Skip to content

Commit 69ab1ed

Browse files
calumgrantcalumgrant
committed
C#: Add nodes predicate to all path queries.
1 parent 8c753d7 commit 69ab1ed

31 files changed

+261
-0
lines changed

‎csharp/ql/src/semmle/code/csharp/dataflow/DataFlow.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,9 @@ module DataFlow {
130130
module PathGraph {
131131
/** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
132132
query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
133+
134+
/** Holds if `node` is a node in the graph of data flow path explanations. */
135+
query predicate nodes(PathNode node) { any() }
133136
}
134137

135138
/**

‎csharp/ql/test/query-tests/Security Features/CWE-022/TaintedPath/TaintedPath.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,15 @@ edges
66
| TaintedPath.cs:12:23:12:45 | access to property QueryString | TaintedPath.cs:38:25:38:31 | access to local variable badPath |
77
| TaintedPath.cs:12:23:12:45 | access to property QueryString | TaintedPath.cs:40:49:40:55 | access to local variable badPath |
88
| TaintedPath.cs:12:23:12:45 | access to property QueryString | TaintedPath.cs:53:26:53:29 | access to local variable path |
9+
nodes
10+
| TaintedPath.cs:12:23:12:45 | access to property QueryString |
11+
| TaintedPath.cs:14:50:14:53 | access to local variable path |
12+
| TaintedPath.cs:19:51:19:54 | access to local variable path |
13+
| TaintedPath.cs:27:30:27:33 | access to local variable path |
14+
| TaintedPath.cs:33:30:33:33 | access to local variable path |
15+
| TaintedPath.cs:38:25:38:31 | access to local variable badPath |
16+
| TaintedPath.cs:40:49:40:55 | access to local variable badPath |
17+
| TaintedPath.cs:53:26:53:29 | access to local variable path |
918
#select
1019
| TaintedPath.cs:14:50:14:53 | access to local variable path | TaintedPath.cs:12:23:12:45 | access to property QueryString | TaintedPath.cs:14:50:14:53 | access to local variable path | $@ flows to here and is used in a path. | TaintedPath.cs:12:23:12:45 | access to property QueryString | User-provided value |
1120
| TaintedPath.cs:19:51:19:54 | access to local variable path | TaintedPath.cs:12:23:12:45 | access to property QueryString | TaintedPath.cs:19:51:19:54 | access to local variable path | $@ flows to here and is used in a path. | TaintedPath.cs:12:23:12:45 | access to property QueryString | User-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-022/ZipSlip/ZipSlip.expected‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,21 @@ edges
1010
| ZipSlip.cs:62:72:62:85 | access to property FullName | ZipSlip.cs:83:57:83:68 | access to local variable destFilePath |
1111
| ZipSlip.cs:62:72:62:85 | access to property FullName | ZipSlip.cs:91:58:91:69 | access to local variable destFilePath |
1212
| ZipSlipBad.cs:9:59:9:72 | access to property FullName | ZipSlipBad.cs:10:29:10:40 | access to local variable destFileName |
13+
nodes
14+
| ZipSlip.cs:16:52:16:65 | access to property FullName |
15+
| ZipSlip.cs:19:31:19:44 | access to property FullName |
16+
| ZipSlip.cs:24:41:24:52 | access to local variable destFileName |
17+
| ZipSlip.cs:32:41:32:52 | access to local variable destFilePath |
18+
| ZipSlip.cs:36:45:36:56 | access to local variable destFilePath |
19+
| ZipSlip.cs:39:53:39:89 | call to method Combine |
20+
| ZipSlip.cs:40:41:40:52 | access to local variable destFilePath |
21+
| ZipSlip.cs:62:72:62:85 | access to property FullName |
22+
| ZipSlip.cs:69:74:69:85 | access to local variable destFilePath |
23+
| ZipSlip.cs:76:71:76:82 | access to local variable destFilePath |
24+
| ZipSlip.cs:83:57:83:68 | access to local variable destFilePath |
25+
| ZipSlip.cs:91:58:91:69 | access to local variable destFilePath |
26+
| ZipSlipBad.cs:9:59:9:72 | access to property FullName |
27+
| ZipSlipBad.cs:10:29:10:40 | access to local variable destFileName |
1328
#select
1429
| ZipSlip.cs:24:41:24:52 | access to local variable destFileName | ZipSlip.cs:19:31:19:44 | access to property FullName | ZipSlip.cs:24:41:24:52 | access to local variable destFileName | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlip.cs:19:31:19:44 | access to property FullName | item path |
1530
| ZipSlip.cs:32:41:32:52 | access to local variable destFilePath | ZipSlip.cs:16:52:16:65 | access to property FullName | ZipSlip.cs:32:41:32:52 | access to local variable destFilePath | Unsanitized zip archive $@, which may contain '..', is used in a file system operation. | ZipSlip.cs:16:52:16:65 | access to property FullName | item path |

