update test scripts

harjotgill · harjotgill · commit 1521a4635c80 · 2024-04-15T17:38:40.000-07:00
diff --git a/.gitignore b/.gitignore
@@ -1,6 +1,3 @@
-# Ignore ast-grep snapshots
-tests/__snapshots__/*
-
 # Other package managers
 bun.lockb
 
diff --git a/package.json b/package.json
@@ -4,8 +4,10 @@
   "description": "ast-grep essential security rules",
   "main": "index.js",
   "scripts": {
-    "test": "ast-grep test --skip-snapshot-tests -c ./sgconfig.yml",
-    "update-tests": "ast-grep test -U -c ./sgconfig.yml"
+    "test-wip": "ast-grep test --skip-snapshot-tests -c ./sgconfig.yml",
+    "test-ci": "ast-grep test -c ./sgconfig.yml",
+    "test": "ast-grep test --interactive -c ./sgconfig.yml",
+    "test-update-all": "ast-grep test --update-all -c ./sgconfig.yml"
   },
   "author": "",
   "license": "ISC",
diff --git a/tests/__snapshots__/bad-tmp-go-snapshot.yml b/tests/__snapshots__/bad-tmp-go-snapshot.yml
@@ -0,0 +1,8 @@
+id: bad-tmp-go
+snapshots:
+  ioutil.WriteFile("/tmp/demo2", "tmp"):
+    labels:
+    - source: ioutil.WriteFile("/tmp/demo2", "tmp")
+      style: primary
+      start: 0
+      end: 37
diff --git a/tests/__snapshots__/binary-formatter-snapshot.yml b/tests/__snapshots__/binary-formatter-snapshot.yml
@@ -0,0 +1,8 @@
+id: binary-formatter
+snapshots:
+  BinaryFormatter binaryFormatter = new BinaryFormatter();:
+    labels:
+    - source: new BinaryFormatter()
+      style: primary
+      start: 34
+      end: 55
diff --git a/tests/__snapshots__/command-injection-formatted-runtime-call-snapshot.yml b/tests/__snapshots__/command-injection-formatted-runtime-call-snapshot.yml
@@ -0,0 +1,18 @@
+id: command-injection-formatted-runtime-call
+snapshots:
+  ? |
+    val r: Runtime = Runtime.getRuntime()
+    r.exec("/bin/sh -c tool_command" + input)
+  : labels:
+    - source: r.exec("/bin/sh -c tool_command" + input)
+      style: primary
+      start: 38
+      end: 79
+  ? |-
+    val r: Runtime = Runtime.getRuntime()
+    r.loadLibrary(String.format("%s.dll", input))
+  : labels:
+    - source: r.loadLibrary(String.format("%s.dll", input))
+      style: primary
+      start: 38
+      end: 83
diff --git a/tests/__snapshots__/data-contract-resolver-snapshot.yml b/tests/__snapshots__/data-contract-resolver-snapshot.yml
@@ -0,0 +1,17 @@
+id: data-contract-resolver
+snapshots:
+  ? |-
+    namespace DCR
+    {
+        class CustomDCR : DataContractResolver
+        {
+        }
+    }
+  : labels:
+    - source: |-
+        class CustomDCR : DataContractResolver
+            {
+            }
+      style: primary
+      start: 20
+      end: 70
diff --git a/tests/__snapshots__/detect-replaceall-sanitization-snapshot.yml b/tests/__snapshots__/detect-replaceall-sanitization-snapshot.yml
@@ -0,0 +1,23 @@
+id: detect-replaceall-sanitization
+snapshots:
+  ? |
+    "<strong>Hello World</strong>".replace('<', '&lt;').replace('>', '&gt;')
+  : labels:
+    - source: '"<strong>Hello World</strong>".replace(''<'', ''&lt;'').replace(''>'', ''&gt;'')'
+      style: primary
+      start: 0
+      end: 72
+  ? |
+    "<strong>Hello World</strong>".replaceAll('"', '&quot;').replaceAll("'", '&apos;').replaceAll('&', '&amp;')
+  : labels:
+    - source: '"<strong>Hello World</strong>".replaceAll(''"'', ''&quot;'').replaceAll("''", ''&apos;'').replaceAll(''&'', ''&amp;'')'
+      style: primary
+      start: 0
+      end: 107
+  ? |
+    "<strong>Hello World</strong>".replaceAll('<', '&lt;').replaceAll('>', '&gt;')
+  : labels:
+    - source: '"<strong>Hello World</strong>".replaceAll(''<'', ''&lt;'').replaceAll(''>'', ''&gt;'')'
+      style: primary
+      start: 0
+      end: 78
diff --git a/tests/__snapshots__/empty-aes-key-snapshot.yml b/tests/__snapshots__/empty-aes-key-snapshot.yml
@@ -0,0 +1,8 @@
+id: empty-aes-key
+snapshots:
+  cipher = AES.new("", AES.MODE_CFB, iv):
