Merge pull request #22123 from owen-mc/csharp/convert-qlref-tests-to-inline-expectations

C#: Convert qlref tests to inline expectations
This commit is contained in:
Owen Mansel-Chan
2026-07-08 14:47:04 +01:00
committed by GitHub
504 changed files with 1654 additions and 1366 deletions

View File

@@ -1 +1,2 @@
ModifiedFnvFunctionDetection.ql
query: ModifiedFnvFunctionDetection.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
NumberOfKnownCommandsAboveThreshold.ql
query: NumberOfKnownCommandsAboveThreshold.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
NumberOfKnownHashesAboveThreshold.ql
query: NumberOfKnownHashesAboveThreshold.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
NumberOfKnownLiteralsAboveThreshold.ql
query: NumberOfKnownLiteralsAboveThreshold.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
NumberOfKnownMethodNamesAboveThreshold.ql
query: NumberOfKnownMethodNamesAboveThreshold.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
SwallowEverythingExceptionHandler.ql
query: SwallowEverythingExceptionHandler.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -6,12 +6,12 @@ class FalsePositiveCases
// regular FVN
ulong GetRegularFvnHash(string s)
{
ulong num = 14695981039346656037UL; /* FNV base offset */
ulong num = 14695981039346656037UL; /* FNV base offset */ // $ SPURIOUS: Alert[cs/solorigate/number-of-known-hashes-above-threshold]
foreach (byte b in Encoding.UTF8.GetBytes(s))
{
num ^= (ulong)b;
num *= 1099511628211UL; /* FNV prime */
num *= 1099511628211UL; /* FNV prime */ // $ SPURIOUS: Alert[cs/solorigate/number-of-known-hashes-above-threshold]
}
return num;
@@ -22,24 +22,24 @@ class TestCases
{
ulong GetRegularFvnHash(string s)
{
ulong num = 14695981039346656037UL;
ulong num = 14695981039346656037UL; // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
try
{
foreach (byte b in Encoding.UTF8.GetBytes(s))
{
num ^= (ulong)b;
num *= 1099511628211UL;
num *= 1099511628211UL; // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
}
}
catch // BUG : SwallowEverythingExceptionHandler
{
}
} // $ Alert[cs/solorigate/swallow-everything-exception]
return num ^ 6605813339339102567UL; // BUG (ModifiedFnvFunctionDetection.ql)
return num ^ 6605813339339102567UL; // $ Alert[cs/solorigate/modified-fnv-function-detection] Alert[cs/solorigate/number-of-known-hashes-above-threshold] // BUG (ModifiedFnvFunctionDetection.ql)
}
enum JobEngine
enum JobEngine // $ Alert[cs/solorigate/number-of-known-commands-in-enum-above-threshold]
{
Idle,
Exit,
@@ -62,222 +62,222 @@ class TestCases
None
}
void Abort() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void AddFileExecutionEngine() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void AddRegistryExecutionEngine() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void AdjustTokenPrivileges() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Base64Decode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Base64Encode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void ByteArrayToHexString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void CheckServerConnection() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Close() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void CloseHandle() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void CollectSystemDescription() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Compress() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void CreateSecureString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void CreateString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void CreateUploadRequest() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void CreateUploadRequestImpl() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Decompress() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void DecryptShort() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Deflate() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void DelayMin() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void DelayMs() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void DeleteFile() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void DeleteRegistryValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void DeleteValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void ExecuteEngine() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void FileExists() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetAddresses() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetAddressFamily() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetArgumentIndex() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetBaseUri() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetBaseUriImpl() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetCache() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetCurrentProcess() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetCurrentString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetDescriptionId() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetFileHash() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetFileSystemEntries() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetHash() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetHive() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetIntArray() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetIPHostEntry() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetManagementObjectProperty() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetNetworkAdapterConfiguration() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetNewOwnerName() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetNextString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetNextStringEx() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetOrCreateUserID() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetOrionImprovementCustomerId() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetOSVersion() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetPreviousString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetProcessByDescription() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetRegistrySubKeyAndValueNames() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetStringHash() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetSubKeyAndValueNames() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetUserAgent() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetWebProxy() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void HexStringToByteArray() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Inflate() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Initialize() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void InitiateSystemShutdownExW() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void IsNullOrInvalidName() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void IsSynchronized() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void KillTask() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void LookupPrivilegeValueW() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void OpenProcessToken() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void ParseServiceResponse() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Quote() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadConfig() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadDeviceInfo() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadRegistryValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadReportStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadServiceStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void RebootComputer() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void RunTask() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SearchAssemblies() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SearchConfigurations() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SearchServices() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetAutomaticMode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetKeyOwner() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetKeyOwnerWithPrivileges() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetKeyPermissions() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetManualMode() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetProcessPrivilege() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetRegistryValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetTime() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetValue() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void SplitString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void ToString() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void TrackEvent() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void TrackProcesses() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Unquote() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Unzip() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Update() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void UpdateBuffer() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void UpdateNotification() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void UploadSystemDescription() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Valid() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void WriteConfig() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void WriteFile() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void WriteReportStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void WriteServiceStatus() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Zip() { } // BUG : NumberOfKnownMethodNamesAboveThreshold
