hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add unit test + fix flow step

Browse Source
This commit is contained in:
Joe Farebrother
2023-12-11 15:56:33 +00:00
parent c3cd40fc69
commit 00892e127f
7 changed files with 114 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
csharp/ql/lib/semmle/code/csharp/frameworks/Razor.qll
View File

@@ -233,12 +233,12 @@ class PageModelClass extends Class {
)
}
/** Gets the Razor Page that this PageModel refers to. */
/** Gets the Razor Page that has this PageModel. */
RazorViewClass getPage() {
exists(Field modelField |
modelField.hasName("Model") and
modelField.getType() = this and
modelField.getDeclaringType() = result
exists(Property modelProp |
modelProp.hasName("Model") and
modelProp.getType() = this and
modelProp.getDeclaringType() = result
)
}
}

16
csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/TestModel.cs Normal file
View File

@@ -0,0 +1,16 @@
using Microsoft.AspNetCore.Mvc.RazorPages;
using Microsoft.AspNetCore.Mvc;
using System.Net;
using System.Threading.Tasks;
namespace test;
class TestModel : PageModel {
public string Name {get; set; } = "abc";
private string source() { return "x"; }
public async Task<IActionResult> OnGetAsync() {
Name = source();
return Page();
}
}

5
csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/TestPage.cshtml Normal file
View File

@@ -0,0 +1,5 @@
@page
@model TestModel
@namespace test
<h3>Hello "@Html.Raw(Model.Name)"</h3>

65
csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/TestPage.cshtml.g.cs Normal file
View File

@@ -0,0 +1,65 @@
// A hand-written test file that mimics the output of compiling a `.cshtml` file
// <auto-generated/>
#pragma warning disable 1591
[assembly: global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemAttribute(typeof(test.Pages.Pages_TestPage), @"mvc.1.0.razor-page", @"TestPage.cshrml")]
namespace test.Pages
{
#line hidden
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Rendering;
using Microsoft.AspNetCore.Mvc.ViewFeatures;
#nullable restore
using test;
#line default
#line hidden
#nullable disable
[global::Microsoft.AspNetCore.Razor.Hosting.RazorSourceChecksumAttribute(@"SHA1", @"c4ae76542f1958092cebd8f57beef899d20fc548", @"TestPage.cshtml")]
// [global::Microsoft.AspNetCore.Razor.Hosting.RazorSourceChecksumAttribute(@"SHA1", @"c13da96c2597d5ddb7d415fb4892c644a268f50b", @"/Pages/_ViewImports.cshtml")]
internal sealed class Pages_TestPage : global::Microsoft.AspNetCore.Mvc.RazorPages.Page
{
#pragma warning disable 1998
public async override global::System.Threading.Tasks.Task ExecuteAsync()
{
#nullable disable
WriteLiteral("<h3>Hello \"");
#nullable restore
#line 5 "TestPage.cshtml"
Write(Html.Raw(Model.Name));
#line default
#line hidden
#nullable disable
WriteLiteral("\"</h3>\n");
#nullable restore
}
#pragma warning restore 1998
#nullable restore
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
public global::Microsoft.AspNetCore.Mvc.ViewFeatures.IModelExpressionProvider ModelExpressionProvider { get; private set; } = default!;
#nullable disable
#nullable restore
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
public global::Microsoft.AspNetCore.Mvc.IUrlHelper Url { get; private set; } = default!;
#nullable disable
#nullable restore
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
public global::Microsoft.AspNetCore.Mvc.IViewComponentHelper Component { get; private set; } = default!;
#nullable disable
#nullable restore
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
public global::Microsoft.AspNetCore.Mvc.Rendering.IJsonHelper Json { get; private set; } = default!;
#nullable disable
#nullable restore
[global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
public global::Microsoft.AspNetCore.Mvc.Rendering.IHtmlHelper<TestModel> Html { get; private set; } = default!;
#nullable disable
public global::Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary<TestModel> ViewData => (global::Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary<TestModel>)PageContext?.ViewData;
public TestModel Model => ViewData.Model; }
}
#pragma warning restore 1591

3
csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/options Normal file
View File

@@ -0,0 +1,3 @@
semmle-extractor-options: /nostdlib /noconfig
semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
semmle-extractor-options: --load-sources-from-project:../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

1
csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/test.expected Normal file
View File

@@ -0,0 +1 @@
| TestPage.cshtml:5:16:5:25 | access to property Name | TestModel.cs:13:16:13:23 | call to method source | TestPage.cshtml:5:16:5:25 | access to property Name | Xss |

19
csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/test.ql Normal file
View File

@@ -0,0 +1,19 @@
import csharp
import semmle.code.csharp.security.dataflow.XSSQuery
import semmle.code.csharp.security.dataflow.XSSSinks
module TestXssTrackingConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asExpr().(MethodCall).getTarget().getName() = "source"
}
predicate isSink = XssTrackingConfig::isSink/1;
predicate isBarrier = XssTrackingConfig::isBarrier/1;
}
module TestXss = TaintTracking::Global<TestXssTrackingConfig>;
from DataFlow::Node source, DataFlow::Node sink
where TestXss::flow(source, sink)
select sink, source, sink, "Xss"