Skip to content

Commit 3de1f3b

Browse files
calumgrantcalumgrant
committed
C#: Query and qltest for VulnerablePackage.
1 parent 0ddb702 commit 3de1f3b

File tree

8 files changed

+437
-0
lines changed

8 files changed

+437
-0
lines changed

‎csharp/ql/src/Security Features/CWE-937/Vulnerabilities.qll‎

Lines changed: 291 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
/**
2+
* A list of NuGet packages with known vulnerabilities.
3+
*
4+
* To add a new vulnerability follow the existing pattern.
5+
* Create a new class that extends the abstract class `Vulnerability`,
6+
* supplying the name and the URL, and override one (or both) of
7+
* `matchesRange` and `matchesVersion`.
8+
*/
9+
10+
import csharp
11+
import Vulnerability
12+
13+
class MicrosoftAdvisory4021279 extends Vulnerability {
14+
15+
MicrosoftAdvisory4021279() { this = "Microsoft Security Advisory 4021279" }
16+
17+
override string getUrl() { result = "https://github.com/dotnet/corefx/issues/19535" }
18+
19+
override predicate matchesRange(string name, Version affected, Version fixed) {
20+
name = "System.Text.Encodings.Web" and (
21+
affected = "4.0.0" and fixed = "4.0.1"
22+
or
23+
affected = "4.3.0" and fixed = "4.3.1"
24+
) or
25+
name = "System.Net.Http" and (
26+
affected = "4.1.1" and fixed = "4.1.2"
27+
or
28+
affected = "4.3.1" and fixed = "4.3.2"
29+
) or
30+
name = "System.Net.Http.WinHttpHandler" and (
31+
affected = "4.0.1" and fixed = "4.0.2"
32+
or
33+
affected = "4.3.0" and fixed = "4.3.1"
34+
) or
35+
name = "System.Net.Security" and (
36+
affected = "4.0.0" and fixed = "4.0.1"
37+
or
38+
affected = "4.3.0" and fixed = "4.3.1"
39+
) or (
40+
name = "Microsoft.AspNetCore.Mvc"
41+
or
42+
name = "Microsoft.AspNetCore.Mvc.Core"
43+
or
44+
name = "Microsoft.AspNetCore.Mvc.Abstractions"
45+
or
46+
name = "Microsoft.AspNetCore.Mvc.ApiExplorer"
47+
or
48+
name = "Microsoft.AspNetCore.Mvc.Cors"
49+
or
50+
name = "Microsoft.AspNetCore.Mvc.DataAnnotations"
51+
or
52+
name = "Microsoft.AspNetCore.Mvc.Formatters.Json"
53+
or
54+
name = "Microsoft.AspNetCore.Mvc.Formatters.Xml"
55+
or
56+
name = "Microsoft.AspNetCore.Mvc.Localization"
57+
or
58+
name = "Microsoft.AspNetCore.Mvc.Razor.Host"
59+
or
60+
name = "Microsoft.AspNetCore.Mvc.Razor"
61+
or
62+
name = "Microsoft.AspNetCore.Mvc.TagHelpers"
63+
or
64+
name = "Microsoft.AspNetCore.Mvc.ViewFeatures"
65+
or
66+
name = "Microsoft.AspNetCore.Mvc.WebApiCompatShim"
67+
) and (
68+
affected = "1.0.0" and fixed = "1.0.4"
69+
or
70+
affected = "1.1.0" and fixed = "1.1.3"
71+
)
72+
}
73+
}
74+
75+
class CVE_2017_8700 extends Vulnerability {
76+
CVE_2017_8700() { this = "CVE-2017-8700" }
77+
78+
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/279" }
79+
80+
override predicate matchesRange(string name, Version affected, Version fixed) {
81+
(
82+
name = "Microsoft.AspNetCore.Mvc.Core"
83+
or
84+
name = "Microsoft.AspNetCore.Mvc.Cors"
85+
) and (
86+
affected = "1.0.0" and fixed = "1.0.6"
87+
or
88+
affected = "1.1.0" and fixed = "1.1.6"
89+
)
90+
}
91+
}
92+
93+
class CVE_2018_0765 extends Vulnerability {
94+
CVE_2018_0765() { this = "CVE-2018-0765" }
95+
96+
override string getUrl() { result = "https://github.com/dotnet/announcements/issues/67" }
97+
98+
override predicate matchesRange(string name, Version affected, Version fixed) {
99+
name = "System.Security.Cryptography.Xml" and
100+
affected = "0.0.0" and
101+
fixed = "4.4.2"
102+
}
103+
}
104+
105+
class AspNetCore_Mar18 extends Vulnerability {
106+
AspNetCore_Mar18() { this = "ASPNETCore-Mar18" }
107+
108+
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/300" }
109+
110+
override predicate matchesRange(string name, Version affected, Version fixed) {
111+
(
112+
name = "Microsoft.AspNetCore.Server.Kestrel.Core"
113+
or
114+
name = "Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions"
115+
or
116+
name = "Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv"
117+
or
118+
name = "Microsoft.AspNetCore.All"
119+
) and
120+
affected = "2.0.0" and
121+
fixed = "2.0.3"
122+
}
123+
}
124+
125+
class CVE_2018_8409 extends Vulnerability {
126+
CVE_2018_8409() { this = "CVE-2018-8409" }
127+
128+
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/316" }
129+
130+
override predicate matchesRange(string name, Version affected, Version fixed) {
131+
name = "System.IO.Pipelines" and affected = "4.5.0" and fixed = "4.5.1"
132+
or
133+
