Adding InlineExpectationsTests to Powershell

powershell/ql/lib/utils/test/InlineExpectationsTest.qll

@@ -0,0 +1,8 @@
+/**
+ * Inline expectation tests for Powershell.
+ * See `shared/util/codeql/util/test/InlineExpectationsTest.qll`
+ */
+
+private import codeql.util.test.InlineExpectationsTest
+private import internal.InlineExpectationsTestImpl
+import Make<Impl>

powershell/ql/lib/utils/test/InlineExpectationsTestQuery.ql

@@ -0,0 +1,21 @@
+/**
+ * @kind test-postprocess
+ */
+
+private import powershell
+private import codeql.util.test.InlineExpectationsTest as T
+private import internal.InlineExpectationsTestImpl
+import T::TestPostProcessing
+import T::TestPostProcessing::Make<Impl, Input>
+
+private module Input implements T::TestPostProcessing::InputSig<Impl> {
+  string getRelativeUrl(Location location) {
+    exists(File f, int startline, int startcolumn, int endline, int endcolumn |
+      location.hasLocationInfo(_, startline, startcolumn, endline, endcolumn) and
+      f = location.getFile()
+    |
+      result =
+        f.getRelativePath() + ":" + startline + ":" + startcolumn + ":" + endline + ":" + endcolumn
+    )
+  }
+}

powershell/ql/lib/utils/test/internal/InlineExpectationsTestImpl.qll

@@ -0,0 +1,13 @@
+private import powershell as P
+private import codeql.util.test.InlineExpectationsTest
+
+module Impl implements InlineExpectationsTestSig {
+  /**
+   * A class representing line comments in Powershell.
+   */
+  class ExpectationComment extends P::SingleLineComment {
+    string getContents() { result = this.getCommentContents().getValue().suffix(1) }
+  }
+
+  class Location = P::Location;
+}

powershell/ql/test/query-tests/security/ConvertToSecureStringAsPlainText/ConvertToSecureStringAsPlainText.qlref

@@ -1 +1,2 @@
-experimental/ConvertToSecureStringAsPlainText.ql
+query: experimental/ConvertToSecureStringAsPlainText.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

powershell/ql/test/query-tests/security/ConvertToSecureStringAsPlainText/test.ps1

@@ -1,4 +1,4 @@
 $UserInput = Read-Host 'Please enter your secure code'
-$EncryptedInput = ConvertTo-SecureString -String $UserInput -AsPlainText -Force
+$EncryptedInput = ConvertTo-SecureString -String $UserInput -AsPlainText -Force # $ Alert
 
 $SecureUserInput = Read-Host 'Please enter your secure code' -AsSecureString

powershell/ql/test/query-tests/security/HardcodedComputerName/HardcodedComputerName.qlref

@@ -1 +1,2 @@
-experimental/HardcodedComputerName.ql
+query: experimental/HardcodedComputerName.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

powershell/ql/test/query-tests/security/HardcodedComputerName/test.ps1

@@ -1,6 +1,6 @@
 Function Invoke-MyRemoteCommand ()
 {
-    Invoke-Command -Port 343 -ComputerName hardcoderemotehostname
+    Invoke-Command -Port 343 -ComputerName hardcoderemotehostname # $ Alert
 }
 
 Function Invoke-MyCommand ($ComputerName)
@@ -10,7 +10,7 @@ Function Invoke-MyCommand ($ComputerName)
 
 Function Invoke-MyLocalCommand ()
 {
-    Invoke-Command -Port 343 -ComputerName hardcodelocalhostname
+    Invoke-Command -Port 343 -ComputerName hardcodelocalhostname # $ Alert
 }
 
 Function Invoke-MyLocalCommand ()

powershell/ql/test/query-tests/security/UseOfReservedCmdletChar/UseOfReservedCmdletChar.qlref

@@ -1 +1,2 @@
-experimental/UseOfReservedCmdletChar.ql
+query: experimental/UseOfReservedCmdletChar.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

powershell/ql/test/query-tests/security/UseOfReservedCmdletChar/test.ps1

@@ -1,2 +1,2 @@
 function MyFunction[1]
-{...}
+{...} # $ Alert Alert

powershell/ql/test/query-tests/security/UsernameOrPasswordParameter/UsernameOrPasswordParameter.qlref

@@ -1 +1,2 @@
-experimental/UsernameOrPasswordParameter.ql
+query: experimental/UsernameOrPasswordParameter.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

powershell/ql/test/query-tests/security/UsernameOrPasswordParameter/test.ps1

@@ -4,8 +4,8 @@ function Test-Script
     Param
     (
         [String]
-        $Username,
+        $Username, # $ Alert
         [SecureString]
-        $Password
+        $Password # $ Alert
     )
 }

powershell/ql/test/query-tests/security/cwe-022/test.ps1

@@ -3,27 +3,27 @@ Add-Type -AssemblyName System.IO.Compression.FileSystem
 $zip = [System.IO.Compression.ZipFile]::OpenRead("MyPath\to\archive.zip")
 
 foreach ($entry in $zip.Entries) {
-    $targetPath = Join-Path $extractPath $entry.FullName
+    $targetPath = Join-Path $extractPath $entry.FullName # $ Alert
     $fullTargetPath = [System.IO.Path]::GetFullPath($targetPath)
 
