@@ -92,3 +92,66 @@ func testMarshalState() {
9292
9393 sinkBytes (serialized .Buf )
9494}
95+
96+ func testTaintedSubmessageModern () {
97+ alert := & query.Query_Alert {}
98+ alert .Msg = getUntrustedString ()
99+
100+ query := & query.Query {}
101+ query .Alerts = append (query .Alerts , alert )
102+
103+ serialized , _ := proto .Marshal (query )
104+
105+ sinkBytes (serialized ) // BAD
106+ }
107+
108+ func testTaintedSubmessageInPlaceModern () {
109+ alert := & query.Query_Alert {}
110+
111+ query := & query.Query {}
112+ query .Alerts = append (query .Alerts , alert )
113+ query .Alerts [0 ].Msg = getUntrustedString ()
114+
115+ serialized , _ := proto .Marshal (query )
116+
117+ sinkBytes (serialized ) // BAD
118+ }
119+
120+ func testUnmarshalTaintedSubmessageModern () {
121+ untrustedSerialized := getUntrustedBytes ()
122+ query := & query.Query {}
123+ proto .Unmarshal (untrustedSerialized , query )
124+
125+ sinkString (query .Alerts [0 ].Msg ) // BAD
126+ }
127+
128+ // This test should be ok, but is flagged because writing taint to a field of a Message
129+ // taints the entire Message structure in our current implementation.
130+ func testFieldConflationFalsePositiveModern () {
131+ query := & query.Query {}
132+ query .Description = getUntrustedString ()
133+ sinkString (query .Id ) // OK (but incorrectly tainted)
134+ }
135+
136+ // This test should be ok, but it flagged because our current implementation doesn't notice
137+ // that the taint applied to `query` is overwritten.
138+ func testMessageReuseFalsePositiveModern () {
139+ query := & query.Query {}
140+ query .Description = getUntrustedString ()
141+ query .Description = "clean"
142+
143+ serialized , _ := proto .Marshal (query )
144+
145+ sinkBytes (serialized ) // OK (but incorrectly tainted)
146+ }
147+
148+ // This test should be flagged, but we don't notice tainting via an alias of a field.
149+ func testSubmessageAliasFalseNegativeModern () {
150+ query := & query.Query {}
151+ alias := & query .Description
152+ * alias = getUntrustedString ()
153+
154+ serialized , _ := proto .Marshal (query )
155+
156+ sinkBytes (serialized ) // BAD (but not noticed by our current implementation)
157+ }
0 commit comments