Skip to content

Commit af453d0

Browse files
hvitvedhvitved
committed
C#: Only track taint through conversion operators defined in libraries
1 parent ce16bc5 commit af453d0

File tree

6 files changed

+40
-54
lines changed

6 files changed

+40
-54
lines changed

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ private class LocalTaintExprStepConfiguration extends ControlFlowReachabilityCon
115115
)
116116
or
117117
e2 = any(OperatorCall oc |
118-
oc.getTarget() instanceof ConversionOperator and
118+
oc.getTarget().(ConversionOperator).fromLibrary() and
119119
e1 = oc.getAnArgument() and
120120
isSuccessor = true
121121
)

‎csharp/ql/test/library-tests/dataflow/local/DataFlow.expected‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
| LocalDataFlow.cs:430:23:430:28 | access to local variable sink72 |
1111
| LocalDataFlow.cs:445:15:445:20 | access to local variable sink73 |
1212
| LocalDataFlow.cs:446:15:446:20 | access to local variable sink74 |
13-
| LocalDataFlow.cs:478:15:478:21 | access to parameter tainted |
13+
| LocalDataFlow.cs:472:15:472:21 | access to parameter tainted |
1414
| SSA.cs:9:15:9:22 | access to local variable ssaSink0 |
1515
| SSA.cs:25:15:25:22 | access to local variable ssaSink1 |
1616
| SSA.cs:43:15:43:22 | access to local variable ssaSink2 |