void Abort() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void AddFileExecutionEngine() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void AddRegistryExecutionEngine() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void AdjustTokenPrivileges() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Base64Decode() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Base64Encode() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void ByteArrayToHexString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void CheckServerConnection() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Close() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void CloseHandle() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void CollectSystemDescription() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Compress() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void CreateSecureString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void CreateString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void CreateUploadRequest() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void CreateUploadRequestImpl() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Decompress() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void DecryptShort() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Deflate() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void DelayMin() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void DelayMs() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void DeleteFile() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void DeleteRegistryValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void DeleteValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void ExecuteEngine() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void FileExists() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetAddresses() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetAddressFamily() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetArgumentIndex() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetBaseUri() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetBaseUriImpl() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetCache() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetCurrentProcess() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetCurrentString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetDescriptionId() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetFileHash() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetFileSystemEntries() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetHash() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetHive() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetIntArray() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetIPHostEntry() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetManagementObjectProperty() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetNetworkAdapterConfiguration() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetNewOwnerName() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetNextString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetNextStringEx() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetOrCreateUserID() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetOrionImprovementCustomerId() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetOSVersion() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetPreviousString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetProcessByDescription() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetRegistrySubKeyAndValueNames() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetStringHash() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetSubKeyAndValueNames() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetUserAgent() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void GetWebProxy() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void HexStringToByteArray() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Inflate() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Initialize() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void InitiateSystemShutdownExW() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void IsNullOrInvalidName() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void IsSynchronized() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void KillTask() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void LookupPrivilegeValueW() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void OpenProcessToken() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void ParseServiceResponse() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Quote() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadConfig() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadDeviceInfo() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadRegistryValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadReportStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void ReadServiceStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void RebootComputer() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void RunTask() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SearchAssemblies() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SearchConfigurations() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SearchServices() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetAutomaticMode() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetKeyOwner() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetKeyOwnerWithPrivileges() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetKeyPermissions() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetManualMode() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetProcessPrivilege() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetRegistryValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetTime() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SetValue() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void SplitString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void ToString() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void TrackEvent() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void TrackProcesses() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Unquote() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Unzip() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Update() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void UpdateBuffer() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void UpdateNotification() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void UploadSystemDescription() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Valid() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void WriteConfig() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void WriteFile() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void WriteReportStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void WriteServiceStatus() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Zip() { } // $ Alert[cs/solorigate/number-of-known-method-names-above-threshold] // BUG : NumberOfKnownMethodNamesAboveThreshold
void Hashes() {
ulong[] hashes = { // BUG : NumberOfKnownHashesAboveThreshold
10063651499895178962, 10235971842993272939, 10296494671777307979,
10336842116636872171, 10374841591685794123, 10393903804869831898,
10463926208560207521, 10484659978517092504, 10501212300031893463,
10545868833523019926, 10657751674541025650, 106672141413120087, 10734127004244879770,
10829648878147112121, 1099511628211, 11073283311104541690, 1109067043404435916,
11109294216876344399, 11266044540366291518, 11385275378891906608,
11771945869106552231, 11801746708619571308, 11818825521849580123,
11913842725949116895, 12027963942392743532, 12094027092655598256,
12343334044036541897, 12445177985737237804, 12445232961318634374,
12574535824074203265, 12679195163651834776, 12709986806548166638,
12718416789200275332, 12785322942775634499, 12790084614253405985,
12969190449276002545, 13014156621614176974, 13029357933491444455,
13135068273077306806, 13260224381505715848, 13316211011159594063,
13464308873961738403, 13544031715334011032, 13581776705111912829,
13599785766252827703, 13611051401579634621, 13611814135072561278,
13655261125244647696, 1367627386496056834, 1368907909245890092, 13693525876560827283,
13783346438774742614, 13799353263187722717, 13825071784440082496,
13852439084267373191, 13876356431472225791, 14055243717250701608,
14079676299181301772, 14095938998438966337, 14111374107076822891,
14193859431895170587, 14226582801651130532, 14243671177281069512,
14256853800858727521, 14480775929210717493, 14482658293117931546,
14513577387099045298, 14630721578341374856, 14695981039346656037,
14710585101020280896, 1475579823244607677, 14868920869169964081, 14968320160131875803,
14971809093655817917, 15039834196857999838, 15092207615430402812,
15114163911481793350, 15194901817027173566, 15267980678929160412,
15457732070353984570, 15514036435533858158, 15535773470978271326,
15587050164583443069, 155978580751494388, 15695338751700748390, 15997665423159927228,
16066522799090129502, 16066651430762394116, 16112751343173365533,
16130138450758310172, 1614465773938842903, 16292685861617888592, 16335643316870329598,
16423314183614230717, 16570804352575357627, 1682585410644922036, 16858955978146406642,
16990567851129491937, 17017923349298346219, 17097380490166623672,