-    [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $fullTargetPath) # BAD
+    [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $fullTargetPath) # $ Sink
 }
 
 foreach ($entry in $zip.Entries) {
-    $targetPath = Join-Path $extractPath $entry.FullName
+    $targetPath = Join-Path $extractPath $entry.FullName # $ Alert
     $fullTargetPath = [System.IO.Path]::GetFullPath($targetPath)
 
-    $stream = [System.IO.File]::Open($fullTargetPath, 'Create') # BAD
+    $stream = [System.IO.File]::Open($fullTargetPath, 'Create') # $ Sink
     $entry.Open().CopyTo($stream)
     $stream.Close()
 }
 
 foreach ($entry in $zip.Entries) {
-    $targetPath = Join-Path $extractPath $entry.FullName
+    $targetPath = Join-Path $extractPath $entry.FullName # $ Alert
     $fullTargetPath = [System.IO.Path]::GetFullPath($targetPath)
 
     $extractRoot = [System.IO.Path]::GetFullPath($extractPath)
     if ($fullTargetPath.StartsWith($extractRoot)) {
-        [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $fullTargetPath) # GOOD [FALSE POSITIVE]
+        [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $fullTargetPath) # $ Sink
     }
 }

powershell/ql/test/query-tests/security/cwe-022/zipslip.qlref

@@ -1 +1,2 @@
-queries/security/cwe-022/ZipSlip.ql
+query: queries/security/cwe-022/ZipSlip.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

powershell/ql/test/query-tests/security/cwe-078/CommandInjection/CommandInjection.qlref

@@ -1 +1,2 @@
-queries/security/cwe-078/CommandInjection.ql
+query: queries/security/cwe-078/CommandInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

powershell/ql/test/query-tests/security/cwe-078/CommandInjection/test.ps1

@@ -1,51 +1,51 @@
 function Invoke-InvokeExpressionInjection1
 {
     param($UserInput)
-    Invoke-Expression "Get-Process -Name $UserInput" # BAD
+    Invoke-Expression "Get-Process -Name $UserInput" # $ Alert
 }
 
 function Invoke-InvokeExpressionInjection2
 {
     param($UserInput)
-    iex "Get-Process -Name $UserInput" # BAD
+    iex "Get-Process -Name $UserInput" # $ Alert
 }
 
 function Invoke-InvokeExpressionInjection3
 {
     param($UserInput)
-    $executionContext.InvokeCommand.InvokeScript("Get-Process -Name $UserInput") # BAD
+    $executionContext.InvokeCommand.InvokeScript("Get-Process -Name $UserInput") # $ Alert
 }
 
 function Invoke-InvokeExpressionInjection4
 {
     param($UserInput)
-    $host.Runspace.CreateNestedPipeline("Get-Process -Name $UserInput", $false).Invoke() # BAD
+    $host.Runspace.CreateNestedPipeline("Get-Process -Name $UserInput", $false).Invoke() # $ Alert
 }
 
 function Invoke-InvokeExpressionInjection5
 {
     param($UserInput)
-    [PowerShell]::Create().AddScript("Get-Process -Name $UserInput").Invoke() # BAD
+    [PowerShell]::Create().AddScript("Get-Process -Name $UserInput").Invoke() # $ Alert
 }
 
 function Invoke-InvokeExpressionInjection6
 {
     param($UserInput)
-    Add-Type "public class Foo { $UserInput }" # BAD
+    Add-Type "public class Foo { $UserInput }" # $ Alert
 }
 
 function Invoke-InvokeExpressionInjection7
 {
     param($UserInput)
-    Add-Type -TypeDefinition "public class Foo { $UserInput }" # BAD
+    Add-Type -TypeDefinition "public class Foo { $UserInput }" # $ Alert
 }
 
 function Invoke-InvokeExpressionInjection8
 {
     param($UserInput)
 
     $code = "public class Foo { $UserInput }"
-    Add-Type -TypeDefinition $code # BAD
+    Add-Type -TypeDefinition $code # $ Alert
 }
 
 function Invoke-InvokeExpressionInjectionFP
@@ -72,21 +72,21 @@ function Invoke-ExploitableCommandInjection1
 {
     param($UserInput)
 
-    powershell -command "Get-Process -Name $UserInput" # BAD
+    powershell -command "Get-Process -Name $UserInput" # $ Alert
 }
 
 function Invoke-ExploitableCommandInjection2
 {
     param($UserInput)
 
