hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 00:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Tolerate missing call targets in LogMessageSink

Browse Source
This commit is contained in:
Tamas Vajk
2023-11-21 10:13:12 +01:00
parent f0e20fa69e
commit 253c658ad2
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll
View File

@@ -27,8 +27,9 @@ private class ExternalModelSink extends ExternalLocationSink {
*/
class LogMessageSink extends ExternalLocationSink {
LogMessageSink() {
this.getExpr() = any(LoggerType i).getAMethod().getACall().getAnArgument()
or
this.getExpr() = any(LoggerType i).getAMethod().getACall().getAnArgument() or
this.getExpr() =
any(MethodCall call | call.getQualifier().getType() instanceof LoggerType).getAnArgument() or
this.getExpr() =
any(ExtensionMethodCall call |
call.getTarget().(ExtensionMethod).getExtendedType() instanceof LoggerType

2
csharp/ql/test/library-tests/standalone/externalLocationSink/externalLocationSink.expected
View File

@@ -1,4 +1,6 @@
#select
| standalone.cs:20:20:20:20 | access to parameter s | standalone.cs:20:20:20:20 | access to parameter s |
| standalone.cs:25:28:25:32 | "abc" | standalone.cs:25:28:25:32 | "abc" |
compilationErrors
| standalone.cs:16:12:16:18 | CS0104: 'ILogger' is an ambiguous reference between 'A.ILogger' and 'B.ILogger' |
methodCalls