17109238199226571972, 17204844226884380288, 17291806236368054941,
17351543633914244545, 17439059603042731363, 17574002783607647274,
17624147599670377042, 17633734304611248415, 17683972236092287897,
17849680105131524334, 17939405613729073960, 17956969551821596225,
17978774977754553159, 17984632978012874803, 17997967489723066537,
18147627057830191163, 18150909006539876521, 18159703063075866524,
18246404330670877335, 18294908219222222902, 18392881921099771407,
18446744073709551613, 191060519014405309, 2032008861530788751, 2128122064571842954,
2147483647, 2147745794, 2380224015317016190, 2478231962306073784,
2532538262737333146, 2589926981877829912, 2597124982561782591, 2600364143812063535,
2717025511528702475, 2734787258623754862, 27407921587843457, 2760663353550280147,
2797129108883749491, 2810460305047003196, 292198192373389586, 2934149816356927366,
3045986759481489935, 3178468437029279937, 3200333496547938354, 3320026265773918739,
3320767229281015341, 3341747963119755850, 3407972863931386250, 3413052607651207697,
3413886037471417852, 3421197789791424393, 3421213182954201407, 3425260965299690882,
3538022140597504361, 3575761800716667678, 3588624367609827560, 3626142665768487764,
3642525650883269872, 3656637464651387014, 3660705254426876796, 3769837838875367802,
3778500091710709090, 3796405623695665524, 3869935012404164040, 3890769468012566366,
3890794756780010537, 397780960855462669, 4030236413975199654, 4088976323439621041,
4454255944391929578, 4501656691368064027, 4578480846255629462, 4821863173800309721,
4931721628717906635, 506634811745884560, 5132256620104998637, 5183687599225757871,
521157249538507889, 5219431737322569038, 541172992193764396, 5415426428750045503,
5449730069165757263, 5587557070429522647, 5614586596107908838, 576626207276463000,
5942282052525294911, 5945487981219695001, 5984963105389676759, 607197993339007484,
6088115528707848728, 6116246686670134098, 6180361713414290679, 6195833633417633900,
6274014997237900919, 640589622539783622, 6461429591783621719, 6491986958834001955,
6508141243778577344, 6605813339339102567, 682250828679635420, 6827032273910657891,
6943102301517884811, 700598796416086955, 7080175711202577138, 7175363135479931834,
7315838824213522000, 7412338704062093516, 7516148236133302073, 7574774749059321801,
7701683279824397773, 7775177810774851294, 7810436520414958497, 7878537243757499832,
79089792725215063, 7982848972385914508, 8052533790968282297, 8129411991672431889,
8146185202538899243, 835151375515278827, 8381292265993977266, 8408095252303317471,
8473756179280619170, 8478833628889826985, 8612208440357175863, 8697424601205169055,
8698326794961817906, 8709004393777297355, 8727477769544302060, 8760312338504300643,
8799118153397725683, 8873858923435176895, 8994091295115840290, 9007106680104765185,
9061219083560670602, 9149947745824492274, 917638920165491138, 9234894663364701749,
9333057603143916814, 9384605490088500348, 9531326785919727076, 9555688264681862794,
9559632696372799208, 9903758755917170407
10063651499895178962, 10235971842993272939, 10296494671777307979, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
10336842116636872171, 10374841591685794123, 10393903804869831898, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
10463926208560207521, 10484659978517092504, 10501212300031893463, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
10545868833523019926, 10657751674541025650, 106672141413120087, 10734127004244879770, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
10829648878147112121, 1099511628211, 11073283311104541690, 1109067043404435916, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
11109294216876344399, 11266044540366291518, 11385275378891906608, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
11771945869106552231, 11801746708619571308, 11818825521849580123, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
11913842725949116895, 12027963942392743532, 12094027092655598256, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
12343334044036541897, 12445177985737237804, 12445232961318634374, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
12574535824074203265, 12679195163651834776, 12709986806548166638, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
12718416789200275332, 12785322942775634499, 12790084614253405985, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
12969190449276002545, 13014156621614176974, 13029357933491444455, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
13135068273077306806, 13260224381505715848, 13316211011159594063, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
13464308873961738403, 13544031715334011032, 13581776705111912829, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
13599785766252827703, 13611051401579634621, 13611814135072561278, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
13655261125244647696, 1367627386496056834, 1368907909245890092, 13693525876560827283, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
13783346438774742614, 13799353263187722717, 13825071784440082496, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
13852439084267373191, 13876356431472225791, 14055243717250701608, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
14079676299181301772, 14095938998438966337, 14111374107076822891, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
14193859431895170587, 14226582801651130532, 14243671177281069512, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
14256853800858727521, 14480775929210717493, 14482658293117931546, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
14513577387099045298, 14630721578341374856, 14695981039346656037, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
14710585101020280896, 1475579823244607677, 14868920869169964081, 14968320160131875803, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
14971809093655817917, 15039834196857999838, 15092207615430402812, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
15114163911481793350, 15194901817027173566, 15267980678929160412, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
15457732070353984570, 15514036435533858158, 15535773470978271326, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
15587050164583443069, 155978580751494388, 15695338751700748390, 15997665423159927228, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
16066522799090129502, 16066651430762394116, 16112751343173365533, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
16130138450758310172, 1614465773938842903, 16292685861617888592, 16335643316870329598, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
16423314183614230717, 16570804352575357627, 1682585410644922036, 16858955978146406642, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
16990567851129491937, 17017923349298346219, 17097380490166623672, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
17109238199226571972, 17204844226884380288, 17291806236368054941, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
17351543633914244545, 17439059603042731363, 17574002783607647274, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
17624147599670377042, 17633734304611248415, 17683972236092287897, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
17849680105131524334, 17939405613729073960, 17956969551821596225, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
17978774977754553159, 17984632978012874803, 17997967489723066537, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
18147627057830191163, 18150909006539876521, 18159703063075866524, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
18246404330670877335, 18294908219222222902, 18392881921099771407, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
18446744073709551613, 191060519014405309, 2032008861530788751, 2128122064571842954, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
2147483647, 2147745794, 2380224015317016190, 2478231962306073784, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
2532538262737333146, 2589926981877829912, 2597124982561782591, 2600364143812063535, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
2717025511528702475, 2734787258623754862, 27407921587843457, 2760663353550280147, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
2797129108883749491, 2810460305047003196, 292198192373389586, 2934149816356927366, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
3045986759481489935, 3178468437029279937, 3200333496547938354, 3320026265773918739, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
3320767229281015341, 3341747963119755850, 3407972863931386250, 3413052607651207697, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
3413886037471417852, 3421197789791424393, 3421213182954201407, 3425260965299690882, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
3538022140597504361, 3575761800716667678, 3588624367609827560, 3626142665768487764, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
3642525650883269872, 3656637464651387014, 3660705254426876796, 3769837838875367802, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
3778500091710709090, 3796405623695665524, 3869935012404164040, 3890769468012566366, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
3890794756780010537, 397780960855462669, 4030236413975199654, 4088976323439621041, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
4454255944391929578, 4501656691368064027, 4578480846255629462, 4821863173800309721, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
4931721628717906635, 506634811745884560, 5132256620104998637, 5183687599225757871, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