+    labels:
+    - source: AES.new("", AES.MODE_CFB, iv)
+      style: primary
+      start: 9
+      end: 38
diff --git a/tests/__snapshots__/go-template-insecure-types-snapshot.yml b/tests/__snapshots__/go-template-insecure-types-snapshot.yml
@@ -0,0 +1,9 @@
+id: go-template-insecure-types
+snapshots:
+  ? |
+    var b template.CSS = "a { text-decoration: underline; } "
+  : labels:
+    - source: 'var b template.CSS = "a { text-decoration: underline; } "'
+      style: primary
+      start: 0
+      end: 57
diff --git a/tests/__snapshots__/grpc-client-insecure-connection-snapshot.yml b/tests/__snapshots__/grpc-client-insecure-connection-snapshot.yml
@@ -0,0 +1,43 @@
+id: grpc-client-insecure-connection
+snapshots:
+  ? |
+    grpc.Dial("example.com", grpc.WithInsecure())
+  : labels:
+    - source: grpc.Dial("example.com", grpc.WithInsecure())
+      style: primary
+      start: 0
+      end: 45
+  ? |
+    grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock())
+  : labels:
+    - source: grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock())
+      style: primary
+      start: 0
+      end: 63
+  ? |
+    grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock(), grpc.WithTimeout(5*time.Second))
+  : labels:
+    - source: grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock(), grpc.WithTimeout(5*time.Second))
+      style: primary
+      start: 0
+      end: 96
+  ? |
+    grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock(), grpc.WithTimeout(5*time.Second), grpc.WithUserAgent("example"))
+  : labels:
+    - source: grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock(), grpc.WithTimeout(5*time.Second), grpc.WithUserAgent("example"))
+      style: primary
+      start: 0
+      end: 127
+  ? |
+    grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock(), grpc.WithTimeout(5*time.Second), grpc.WithUserAgent("example"), grpc.WithAuthority("example.com"))
+  : labels:
+    - source: grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock(), grpc.WithTimeout(5*time.Second), grpc.WithUserAgent("example"), grpc.WithAuthority("example.com"))
+      style: primary
+      start: 0
+      end: 162
+  ? grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock(), grpc.WithTimeout(5*time.Second), grpc.WithUserAgent("example"), grpc.WithAuthority("example.com"), grpc.WithDial)
+  : labels:
+    - source: grpc.Dial("example.com", grpc.WithInsecure(), grpc.WithBlock(), grpc.WithTimeout(5*time.Second), grpc.WithUserAgent("example"), grpc.WithAuthority("example.com"), grpc.WithDial)
+      style: primary
+      start: 0
+      end: 177
diff --git a/tests/__snapshots__/html-raw-json-snapshot.yml b/tests/__snapshots__/html-raw-json-snapshot.yml
@@ -0,0 +1,18 @@
+id: html-raw-json
+snapshots:
+  ? |-
+    anotherCall();
+    var obj = @Html.Raw(Json.Encode(Model));
+    alert("hello world");
+  : labels:
+    - source: '@Html.Raw(Json.Encode(Model))'
+      style: primary
+      start: 25
+      end: 54
+  ? |
+    var obj = @Html.Raw(JsonConvert.SerializeObject(Model));
+  : labels:
+    - source: '@Html.Raw(JsonConvert.SerializeObject(Model))'
+      style: primary
+      start: 10
+      end: 55
diff --git a/tests/__snapshots__/info-leak-on-non-formated-string-snapshot.yml b/tests/__snapshots__/info-leak-on-non-formated-string-snapshot.yml
@@ -0,0 +1,8 @@
+id: info-leak-on-non-formated-string
+snapshots:
+  printf(argv[0]);:
+    labels:
+    - source: printf(argv[0]);
+      style: primary
+      start: 0
+      end: 16
diff --git a/tests/__snapshots__/insecure-fspickler-deserialization-snapshot.yml b/tests/__snapshots__/insecure-fspickler-deserialization-snapshot.yml
@@ -0,0 +1,8 @@
+id: insecure-fspickler-deserialization
+snapshots:
+  var fsPickler = FsPickler.CreateJsonSerializer();:
+    labels:
+    - source: FsPickler.CreateJsonSerializer()