‎csharp/ql/test/query-tests/Security Features/CWE-078/CommandInjection.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,15 @@ edges
66
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | CommandInjection.cs:32:39:32:47 | access to local variable userInput |
77
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | CommandInjection.cs:33:40:33:48 | access to local variable userInput |
88
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | CommandInjection.cs:34:47:34:55 | access to local variable userInput |
9+
nodes
10+
| CommandInjection.cs:25:32:25:46 | access to field categoryTextBox |
11+
| CommandInjection.cs:26:27:26:47 | ... + ... |
12+
| CommandInjection.cs:26:50:26:66 | ... + ... |
13+
| CommandInjection.cs:28:63:28:71 | access to local variable userInput |
14+
| CommandInjection.cs:28:74:28:82 | access to local variable userInput |
15+
| CommandInjection.cs:32:39:32:47 | access to local variable userInput |
16+
| CommandInjection.cs:33:40:33:48 | access to local variable userInput |
17+
| CommandInjection.cs:34:47:34:55 | access to local variable userInput |
918
#select
1019
| CommandInjection.cs:26:27:26:47 | ... + ... | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | CommandInjection.cs:26:27:26:47 | ... + ... | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |
1120
| CommandInjection.cs:26:50:26:66 | ... + ... | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | CommandInjection.cs:26:50:26:66 | ... + ... | $@ flows to here and is used in a command. | CommandInjection.cs:25:32:25:46 | access to field categoryTextBox | User-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-078/StoredCommandInjection.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
edges
22
| StoredCommandInjection.cs:24:54:24:80 | call to method GetString | StoredCommandInjection.cs:24:46:24:80 | ... + ... |
3+
nodes
4+
| StoredCommandInjection.cs:24:46:24:80 | ... + ... |
5+
| StoredCommandInjection.cs:24:54:24:80 | call to method GetString |
36
#select
47
| StoredCommandInjection.cs:24:46:24:80 | ... + ... | StoredCommandInjection.cs:24:54:24:80 | call to method GetString | StoredCommandInjection.cs:24:46:24:80 | ... + ... | $@ flows to here and is used in a command. | StoredCommandInjection.cs:24:54:24:80 | call to method GetString | Stored user-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-079/StoredXSS/StoredXSS.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
edges
22
| StoredXSS.cs:24:60:24:86 | call to method GetString | StoredXSS.cs:24:44:24:86 | ... + ... |
3+
nodes
4+
| StoredXSS.cs:24:44:24:86 | ... + ... |
5+
| StoredXSS.cs:24:60:24:86 | call to method GetString |
36
#select
47
| StoredXSS.cs:24:44:24:86 | ... + ... | StoredXSS.cs:24:60:24:86 | call to method GetString | StoredXSS.cs:24:44:24:86 | ... + ... | $@ flows to here and is written to HTML or JavaScript. | StoredXSS.cs:24:60:24:86 | call to method GetString | Stored user-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-089/SecondOrderSqlInjection.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
edges
22
| SecondOrderSqlInjection.cs:21:119:21:145 | call to method GetString | SecondOrderSqlInjection.cs:21:71:21:145 | ... + ... |
3+
nodes
4+
| SecondOrderSqlInjection.cs:21:71:21:145 | ... + ... |
5+
| SecondOrderSqlInjection.cs:21:119:21:145 | call to method GetString |
36
#select
47
| SecondOrderSqlInjection.cs:21:71:21:145 | ... + ... | SecondOrderSqlInjection.cs:21:119:21:145 | call to method GetString | SecondOrderSqlInjection.cs:21:71:21:145 | ... + ... | $@ flows to here and is used in an SQL query. | SecondOrderSqlInjection.cs:21:119:21:145 | call to method GetString | Stored user-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-089/SqlInjection.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,16 @@ edges
1818
| SqlInjection.cs:61:62:61:81 | access to property Text | SqlInjection.cs:75:55:75:60 | access to local variable query1 |
1919
| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox | SqlInjection.cs:74:56:74:61 | access to local variable query1 |
2020
| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox | SqlInjection.cs:75:55:75:60 | access to local variable query1 |
21+
nodes
22+
| SqlInjection.cs:38:21:38:35 | access to field categoryTextBox |
23+
| SqlInjection.cs:39:50:39:55 | access to local variable query1 |
24+
| SqlInjection.cs:49:62:49:76 | access to field categoryTextBox |
25+
| SqlInjection.cs:49:62:49:81 | access to property Text |
26+
| SqlInjection.cs:61:62:61:76 | access to field categoryTextBox |
27+
| SqlInjection.cs:61:62:61:81 | access to property Text |
28+
| SqlInjection.cs:73:33:73:47 | access to field categoryTextBox |
29+
| SqlInjection.cs:74:56:74:61 | access to local variable query1 |
30+
| SqlInjection.cs:75:55:75:60 | access to local variable query1 |
2131
#select
2232
| SqlInjection.cs:39:50:39:55 | access to local variable query1 | SqlInjection.cs:38:21:38:35 | access to field categoryTextBox | SqlInjection.cs:39:50:39:55 | access to local variable query1 | Query might include code from $@. | SqlInjection.cs:38:21:38:35 | access to field categoryTextBox | this ASP.NET user input |
2333
| SqlInjection.cs:74:56:74:61 | access to local variable query1 | SqlInjection.cs:38:21:38:35 | access to field categoryTextBox | SqlInjection.cs:74:56:74:61 | access to local variable query1 | Query might include code from $@. | SqlInjection.cs:38:21:38:35 | access to field categoryTextBox | this ASP.NET user input |