(name = "Microsoft.AspNetCore.All" or name = "Microsoft.AspNetCore.App") and
134+
affected = "2.1.0" and fixed = "2.1.4"
135+
}
136+
}
137+
138+
class CVE_2018_8171 extends Vulnerability {
139+
CVE_2018_8171() { this = "CVE-2018-8171" }
140+
141+
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/310" }
142+
143+
override predicate matchesRange(string name, Version affected, Version fixed) {
144+
name = "Microsoft.AspNetCore.Identity" and (
145+
affected = "1.0.0" and fixed = "1.0.6"
146+
or
147+
affected = "1.1.0" and fixed = "1.1.6"
148+
or
149+
affected = "2.0.0" and fixed = "2.0.4"
150+
or
151+
affected = "2.1.0" and fixed = "2.1.2"
152+
)
153+
}
154+
}
155+
156+
class CVE_2018_8356 extends Vulnerability {
157+
CVE_2018_8356() { this = "CVE-2018-8356" }
158+
159+
override string getUrl() { result = "https://github.com/dotnet/announcements/issues/73" }
160+
161+
override predicate matchesRange(string name, Version affected, Version fixed) {
162+
(
163+
name = "System.Private.ServiceModel"
164+
or
165+
name = "System.ServiceModel.Http"
166+
or
167+
name = "System.ServiceModel.NetTcp"
168+
) and (
169+
affected = "4.0.0" and fixed = "4.1.3"
170+
or
171+
affected = "4.3.0" and fixed = "4.3.3"
172+
or
173+
affected = "4.4.0" and fixed = "4.4.4"
174+
or
175+
affected = "4.5.0" and fixed = "4.5.3"
176+
)
177+
or
178+
(
179+
name = "System.ServiceModel.Duplex"
180+
or
181+
name = "System.ServiceModel.Security"
182+
) and (
183+
affected = "4.0.0" and fixed = "4.0.4"
184+
or
185+
affected = "4.3.0" and fixed = "4.3.3"
186+
or
187+
affected = "4.4.0" and fixed = "4.4.4"
188+
or
189+
affected = "4.5.0" and fixed = "4.5.3"
190+
)
191+
or
192+
name = "System.ServiceModel.NetTcp" and (
193+
affected = "4.0.0" and fixed = "4.1.3"
194+
or
195+
affected = "4.3.0" and fixed = "4.3.3"
196+
or
197+
affected = "4.4.0" and fixed = "4.4.4"
198+
or
199+
affected = "4.5.0" and fixed = "4.5.1"
200+
)
201+
}
202+
}
203+
204+
class ASPNETCore_Jul18 extends Vulnerability {
205+
ASPNETCore_Jul18() { this = "ASPNETCore-July18" }
206+
207+
override string getUrl() { result = "https://github.com/aspnet/Announcements/issues/311" }
208+
209+
override predicate matchesRange(string name, Version affected, Version fixed) {
210+
name = "Microsoft.AspNetCore.Server.Kestrel.Core" and (
211+
affected = "2.0.0" and fixed = "2.0.4"
212+
or
213+
affected = "2.1.0" and fixed = "2.1.2"
214+
)
215+
or
216+
name = "Microsoft.AspNetCore.All" and (
217+
affected = "2.0.0" and fixed = "2.0.9"
218+
or
219+
affected = "2.1.0" and fixed = "2.1.2"
220+
)
221+
or
222+
name = "Microsoft.AspNetCore.App" and
223+
affected = "2.1.0" and
224+
fixed = "2.1.2"
225+
}
226+
}
227+
228+
class CVE_2018_8292 extends Vulnerability {
229+
CVE_2018_8292() { this = "CVE-2018-8292" }
230+
231+
override string getUrl() { result = "https://github.com/dotnet/announcements/issues/88" }
232+
233+
override predicate matchesVersion(string name, Version affected, Version fixed) {
234+
name = "System.Net.Http" and (
235+
affected = "2.0" or
236+
affected = "4.0.0" or
237+
affected = "4.1.0" or
238+
affected = "1.1.1" or
239+
affected = "4.1.2" or
240+
affected = "4.3.0" or
241+
affected = "4.3.1" or
242+
affected = "4.3.2" or
243+
affected = "4.3.3"
244+
) and
245+
fixed = "4.3.4"
246+
}
247+
}
248+
249+
class CVE_2018_0786 extends Vulnerability {
250+
CVE_2018_0786() { this = "CVE-2018-0786" }
251+
252+
override string getUrl() { result = "https://github.com/dotnet/announcements/issues/51" }
253+
254+
override predicate matchesRange(string name, Version affected, Version fixed) {
255+
(
256+
name = "System.ServiceModel.Primitives"
257+
or
258+
name = "System.ServiceModel.Http"
259+
or
260+
name = "System.ServiceModel.NetTcp"
261+
or
262+
name = "System.ServiceModel.Duplex"
263+
or
264+
name = "System.ServiceModel.Security"
265+
or
266+
name = "System.Private.ServiceModel"
267+
) and (
268+
affected = "4.4.0" and fixed = "4.4.1"
269+
or
270+
affected = "4.3.0" and fixed = "4.3.1"
271+
)
272+
or (
273+
name = "System.ServiceModel.Primitives"
274+
or
275+
name = "System.ServiceModel.Http"
276+
or
277+
name = "System.ServiceModel.NetTcp"
278+
or
279+
name = "System.Private.ServiceModel"
280+
) and
281+
affected = "4.1.0" and
282+
fixed = "4.1.1"
283+
or (
284+
name = "System.ServiceModel.Duplex"
285+
or
286+
name = "System.ServiceModel.Security"
287+
) and
288+
affected = "4.0.1" and
289+
fixed = "4.0.2"
290+
}
291+
}