-    powershell "Get-Process -Name $UserInput" # BAD
+    powershell "Get-Process -Name $UserInput" # $ Alert
 }
 
 function Invoke-ExploitableCommandInjection3
 {
     param($UserInput)
 
-    cmd /c "ping $UserInput" # BAD
+    cmd /c "ping $UserInput" # $ Alert
 }
 
 function Invoke-ScriptBlockInjection1
@@ -95,7 +95,7 @@ function Invoke-ScriptBlockInjection1
 
     ## Often used when making remote connections
 
-    $sb = [ScriptBlock]::Create("Get-Process -Name $UserInput") # BAD
+    $sb = [ScriptBlock]::Create("Get-Process -Name $UserInput") # $ Alert
     Invoke-Command RemoteServer $sb
 }
 
@@ -105,63 +105,63 @@ function Invoke-ScriptBlockInjection2
 
     ## Often used when making remote connections
 
-    $sb = $executionContext.InvokeCommand.NewScriptBlock("Get-Process -Name $UserInput") # BAD
+    $sb = $executionContext.InvokeCommand.NewScriptBlock("Get-Process -Name $UserInput") # $ Alert
     Invoke-Command RemoteServer $sb
 }
 
 function Invoke-MethodInjection1
 {
     param($UserInput)
 
-    Get-Process | Foreach-Object $UserInput # BAD
+    Get-Process | Foreach-Object $UserInput # $ Alert
 }
 
 function Invoke-MethodInjection2
 {
     param($UserInput)
 
-    (Get-Process -Id $pid).$UserInput() # BAD
+    (Get-Process -Id $pid).$UserInput() # $ Alert
 }
 
 
 function Invoke-MethodInjection3
 {
     param($UserInput)
 
-    (Get-Process -Id $pid).$UserInput.Invoke() # BAD
+    (Get-Process -Id $pid).$UserInput.Invoke() # $ Alert
 }
 
 function Invoke-ExpandStringInjection1
 {
     param($UserInput)
 
     ## Used to attempt a variable resolution
-    $executionContext.InvokeCommand.ExpandString($UserInput) # BAD
+    $executionContext.InvokeCommand.ExpandString($UserInput) # $ Alert
 }
 
 function Invoke-ExpandStringInjection2
 {
     param($UserInput)
 
     ## Used to attempt a variable resolution
-    $executionContext.SessionState.InvokeCommand.ExpandString($UserInput) # BAD
+    $executionContext.SessionState.InvokeCommand.ExpandString($UserInput) # $ Alert
 }
 
 function Invoke-InvokeExpressionInjectionCmdletBinding
 {
     [CmdletBinding()]
     param($UserInput)
-    Invoke-Expression "Get-Process -Name $UserInput" # BAD
+    Invoke-Expression "Get-Process -Name $UserInput" # $ Alert
 }
 
 function Invoke-StartProcessInjection
 {
     param($UserInput)
-    Start-Process -FilePath $UserInput # BAD
+    Start-Process -FilePath $UserInput # $ Alert
 }
 
 
-$input = Read-Host "enter input"
+$input = Read-Host "enter input" # $ Source
 
 Invoke-InvokeExpressionInjection1 -UserInput $input  
 Invoke-InvokeExpressionInjection2 -UserInput $input  
@@ -251,20 +251,20 @@ Invoke-InvokeExpressionInjectionSafe5 -UserInput $input
 
 function false-positive-in-call-operator($d)
 {
-    $o = Read-Host "enter input"
+    $o = Read-Host "enter input" # $ Source
     & unzip -o "$o" -d $d # GOOD
 
-    . "$o" # BAD
+    . "$o" # $ Alert
 }
 
 function flow-through-env-var() {
     $x = $env:foo
 
     . "$x" # GOOD # we don't consider environment vars flow sources
 
-    $input = Read-Host "enter input"
+    $input = Read-Host "enter input" # $ Source
     $env:bar = $input
 
     $y = $env:bar
-    . "$y" # BAD # but we have flow through them
+    . "$y" # $ Alert # but we have flow through them
 }

powershell/ql/test/query-tests/security/cwe-078/DoNotUseInvokeExpression/DoNotUseInvokeExpression.qlref

@@ -1 +1,2 @@
-queries/security/cwe-078/DoNotUseInvokeExpression.ql
+query: queries/security/cwe-078/DoNotUseInvokeExpression.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql

powershell/ql/test/query-tests/security/cwe-078/DoNotUseInvokeExpression/test.ps1

@@ -1,2 +1,2 @@
 $command = "Get-Process"
-Invoke-Expression $Command
+Invoke-Expression $Command # $ Alert

powershell/ql/test/query-tests/security/cwe-089/SqlInjection.qlref

@@ -1 +1,2 @@
-queries/security/cwe-089/SqlInjection.ql
+query: queries/security/cwe-089/SqlInjection.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql