Skip to content

Commit 5964be4

Browse files
asgerfasgerf
authored
Merge branch 'main' into js/type-confusion-parmaeter-tampering-barrier
2 parents 877a9d8 + 893f4ab commit 5964be4

File tree

45 files changed

+24476
-44
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+24476
-44
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ private import internal.FlowSummaryImplSpecific
8686
*/
8787
private module Frameworks {
8888
private import semmle.code.csharp.frameworks.EntityFramework
89+
private import semmle.code.csharp.frameworks.Generated
8990
private import semmle.code.csharp.frameworks.JsonNET
9091
private import semmle.code.csharp.frameworks.microsoft.extensions.Primitives
9192
private import semmle.code.csharp.frameworks.microsoft.VisualBasic

‎csharp/ql/lib/semmle/code/csharp/frameworks/Generated.qll‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
/**
2+
* A module importing all generated Models as Data models.
3+
*/
4+
5+
import csharp
6+
7+
private module GeneratedFrameworks {
8+
private import generated.dotnet.Runtime
9+
}

‎csharp/ql/lib/semmle/code/csharp/frameworks/generated/dotnet/Runtime.qll‎

Lines changed: 10122 additions & 0 deletions
Large diffs are not rendered by default.

‎csharp/ql/src/Security Features/CWE-209/ExceptionInformationExposure.ql‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,6 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
2828
exists(Expr exceptionExpr |
2929
// Writing an exception directly is bad
3030
source.asExpr() = exceptionExpr
31-
or
32-
// Writing an exception property is bad
33-
source.asExpr().(PropertyAccess).getQualifier() = exceptionExpr
34-
or
35-
// Writing the result of ToString is bad
36-
source.asExpr() =
37-
any(MethodCall mc | mc.getQualifier() = exceptionExpr and mc.getTarget().hasName("ToString"))
3831
|
3932
// Expr has type `System.Exception`.
4033
exceptionExpr.getType().(RefType).getABaseType*() instanceof SystemExceptionClass and
@@ -47,12 +40,26 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
4740
)
4841
}
4942

43+
override predicate isAdditionalTaintStep(DataFlow::Node source, DataFlow::Node sink) {
44+
sink.asExpr() =
45+
any(MethodCall mc |
46+
source.asExpr() = mc.getQualifier() and
47+
mc.getTarget().hasName("ToString") and
48+
mc.getQualifier().getType().(RefType).getABaseType*() instanceof SystemExceptionClass
49+
)
50+
}
51+
5052
override predicate isSink(DataFlow::Node sink) { sink instanceof RemoteFlowSink }
5153

5254
override predicate isSanitizer(DataFlow::Node sanitizer) {
5355
// Do not flow through Message
5456
sanitizer.asExpr() = any(SystemExceptionClass se).getProperty("Message").getAnAccess()
5557
}
58+
59+
override predicate isSanitizerIn(DataFlow::Node sanitizer) {
60+
// Do not flow through Message
61+
sanitizer.asExpr().getType().(RefType).getABaseType*() instanceof SystemExceptionClass
62+
}
5663
}
5764

5865
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink

‎csharp/ql/test/library-tests/csharp7/LocalTaintFlow.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,9 @@
206206
| CSharp7.cs:283:13:283:62 | SSA def(list) | CSharp7.cs:285:39:285:42 | access to local variable list |
207207
| CSharp7.cs:283:20:283:62 | call to method Select<KeyValuePair<Int32,String>,(Int32,String)> | CSharp7.cs:283:13:283:62 | SSA def(list) |
208208
| CSharp7.cs:283:32:283:35 | item | CSharp7.cs:283:41:283:44 | access to parameter item |
209+
| CSharp7.cs:283:41:283:44 | access to parameter item | CSharp7.cs:283:41:283:48 | access to property Key |
209210
| CSharp7.cs:283:41:283:44 | access to parameter item | CSharp7.cs:283:51:283:54 | access to parameter item |
211+
| CSharp7.cs:283:51:283:54 | access to parameter item | CSharp7.cs:283:51:283:60 | access to property Value |
210212
| CSharp7.cs:285:39:285:42 | access to local variable list | CSharp7.cs:287:36:287:39 | access to local variable list |
211213
| CSharp7.cs:287:36:287:39 | access to local variable list | CSharp7.cs:289:32:289:35 | access to local variable list |
212214
| CSharp7.cs:297:18:297:22 | SSA def(x) | CSharp7.cs:297:25:297:25 | SSA phi(x) |

‎csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected‎

Lines changed: 7173 additions & 0 deletions
Large diffs are not rendered by default.