521157249538507889, 5219431737322569038, 541172992193764396, 5415426428750045503, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
5449730069165757263, 5587557070429522647, 5614586596107908838, 576626207276463000, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
5942282052525294911, 5945487981219695001, 5984963105389676759, 607197993339007484, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
6088115528707848728, 6116246686670134098, 6180361713414290679, 6195833633417633900, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
6274014997237900919, 640589622539783622, 6461429591783621719, 6491986958834001955, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
6508141243778577344, 6605813339339102567, 682250828679635420, 6827032273910657891, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
6943102301517884811, 700598796416086955, 7080175711202577138, 7175363135479931834, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
7315838824213522000, 7412338704062093516, 7516148236133302073, 7574774749059321801, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
7701683279824397773, 7775177810774851294, 7810436520414958497, 7878537243757499832, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
79089792725215063, 7982848972385914508, 8052533790968282297, 8129411991672431889, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
8146185202538899243, 835151375515278827, 8381292265993977266, 8408095252303317471, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
8473756179280619170, 8478833628889826985, 8612208440357175863, 8697424601205169055, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
8698326794961817906, 8709004393777297355, 8727477769544302060, 8760312338504300643, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
8799118153397725683, 8873858923435176895, 8994091295115840290, 9007106680104765185, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
9061219083560670602, 9149947745824492274, 917638920165491138, 9234894663364701749, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
9333057603143916814, 9384605490088500348, 9531326785919727076, 9555688264681862794, // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
9559632696372799208, 9903758755917170407 // $ Alert[cs/solorigate/number-of-known-hashes-above-threshold]
};
}
void Literals() {
string[] literals = { // BUG : NumberOfKnownLiteralsAboveThreshold
"(?i)([^a-z]|^)(test)([^a-z]|$)", "(?i)(solarwinds)", "[{0,5}] {1,-16} {2}\t{3,5} {4}\\{5}\n",
"[{0,5}] {1}\n", "[E] {0} {1} {2}",
"\"\\{[0-9a-f-]{36}\\}\"|\"[0-9a-f]{32}\"|\"[0-9a-f]{16}\"", ".CortexPlugin", ".Orion",
"\"EventName\":\"EventManager\",", "\"EventType\":\"Orion\",",
"\\OrionImprovement\\SolarWinds.OrionImprovement.exe",
"0123456789abcdefghijklmnopqrstuvwxyz-_.", "\"sessionId\":\"{0}\",", "\"steps\":[",
"\"Succeeded\":true,", "\"Timestamp\":\"\\/Date({0})\\/\",", "\"userId\":\"{0}\",",
"{0} {1} HTTP/{2}\n", "10140", "144.86.226.0", "154.118.140.0", "172.16.0.0", "18.130.0.0",
"184.72.0.0", "192.168.0.0", "199.201.117.0", "20.140.0.0", "20100", "20220", "217.163.7.0",
"224.0.0.0", "240.0.0.0", "255.240.0.0", "255.254.0.0", "255.255.248.0", "3.0.0.382",
"41.84.159.0", "43140", "4320", "43260", "524287", "583da945-62af-10e8-4902-a8f205c72b2e",
"65280", "71.152.53.0", "74.114.24.0", "8.18.144.0", "87.238.80.0", "96.31.172.0", "983040",
"99.79.0.0", "Administrator", "advapi32.dll", "Apollo", "appsync-api", "avsvmcloud.com",
"api.solarwinds.com", "-root", "-cert", "-universal_ca", "-ca", "-primary_ca", "-timestamp",
"-global", "-secureca", "CloudMonitoring", "MACAddress", "DHCPEnabled", "DHCPServer",
"DNSHostName", "DNSDomainSuffixSearchOrder", "DNSServerSearchOrder", "IPAddress", "IPSubnet",
"DefaultIPGateway", "OSArchitecture", "InstallDate", "Organization", "RegisteredUser",
"fc00::", "fe00::", "fec0::", "ffc0::", "ff00::", "HKCC", "HKCR", "HKCU", "HKDD",
"HKEY_CLASSES_ROOT", "HKEY_CURRENT_CONFIG", "HKEY_CURRENT_USER", "HKEY_DYN_DATA",
"HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography",
"HKEY_PERFOMANCE_DATA", "HKEY_USERS", "HKLM", "HKPD", "HKU", "If-None-Match",
"Microsoft-CryptoAPI/", "Nodes", "Volumes", "Interfaces", "Components", "opensans",
"Organization", "OSArchitecture", "ParentProcessID", "PathName", "ReportWatcherPostpone",
"ReportWatcherRetry", "S-1-5-", "SeRestorePrivilege", "SeShutdownPrivilege",
"SeTakeOwnershipPrivilege", "SolarWinds", "SolarWindsOrionImprovementClient/",
"SourceCodePro", "SourceHanSans", "SourceHanSerif", "SourceSerifPro", "Start", "swip/Events",
"swip/upd/", "swip/Upload.ashx", "SYSTEM", "SYSTEM\\CurrentControlSet\\services", "us-east-1",
"us-east-2", "us-west-2", "fonts/woff/{0}-{1}-{2}{3}.woff2",
"fonts/woff/{0}-{1}-{2}-webfont{3}.woff2", "ph2eifo3n5utg1j8d94qrvbmk0sal76c",
"pki/crl/{0}{1}{2}.crl", "rq3gsalt6u1iyfzop572d49bnx8cvmkewhj",
"Select * From Win32_NetworkAdapterConfiguration where IPEnabled=true",
"Select * From Win32_OperatingSystem", "Select * From Win32_Process",
"Select * From Win32_SystemDriver", "Select * From Win32_UserAccount"
"(?i)([^a-z]|^)(test)([^a-z]|$)", "(?i)(solarwinds)", "[{0,5}] {1,-16} {2}\t{3,5} {4}\\{5}\n", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"[{0,5}] {1}\n", "[E] {0} {1} {2}", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"\"\\{[0-9a-f-]{36}\\}\"|\"[0-9a-f]{32}\"|\"[0-9a-f]{16}\"", ".CortexPlugin", ".Orion", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"\"EventName\":\"EventManager\",", "\"EventType\":\"Orion\",", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"\\OrionImprovement\\SolarWinds.OrionImprovement.exe", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"0123456789abcdefghijklmnopqrstuvwxyz-_.", "\"sessionId\":\"{0}\",", "\"steps\":[", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"\"Succeeded\":true,", "\"Timestamp\":\"\\/Date({0})\\/\",", "\"userId\":\"{0}\",", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"{0} {1} HTTP/{2}\n", "10140", "144.86.226.0", "154.118.140.0", "172.16.0.0", "18.130.0.0", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"184.72.0.0", "192.168.0.0", "199.201.117.0", "20.140.0.0", "20100", "20220", "217.163.7.0", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"224.0.0.0", "240.0.0.0", "255.240.0.0", "255.254.0.0", "255.255.248.0", "3.0.0.382", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"41.84.159.0", "43140", "4320", "43260", "524287", "583da945-62af-10e8-4902-a8f205c72b2e", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"65280", "71.152.53.0", "74.114.24.0", "8.18.144.0", "87.238.80.0", "96.31.172.0", "983040", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"99.79.0.0", "Administrator", "advapi32.dll", "Apollo", "appsync-api", "avsvmcloud.com", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"api.solarwinds.com", "-root", "-cert", "-universal_ca", "-ca", "-primary_ca", "-timestamp", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"-global", "-secureca", "CloudMonitoring", "MACAddress", "DHCPEnabled", "DHCPServer", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"DNSHostName", "DNSDomainSuffixSearchOrder", "DNSServerSearchOrder", "IPAddress", "IPSubnet", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"DefaultIPGateway", "OSArchitecture", "InstallDate", "Organization", "RegisteredUser", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"fc00::", "fe00::", "fec0::", "ffc0::", "ff00::", "HKCC", "HKCR", "HKCU", "HKDD", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"HKEY_CLASSES_ROOT", "HKEY_CURRENT_CONFIG", "HKEY_CURRENT_USER", "HKEY_DYN_DATA", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"HKEY_PERFOMANCE_DATA", "HKEY_USERS", "HKLM", "HKPD", "HKU", "If-None-Match", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"Microsoft-CryptoAPI/", "Nodes", "Volumes", "Interfaces", "Components", "opensans", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"Organization", "OSArchitecture", "ParentProcessID", "PathName", "ReportWatcherPostpone", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"ReportWatcherRetry", "S-1-5-", "SeRestorePrivilege", "SeShutdownPrivilege", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"SeTakeOwnershipPrivilege", "SolarWinds", "SolarWindsOrionImprovementClient/", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"SourceCodePro", "SourceHanSans", "SourceHanSerif", "SourceSerifPro", "Start", "swip/Events", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"swip/upd/", "swip/Upload.ashx", "SYSTEM", "SYSTEM\\CurrentControlSet\\services", "us-east-1", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"us-east-2", "us-west-2", "fonts/woff/{0}-{1}-{2}{3}.woff2", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"fonts/woff/{0}-{1}-{2}-webfont{3}.woff2", "ph2eifo3n5utg1j8d94qrvbmk0sal76c", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"pki/crl/{0}{1}{2}.crl", "rq3gsalt6u1iyfzop572d49bnx8cvmkewhj", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"Select * From Win32_NetworkAdapterConfiguration where IPEnabled=true", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"Select * From Win32_OperatingSystem", "Select * From Win32_Process", // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
"Select * From Win32_SystemDriver", "Select * From Win32_UserAccount" // $ Alert[cs/solorigate/number-of-known-literals-above-threshold]
};
}
void SwallowExceptionTest()
@@ -286,15 +286,15 @@ class TestCases
Literals();
}
catch // BUG : SwallowEverythingExceptionHandler
{}
{} // $ Alert[cs/solorigate/swallow-everything-exception]
try{
Literals();
}
catch( Exception e) // BUG : SwallowEverythingExceptionHandler
{
//
}
//
} // $ Alert[cs/solorigate/swallow-everything-exception]
try{
Literals();

