Skip to content

Commit b00c1b6

Browse files
michaelnebelmichaelnebel
committed
C#: Deprecate all experimental queries.
1 parent ff80b24 commit b00c1b6

20 files changed

+319
-261
lines changed

‎csharp/ql/src/experimental/CWE-099/TaintedWebClient.ql‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,15 @@
1616

1717
import csharp
1818
import TaintedWebClientLib
19-
import TaintedWebClient::PathGraph
19+
deprecated import TaintedWebClient::PathGraph
2020

21-
from TaintedWebClient::PathNode source, TaintedWebClient::PathNode sink
22-
where TaintedWebClient::flowPath(source, sink)
23-
select sink.getNode(), source, sink, "A method of WebClient depepends on a $@.", source.getNode(),
24-
"user-provided value"
21+
deprecated query predicate problems(
22+
DataFlow::Node sinkNode, TaintedWebClient::PathNode source, TaintedWebClient::PathNode sink,
23+
string message1, DataFlow::Node sourceNode, string message2
24+
) {
25+
TaintedWebClient::flowPath(source, sink) and
26+
sinkNode = sink.getNode() and
27+
message1 = "A method of WebClient depepends on a $@." and
28+
sourceNode = source.getNode() and
29+
message2 = "user-provided value"
30+
}

‎csharp/ql/src/experimental/CWE-099/TaintedWebClientLib.qll‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import semmle.code.csharp.security.Sanitizers
66

77
//If this leaves experimental this should probably go in semmle.code.csharp.frameworks.system.Net
88
/** The `System.Net.WebClient` class. */
9-
class SystemNetWebClientClass extends SystemNetClass {
9+
deprecated class SystemNetWebClientClass extends SystemNetClass {
1010
SystemNetWebClientClass() { this.hasName("WebClient") }
1111

1212
/** Gets the `DownloadString` method. */
@@ -16,7 +16,7 @@ class SystemNetWebClientClass extends SystemNetClass {
1616
//If this leaves experimental this should probably go in semmle.code.csharp.frameworks.System
1717
//Extend the already existent SystemUriClass to not touch the stdlib.
1818
/** The `System.Uri` class. */
19-
class SystemUriClassExtra extends SystemUriClass {
19+
deprecated class SystemUriClassExtra extends SystemUriClass {
2020
/** Gets the `IsWellFormedUriString` method. */
2121
Method getIsWellFormedUriStringMethod() { result = this.getAMethod("IsWellFormedUriString") }
2222
}
@@ -25,22 +25,22 @@ class SystemUriClassExtra extends SystemUriClass {
2525
/**
2626
* A data flow source for uncontrolled data in path expression vulnerabilities.
2727
*/
28-
abstract class Source extends DataFlow::Node { }
28+
abstract deprecated class Source extends DataFlow::Node { }
2929

3030
/**
3131
* A data flow sink for uncontrolled data in path expression vulnerabilities.
3232
*/
33-
abstract class Sink extends DataFlow::ExprNode { }
33+
abstract deprecated class Sink extends DataFlow::ExprNode { }
3434

3535
/**
3636
* A sanitizer for uncontrolled data in path expression vulnerabilities.
3737
*/
38-
abstract class Sanitizer extends DataFlow::ExprNode { }
38+
abstract deprecated class Sanitizer extends DataFlow::ExprNode { }
3939

4040
/**
4141
* A taint-tracking configuration for uncontrolled data in path expression vulnerabilities.
4242
*/
43-
private module TaintedWebClientConfig implements DataFlow::ConfigSig {
43+
deprecated private module TaintedWebClientConfig implements DataFlow::ConfigSig {
4444
predicate isSource(DataFlow::Node source) { source instanceof Source }
4545

4646
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
@@ -51,7 +51,7 @@ private module TaintedWebClientConfig implements DataFlow::ConfigSig {
5151
/**
5252
* A taint-tracking module for uncontrolled data in path expression vulnerabilities.
5353
*/
54-
module TaintedWebClient = TaintTracking::Global<TaintedWebClientConfig>;
54+
deprecated module TaintedWebClient = TaintTracking::Global<TaintedWebClientConfig>;
5555

5656
/**
5757
* DEPRECATED: Use `ThreatModelSource` instead.
@@ -61,12 +61,12 @@ module TaintedWebClient = TaintTracking::Global<TaintedWebClientConfig>;
6161
deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource { }
6262

6363
/** A source supported by the current threat model. */
64-
class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
64+
deprecated class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
6565

6666
/**
6767
* A path argument to a `WebClient` method call that has an address argument.
6868
*/
69-
class WebClientSink extends Sink {
69+
deprecated class WebClientSink extends Sink {
7070
WebClientSink() {
7171
exists(Method m | m = any(SystemNetWebClientClass f).getAMethod() |
7272
this.getExpr() = m.getACall().getArgumentForName("address")
@@ -77,14 +77,14 @@ class WebClientSink extends Sink {
7777
/**
7878
* A call to `System.Uri.IsWellFormedUriString` that is considered to sanitize the input.
7979
*/
80-
class RequestMapPathSanitizer extends Sanitizer {
80+
deprecated class RequestMapPathSanitizer extends Sanitizer {
8181
RequestMapPathSanitizer() {
8282
exists(Method m | m = any(SystemUriClassExtra uri).getIsWellFormedUriStringMethod() |
8383
this.getExpr() = m.getACall().getArgument(0)
8484
)
8585
}
8686
}
8787

88-
private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }
88+
deprecated private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }
8989

90-
private class GuidSanitizer extends Sanitizer, GuidSanitizedExpr { }
90+
deprecated private class GuidSanitizer extends Sanitizer, GuidSanitizedExpr { }

‎csharp/ql/src/experimental/CWE-918/RequestForgery.ql‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,16 @@
1111
*/
1212

1313
import csharp
14-
import RequestForgery::RequestForgery
15-
import RequestForgeryFlow::PathGraph
14+
deprecated import RequestForgery::RequestForgery
15+
deprecated import RequestForgeryFlow::PathGraph
1616

17-
from RequestForgeryFlow::PathNode source, RequestForgeryFlow::PathNode sink
18-
where RequestForgeryFlow::flowPath(source, sink)
19-
select sink.getNode(), source, sink, "The URL of this request depends on a $@.", source.getNode(),
20-
"user-provided value"
17+
deprecated query predicate problems(
18+
DataFlow::Node sinkNode, RequestForgeryFlow::PathNode source, RequestForgeryFlow::PathNode sink,
19+
string message1, DataFlow::Node sourceNode, string message2
20+
) {
21+
RequestForgeryFlow::flowPath(source, sink) and
22+
sinkNode = sink.getNode() and
23+
message1 = "The URL of this request depends on a $@." and
24+
sourceNode = source.getNode() and
25+
message2 = "user-provided value"
26+
}

‎csharp/ql/src/experimental/CWE-918/RequestForgery.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import csharp
22

3-
module RequestForgery {
3+
deprecated module RequestForgery {
44
import semmle.code.csharp.controlflow.Guards
55
import semmle.code.csharp.frameworks.System
66
import semmle.code.csharp.frameworks.system.Web
@@ -55,7 +55,7 @@ module RequestForgery {
5555
/**
5656
* A data flow module for detecting server side request forgery vulnerabilities.
5757
*/
58-
module RequestForgeryFlow = DataFlow::Global<RequestForgeryFlowConfig>;
58+
deprecated module RequestForgeryFlow = DataFlow::Global<RequestForgeryFlowConfig>;
5959

6060
/**
6161
* A dataflow source for Server Side Request Forgery(SSRF) Vulnerabilities.

‎csharp/ql/src/experimental/Security Features/CWE-1004/CookieWithoutHttpOnly.ql‎

Lines changed: 75 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -19,87 +19,89 @@ import semmle.code.csharp.frameworks.system.Web
1919
import semmle.code.csharp.frameworks.microsoft.AspNetCore
2020
import experimental.dataflow.flowsources.AuthCookie
2121

22-
from Expr httpOnlySink
23-
where
24-
exists(Assignment a, Expr val |
25-
httpOnlySink = a.getRValue() and
26-
val.getValue() = "false" and
27-
(
28-
exists(ObjectCreation oc |
29-
getAValueForProp(oc, a, "HttpOnly") = val and
30-
(
31-
oc.getType() instanceof SystemWebHttpCookie and
32-
isCookieWithSensitiveName(oc.getArgument(0))
33-
or
34-
exists(MethodCall mc, MicrosoftAspNetCoreHttpResponseCookies iResponse |
35-
oc.getType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
36-
iResponse.getAppendMethod() = mc.getTarget() and
37-
isCookieWithSensitiveName(mc.getArgument(0)) and
38-
// there is no callback `OnAppendCookie` that sets `HttpOnly` to true
39-
not OnAppendCookieHttpOnlyTracking::flowTo(_) and
40-
// Passed as third argument to `IResponseCookies.Append`
41-
exists(DataFlow::Node creation, DataFlow::Node append |
42-
CookieOptionsTracking::flow(creation, append) and
43-
creation.asExpr() = oc and
44-
append.asExpr() = mc.getArgument(2)
22+
deprecated query predicate problems(Expr httpOnlySink, string message) {
23+
(
24+
exists(Assignment a, Expr val |
25+
httpOnlySink = a.getRValue() and
26+
val.getValue() = "false" and
27+
(
28+
exists(ObjectCreation oc |
29+
getAValueForProp(oc, a, "HttpOnly") = val and
30+
(
31+
oc.getType() instanceof SystemWebHttpCookie and
32+
isCookieWithSensitiveName(oc.getArgument(0))
33+
or
34+
exists(MethodCall mc, MicrosoftAspNetCoreHttpResponseCookies iResponse |
35+
oc.getType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
36+
iResponse.getAppendMethod() = mc.getTarget() and
37+
isCookieWithSensitiveName(mc.getArgument(0)) and
38+
// there is no callback `OnAppendCookie` that sets `HttpOnly` to true
39+
not OnAppendCookieHttpOnlyTracking::flowTo(_) and
40+
// Passed as third argument to `IResponseCookies.Append`
41+
exists(DataFlow::Node creation, DataFlow::Node append |
42+
CookieOptionsTracking::flow(creation, append) and
43+
creation.asExpr() = oc and
44+
append.asExpr() = mc.getArgument(2)
45+
)
4546
)
4647
)
4748
)
48-
)
49-
or
50-
exists(PropertyWrite pw |
51-
(
52-
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreHttpCookieBuilder or
53-
pw.getProperty().getDeclaringType() instanceof
54-
MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
55-
) and
56-
pw.getProperty().getName() = "HttpOnly" and
57-
a.getLValue() = pw and
58-
DataFlow::localExprFlow(val, a.getRValue())
49+
or
50+
exists(PropertyWrite pw |
51+
(
52+
pw.getProperty().getDeclaringType() instanceof MicrosoftAspNetCoreHttpCookieBuilder or
53+
pw.getProperty().getDeclaringType() instanceof
54+
MicrosoftAspNetCoreAuthenticationCookiesCookieAuthenticationOptions
55+
) and
56+
pw.getProperty().getName() = "HttpOnly" and
57+
a.getLValue() = pw and
58+
DataFlow::localExprFlow(val, a.getRValue())
59+
)
5960
)
6061
)
61-
)
62-
or
63-
exists(Call c |
64-
httpOnlySink = c and
65-
(
66-
exists(MicrosoftAspNetCoreHttpResponseCookies iResponse, MethodCall mc |
67-
// default is not configured or is not set to `Always`
68-
not getAValueForCookiePolicyProp("HttpOnly").getValue() = "1" and
69-
// there is no callback `OnAppendCookie` that sets `HttpOnly` to true
70-
not OnAppendCookieHttpOnlyTracking::flowTo(_) and
71-
iResponse.getAppendMethod() = mc.getTarget() and
72-