‎csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected‎

Lines changed: 6871 additions & 0 deletions
Large diffs are not rendered by default.

‎csharp/ql/test/query-tests/Security Features/CWE-020/ExternalAPIsUsedWithUntrustedData.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,2 @@
1-
| System.Collections.Specialized.NameValueCollection.get_Item(string) [qualifier] | 1 | 1 |
21
| System.Web.HttpRequest.get_QueryString() [qualifier] | 1 | 1 |
32
| System.Web.HttpResponse.Write(string) [param 0] | 1 | 1 |

‎csharp/ql/test/query-tests/Security Features/CWE-020/UntrustedDataToExternalAPI.expected‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
edges
2+
| UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | UntrustedData.cs:9:20:9:50 | access to indexer : String |
23
| UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | UntrustedData.cs:13:28:13:31 | access to local variable name |
4+
| UntrustedData.cs:9:20:9:50 | access to indexer : String | UntrustedData.cs:13:28:13:31 | access to local variable name |
35
nodes
46
| UntrustedData.cs:9:20:9:30 | access to property Request | semmle.label | access to property Request |
5-
| UntrustedData.cs:9:20:9:42 | access to property QueryString | semmle.label | access to property QueryString |
67
| UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
8+
| UntrustedData.cs:9:20:9:50 | access to indexer : String | semmle.label | access to indexer : String |
79
| UntrustedData.cs:13:28:13:31 | access to local variable name | semmle.label | access to local variable name |
810
subpaths
911
#select
1012
| UntrustedData.cs:9:20:9:30 | access to property Request | UntrustedData.cs:9:20:9:30 | access to property Request | UntrustedData.cs:9:20:9:30 | access to property Request | Call to System.Web.HttpRequest.get_QueryString with untrusted data from $@. | UntrustedData.cs:9:20:9:30 | access to property Request | access to property Request |
11-
| UntrustedData.cs:9:20:9:42 | access to property QueryString | UntrustedData.cs:9:20:9:42 | access to property QueryString | UntrustedData.cs:9:20:9:42 | access to property QueryString | Call to System.Collections.Specialized.NameValueCollection.get_Item with untrusted data from $@. | UntrustedData.cs:9:20:9:42 | access to property QueryString | access to property QueryString |
1213
| UntrustedData.cs:13:28:13:31 | access to local variable name | UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | UntrustedData.cs:13:28:13:31 | access to local variable name | Call to System.Web.HttpResponse.Write with untrusted data from $@. | UntrustedData.cs:9:20:9:42 | access to property QueryString : NameValueCollection | access to property QueryString : NameValueCollection |

‎csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,22 @@
11
edges
2+
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:10:23:10:53 | access to indexer : String |
23
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:12:50:12:53 | access to local variable path |
34
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:17:51:17:54 | access to local variable path |
45
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:25:30:25:33 | access to local variable path |
56
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:31:30:31:33 | access to local variable path |
67
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:36:25:36:31 | access to local variable badPath |
78
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:38:49:38:55 | access to local variable badPath |
89
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | TaintedPath.cs:51:26:51:29 | access to local variable path |
10+
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:12:50:12:53 | access to local variable path |
11+
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:17:51:17:54 | access to local variable path |
12+
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:25:30:25:33 | access to local variable path |
13+
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:31:30:31:33 | access to local variable path |
14+
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:36:25:36:31 | access to local variable badPath |
15+
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:38:49:38:55 | access to local variable badPath |
16+
| TaintedPath.cs:10:23:10:53 | access to indexer : String | TaintedPath.cs:51:26:51:29 | access to local variable path |
917
nodes
1018
| TaintedPath.cs:10:23:10:45 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
19+
| TaintedPath.cs:10:23:10:53 | access to indexer : String | semmle.label | access to indexer : String |
1120
| TaintedPath.cs:12:50:12:53 | access to local variable path | semmle.label | access to local variable path |
1221
| TaintedPath.cs:17:51:17:54 | access to local variable path | semmle.label | access to local variable path |
1322
| TaintedPath.cs:25:30:25:33 | access to local variable path | semmle.label | access to local variable path |

0 commit comments

Comments
 (0)