diff --git a/.codeqlmanifest.json b/.codeqlmanifest.json index 7a76f3a..6e70fe8 100644 --- a/.codeqlmanifest.json +++ b/.codeqlmanifest.json @@ -1,6 +1,7 @@ { "provide": [ "ql/src/qlpack.yml", + "ql/test/qlpack.yml", "extractor/codeql-extractor.yml" ], "ignore": [ diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml index c9c5a40..7835965 100644 --- a/.github/workflows/continuous-integration.yml +++ b/.github/workflows/continuous-integration.yml @@ -87,6 +87,12 @@ jobs: run: | bundle exec rake spec:ci + - name: Run CodeQL Tests + working-directory: ./codeql-ruby + run: | + bundle exec rake install + $GITHUB_WORKSPACE/codeql/codeql test run -vvvvv ql/test + # - name: Setup tmate session # uses: mxschmitt/action-tmate@v2 diff --git a/.gitignore b/.gitignore index ca14ba2..dca2a60 100644 --- a/.gitignore +++ b/.gitignore @@ -11,6 +11,9 @@ # rspec failure tracking .rspec_status +# CodeQL test runner databases +*.testproj + .cache/ TODOS.md diff --git a/extractor/codeql-extractor.yml b/extractor/codeql-extractor.yml index a52bba6..1d3ab21 100644 --- a/extractor/codeql-extractor.yml +++ b/extractor/codeql-extractor.yml @@ -8,4 +8,4 @@ file_types: display_name: Ruby extensions: - .rb -legacy_qltest_extraction: false +legacy_qltest_extraction: true diff --git a/extractor/tools/index.sh b/extractor/tools/index.sh new file mode 100755 index 0000000..d0ecab2 --- /dev/null +++ b/extractor/tools/index.sh @@ -0,0 +1,15 @@ +#!/bin/sh + +#################################################################################### +# +# Required for running `codeql test run my/test/dir` +# when legacy_qltest_extraction is set to true in ruby/codeql-extractor.yml +# +# +# FIXME: figure out what "non-legacy" test extraction looks like and how it works +# +#################################################################################### + +set -eu + +codeql_ruby $@ diff --git a/ql/test/base_unsafe_script/example.expected b/ql/test/base_unsafe_script/example.expected new file mode 100644 index 0000000..9fb3375 --- /dev/null +++ b/ql/test/base_unsafe_script/example.expected @@ -0,0 +1,3 @@ +| 1 | This is a leaf node. | +| ARGV | This is a leaf node. | +| eval | This is a leaf node. | diff --git a/spec/base_unsafe_script/example.ql b/ql/test/base_unsafe_script/example.ql similarity index 100% rename from spec/base_unsafe_script/example.ql rename to ql/test/base_unsafe_script/example.ql diff --git a/spec/base_unsafe_script/unsafe_command.rb b/ql/test/base_unsafe_script/unsafe_command.rb similarity index 100% rename from spec/base_unsafe_script/unsafe_command.rb rename to ql/test/base_unsafe_script/unsafe_command.rb diff --git a/ql/test/leaf_node_location/example.expected b/ql/test/leaf_node_location/example.expected new file mode 100644 index 0000000..e871bb8 --- /dev/null +++ b/ql/test/leaf_node_location/example.expected @@ -0,0 +1,4 @@ +| leaf_node_location.rb:1:0:1:4 | LeafNode | puts | leaf_node_location.rb:1 | +| leaf_node_location.rb:1:0:1:4 | LeafNode | puts | leaf_node_location.rb:1 | +| leaf_node_location.rb:1:6:1:40 | LeafNode | this file contains some leaf nodes | leaf_node_location.rb:1 | +| leaf_node_location.rb:1:6:1:40 | LeafNode | this file contains some leaf nodes | leaf_node_location.rb:1 | diff --git a/spec/leaf_node_location/example.ql b/ql/test/leaf_node_location/example.ql similarity index 100% rename from spec/leaf_node_location/example.ql rename to ql/test/leaf_node_location/example.ql diff --git a/spec/leaf_node_location/leaf_node_location.rb b/ql/test/leaf_node_location/leaf_node_location.rb similarity index 100% rename from spec/leaf_node_location/leaf_node_location.rb rename to ql/test/leaf_node_location/leaf_node_location.rb diff --git a/ql/test/qlpack.yml b/ql/test/qlpack.yml new file mode 100644 index 0000000..b47ea53 --- /dev/null +++ b/ql/test/qlpack.yml @@ -0,0 +1,5 @@ +name: codeql-ruby-tests +version: 0.0.0 +libraryPathDependencies: + - codeql-ruby +extractor: ruby diff --git a/ql/test/script_with_require/example.expected b/ql/test/script_with_require/example.expected new file mode 100644 index 0000000..ae60544 --- /dev/null +++ b/ql/test/script_with_require/example.expected @@ -0,0 +1,14 @@ +| . | This is a leaf node. | +| ./required_file | This is a leaf node. | +| @fullpath | This is a leaf node. | +| File | This is a leaf node. | +| RequiredFile | This is a leaf node. | +| __FILE__ | This is a leaf node. | +| attr_reader | This is a leaf node. | +| expand_path | This is a leaf node. | +| fullpath | This is a leaf node. | +| initialize | This is a leaf node. | +| new | This is a leaf node. | +| puts | This is a leaf node. | +| require_relative | This is a leaf node. | +| rf | This is a leaf node. | diff --git a/spec/script_with_require/example.ql b/ql/test/script_with_require/example.ql similarity index 100% rename from spec/script_with_require/example.ql rename to ql/test/script_with_require/example.ql diff --git a/spec/script_with_require/required_file.rb b/ql/test/script_with_require/required_file.rb similarity index 100% rename from spec/script_with_require/required_file.rb rename to ql/test/script_with_require/required_file.rb diff --git a/spec/script_with_require/script_with_require.rb b/ql/test/script_with_require/script_with_require.rb similarity index 100% rename from spec/script_with_require/script_with_require.rb rename to ql/test/script_with_require/script_with_require.rb diff --git a/spec/base_unsafe_script/qlpack.yml b/spec/base_unsafe_script/qlpack.yml deleted file mode 100644 index f918ed8..0000000 --- a/spec/base_unsafe_script/qlpack.yml +++ /dev/null @@ -1,3 +0,0 @@ -name: base-unsafe-script-ruby-queries -version: 0.0.0 -libraryPathDependencies: codeql-ruby diff --git a/spec/codeql_ruby_spec.rb b/spec/codeql_ruby_spec.rb index 4333f25..121241c 100644 --- a/spec/codeql_ruby_spec.rb +++ b/spec/codeql_ruby_spec.rb @@ -5,32 +5,11 @@ expect(CodeqlRuby::VERSION).not_to be nil end - it "extracts a db, runs a query, and generates JSON results" do - results = CodeqlRunner.results_for_db('base_unsafe_script') - tuples = results.dig('#select', 'tuples') - - expect(tuples).to include(['eval', 'This is a leaf node.']) - end - - it "extracts a directory as a db and queries it" do - results = CodeqlRunner.results_for_db('script_with_require') - tuples = results.dig('#select', 'tuples') - - expect(tuples).to include(['RequiredFile', 'This is a leaf node.']) - end - it "extracts a file to relevant trap structures" do - filepath = File.expand_path(File.join(File.dirname(__FILE__), 'script_with_require', 'script_with_require.rb')) + filepath = File.expand_path(File.join(File.dirname(__FILE__), '..', 'ql', 'test', 'script_with_require', 'script_with_require.rb')) ef = CodeqlRuby::ExtractorFile.new(filepath) results = ef.to_trap expect(results).to be_a(String) end - - it "extracts Location info from LeafNodes" do - results = CodeqlRunner.results_for_db('leaf_node_location') - tuples = results.dig('#select', 'tuples') - - expect(tuples).to include([{'label'=>'LeafNode'}, 'puts', 'leaf_node_location.rb:1']) - end end diff --git a/spec/leaf_node_location/qlpack.yml b/spec/leaf_node_location/qlpack.yml deleted file mode 100644 index d18b613..0000000 --- a/spec/leaf_node_location/qlpack.yml +++ /dev/null @@ -1,3 +0,0 @@ -name: leaf-node-location-ruby-queries -version: 0.0.0 -libraryPathDependencies: codeql-ruby diff --git a/spec/script_with_require/qlpack.yml b/spec/script_with_require/qlpack.yml deleted file mode 100644 index a40d8a2..0000000 --- a/spec/script_with_require/qlpack.yml +++ /dev/null @@ -1,3 +0,0 @@ -name: ruby-script-with-require -version: 0.0.0 -libraryPathDependencies: codeql-ruby