isCookieWithSensitiveName(mc.getArgument(0)) and
73-
(
74-
// `HttpOnly` property in `CookieOptions` passed to IResponseCookies.Append(...) wasn't set
75-
exists(ObjectCreation oc |
76-
oc = c and
77-
oc.getType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
78-
not isPropertySet(oc, "HttpOnly") and
79-
exists(DataFlow::Node creation |
80-
CookieOptionsTracking::flow(creation, _) and
81-
creation.asExpr() = oc
62+
or
63+
exists(Call c |
64+
httpOnlySink = c and
65+
(
66+
exists(MicrosoftAspNetCoreHttpResponseCookies iResponse, MethodCall mc |
67+
// default is not configured or is not set to `Always`
68+
not getAValueForCookiePolicyProp("HttpOnly").getValue() = "1" and
69+
// there is no callback `OnAppendCookie` that sets `HttpOnly` to true
70+
not OnAppendCookieHttpOnlyTracking::flowTo(_) and
71+
iResponse.getAppendMethod() = mc.getTarget() and
72+
isCookieWithSensitiveName(mc.getArgument(0)) and
73+
(
74+
// `HttpOnly` property in `CookieOptions` passed to IResponseCookies.Append(...) wasn't set
75+
exists(ObjectCreation oc |
76+
oc = c and
77+
oc.getType() instanceof MicrosoftAspNetCoreHttpCookieOptions and
78+
not isPropertySet(oc, "HttpOnly") and
79+
exists(DataFlow::Node creation |
80+
CookieOptionsTracking::flow(creation, _) and
81+
creation.asExpr() = oc
82+
)
8283
)
84+
or
85+
// IResponseCookies.Append(String, String) was called, `HttpOnly` is set to `false` by default
86+
mc = c and
87+
mc.getNumberOfArguments() < 3
8388
)
84-
or
85-
// IResponseCookies.Append(String, String) was called, `HttpOnly` is set to `false` by default
86-
mc = c and
87-
mc.getNumberOfArguments() < 3
8889
)
89-
)
90-
or
91-
exists(ObjectCreation oc |
92-
oc = c and
93-
oc.getType() instanceof SystemWebHttpCookie and
94-
isCookieWithSensitiveName(oc.getArgument(0)) and
95-
// the property wasn't explicitly set, so a default value from config is used
96-
not isPropertySet(oc, "HttpOnly") and
97-
// the default in config is not set to `true`
98-
not exists(XmlElement element |
99-
element instanceof HttpCookiesElement and
100-
element.(HttpCookiesElement).isHttpOnlyCookies()
90+
or
91+
exists(ObjectCreation oc |
92+
oc = c and
93+
oc.getType() instanceof SystemWebHttpCookie and
94+
isCookieWithSensitiveName(oc.getArgument(0)) and
95+
// the property wasn't explicitly set, so a default value from config is used
96+
not isPropertySet(oc, "HttpOnly") and
97+
// the default in config is not set to `true`
98+
not exists(XmlElement element |
99+
element instanceof HttpCookiesElement and
100+
element.(HttpCookiesElement).isHttpOnlyCookies()
101+
)
101102
)
102103
)
103104
)
104-
)
105-
select httpOnlySink, "Cookie attribute 'HttpOnly' is not set to true."
105+
) and
106+
message = "Cookie attribute 'HttpOnly' is not set to true."
107+
}

‎csharp/ql/src/experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -68,15 +68,14 @@ predicate isExprAnAccessToSafeClientSideEncryptionVersionValue(Expr e) {
6868
)
6969
}
7070

71-
from Expr e, Class c, Assembly asm
72-
where
73-
asm = c.getLocation() and
74-
(
71+
deprecated query predicate problems(Expr e, string message) {
72+
exists(Class c, Assembly asm | asm = c.getLocation() |
7573
exists(Expr e2 |
7674
isCreatingAzureClientSideEncryptionObject(e, c, e2) and
7775
not isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(e2, asm)
7876
)
7977
or
8078
isCreatingOutdatedAzureClientSideEncryptionObject(e, c)
81-
)
82-
select e, "Unsafe usage of v1 version of Azure Storage client-side encryption."
79+
) and
80+
message = "Unsafe usage of v1 version of Azure Storage client-side encryption."
81+
}

0 commit comments

Comments
 (0)