‎csharp/ql/src/Security Features/CWE-937/Vulnerability.qll‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
import csharp
2+
3+
/**
4+
* A package reference in an XML file, for example in a
5+
* .csproj file, a .props file or a packages.config file.
6+
*/
7+
class Package extends XMLElement {
8+
string name;
9+
Version version;
10+
11+
Package() {
12+
(this.getName() = "PackageManagement" or this.getName() = "PackageReference") and
13+
name = this.getAttributeValue("Include") and
14+
version = this.getAttributeValue("Version")
15+
or
16+
this.getName() = "package" and
17+
name = this.getAttributeValue("id") and
18+
version = this.getAttributeValue("version")
19+
}
20+
21+
/** Gets the name of the package, for example `System.IO.Pipelines`. */
22+
string getPackageName() {
23+
result = name
24+
}
25+
26+
/** Gets the version of the package, for example `4.5.1`. */
27+
Version getVersion() {
28+
result = version
29+
}
30+
31+
override string toString() {
32+
result = name + " " + version
33+
}
34+
}
35+
36+
/**
37+
* A vulnerability, where the name of the vulnerability is this string.
38+
* One of `matchesRange` or `matchesVersion` must be overridden in order to
39+
* specify which packages are vulnerable.
40+
*/
41+
abstract class Vulnerability extends string {
42+
bindingset[this]
43+
Vulnerability() { any() }
44+
45+
/**
46+
* A package with name `name` is vulnerable from version `affected`
47+
* until version `fixed`.
48+
*/
49+
predicate matchesRange(string name, Version affected, Version fixed) { none() }
50+
51+
/**
52+
* A package with name `name` is vulnerable in version `affected`, and
53+
* is fixed by version `fixed`.
54+
*/
55+
predicate matchesVersion(string name, Version affecter, Version fixed) { none() }
56+
57+
/** Gets the URL describing the vulnerability. */
58+
abstract string getUrl();
59+
60+
/**
61+
* Holds if a package with name `name` and version `version`
62+
* has this vulnerability. The fixed version is given by `fixed`.
63+
*/
64+
bindingset[name, version]
65+
predicate isVulnerable(string name, Version version, Version fixed) {
66+
exists(Version affected, string n |
67+
name.toLowerCase() = n.toLowerCase() |
68+
matchesRange(n, affected, fixed) and
69+
version.compareTo(fixed) < 0 and
70+
version.compareTo(affected) >= 0
71+
or
72+
matchesVersion(n, affected, fixed) and
73+
version.compareTo(affected) = 0
74+
)
75+
}
76+
}
77+
78+
/**
79+
* A package with a vulnerability.
80+
*/
81+
class VulnerablePackage extends Package {
82+
Vulnerability vuln;
83+
Version fixed;
84+
85+
VulnerablePackage() {
86+
vuln.isVulnerable(this.getPackageName(), this.getVersion(), fixed)
87+
}
88+
89+
/** Gets the vulnerability of this package. */
90+
Vulnerability getVulnerability() { result = vuln }
91+
92+
/** Gets the version of this package where the vulnerability is fixed. */
93+
Version getFixedVersion() { result = fixed }
94+
}

0 commit comments

Comments
 (0)