View File

@@ -2,7 +2,7 @@
<div>
<p>Value from InputText: @Value</p>
<p>Raw value from InputText: @(new MarkupString(Value))</p>
<p>Raw value from InputText: @(new MarkupString(Value))</p> @* $ Alert[cs/web/xss]=r1 *@
</div>
@code {

View File

@@ -8,7 +8,7 @@
<h3>Route parameter</h3>
<p>Go to: <a href="/test/@XssUrl">/test/@XssUrl</a></p>
<p>Parameter from URL: @UrlParam</p>
<p>Raw parameter from URL: @((MarkupString)UrlParam)</p>
<p>Raw parameter from URL: @((MarkupString)UrlParam)</p> @* $ Alert[cs/web/xss]=r2 $ Alert[cs/web/xss]=r2 *@
</div>
<hr />
@@ -17,7 +17,7 @@
<h3>Query parameter</h3>
<p>Go to: <a href="/test/?qs=@XssUrl">/test/?qs=@XssUrl</a></p>
<p>Parameter from query string: @QueryParam</p>
<p>Raw parameter from query string: @(new MarkupString(QueryParam))</p>
<p>Raw parameter from query string: @(new MarkupString(QueryParam))</p> @* $ Alert[cs/web/xss]=r3 $ Alert[cs/web/xss]=r3 *@
</div>
<hr />
@@ -82,7 +82,7 @@
</div>
<div>
<MyOutput Value="@QueryParam" />
<MyOutput Value="@QueryParam" /> @* $ Source[cs/web/xss]=r1 *@
</div>
@code {

View File

@@ -16,3 +16,4 @@ nodes
| BlazorTest/Components/Pages/TestPage.razor:85:23:85:32 | access to property QueryParam : String | semmle.label | access to property QueryParam : String |
| BlazorTest/obj/Debug/net10.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components/Pages/TestPage_razor.g.cs:553:16:561:13 | call to method TypeCheck<String> : String | semmle.label | call to method TypeCheck<String> : String |
subpaths
testFailures

View File

@@ -1,2 +1,4 @@
query: Security Features/CWE-079/XSS.ql
postprocess: utils/test/PrettyPrintModels.ql
postprocess:
- utils/test/PrettyPrintModels.ql
- utils/test/InlineExpectationsTestQuery.ql

View File

@@ -2,7 +2,7 @@
<div>
<p>Value from InputText: @Value</p>
<p>Raw value from InputText: @(new MarkupString(Value))</p>
<p>Raw value from InputText: @(new MarkupString(Value))</p> @* $ Alert[cs/web/xss]=r1 *@
</div>
@code {