‎csharp/ql/test/library-tests/dataflow/local/DataFlowStep.expected‎

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -498,8 +498,6 @@
498498
| LocalDataFlow.cs:373:13:373:33 | SSA def(sink66) | LocalDataFlow.cs:374:15:374:20 | access to local variable sink66 |
499499
| LocalDataFlow.cs:373:22:373:27 | access to local variable sink65 | LocalDataFlow.cs:373:22:373:33 | access to property Value |
500500
| LocalDataFlow.cs:373:22:373:33 | access to property Value | LocalDataFlow.cs:373:13:373:33 | SSA def(sink66) |
501-
| LocalDataFlow.cs:374:15:374:20 | [post] access to local variable sink66 | LocalDataFlow.cs:451:47:451:52 | access to local variable sink66 |
502-
| LocalDataFlow.cs:374:15:374:20 | access to local variable sink66 | LocalDataFlow.cs:451:47:451:52 | access to local variable sink66 |
503501
| LocalDataFlow.cs:377:22:377:30 | SSA def(nonSink17) | LocalDataFlow.cs:378:19:378:27 | access to local variable nonSink17 |
504502
| LocalDataFlow.cs:377:35:377:42 | access to local variable nonSink4 | LocalDataFlow.cs:379:33:379:40 | access to local variable nonSink4 |
505503
| LocalDataFlow.cs:379:21:379:56 | SSA def(nonSink18) | LocalDataFlow.cs:380:15:380:23 | access to local variable nonSink18 |
@@ -579,21 +577,18 @@
579577
| LocalDataFlow.cs:444:22:444:26 | access to local variable sink0 | LocalDataFlow.cs:444:22:444:38 | ... ?? ... |
580578
| LocalDataFlow.cs:444:22:444:38 | ... ?? ... | LocalDataFlow.cs:444:13:444:38 | SSA def(sink74) |
581579
| LocalDataFlow.cs:444:31:444:38 | access to local variable nonSink0 | LocalDataFlow.cs:444:22:444:38 | ... ?? ... |
582-
| LocalDataFlow.cs:446:15:446:20 | [post] access to local variable sink74 | LocalDataFlow.cs:448:32:448:37 | access to local variable sink74 |
583-
| LocalDataFlow.cs:446:15:446:20 | access to local variable sink74 | LocalDataFlow.cs:448:32:448:37 | access to local variable sink74 |
584-
| LocalDataFlow.cs:448:23:448:37 | SSA def(sink75) | LocalDataFlow.cs:449:15:449:20 | access to local variable sink75 |
585-
| LocalDataFlow.cs:448:32:448:37 | call to operator implicit conversion | LocalDataFlow.cs:448:23:448:37 | SSA def(sink75) |
586-
| LocalDataFlow.cs:451:23:451:52 | SSA def(sink76) | LocalDataFlow.cs:452:15:452:20 | access to local variable sink76 |
587-
| LocalDataFlow.cs:451:32:451:52 | call to operator implicit conversion | LocalDataFlow.cs:451:23:451:52 | SSA def(sink76) |
588-
| LocalDataFlow.cs:470:28:470:30 | this | LocalDataFlow.cs:470:41:470:45 | this access |
589-
| LocalDataFlow.cs:470:50:470:52 | this | LocalDataFlow.cs:470:56:470:60 | this access |
590-
| LocalDataFlow.cs:470:50:470:52 | value | LocalDataFlow.cs:470:64:470:68 | access to parameter value |
591-
| LocalDataFlow.cs:476:41:476:47 | tainted | LocalDataFlow.cs:478:15:478:21 | access to parameter tainted |
592-
| LocalDataFlow.cs:481:44:481:53 | nonTainted | LocalDataFlow.cs:483:15:483:24 | access to parameter nonTainted |
593-
| LocalDataFlow.cs:486:44:486:44 | x | LocalDataFlow.cs:489:21:489:21 | access to parameter x |
594-
| LocalDataFlow.cs:486:67:486:68 | os | LocalDataFlow.cs:492:32:492:33 | access to parameter os |
595-
| LocalDataFlow.cs:489:21:489:21 | access to parameter x | LocalDataFlow.cs:489:16:489:21 | ... = ... |
596-
| LocalDataFlow.cs:492:32:492:33 | access to parameter os | LocalDataFlow.cs:492:26:492:33 | ... = ... |
580+
| LocalDataFlow.cs:464:28:464:30 | this | LocalDataFlow.cs:464:41:464:45 | this access |
581+
| LocalDataFlow.cs:464:50:464:52 | this | LocalDataFlow.cs:464:56:464:60 | this access |
582+
| LocalDataFlow.cs:464:50:464:52 | value | LocalDataFlow.cs:464:64:464:68 | access to parameter value |
583+
| LocalDataFlow.cs:470:41:470:47 | tainted | LocalDataFlow.cs:472:15:472:21 | access to parameter tainted |
584+
| LocalDataFlow.cs:475:44:475:53 | nonTainted | LocalDataFlow.cs:477:15:477:24 | access to parameter nonTainted |
585+
| LocalDataFlow.cs:480:44:480:44 | x | LocalDataFlow.cs:483:21:483:21 | access to parameter x |
586+
| LocalDataFlow.cs:480:67:480:68 | os | LocalDataFlow.cs:486:32:486:33 | access to parameter os |
587+
| LocalDataFlow.cs:483:21:483:21 | access to parameter x | LocalDataFlow.cs:483:16:483:21 | ... = ... |
588+
| LocalDataFlow.cs:486:32:486:33 | access to parameter os | LocalDataFlow.cs:486:26:486:33 | ... = ... |
589+
| LocalDataFlow.cs:491:41:491:44 | args | LocalDataFlow.cs:493:29:493:32 | access to parameter args |
590+
| LocalDataFlow.cs:493:29:493:32 | [post] access to parameter args | LocalDataFlow.cs:494:27:494:30 | access to parameter args |
591+
| LocalDataFlow.cs:493:29:493:32 | access to parameter args | LocalDataFlow.cs:494:27:494:30 | access to parameter args |
597592
| SSA.cs:5:17:5:17 | SSA entry def(this.S) | SSA.cs:67:9:67:14 | access to field S |
598593
| SSA.cs:5:17:5:17 | this | SSA.cs:67:9:67:12 | this access |
599594
| SSA.cs:5:26:5:32 | tainted | SSA.cs:8:24:8:30 | access to parameter tainted |

‎csharp/ql/test/library-tests/dataflow/local/LocalDataFlow.cs‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -444,12 +444,6 @@ public async void M(bool b)
444444
var sink74 = sink0 ?? nonSink0;
445445
Check(sink73);
446446
Check(sink74);
447-
448-
LocalDataFlow sink75 = sink74;
449-
Check(sink75);
450-
451-
LocalDataFlow sink76 = (LocalDataFlow)sink66;
452-
Check(sink76);
453447
}
454448

455449
static void Check<T>(T x) { }
@@ -492,7 +486,11 @@ public void AssignmentFlow(IDisposable x, IEnumerable<object> os)
492486
foreach(var o in os2 = os) { }
493487
}
494488

495-
public static implicit operator LocalDataFlow(string s) => null;
489+
public static implicit operator LocalDataFlow(string[] args) => null;
496490

497-
public static explicit operator LocalDataFlow(int x) => null;
491+
public void ConversionFlow(string[] args)
492+
{
493+
Span<object> span = args; // flow (library operator)
494+
LocalDataFlow x = args; // no flow (source code operator)
495+
}
498496
}

