Skip to content

Commit 9e66ee1

Browse files
author
Benjamin Muskalla
committed
Add example to inline flow test docs
1 parent 3641b28 commit 9e66ee1

File tree

1 file changed

+39
-0
lines changed

1 file changed

+39
-0
lines changed

java/ql/test/TestUtilities/InlineFlowTest.qll

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,42 @@
1+
/**
2+
* Provides a simple base test for flow-related tests using inline expectations.
3+
*
4+
* Example for a test.ql:
5+
* ```ql
6+
* class HasFlowTest extends InlineFlowTest { }
7+
* ```
8+
*
9+
* To declare expecations, you can use the $hasTaintFlow or $hasValueFlow comments within the test source files.
10+
* Example of the corresponding test file, e.g. Test.java
11+
* ```java
12+
* public class Test {
13+
*
14+
* Object source() { return null; }
15+
* String taint() { return null; }
16+
* void sink(Object o) { }
17+
*
18+
* public void test() {
19+
* Object s = source();
20+
* sink(s); //$hasValueFlow
21+
* String t = "foo" + taint();
22+
* sink(t); //$hasTaintFlow
23+
* }
24+
*
25+
* }
26+
* ```
27+
*
28+
* If you're not interested in a specific flow type, you can disable either value or taint flow expectations as follows:
29+
* ```ql
30+
* class HasFlowTest extends InlineFlowTest {
31+
* override DataFlow::Configuration getTaintFlowConfig() { none() }
32+
*
33+
* override DataFlow::Configuration getValueFlowConfig() { none() }
34+
* }
35+
* ```
36+
*
37+
* If you need more fine-grained tuning, consider implementing a test using `InlineExpectationsTest`.
38+
*/
39+
140
import semmle.code.java.dataflow.DataFlow
241
import semmle.code.java.dataflow.ExternalFlow
342
import semmle.code.java.dataflow.TaintTracking

0 commit comments

Comments
 (0)