View File

@@ -8,7 +8,7 @@
<h3>Route parameter</h3>
<p>Go to: <a href="/test/@XssUrl">/test/@XssUrl</a></p>
<p>Parameter from URL: @UrlParam</p>
<p>Raw parameter from URL: @((MarkupString)UrlParam)</p>
<p>Raw parameter from URL: @((MarkupString)UrlParam)</p> @* $ Alert[cs/web/xss]=r2 $ Alert[cs/web/xss]=r2 *@
</div>
<hr />
@@ -17,7 +17,7 @@
<h3>Query parameter</h3>
<p>Go to: <a href="/test/?qs=@XssUrl">/test/?qs=@XssUrl</a></p>
<p>Parameter from query string: @QueryParam</p>
<p>Raw parameter from query string: @(new MarkupString(QueryParam))</p>
<p>Raw parameter from query string: @(new MarkupString(QueryParam))</p> @* $ Alert[cs/web/xss]=r3 $ Alert[cs/web/xss]=r3 *@
</div>
<hr />
@@ -82,7 +82,7 @@
</div>
<div>
<MyOutput Value="@QueryParam" />
<MyOutput Value="@QueryParam" /> @* $ Source[cs/web/xss]=r1 *@
</div>
@code {

View File

@@ -16,3 +16,4 @@ nodes
| BlazorTest/Components/Pages/TestPage.razor:85:23:85:32 | access to property QueryParam : String | semmle.label | access to property QueryParam : String |
| BlazorTest/obj/Debug/net8.0/generated/Microsoft.CodeAnalysis.Razor.Compiler/Microsoft.NET.Sdk.Razor.SourceGenerators.RazorSourceGenerator/Components_Pages_TestPage_razor.g.cs:497:59:505:13 | call to method TypeCheck<String> : String | semmle.label | call to method TypeCheck<String> : String |
subpaths
testFailures

View File

@@ -1,2 +1,4 @@
query: Security Features/CWE-079/XSS.ql
postprocess: utils/test/PrettyPrintModels.ql
postprocess:
- utils/test/PrettyPrintModels.ql
- utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1 @@
Telemetry/DatabaseQualityDiagnostics.ql
query: Telemetry/DatabaseQualityDiagnostics.ql

View File

@@ -1 +1 @@
Telemetry/DatabaseQualityDiagnostics.ql
query: Telemetry/DatabaseQualityDiagnostics.ql

View File

@@ -1,13 +1,51 @@
private import csharp as CS
private import semmle.code.asp.AspNet as ASP
private import codeql.util.test.InlineExpectationsTest
module Impl implements InlineExpectationsTestSig {
private newtype TExpectationComment =
TCSharpComment(CS::SinglelineComment c) or
TXmlComment(CS::XmlComment c) or
TAspComment(ASP::AspComment c)
/**
* A class representing line comments in C# used by the InlineExpectations core code
* A class representing comments that may contain inline expectations.
* Supports C# single-line comments (`//`), XML comments (`<!-- -->`), and
* ASP.NET comments (`<!-- -->` and `<%-- --%>`) in their respective file types.
*/
class ExpectationComment extends CS::SinglelineComment {
/** Gets the contents of the given comment, _without_ the preceding comment marker (`//`). */
string getContents() { result = this.getText() }
class ExpectationComment extends TExpectationComment {
CS::SinglelineComment asCSharpComment() { this = TCSharpComment(result) }
CS::XmlComment asXmlComment() { this = TXmlComment(result) }
ASP::AspComment asAspComment() { this = TAspComment(result) }
/** Gets the contents of this comment, _without_ the preceding comment marker. */
string getContents() {
result = this.asCSharpComment().getText()
or
result = this.asXmlComment().getText()
or
result = this.asAspComment().getBody()
}
/** Gets the location of this comment. */
Location getLocation() {
result = this.asCSharpComment().getLocation()
or
result = this.asXmlComment().getLocation()
or
result = this.asAspComment().getLocation()
}
/** Gets a textual representation of this comment. */
string toString() {
result = this.asCSharpComment().toString()
or
result = this.asXmlComment().toString()
or
result = this.asAspComment().toString()
}
}
class Location = CS::Location;

View File

@@ -16,6 +16,6 @@ public class PersonBad : ISerializable
[OnDeserializing]
void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context)
{
Age = info.GetInt32("age"); // BAD - write is unsafe
Age = info.GetInt32("age"); // $ Alert[cs/serialization-check-bypass] // BAD - write is unsafe
}
}

View File

@@ -9,9 +9,9 @@ namespace RequestForgery.Controllers
{
[HttpPost]
[ValidateAntiForgeryToken]
public async Task<ActionResult> Bad(string url)
public async Task<ActionResult> Bad(string url) // $ Source=r1
{
var request = new HttpRequestMessage(HttpMethod.Get, url);
var request = new HttpRequestMessage(HttpMethod.Get, url); // $ Alert=r1
var client = new HttpClient();
await client.SendAsync(request);