‎csharp/ql/test/library-tests/dataflow/local/TaintTracking.expected‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,9 +64,7 @@
6464
| LocalDataFlow.cs:430:23:430:28 | access to local variable sink72 |
6565
| LocalDataFlow.cs:445:15:445:20 | access to local variable sink73 |
6666
| LocalDataFlow.cs:446:15:446:20 | access to local variable sink74 |
67-
| LocalDataFlow.cs:449:15:449:20 | access to local variable sink75 |
68-
| LocalDataFlow.cs:452:15:452:20 | access to local variable sink76 |
69-
| LocalDataFlow.cs:478:15:478:21 | access to parameter tainted |
67+
| LocalDataFlow.cs:472:15:472:21 | access to parameter tainted |
7068
| SSA.cs:9:15:9:22 | access to local variable ssaSink0 |
7169
| SSA.cs:25:15:25:22 | access to local variable ssaSink1 |
7270
| SSA.cs:43:15:43:22 | access to local variable ssaSink2 |

‎csharp/ql/test/library-tests/dataflow/local/TaintTrackingStep.expected‎

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -636,8 +636,6 @@
636636
| LocalDataFlow.cs:373:13:373:33 | SSA def(sink66) | LocalDataFlow.cs:374:15:374:20 | access to local variable sink66 |
637637
| LocalDataFlow.cs:373:22:373:27 | access to local variable sink65 | LocalDataFlow.cs:373:22:373:33 | access to property Value |
638638
| LocalDataFlow.cs:373:22:373:33 | access to property Value | LocalDataFlow.cs:373:13:373:33 | SSA def(sink66) |
639-
| LocalDataFlow.cs:374:15:374:20 | [post] access to local variable sink66 | LocalDataFlow.cs:451:47:451:52 | access to local variable sink66 |
640-
| LocalDataFlow.cs:374:15:374:20 | access to local variable sink66 | LocalDataFlow.cs:451:47:451:52 | access to local variable sink66 |
641639
| LocalDataFlow.cs:377:22:377:30 | SSA def(nonSink17) | LocalDataFlow.cs:378:19:378:27 | access to local variable nonSink17 |
642640
| LocalDataFlow.cs:377:35:377:42 | access to local variable nonSink4 | LocalDataFlow.cs:377:22:377:30 | SSA def(nonSink17) |
643641
| LocalDataFlow.cs:377:35:377:42 | access to local variable nonSink4 | LocalDataFlow.cs:379:33:379:40 | access to local variable nonSink4 |
@@ -724,28 +722,25 @@
724722
| LocalDataFlow.cs:444:22:444:26 | access to local variable sink0 | LocalDataFlow.cs:444:22:444:38 | ... ?? ... |
725723
| LocalDataFlow.cs:444:22:444:38 | ... ?? ... | LocalDataFlow.cs:444:13:444:38 | SSA def(sink74) |
726724
| LocalDataFlow.cs:444:31:444:38 | access to local variable nonSink0 | LocalDataFlow.cs:444:22:444:38 | ... ?? ... |
727-
| LocalDataFlow.cs:446:15:446:20 | [post] access to local variable sink74 | LocalDataFlow.cs:448:32:448:37 | access to local variable sink74 |
728-
| LocalDataFlow.cs:446:15:446:20 | access to local variable sink74 | LocalDataFlow.cs:448:32:448:37 | access to local variable sink74 |
729-
| LocalDataFlow.cs:448:23:448:37 | SSA def(sink75) | LocalDataFlow.cs:449:15:449:20 | access to local variable sink75 |
730-
| LocalDataFlow.cs:448:32:448:37 | access to local variable sink74 | LocalDataFlow.cs:448:32:448:37 | call to operator implicit conversion |
731-
| LocalDataFlow.cs:448:32:448:37 | call to operator implicit conversion | LocalDataFlow.cs:448:23:448:37 | SSA def(sink75) |
732-
| LocalDataFlow.cs:451:23:451:52 | SSA def(sink76) | LocalDataFlow.cs:452:15:452:20 | access to local variable sink76 |
733-
| LocalDataFlow.cs:451:32:451:52 | call to operator implicit conversion | LocalDataFlow.cs:451:23:451:52 | SSA def(sink76) |
734-
| LocalDataFlow.cs:451:47:451:52 | access to local variable sink66 | LocalDataFlow.cs:451:32:451:52 | call to operator implicit conversion |
735-
| LocalDataFlow.cs:470:28:470:30 | this | LocalDataFlow.cs:470:41:470:45 | this access |
