set to true. |
97-
| main.rs:257:45:257:50 | finish | main.rs:257:5:257:26 | ...::build | main.rs:257:45:257:50 | finish | Cookie attribute 'Secure' is not set to true. |
98-
| main.rs:260:9:260:11 | add | main.rs:259:19:259:38 | ...::new | main.rs:260:9:260:11 | add | Cookie attribute 'Secure' is not set to true. |
90+
| main.rs:255:59:255:64 | finish | main.rs:255:5:255:26 | ...::build | main.rs:255:59:255:64 | finish | Cookie attribute 'Secure' is not set to true. |
91+
| main.rs:255:59:255:64 | finish | main.rs:255:5:255:43 | ...::build(...) | main.rs:255:59:255:64 | finish | Cookie attribute 'Secure' is not set to true. |
92+
| main.rs:256:69:256:74 | finish | main.rs:256:5:256:26 | ...::build | main.rs:256:69:256:74 | finish | Cookie attribute 'Secure' is not set to true. |
93+
| main.rs:256:69:256:74 | finish | main.rs:256:5:256:43 | ...::build(...) | main.rs:256:69:256:74 | finish | Cookie attribute 'Secure' is not set to true. |
94+
| main.rs:260:9:260:11 | add | main.rs:258:23:258:42 | ...::new | main.rs:260:9:260:11 | add | Cookie attribute 'Secure' is not set to true. |
95+
| main.rs:260:9:260:11 | add | main.rs:259:5:259:11 | [SSA] cookie1 | main.rs:260:9:260:11 | add | Cookie attribute 'Secure' is not set to true. |
96+
| main.rs:260:9:260:11 | add | main.rs:259:5:259:11 | cookie1 | main.rs:260:9:260:11 | add | Cookie attribute 'Secure' is not set to true. |
97+
| main.rs:270:45:270:50 | finish | main.rs:270:5:270:26 | ...::build | main.rs:270:45:270:50 | finish | Cookie attribute 'Secure' is not set to true. |
98+
| main.rs:273:9:273:11 | add | main.rs:272:19:272:38 | ...::new | main.rs:273:9:273:11 | add | Cookie attribute 'Secure' is not set to true. |
9999
edges
100100
| main.rs:8:19:8:31 | ...::build | main.rs:8:19:8:50 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
101101
| main.rs:8:19:8:50 | ...::build(...) | main.rs:8:19:8:64 | ... .secure(...) | provenance | MaD:41 |
@@ -357,31 +357,31 @@ edges
357357
| main.rs:214:19:214:51 | ...::new(...) | main.rs:214:9:214:15 | cookie3 | provenance | |
358358
| main.rs:215:13:215:19 | cookie3 | main.rs:215:13:215:27 | cookie3.clone() | provenance | MaD:17 |
359359
| main.rs:215:13:215:27 | cookie3.clone() | main.rs:215:9:215:11 | add | provenance | MaD:4 Sink:MaD:4 |
360-
| main.rs:242:5:242:26 | ...::build | main.rs:242:5:242:43 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
361-
| main.rs:242:5:242:43 | ...::build(...) | main.rs:242:5:242:57 | ... .secure(...) | provenance | MaD:41 |
362-
| main.rs:242:5:242:57 | ... .secure(...) | main.rs:242:59:242:64 | finish | provenance | MaD:3 Sink:MaD:3 |
363-
| main.rs:243:5:243:26 | ...::build | main.rs:243:5:243:43 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
364-
| main.rs:243:5:243:43 | ...::build(...) | main.rs:243:5:243:57 | ... .secure(...) | provenance | MaD:41 |
365-
| main.rs:243:5:243:57 | ... .secure(...) | main.rs:243:5:243:67 | ... .path(...) | provenance | MaD:37 |
366-
| main.rs:243:5:243:67 | ... .path(...) | main.rs:243:69:243:74 | finish | provenance | MaD:3 Sink:MaD:3 |
367-
| main.rs:245:9:245:19 | mut cookie1 | main.rs:247:13:247:19 | cookie1 | provenance | |
368-
| main.rs:245:9:245:19 | mut cookie1 | main.rs:247:13:247:27 | cookie1.clone() | provenance | MaD:17 |
369-
| main.rs:245:23:245:42 | ...::new | main.rs:245:23:245:59 | ...::new(...) | provenance | Src:MaD:15 MaD:15 |
