Add test_004 integration test (ensure single-line and minimum are working)

Add test_004. This tests options that are often used when sending
flawfinder output to other tools.  In this case,
we test -m, -S, -D, -C, and --quiet.

This also begins a convention change, to name tests e.g., "test_001".
This ensures that the tests sort reasonably without special options.

Signed-off-by: David A. Wheeler <dwheeler@dwheeler.com>
This commit is contained in:
David A. Wheeler 2017-08-26 11:15:51 -04:00
parent 62c1db1141
commit 64c8f8dcbb
2 changed files with 21 additions and 7 deletions

7
correct-results-004.txt Normal file
View File

@ -0,0 +1,7 @@
test.c:32:2: [5] (buffer) gets:Does not check for buffer overflows (CWE-120, CWE-20). Use fgets() instead.
test.c:56:3: [5] (buffer) strncat:Easily used incorrectly (e.g., incorrectly computing the correct maximum size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, snprintf, or automatically resizing strings. Risk is high; the length parameter appears to be a constant, instead of computing the number of characters left.
test.c:57:3: [5] (buffer) _tcsncat:Easily used incorrectly (e.g., incorrectly computing the correct maximum size to add) [MS-banned] (CWE-120). Consider strcat_s, strlcat, or automatically resizing strings. Risk is high; the length parameter appears to be a constant, instead of computing the number of characters left.
test.c:60:3: [5] (buffer) MultiByteToWideChar:Requires maximum length in CHARACTERS, not bytes (CWE-120). Risk is high, it appears that the size is given as bytes, but the function requires size as characters.
test.c:62:3: [5] (buffer) MultiByteToWideChar:Requires maximum length in CHARACTERS, not bytes (CWE-120). Risk is high, it appears that the size is given as bytes, but the function requires size as characters.
test.c:73:3: [5] (misc) SetSecurityDescriptorDacl:Never create NULL ACLs; an attacker can set it to Everyone (Deny All Access), which would even forbid administrator access (CWE-732).
test.c:73:3: [5] (misc) SetSecurityDescriptorDacl:Never create NULL ACLs; an attacker can set it to Everyone (Deny All Access), which would even forbid administrator access (CWE-732).

View File

@ -125,8 +125,8 @@ time:
echo "Lines examined:"
wc -l $(SAMPLE_DIR)/*/*.[ch] | tail -2
test_1: flawfinder test.c test2.c
@echo 'test_1'
test_001: flawfinder test.c test2.c
@echo 'test_001 (text output)'
@# Omit time report so that results are always the same textually.
@$(PYTHON) ./flawfinder --omittime test.c test2.c > test-results.txt
@echo >> test-results.txt
@ -135,20 +135,26 @@ test_1: flawfinder test.c test2.c
grep 'Lines analyzed' >> test-results.txt
@diff -u correct-results.txt test-results.txt
test_2: flawfinder test.c test2.c
@echo 'test_2'
test_002: flawfinder test.c test2.c
@echo 'test_002 (HTML output)'
@$(PYTHON) ./flawfinder --omittime --html --context test.c test2.c > test-results.html
@diff -u correct-results.html test-results.html
test_3: flawfinder test.c test2.c
@echo 'test_3'
test_003: flawfinder test.c test2.c
@echo 'test_003 (CSV output)'
@$(PYTHON) ./flawfinder --csv test.c test2.c > test-results.csv
@diff -u correct-results.csv test-results.csv
test_004: flawfinder test.c
@echo 'test_004 (single-line)'
@$(PYTHON) ./flawfinder -m 5 -S -DC --quiet test.c > \
test-results-004.txt
@diff -u correct-results-004.txt test-results-004.txt
# Run all tests; output shows differences from expected results.
# If everything works as expected, it just prints test numbers.
# Set PYTHON as needed, including to ""
test: test_1 test_2 test_3
test: test_001 test_002 test_003 test_004
check: test
@ -157,6 +163,7 @@ test-is-correct: test-results.txt
mv test-results.txt correct-results.txt
mv test-results.html correct-results.html
mv test-results.csv correct-results.csv
mv test-results-004.txt correct-results-004.txt
profile:
/usr/lib/python1.5/profile.py ./flawfinder > profile-results $(SAMPLE_DIR)/*/*.[ch] > profile-results