C#: Add taint-tracking steps through conversion operator calls

Author: hvitved

csharp/ql/src/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll

@@ -113,6 +113,12 @@ private class LocalTaintExprStepConfiguration extends ControlFlowReachabilityCon
           scope = e2 and
           isSuccessor = true
         )
+      or
+      e2 = any(OperatorCall oc |
+        oc.getTarget() instanceof ConversionOperator and
+        e1 = oc.getAnArgument() and
+        isSuccessor = true
+      )
     )
   }
 

csharp/ql/test/library-tests/dataflow/local/TaintTracking.expected

@@ -64,6 +64,8 @@
 | LocalDataFlow.cs:430:23:430:28 | access to local variable sink72 |
 | LocalDataFlow.cs:445:15:445:20 | access to local variable sink73 |
 | LocalDataFlow.cs:446:15:446:20 | access to local variable sink74 |
+| LocalDataFlow.cs:449:15:449:20 | access to local variable sink75 |
+| LocalDataFlow.cs:452:15:452:20 | access to local variable sink76 |
 | LocalDataFlow.cs:478:15:478:21 | access to parameter tainted |
 | SSA.cs:9:15:9:22 | access to local variable ssaSink0 |
 | SSA.cs:25:15:25:22 | access to local variable ssaSink1 |

csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected

@@ -727,9 +727,11 @@
 | LocalDataFlow.cs:446:15:446:20 | [post] access to local variable sink74 | LocalDataFlow.cs:448:32:448:37 | access to local variable sink74 |
 | LocalDataFlow.cs:446:15:446:20 | access to local variable sink74 | LocalDataFlow.cs:448:32:448:37 | access to local variable sink74 |
 | LocalDataFlow.cs:448:23:448:37 | SSA def(sink75) | LocalDataFlow.cs:449:15:449:20 | access to local variable sink75 |
+| LocalDataFlow.cs:448:32:448:37 | access to local variable sink74 | LocalDataFlow.cs:448:32:448:37 | call to operator implicit conversion |
 | LocalDataFlow.cs:448:32:448:37 | call to operator implicit conversion | LocalDataFlow.cs:448:23:448:37 | SSA def(sink75) |
 | LocalDataFlow.cs:451:23:451:52 | SSA def(sink76) | LocalDataFlow.cs:452:15:452:20 | access to local variable sink76 |
 | LocalDataFlow.cs:451:32:451:52 | call to operator implicit conversion | LocalDataFlow.cs:451:23:451:52 | SSA def(sink76) |
+| LocalDataFlow.cs:451:47:451:52 | access to local variable sink66 | LocalDataFlow.cs:451:32:451:52 | call to operator implicit conversion |
 | LocalDataFlow.cs:470:28:470:30 | this | LocalDataFlow.cs:470:41:470:45 | this access |
 | LocalDataFlow.cs:470:50:470:52 | this | LocalDataFlow.cs:470:56:470:60 | this access |
 | LocalDataFlow.cs:470:50:470:52 | value | LocalDataFlow.cs:470:50:470:52 | value |