370-
| main.rs:245:23:245:59 | ...::new(...) | main.rs:245:9:245:19 | mut cookie1 | provenance | |
371-
| main.rs:246:5:246:11 | [SSA] cookie1 | main.rs:247:13:247:19 | cookie1 | provenance | |
372-
| main.rs:246:5:246:11 | [SSA] cookie1 | main.rs:247:13:247:27 | cookie1.clone() | provenance | MaD:17 |
373-
| main.rs:246:5:246:11 | cookie1 | main.rs:247:13:247:19 | cookie1 | provenance | |
374-
| main.rs:246:5:246:11 | cookie1 | main.rs:247:13:247:27 | cookie1.clone() | provenance | MaD:17 |
375-
| main.rs:247:13:247:19 | cookie1 | main.rs:247:13:247:27 | cookie1.clone() | provenance | MaD:17 |
376-
| main.rs:247:13:247:27 | cookie1.clone() | main.rs:247:9:247:11 | add | provenance | MaD:4 Sink:MaD:4 |
377-
| main.rs:257:5:257:26 | ...::build | main.rs:257:5:257:43 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
378-
| main.rs:257:5:257:43 | ...::build(...) | main.rs:257:45:257:50 | finish | provenance | MaD:3 Sink:MaD:3 |
379-
| main.rs:259:9:259:15 | cookie3 | main.rs:260:13:260:19 | cookie3 | provenance | |
380-
| main.rs:259:9:259:15 | cookie3 | main.rs:260:13:260:27 | cookie3.clone() | provenance | MaD:17 |
381-
| main.rs:259:19:259:38 | ...::new | main.rs:259:19:259:55 | ...::new(...) | provenance | Src:MaD:15 MaD:15 |
382-
| main.rs:259:19:259:55 | ...::new(...) | main.rs:259:9:259:15 | cookie3 | provenance | |
383-
| main.rs:260:13:260:19 | cookie3 | main.rs:260:13:260:27 | cookie3.clone() | provenance | MaD:17 |
384-
| main.rs:260:13:260:27 | cookie3.clone() | main.rs:260:9:260:11 | add | provenance | MaD:4 Sink:MaD:4 |
360+
| main.rs:255:5:255:26 | ...::build | main.rs:255:5:255:43 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
361+
| main.rs:255:5:255:43 | ...::build(...) | main.rs:255:5:255:57 | ... .secure(...) | provenance | MaD:41 |
362+
| main.rs:255:5:255:57 | ... .secure(...) | main.rs:255:59:255:64 | finish | provenance | MaD:3 Sink:MaD:3 |
363+
| main.rs:256:5:256:26 | ...::build | main.rs:256:5:256:43 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
364+
| main.rs:256:5:256:43 | ...::build(...) | main.rs:256:5:256:57 | ... .secure(...) | provenance | MaD:41 |
365+
| main.rs:256:5:256:57 | ... .secure(...) | main.rs:256:5:256:67 | ... .path(...) | provenance | MaD:37 |
366+
| main.rs:256:5:256:67 | ... .path(...) | main.rs:256:69:256:74 | finish | provenance | MaD:3 Sink:MaD:3 |
367+
| main.rs:258:9:258:19 | mut cookie1 | main.rs:260:13:260:19 | cookie1 | provenance | |
368+
| main.rs:258:9:258:19 | mut cookie1 | main.rs:260:13:260:27 | cookie1.clone() | provenance | MaD:17 |
369+
| main.rs:258:23:258:42 | ...::new | main.rs:258:23:258:59 | ...::new(...) | provenance | Src:MaD:15 MaD:15 |
370+
| main.rs:258:23:258:59 | ...::new(...) | main.rs:258:9:258:19 | mut cookie1 | provenance | |
371+
| main.rs:259:5:259:11 | [SSA] cookie1 | main.rs:260:13:260:19 | cookie1 | provenance | |
372+
| main.rs:259:5:259:11 | [SSA] cookie1 | main.rs:260:13:260:27 | cookie1.clone() | provenance | MaD:17 |
373+
| main.rs:259:5:259:11 | cookie1 | main.rs:260:13:260:19 | cookie1 | provenance | |
374+
| main.rs:259:5:259:11 | cookie1 | main.rs:260:13:260:27 | cookie1.clone() | provenance | MaD:17 |
375+
| main.rs:260:13:260:19 | cookie1 | main.rs:260:13:260:27 | cookie1.clone() | provenance | MaD:17 |
376+
| main.rs:260:13:260:27 | cookie1.clone() | main.rs:260:9:260:11 | add | provenance | MaD:4 Sink:MaD:4 |