‎csharp/ql/test/query-tests/Security Features/CWE-090/LDAPInjection.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,14 @@ edges
55
| LDAPInjection.cs:13:27:13:49 | access to property QueryString | LDAPInjection.cs:26:53:26:77 | ... + ... |
66
| LDAPInjection.cs:13:27:13:49 | access to property QueryString | LDAPInjection.cs:29:48:29:70 | ... + ... |
77
| LDAPInjection.cs:13:27:13:49 | access to property QueryString | LDAPInjection.cs:31:20:31:42 | ... + ... |
8+
nodes
9+
| LDAPInjection.cs:13:27:13:49 | access to property QueryString |
10+
| LDAPInjection.cs:16:54:16:78 | ... + ... |
11+
| LDAPInjection.cs:18:21:18:45 | ... + ... |
12+
| LDAPInjection.cs:25:21:25:45 | ... + ... |
13+
| LDAPInjection.cs:26:53:26:77 | ... + ... |
14+
| LDAPInjection.cs:29:48:29:70 | ... + ... |
15+
| LDAPInjection.cs:31:20:31:42 | ... + ... |
816
#select
917
| LDAPInjection.cs:16:54:16:78 | ... + ... | LDAPInjection.cs:13:27:13:49 | access to property QueryString | LDAPInjection.cs:16:54:16:78 | ... + ... | $@ flows to here and is used in an LDAP query. | LDAPInjection.cs:13:27:13:49 | access to property QueryString | User-provided value |
1018
| LDAPInjection.cs:18:21:18:45 | ... + ... | LDAPInjection.cs:13:27:13:49 | access to property QueryString | LDAPInjection.cs:18:21:18:45 | ... + ... | $@ flows to here and is used in an LDAP query. | LDAPInjection.cs:13:27:13:49 | access to property QueryString | User-provided value |

‎csharp/ql/test/query-tests/Security Features/CWE-090/StoredLDAPInjection.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
edges
22
| StoredLDAPInjection.cs:24:83:24:109 | call to method GetString | StoredLDAPInjection.cs:24:66:24:109 | ... + ... |
3+
nodes
4+
| StoredLDAPInjection.cs:24:66:24:109 | ... + ... |
5+
| StoredLDAPInjection.cs:24:83:24:109 | call to method GetString |
36
#select
47
| StoredLDAPInjection.cs:24:66:24:109 | ... + ... | StoredLDAPInjection.cs:24:83:24:109 | call to method GetString | StoredLDAPInjection.cs:24:66:24:109 | ... + ... | $@ flows to here and is used in an LDAP query. | StoredLDAPInjection.cs:24:83:24:109 | call to method GetString | Stored user-provided value |

0 commit comments

Comments
 (0)