+      style: primary
+      start: 16
+      end: 48
diff --git a/tests/__snapshots__/insecure-hashes-snapshot.yml b/tests/__snapshots__/insecure-hashes-snapshot.yml
@@ -0,0 +1,30 @@
+id: insecure-hashes
+snapshots:
+  ? |
+    let mut hasher = Md2::new();
+  : labels:
+    - source: Md2::new()
+      style: primary
+      start: 17
+      end: 27
+  ? |
+    let mut hasher = Md4::new();
+  : labels:
+    - source: Md4::new()
+      style: primary
+      start: 17
+      end: 27
+  ? |
+    let mut hasher = Md5::new();
+  : labels:
+    - source: Md5::new()
+      style: primary
+      start: 17
+      end: 27
+  ? |
+    let mut hasher = Sha1::new();
+  : labels:
+    - source: Sha1::new()
+      style: primary
+      start: 17
+      end: 28
diff --git a/tests/__snapshots__/insecure-netdatacontract-deserialization-snapshot.yml b/tests/__snapshots__/insecure-netdatacontract-deserialization-snapshot.yml
@@ -0,0 +1,8 @@
+id: insecure-netdatacontract-deserialization
+snapshots:
+  NetDataContractSerializer netDataContractSerializer = new NetDataContractSerializer();:
+    labels:
+    - source: new NetDataContractSerializer()
+      style: primary
+      start: 54
+      end: 85
diff --git a/tests/__snapshots__/insecure-use-gets-function-snapshot.yml b/tests/__snapshots__/insecure-use-gets-function-snapshot.yml
@@ -0,0 +1,8 @@
+id: insecure-use-gets-function
+snapshots:
+  gets(buffer);:
+    labels:
+    - source: gets(buffer);
+      style: primary
+      start: 0
+      end: 13
diff --git a/tests/__snapshots__/insecure-use-memset-function-snapshot.yml b/tests/__snapshots__/insecure-use-memset-function-snapshot.yml
@@ -0,0 +1,8 @@
+id: insecure-use-memset-function
+snapshots:
+  memset(buffer, 0, sizeof(buffer));:
+    labels:
+    - source: memset(buffer, 0, sizeof(buffer));
+      style: primary
+      start: 0
+      end: 34
diff --git a/tests/__snapshots__/insecure-use-scanf-function-snapshot.yml b/tests/__snapshots__/insecure-use-scanf-function-snapshot.yml
@@ -0,0 +1,8 @@
+id: insecure-use-scanf-function
+snapshots:
+  scanf("%s", buffer);:
+    labels:
+    - source: scanf("%s", buffer);
+      style: primary
+      start: 0
+      end: 20
diff --git a/tests/__snapshots__/insecure-use-strcat-function-snapshot.yml b/tests/__snapshots__/insecure-use-strcat-function-snapshot.yml
@@ -0,0 +1,10 @@
+id: insecure-use-strcat-function
+snapshots:
+  ? |-
+    strcat(buffer, "abc");
+    strncat(buffer, "abc", sizeof(buffer));
+  : labels:
+    - source: strcat(buffer, "abc");
+      style: primary
+      start: 0
+      end: 22
diff --git a/tests/__snapshots__/insecure-use-string-copy-function-snapshot.yml b/tests/__snapshots__/insecure-use-string-copy-function-snapshot.yml
@@ -0,0 +1,10 @@
+id: insecure-use-string-copy-function
+snapshots:
+  ? |-
+    strcpy(buffer, "abc");
+    strncpy(buffer, "abc", sizeof(buffer));
+  : labels:
+    - source: strcpy(buffer, "abc");
+      style: primary
+      start: 0
+      end: 22
diff --git a/tests/__snapshots__/insecure-use-strtok-function-snapshot.yml b/tests/__snapshots__/insecure-use-strtok-function-snapshot.yml
@@ -0,0 +1,8 @@
+id: insecure-use-strtok-function
+snapshots:
+  strtok(buffer, " ");:
+    labels:
+    - source: strtok(buffer, " ");
+      style: primary
+      start: 0
+      end: 20
diff --git a/tests/__snapshots__/json-entity-escape-snapshot.yml b/tests/__snapshots__/json-entity-escape-snapshot.yml
@@ -0,0 +1,8 @@
+id: json-entity-escape
+snapshots:
+  ActiveSupport.escape_html_entities_in_json = false:
+    labels:
+    - source: ActiveSupport.escape_html_entities_in_json = false
+      style: primary
+      start: 0
+      end: 50
diff --git a/tests/__snapshots__/jwt-go-none-algorithm-snapshot.yml b/tests/__snapshots__/jwt-go-none-algorithm-snapshot.yml
@@ -0,0 +1,23 @@
+id: jwt-go-none-algorithm