736-
| LocalDataFlow.cs:470:50:470:52 | this | LocalDataFlow.cs:470:56:470:60 | this access |
737-
| LocalDataFlow.cs:470:50:470:52 | value | LocalDataFlow.cs:470:50:470:52 | value |
738-
| LocalDataFlow.cs:470:50:470:52 | value | LocalDataFlow.cs:470:64:470:68 | access to parameter value |
739-
| LocalDataFlow.cs:476:41:476:47 | tainted | LocalDataFlow.cs:476:41:476:47 | tainted |
740-
| LocalDataFlow.cs:476:41:476:47 | tainted | LocalDataFlow.cs:478:15:478:21 | access to parameter tainted |
741-
| LocalDataFlow.cs:481:44:481:53 | nonTainted | LocalDataFlow.cs:481:44:481:53 | nonTainted |
742-
| LocalDataFlow.cs:481:44:481:53 | nonTainted | LocalDataFlow.cs:483:15:483:24 | access to parameter nonTainted |
743-
| LocalDataFlow.cs:486:44:486:44 | x | LocalDataFlow.cs:486:44:486:44 | x |
744-
| LocalDataFlow.cs:486:44:486:44 | x | LocalDataFlow.cs:489:21:489:21 | access to parameter x |
745-
| LocalDataFlow.cs:486:67:486:68 | os | LocalDataFlow.cs:486:67:486:68 | os |
746-
| LocalDataFlow.cs:486:67:486:68 | os | LocalDataFlow.cs:492:32:492:33 | access to parameter os |
747-
| LocalDataFlow.cs:489:21:489:21 | access to parameter x | LocalDataFlow.cs:489:16:489:21 | ... = ... |
748-
| LocalDataFlow.cs:492:32:492:33 | access to parameter os | LocalDataFlow.cs:492:26:492:33 | ... = ... |
725+
| LocalDataFlow.cs:464:28:464:30 | this | LocalDataFlow.cs:464:41:464:45 | this access |
726+
| LocalDataFlow.cs:464:50:464:52 | this | LocalDataFlow.cs:464:56:464:60 | this access |
727+
| LocalDataFlow.cs:464:50:464:52 | value | LocalDataFlow.cs:464:50:464:52 | value |
728+
| LocalDataFlow.cs:464:50:464:52 | value | LocalDataFlow.cs:464:64:464:68 | access to parameter value |
729+
| LocalDataFlow.cs:470:41:470:47 | tainted | LocalDataFlow.cs:470:41:470:47 | tainted |
730+
| LocalDataFlow.cs:470:41:470:47 | tainted | LocalDataFlow.cs:472:15:472:21 | access to parameter tainted |
731+
| LocalDataFlow.cs:475:44:475:53 | nonTainted | LocalDataFlow.cs:475:44:475:53 | nonTainted |
732+
| LocalDataFlow.cs:475:44:475:53 | nonTainted | LocalDataFlow.cs:477:15:477:24 | access to parameter nonTainted |
733+
| LocalDataFlow.cs:480:44:480:44 | x | LocalDataFlow.cs:480:44:480:44 | x |
734+
| LocalDataFlow.cs:480:44:480:44 | x | LocalDataFlow.cs:483:21:483:21 | access to parameter x |
735+
| LocalDataFlow.cs:480:67:480:68 | os | LocalDataFlow.cs:480:67:480:68 | os |
736+
| LocalDataFlow.cs:480:67:480:68 | os | LocalDataFlow.cs:486:32:486:33 | access to parameter os |
737+
| LocalDataFlow.cs:483:21:483:21 | access to parameter x | LocalDataFlow.cs:483:16:483:21 | ... = ... |
738+
| LocalDataFlow.cs:486:32:486:33 | access to parameter os | LocalDataFlow.cs:486:26:486:33 | ... = ... |
739+
| LocalDataFlow.cs:491:41:491:44 | args | LocalDataFlow.cs:491:41:491:44 | args |
740+
| LocalDataFlow.cs:491:41:491:44 | args | LocalDataFlow.cs:493:29:493:32 | access to parameter args |
741+
| LocalDataFlow.cs:493:29:493:32 | [post] access to parameter args | LocalDataFlow.cs:494:27:494:30 | access to parameter args |
742+
| LocalDataFlow.cs:493:29:493:32 | access to parameter args | LocalDataFlow.cs:493:29:493:32 | call to operator implicit conversion |
743+
| LocalDataFlow.cs:493:29:493:32 | access to parameter args | LocalDataFlow.cs:494:27:494:30 | access to parameter args |
749744
| SSA.cs:5:17:5:17 | SSA entry def(this.S) | SSA.cs:67:9:67:14 | access to field S |
750745
| SSA.cs:5:17:5:17 | this | SSA.cs:67:9:67:12 | this access |
751746
| SSA.cs:5:26:5:32 | tainted | SSA.cs:5:26:5:32 | tainted |

0 commit comments

Comments
 (0)