C#: Recognize more path-normalization steps.

Author: MathiasVP

csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll

@@ -52,6 +52,40 @@ private class GetFullPathStep extends PathNormalizationStep {
   }
 }
 
+/** Holds if `e` may evaluate to an absolute path. */
+bindingset[e]
+pragma[inline_late]
+private predicate isAbsolute(Expr e) {
+  exists(Expr absolute | DataFlow::localExprFlow(absolute, e) |
+    exists(Call call | absolute = call |
+      call.getARuntimeTarget()
+          .hasFullyQualifiedName(["System.Web.HttpServerUtilityBase", "System.Web.HttpRequest"],
+            "MapPath")
+      or
+      call.getARuntimeTarget().hasFullyQualifiedName("System.IO.Path", "GetFullPath")
+      or
+      call.getARuntimeTarget().hasFullyQualifiedName("System.IO.Directory", "GetCurrentDirectory")
+    )
+    or
+    exists(PropertyRead read | absolute = read |
+      read.getTarget().hasFullyQualifiedName("System", "Environment", "CurrentDirectory")
+    )
+  )
+}
+
+private class PathCombineStep extends PathNormalizationStep {
+  override predicate isAdditionalFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
+    exists(Call call |
+      // The result of `Path.Combine(x, y)` is an absolute path when `x` is an
+      // absolute path.
+      call.getARuntimeTarget().hasFullyQualifiedName("System.IO.Path", "Combine") and
+      isAbsolute(call.getArgument(0)) and
+      n1.asExpr() = call.getArgument(1) and
+      n2.asExpr() = call
+    )
+  }
+}
+
 /**
  * A taint-tracking configuration for uncontrolled data in path expression vulnerabilities.
  */