+snapshots:
+  ? |
+    jwt.New(jwt.SigningMethodNone)
+  : labels:
+    - source: jwt.SigningMethodNone
+      style: primary
+      start: 8
+      end: 29
+  ? |
+    jwt.New(jwt.SigningMethodNone, jwt.WithClaims(jwt.MapClaims{"foo": "bar"}))
+  : labels:
+    - source: jwt.SigningMethodNone
+      style: primary
+      start: 8
+      end: 29
+  ? |
+    jwt.New(jwt.UnsafeAllowNoneSignatureType, jwt.WithHeader(jwt.MapClaims{"foo": "bar"}))
+  : labels:
+    - source: jwt.UnsafeAllowNoneSignatureType
+      style: primary
+      start: 8
+      end: 40
diff --git a/tests/__snapshots__/jwt-go-parse-unverified-snapshot.yml b/tests/__snapshots__/jwt-go-parse-unverified-snapshot.yml
@@ -0,0 +1,8 @@
+id: jwt-go-parse-unverified
+snapshots:
+  token, _, err := new(jwt.Parser).ParseUnverified(tokenString, jwt.MapClaims{}):
+    labels:
+    - source: new(jwt.Parser).ParseUnverified(tokenString, jwt.MapClaims{})
+      style: primary
+      start: 17
+      end: 78
diff --git a/tests/__snapshots__/jwt-go-snapshot.yml b/tests/__snapshots__/jwt-go-snapshot.yml
@@ -0,0 +1,8 @@
+id: jwt-go
+snapshots:
+  token.SignedString([]byte("secret")):
+    labels:
+    - source: token.SignedString([]byte("secret"))
+      style: primary
+      start: 0
+      end: 36
diff --git a/tests/__snapshots__/jwt-non-alg-ruby-snapshot.yml b/tests/__snapshots__/jwt-non-alg-ruby-snapshot.yml
@@ -0,0 +1,16 @@
+id: jwt-non-alg-ruby
+snapshots:
+  ? |
+    token = JWT.encode(payload, nil, 'none');
+  : labels:
+    - source: JWT.encode(payload, nil, 'none')
+      style: primary
+      start: 8
+      end: 40
+  ? |
+    token = JWT.encode(payload, nil, 'none', { algorithm: 'none' });
+  : labels:
+    - source: 'JWT.encode(payload, nil, ''none'', { algorithm: ''none'' })'
+      style: primary
+      start: 8
+      end: 63
diff --git a/tests/__snapshots__/los-formatter-snapshot.yml b/tests/__snapshots__/los-formatter-snapshot.yml
@@ -0,0 +1,8 @@
+id: los-formatter
+snapshots:
+  LosFormatter losFormatter = new LosFormatter();:
+    labels:
+    - source: new LosFormatter()
+      style: primary
+      start: 28
+      end: 46
diff --git a/tests/__snapshots__/object-deserialization-snapshot.yml b/tests/__snapshots__/object-deserialization-snapshot.yml
@@ -0,0 +1,12 @@
+id: object-deserialization
+snapshots:
+  ? |-
+    ObjectInputStream ois = new ObjectInputStream(new FileInputStream("object.ser"));
+    Object obj = ois.readObject();
+    ois.close();
+    // obj is now deserialized
+  : labels:
+    - source: new ObjectInputStream(new FileInputStream("object.ser"))
+      style: primary
+      start: 24
+      end: 80
diff --git a/tests/__snapshots__/rails-skip-forgery-protection-snapshot.yml b/tests/__snapshots__/rails-skip-forgery-protection-snapshot.yml
@@ -0,0 +1,11 @@
+id: rails-skip-forgery-protection
+snapshots:
+  ? |-
+    class ApplicationController < ActionController::Base
+      skip_forgery_protection
+    end
+  : labels:
+    - source: skip_forgery_protection
+      style: primary
+      start: 55
+      end: 78
diff --git a/tests/__snapshots__/session-cookie-missing-httponly-snapshot.yml b/tests/__snapshots__/session-cookie-missing-httponly-snapshot.yml
diff --git a/tests/__snapshots__/session-cookie-missing-secure-snapshot.yml b/tests/__snapshots__/session-cookie-missing-secure-snapshot.yml
diff --git a/tests/__snapshots__/ssl-mode-no-verify-snapshot.yml b/tests/__snapshots__/ssl-mode-no-verify-snapshot.yml
diff --git a/tests/__snapshots__/unencrypted-socket-snapshot.yml b/tests/__snapshots__/unencrypted-socket-snapshot.yml
diff --git a/tests/__snapshots__/unsafe-usage-snapshot.yml b/tests/__snapshots__/unsafe-usage-snapshot.yml
diff --git a/tests/__snapshots__/wildcard-postmessage-configuration-snapshot.yml b/tests/__snapshots__/wildcard-postmessage-configuration-snapshot.yml