View File

@@ -1 +1,2 @@
experimental/CWE-918/RequestForgery.ql
query: experimental/CWE-918/RequestForgery.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -15,9 +15,9 @@ public class Test
// BAD - Hash without a salt.
public static String HashPassword(string password, string strAlgName ="SHA256")
{
IBuffer passBuff = CryptographicBuffer.ConvertStringToBinary(password, BinaryStringEncoding.Utf8);
IBuffer passBuff = CryptographicBuffer.ConvertStringToBinary(password, BinaryStringEncoding.Utf8); // $ Source
HashAlgorithmProvider algProvider = HashAlgorithmProvider.OpenAlgorithm(strAlgName);
IBuffer hashBuff = algProvider.HashData(passBuff);
IBuffer hashBuff = algProvider.HashData(passBuff); // $ Alert
return CryptographicBuffer.EncodeToBase64String(hashBuff);
}
@@ -35,8 +35,8 @@ public class Test
public static string HashPassword(string password)
{
SHA256 sha256Hash = SHA256.Create();
byte[] passBytes = System.Text.Encoding.ASCII.GetBytes(password);
byte[] hashBytes = sha256Hash.ComputeHash(passBytes);
byte[] passBytes = System.Text.Encoding.ASCII.GetBytes(password); // $ Source
byte[] hashBytes = sha256Hash.ComputeHash(passBytes); // $ Alert
return Convert.ToBase64String(hashBytes);
}
@@ -47,11 +47,11 @@ public class Test
byte[] saltBytes = GenerateSalt();
// Add the salt to the hash.
byte[] rawSalted = new byte[passBytes.Length + saltBytes.Length];
byte[] rawSalted = new byte[passBytes.Length + saltBytes.Length];
passBytes.CopyTo(rawSalted, 0);
saltBytes.CopyTo(rawSalted, passBytes.Length);
//Create the salted hash.
//Create the salted hash.
SHA256 sha256 = SHA256.Create();
byte[] saltedPassBytes = sha256.ComputeHash(rawSalted);
@@ -67,8 +67,8 @@ public class Test
public static string HashPassword3(string password)
{
HashAlgorithm hashAlg = new SHA256CryptoServiceProvider();
byte[] passBytes = System.Text.Encoding.ASCII.GetBytes(password);
byte[] hashBytes = hashAlg.ComputeHash(passBytes);
byte[] passBytes = System.Text.Encoding.ASCII.GetBytes(password); // $ Source
byte[] hashBytes = hashAlg.ComputeHash(passBytes); // $ Alert
return Convert.ToBase64String(hashBytes);
}
@@ -164,7 +164,7 @@ public class Test
StringBuilder sb = new StringBuilder ();
foreach (byte b in result)
sb.Append (b.ToString ("x2"));
return sb.ToString ();
}

View File

@@ -1,2 +1,4 @@
query: experimental/Security Features/CWE-759/HashWithoutSalt.ql
postprocess: utils/test/PrettyPrintModels.ql
postprocess:
- utils/test/PrettyPrintModels.ql
- utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql
query: experimental/Security Features/JsonWebTokenHandler/delegated-security-validations-always-return-true.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -98,8 +98,8 @@ namespace JsonWebTokenHandlerTest
SaveSigninToken = true
};
tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // BUG delegated-security-validations-always-return-true
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => true; // BUG delegated-security-validations-always-return-true
tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true]
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => true; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true]
tokenValidationParamsBaseline.TokenReplayValidator = (DateTime? expirationTime, string securityToken, TokenValidationParameters validationParameters) => // GOOD
{
if (securityToken is null)
@@ -111,12 +111,12 @@ namespace JsonWebTokenHandlerTest
tokenValidationParamsBaseline.LifetimeValidator = (notBefore, expires, securityToken, validationParameters) => ValidateLifetime02(securityToken, validationParameters); // GOOD
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => {return securityToken is null?false:true; }; // GOOD
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return true; }; // BUG
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => !false ; // BUG
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return securityToken is null?true:true; }; // BUG
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return ValidateLifetimeAlwaysTrue(securityToken, validationParameters);}; //BUG
tokenValidationParamsBaseline.AudienceValidator = (audiences, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); //BUG
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return true; }; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => !false ; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return securityToken is null?true:true; }; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] // BUG
tokenValidationParamsBaseline.AudienceValidator = (IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) => { return ValidateLifetimeAlwaysTrue(securityToken, validationParameters);}; // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] //BUG
tokenValidationParamsBaseline.AudienceValidator = (audiences, securityToken, validationParameters) => ValidateLifetimeAlwaysTrue(securityToken, validationParameters); // $ Alert[cs/json-webtoken-handler/delegated-security-validations-always-return-true] //BUG
}
@@ -134,4 +134,4 @@ namespace JsonWebTokenHandlerTest
return !false;
}
}
}
}

View File

@@ -28,16 +28,16 @@ namespace JsonWebTokenHandlerTest
ClockSkew = TimeSpan.FromMinutes(5),
ValidateActor = false,
ValidateIssuerSigningKey = false,
ValidateIssuer = false, // BUG
ValidateAudience = false, // BUG
ValidateLifetime = false, // BUG
RequireExpirationTime = false, // BUG
ValidateIssuer = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG
ValidateAudience = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG
ValidateLifetime = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG
RequireExpirationTime = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG
ValidateTokenReplay = false,
RequireSignedTokens = false,
RequireAudience = false, // BUG
RequireAudience = false, // $ Alert[cs/json-webtoken-handler/security-validations-disabled] // BUG
SaveSigninToken = false
};
}
}
}
}

