Skip to content

Commit 201f64e

Browse files
hvitvedhvitved
authored
Merge pull request #367 from calumgrant/cs/path-problems
C#: Update all security queries to path-problems
2 parents e062851 + 3eae1cd commit 201f64e

File tree

62 files changed

+1106
-263
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

62 files changed

+1106
-263
lines changed

‎csharp/ql/src/Security Features/CWE-022/TaintedPath.ql‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
/**
22
* @name Uncontrolled data used in path expression
33
* @description Accessing paths influenced by users can allow an attacker to access unexpected resources.
4-
* @kind problem
4+
* @kind path-problem
55
* @problem.severity error
66
* @precision high
77
* @id cs/path-injection
@@ -14,7 +14,9 @@
1414
*/
1515
import csharp
1616
import semmle.code.csharp.security.dataflow.TaintedPath::TaintedPath
17+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1718

18-
from TaintTrackingConfiguration c, Source source, Sink sink
19-
where c.hasFlow(source, sink)
20-
select sink, "$@ flows to here and is used in a path.", source, "User-provided value"
19+
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
20+
where c.hasFlowPath(source, sink)
21+
select sink.getNode(), source, sink,
22+
"$@ flows to here and is used in a path.", source.getNode(), "User-provided value"

‎csharp/ql/src/Security Features/CWE-022/ZipSlip.ql‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description Extracting files from a malicious zip archive without validating that the
44
* destination file path is within the destination directory can cause files outside
55
* the destination directory to be overwritten.
6-
* @kind problem
6+
* @kind path-problem
77
* @id cs/zipslip
88
* @problem.severity error
99
* @precision high
@@ -13,7 +13,9 @@
1313

1414
import csharp
1515
import semmle.code.csharp.security.dataflow.ZipSlip::ZipSlip
16+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1617

17-
from TaintTrackingConfiguration zipTaintTracking, DataFlow::Node source, DataFlow::Node sink
18-
where zipTaintTracking.hasFlow(source, sink)
19-
select sink, "Unsanitized zip archive $@, which may contain '..', is used in a file system operation.", source, "item path"
18+
from TaintTrackingConfiguration zipTaintTracking, DataFlow::PathNode source, DataFlow::PathNode sink
19+
where zipTaintTracking.hasFlowPath(source, sink)
20+
select sink.getNode(), source, sink,
21+
"Unsanitized zip archive $@, which may contain '..', is used in a file system operation.", source.getNode(), "item path"

‎csharp/ql/src/Security Features/CWE-078/CommandInjection.ql‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name Uncontrolled command line
33
* @description Using externally controlled strings in a command line may allow a malicious
44
* user to change the meaning of the command.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity error
77
* @precision high
88
* @id cs/command-line-injection
@@ -14,7 +14,9 @@
1414

1515
import csharp
1616
import semmle.code.csharp.security.dataflow.CommandInjection::CommandInjection
17+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1718

18-
from TaintTrackingConfiguration c, Source source, Sink sink
19-
where c.hasFlow(source, sink)
20-
select sink, "$@ flows to here and is used in a command.", source, "User-provided value"
19+
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
20+
where c.hasFlowPath(source, sink)
21+
select sink.getNode(), source, sink,
22+
"$@ flows to here and is used in a command.", source.getNode(), "User-provided value"

‎csharp/ql/src/Security Features/CWE-078/StoredCommandInjection.ql‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name Uncontrolled command line from stored user input
33
* @description Using externally controlled strings in a command line may allow a malicious
44
* user to change the meaning of the command.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity error
77
* @precision medium
88
* @id cs/stored-command-line-injection
@@ -15,13 +15,15 @@
1515
import csharp
1616
import semmle.code.csharp.security.dataflow.flowsources.Stored
1717
import semmle.code.csharp.security.dataflow.CommandInjection::CommandInjection
18+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1819

1920
class StoredTaintTrackingConfiguration extends TaintTrackingConfiguration {
2021
override predicate isSource(DataFlow::Node source) {
2122
source instanceof StoredFlowSource
2223
}
2324
}
2425

25-
from StoredTaintTrackingConfiguration c, StoredFlowSource source, Sink sink
26-
where c.hasFlow(source, sink)
27-
select sink, "$@ flows to here and is used in a command.", source, "Stored user-provided value"
26+
from StoredTaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
27+
where c.hasFlowPath(source, sink)
28+
select sink.getNode(), source, sink,
29+
"$@ flows to here and is used in a command.", source.getNode(), "Stored user-provided value"

‎csharp/ql/src/Security Features/CWE-079/StoredXSS.ql‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name Stored cross-site scripting
33
* @description Writing input from the database directly to a web page indicates a cross-site
44
* scripting vulnerability if the data was originally user-provided.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity error
77
* @precision medium
88
* @id cs/web/stored-xss
@@ -13,17 +13,19 @@
1313
import csharp
1414
import semmle.code.csharp.security.dataflow.flowsources.Stored
1515
import semmle.code.csharp.security.dataflow.XSS::XSS
16+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1617

1718
class StoredTaintTrackingConfiguration extends TaintTrackingConfiguration {
1819
override predicate isSource(DataFlow::Node source) {
1920
source instanceof StoredFlowSource
2021
}
2122
}
2223