377+
| main.rs:270:5:270:26 | ...::build | main.rs:270:5:270:43 | ...::build(...) | provenance | Src:MaD:13 MaD:13 |
378+
| main.rs:270:5:270:43 | ...::build(...) | main.rs:270:45:270:50 | finish | provenance | MaD:3 Sink:MaD:3 |
379+
| main.rs:272:9:272:15 | cookie3 | main.rs:273:13:273:19 | cookie3 | provenance | |
380+
| main.rs:272:9:272:15 | cookie3 | main.rs:273:13:273:27 | cookie3.clone() | provenance | MaD:17 |
381+
| main.rs:272:19:272:38 | ...::new | main.rs:272:19:272:55 | ...::new(...) | provenance | Src:MaD:15 MaD:15 |
382+
| main.rs:272:19:272:55 | ...::new(...) | main.rs:272:9:272:15 | cookie3 | provenance | |
383+
| main.rs:273:13:273:19 | cookie3 | main.rs:273:13:273:27 | cookie3.clone() | provenance | MaD:17 |
384+
| main.rs:273:13:273:27 | cookie3.clone() | main.rs:273:9:273:11 | add | provenance | MaD:4 Sink:MaD:4 |
385385
models
386386
| 1 | Sink: <biscotti::response_cookies::ResponseCookies>::insert; Argument[0]; cookie-use |
387387
| 2 | Sink: <cookie::builder::CookieBuilder>::build; Argument[self]; cookie-use |
@@ -688,30 +688,30 @@ nodes
688688
| main.rs:215:9:215:11 | add | semmle.label | add |
689689
| main.rs:215:13:215:19 | cookie3 | semmle.label | cookie3 |
690690
| main.rs:215:13:215:27 | cookie3.clone() | semmle.label | cookie3.clone() |
691-
| main.rs:242:5:242:26 | ...::build | semmle.label | ...::build |
692-
| main.rs:242:5:242:43 | ...::build(...) | semmle.label | ...::build(...) |
693-
| main.rs:242:5:242:57 | ... .secure(...) | semmle.label | ... .secure(...) |
694-
| main.rs:242:59:242:64 | finish | semmle.label | finish |
695-
| main.rs:243:5:243:26 | ...::build | semmle.label | ...::build |
696-
| main.rs:243:5:243:43 | ...::build(...) | semmle.label | ...::build(...) |
697-
| main.rs:243:5:243:57 | ... .secure(...) | semmle.label | ... .secure(...) |
698-
| main.rs:243:5:243:67 | ... .path(...) | semmle.label | ... .path(...) |
699-
| main.rs:243:69:243:74 | finish | semmle.label | finish |
700-
| main.rs:245:9:245:19 | mut cookie1 | semmle.label | mut cookie1 |
701-
| main.rs:245:23:245:42 | ...::new | semmle.label | ...::new |
702-
| main.rs:245:23:245:59 | ...::new(...) | semmle.label | ...::new(...) |
703-
| main.rs:246:5:246:11 | [SSA] cookie1 | semmle.label | [SSA] cookie1 |
704-
| main.rs:246:5:246:11 | cookie1 | semmle.label | cookie1 |
705-
| main.rs:247:9:247:11 | add | semmle.label | add |
706-
| main.rs:247:13:247:19 | cookie1 | semmle.label | cookie1 |
707-
| main.rs:247:13:247:27 | cookie1.clone() | semmle.label | cookie1.clone() |
708-
| main.rs:257:5:257:26 | ...::build | semmle.label | ...::build |
709-
| main.rs:257:5:257:43 | ...::build(...) | semmle.label | ...::build(...) |
710-
| main.rs:257:45:257:50 | finish | semmle.label | finish |
711-
| main.rs:259:9:259:15 | cookie3 | semmle.label | cookie3 |
712-
| main.rs:259:19:259:38 | ...::new | semmle.label | ...::new |
713-
| main.rs:259:19:259:55 | ...::new(...) | semmle.label | ...::new(...) |
691+
| main.rs:255:5:255:26 | ...::build | semmle.label | ...::build |
692+
| main.rs:255:5:255:43 | ...::build(...) | semmle.label | ...::build(...) |
693+
| main.rs:255:5:255:57 | ... .secure(...) | semmle.label | ... .secure(...) |
694+
| main.rs:255:59:255:64 | finish | semmle.label | finish |
695+
| main.rs:256:5:256:26 | ...::build | semmle.label | ...::build |