23-
from StoredTaintTrackingConfiguration c, StoredFlowSource source, Sink sink, string explanation
24-
where c.hasFlow(source, sink)
24+
from StoredTaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink, string explanation
25+
where c.hasFlowPath(source, sink)
2526
and
26-
if exists(sink.explanation())
27-
then explanation = ": " + sink.explanation() + "."
27+
if exists(sink.getNode().(Sink).explanation())
28+
then explanation = ": " + sink.getNode().(Sink).explanation() + "."
2829
else explanation = "."
29-
select sink, "$@ flows to here and is written to HTML or javascript" + explanation, source, "Stored user-provided value"
30+
select sink.getNode(), source, sink,
31+
"$@ flows to here and is written to HTML or JavaScript" + explanation, source.getNode(), "Stored user-provided value"

‎csharp/ql/src/Security Features/CWE-089/SecondOrderSqlInjection.ql‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name SQL query built from stored user-controlled sources
33
* @description Building a SQL query from stored user-controlled sources is vulnerable to insertion
44
* of malicious SQL code by the user.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity error
77
* @precision medium
88
* @id cs/second-order-sql-injection
@@ -13,13 +13,15 @@
1313
import csharp
1414
import semmle.code.csharp.security.dataflow.SqlInjection
1515
import semmle.code.csharp.security.dataflow.flowsources.Stored
16+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1617

1718
class StoredTaintTrackingConfiguration extends SqlInjection::TaintTrackingConfiguration {
1819
override predicate isSource(DataFlow::Node source) {
1920
source instanceof StoredFlowSource
2021
}
2122
}
2223

23-
from StoredTaintTrackingConfiguration c, DataFlow::Node source, DataFlow::Node sink
24-
where c.hasFlow(source, sink)
25-
select sink, "$@ flows to here and is used in an SQL query.", source, "Stored user-provided value"
24+
from StoredTaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
25+
where c.hasFlowPath(source, sink)
26+
select sink.getNode(), source, sink,
27+
"$@ flows to here and is used in an SQL query.", source.getNode(), "Stored user-provided value"

‎csharp/ql/src/Security Features/CWE-089/SqlInjection.ql‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name SQL query built from user-controlled sources
33
* @description Building a SQL query from user-controlled sources is vulnerable to insertion of
44
* malicious SQL code by the user.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity error
77
* @precision high
88
* @id cs/sql-injection
@@ -12,7 +12,9 @@
1212

1313
import csharp
1414
import semmle.code.csharp.security.dataflow.SqlInjection::SqlInjection
15+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1516

16-
from TaintTrackingConfiguration c, RemoteFlowSource source, Sink sink
17-
where c.hasFlow(source, sink)
18-
select sink, "Query might include code from $@.", source, ("this " + source.getSourceType())
17+
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
18+
where c.hasFlowPath(source, sink)
19+
select sink.getNode(), source, sink,
20+
"Query might include code from $@.", source, ("this " + source.getNode().(RemoteFlowSource).getSourceType())

‎csharp/ql/src/Security Features/CWE-090/LDAPInjection.ql‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name LDAP query built from user-controlled sources
33
* @description Building an LDAP query from user-controlled sources is vulnerable to insertion of
44
* malicious LDAP code by the user.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity error
77
* @precision high
88
* @id cs/ldap-injection
@@ -11,7 +11,9 @@
1111
*/
1212
import csharp
1313
import semmle.code.csharp.security.dataflow.LDAPInjection::LDAPInjection
14+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1415

15-
from TaintTrackingConfiguration c, Source source, Sink sink
16-
where c.hasFlow(source, sink)
17-
select sink, "$@ flows to here and is used in an LDAP query.", source, "User-provided value"
16+
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
17+
where c.hasFlowPath(source, sink)
18+
select sink.getNode(), source, sink,
19+
"$@ flows to here and is used in an LDAP query.", source.getNode(), "User-provided value"

‎csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.ql‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name LDAP query built from stored user-controlled sources
33
* @description Building an LDAP query from stored user-controlled sources is vulnerable to
44
* insertion of malicious LDAP code by the user.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity error
77
* @precision medium
88
* @id cs/stored-ldap-injection
@@ -12,13 +12,15 @@
1212
import csharp
1313
import semmle.code.csharp.security.dataflow.LDAPInjection::LDAPInjection
1414
import semmle.code.csharp.security.dataflow.flowsources.Stored
15+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1516

1617
class StoredTaintTrackingConfiguration extends TaintTrackingConfiguration {
1718
override predicate isSource(DataFlow::Node source) {
1819
source instanceof StoredFlowSource
1920
}
2021
}
2122

22-
from StoredTaintTrackingConfiguration c, StoredFlowSource source, Sink sink
23-
where c.hasFlow(source, sink)
24-
select sink, "$@ flows to here and is used in an LDAP query.", source, "Stored user-provided value"
23+
from StoredTaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
24+
where c.hasFlowPath(source, sink)
25+
select sink.getNode(), source, sink,
26+
"$@ flows to here and is used in an LDAP query.", source.getNode(), "Stored user-provided value"

‎csharp/ql/src/Security Features/CWE-094/CodeInjection.ql‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name Improper control of generation of code
33
* @description Treating externally controlled strings as code can allow an attacker to execute
44
* malicious code.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity error
77
* @precision high
88
* @id cs/code-injection
@@ -13,7 +13,9 @@
1313
*/
1414
import csharp
1515
import semmle.code.csharp.security.dataflow.CodeInjection::CodeInjection
16+
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph
1617

17-
from TaintTrackingConfiguration c, Source source, Sink sink
18-
where c.hasFlow(source, sink)
19-
select sink, "$@ flows to here and is compiled as code.", source, "User-provided value"
18+
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink
19+
where c.hasFlowPath(source, sink)
20+
select sink.getNode(), source, sink,
21+
"$@ flows to here and is compiled as code.", source.getNode(), "User-provided value"

0 commit comments

Comments
 (0)