696+
| main.rs:256:5:256:43 | ...::build(...) | semmle.label | ...::build(...) |
697+
| main.rs:256:5:256:57 | ... .secure(...) | semmle.label | ... .secure(...) |
698+
| main.rs:256:5:256:67 | ... .path(...) | semmle.label | ... .path(...) |
699+
| main.rs:256:69:256:74 | finish | semmle.label | finish |
700+
| main.rs:258:9:258:19 | mut cookie1 | semmle.label | mut cookie1 |
701+
| main.rs:258:23:258:42 | ...::new | semmle.label | ...::new |
702+
| main.rs:258:23:258:59 | ...::new(...) | semmle.label | ...::new(...) |
703+
| main.rs:259:5:259:11 | [SSA] cookie1 | semmle.label | [SSA] cookie1 |
704+
| main.rs:259:5:259:11 | cookie1 | semmle.label | cookie1 |
714705
| main.rs:260:9:260:11 | add | semmle.label | add |
715-
| main.rs:260:13:260:19 | cookie3 | semmle.label | cookie3 |
716-
| main.rs:260:13:260:27 | cookie3.clone() | semmle.label | cookie3.clone() |
706+
| main.rs:260:13:260:19 | cookie1 | semmle.label | cookie1 |
707+
| main.rs:260:13:260:27 | cookie1.clone() | semmle.label | cookie1.clone() |
708+
| main.rs:270:5:270:26 | ...::build | semmle.label | ...::build |
709+
| main.rs:270:5:270:43 | ...::build(...) | semmle.label | ...::build(...) |
710+
| main.rs:270:45:270:50 | finish | semmle.label | finish |
711+
| main.rs:272:9:272:15 | cookie3 | semmle.label | cookie3 |
712+
| main.rs:272:19:272:38 | ...::new | semmle.label | ...::new |
713+
| main.rs:272:19:272:55 | ...::new(...) | semmle.label | ...::new(...) |
714+
| main.rs:273:9:273:11 | add | semmle.label | add |
715+
| main.rs:273:13:273:19 | cookie3 | semmle.label | cookie3 |
716+
| main.rs:273:13:273:27 | cookie3.clone() | semmle.label | cookie3.clone() |
717717
subpaths

‎rust/ql/test/query-tests/security/CWE-614/main.rs‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -232,6 +232,19 @@ fn test_poem() {
232232
// secure left as default
233233
let cookie3 = PoemCookie::new_with_str("name", "value"); // $ MISSING: Source
234234
jar.add(cookie3.clone()); // $ MISSING: Alert[rust/insecure-cookie]
235+
236+
// set secure via CookieConfig
237+
let cookie_config_bad = poem::session::CookieConfig::new().secure(false);
238+
_ = poem::session::ServerSession::new(cookie_config_bad, ()); // $ MISSING: Alert[rust/insecure-cookie]
239+
240+
let cookie_config_bad2 = poem::session::CookieConfig::new().secure(false).name("name").path("/");
241+
_ = poem::session::ServerSession::new(cookie_config_bad2, ()); // $ MISSING: Alert[rust/insecure-cookie]
242+
243+
let cookie_config_good = poem::session::CookieConfig::new().secure(true);
244+
_ = poem::session::ServerSession::new(cookie_config_good, ()); // good
245+
246+
let cookie_config_default = poem::session::CookieConfig::new();
247+
_ = poem::session::ServerSession::new(cookie_config_default, ()); // $ MISSING: Alert[rust/insecure-cookie]
235248
}
236249

237250
fn test_http_types() {

‎rust/ql/test/query-tests/security/CWE-614/options.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@ qltest_dependencies:
33
- cookie = { version = "0.18.1", features = ["percent-encode", "signed", "private"] }
44
- biscotti = { version = "0.4.3" }
55
- actix-web = { version = "4", features = ["cookies"] }
6-
- poem = { version = "3", features = ["cookie"] }
6+
- poem = { version = "3", features = ["cookie", "session"] }
77
- http-types = { version = "2", features = ["cookies"] }

0 commit comments

Comments
 (0)