View File

@@ -1 +1,2 @@
experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.ql
query: experimental/Security Features/JsonWebTokenHandler/security-validation-disabled.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
experimental/Security Features/Serialization/DefiningDatasetRelatedType.ql
query: experimental/Security Features/Serialization/DefiningDatasetRelatedType.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.ql
query: experimental/Security Features/Serialization/DefiningPotentiallyUnsafeXmlSerializer.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.ql
query: experimental/Security Features/Serialization/UnsafeTypeUsedDataContractSerializer.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
experimental/Security Features/Serialization/XmlDeserializationWithDataSet.ql
query: experimental/Security Features/Serialization/XmlDeserializationWithDataSet.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -8,9 +8,9 @@ using System.Collections.Generic;
namespace DataSetSerializationTest
{
public class DerivesFromDeprecatedType1 : XmlSerializer // warning:DefiningDatasetRelatedType.ql
public class DerivesFromDeprecatedType1 : XmlSerializer // $ Alert[cs/dataset-serialization/defining-dataset-related-type] // warning:DefiningDatasetRelatedType.ql
{
public DataSet MyDataSet { get; set; } // bug:DefiningPotentiallyUnsafeXmlSerializer.ql
public DataSet MyDataSet { get; set; } // $ Alert[cs/dataset-serialization/defining-potentially-unsafe-xml-serializer] // bug:DefiningPotentiallyUnsafeXmlSerializer.ql
public DerivesFromDeprecatedType1()
{
@@ -54,9 +54,9 @@ namespace DataSetSerializationTest
*/
[Serializable()]
public class AttributeSerializer01 // warning:DefiningDatasetRelatedType.ql
public class AttributeSerializer01 // $ Alert[cs/dataset-serialization/defining-dataset-related-type] // warning:DefiningDatasetRelatedType.ql
{
private DataSet MyDataSet; // bug:DefiningPotentiallyUnsafeXmlSerializer.ql
private DataSet MyDataSet; // $ Alert[cs/dataset-serialization/defining-potentially-unsafe-xml-serializer] // bug:DefiningPotentiallyUnsafeXmlSerializer.ql
AttributeSerializer01()
{
@@ -83,15 +83,15 @@ namespace DataSetSerializationTest
{
DataTable newTable = new DataTable();
System.Xml.XmlTextReader reader = new System.Xml.XmlTextReader(fs);
newTable.ReadXmlSchema(reader); //bug:XmlDeserializationWithDataSet.ql
newTable.ReadXmlSchema(reader); // $ Alert[cs/dataset-serialization/xml-deserialization-with-dataset] //bug:XmlDeserializationWithDataSet.ql
}
}
static void Main(string[] args)
{
XmlSerializer x = new XmlSerializer(typeof(DataSet)); // bug:UnsafeTypeUsedDataContractSerializer.ql
XmlSerializer y = new XmlSerializer(typeof(AttributeSerializer01)); //bug:UnsafeTypeUsedDataContractSerializer.ql
XmlSerializer x = new XmlSerializer(typeof(DataSet)); // $ Alert[cs/dataset-serialization/unsafe-type-used-data-contract-serializer] // bug:UnsafeTypeUsedDataContractSerializer.ql
XmlSerializer y = new XmlSerializer(typeof(AttributeSerializer01)); // $ Alert[cs/dataset-serialization/unsafe-type-used-data-contract-serializer] //bug:UnsafeTypeUsedDataContractSerializer.ql
Console.WriteLine("Hello World!");
}

View File

@@ -1 +1,2 @@
experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql
query: experimental/Security Features/backdoor/DangerousNativeFunctionCall.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
experimental/Security Features/backdoor/PotentialTimeBomb.ql
query: experimental/Security Features/backdoor/PotentialTimeBomb.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1,2 @@
experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql
query: experimental/Security Features/backdoor/ProcessNameToHashTaintFlow.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -29,7 +29,7 @@ class External
void TestDangerousNativeFunctionCall()
{
InitiateSystemShutdownExW(null, null, 0U, true, true, 2147745794U); // BUG : DangerousNativeFunctionCall
InitiateSystemShutdownExW(null, null, 0U, true, true, 2147745794U); // $ Alert[cs/backdoor/dangerous-native-functions] // BUG : DangerousNativeFunctionCall
}
ulong GetFvnHash(string s)
@@ -66,12 +66,12 @@ class External
void TestTimeBomb()
{
DateTime lastWriteTime = System.IO.File.GetLastWriteTime("someFile");
DateTime lastWriteTime = System.IO.File.GetLastWriteTime("someFile"); // $ Source[cs/backdoor/potential-time-bomb]
int num = new Random().Next(288, 336);
if (DateTime.Now.CompareTo(lastWriteTime.AddHours((double)num)) >= 0) // BUG : Potential time bomb, currently not detected
if (DateTime.Now.CompareTo(lastWriteTime.AddHours((double)num)) >= 0) // $ Sink[cs/backdoor/potential-time-bomb] // BUG : Potential time bomb, currently not detected
{
// Some code here
}
} // $ Alert[cs/backdoor/potential-time-bomb]
}
}
}

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
Diagnostics/CompilerError.ql
query: Diagnostics/CompilerError.ql

View File

@@ -1 +1 @@
Diagnostics/CompilerMessage.ql
query: Diagnostics/CompilerMessage.ql

View File

@@ -1 +1 @@
Diagnostics/ExtractorError.ql
query: Diagnostics/ExtractorError.ql

View File

@@ -1 +1 @@
Diagnostics/ExtractorMessage.ql
query: Diagnostics/ExtractorMessage.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
definitions.ql
query: definitions.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
Diagnostics/DiagnosticExtractionErrors.ql
query: Diagnostics/DiagnosticExtractionErrors.ql

View File

@@ -1 +1 @@
Diagnostics/ExtractedFiles.ql
query: Diagnostics/ExtractedFiles.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
filters/ClassifyFiles.ql
query: filters/ClassifyFiles.ql

View File

@@ -135,7 +135,7 @@ UrlParam
__builder.AddContent(18, "Raw parameter from URL: ");
__builder.AddContent(19,
#nullable restore
(MarkupString)UrlParam
(MarkupString)UrlParam // $ Alert=r1 $ Alert=r1
#line default
#line hidden
@@ -185,7 +185,7 @@ QueryParam
__builder.AddContent(35, "Raw parameter from query string: ");
__builder.AddContent(36,
#nullable restore
new MarkupString(QueryParam)
new MarkupString(QueryParam) // $ Alert=r2 $ Alert=r2
#line default
#line hidden

View File

@@ -10,7 +10,7 @@ namespace VulnerableBlazorApp.Components
{
builder.OpenElement(0, "div");
builder.OpenElement(1, "p");
builder.AddContent(2, (MarkupString)TheName);
builder.AddContent(2, (MarkupString)TheName); // $ Alert=r3 $ Alert=r4
builder.CloseElement();
builder.CloseElement();
}
@@ -19,4 +19,4 @@ namespace VulnerableBlazorApp.Components
[Parameter]
public string TheName { get; set; }
}
}
}

View File

@@ -28,7 +28,7 @@ namespace VulnerableBlazorApp.Components
builder.OpenElement(6, "p");
builder.AddContent(7, "Name: ");
builder.OpenComponent<VulnerableBlazorApp.Components.Name>(8);
builder.AddComponentParameter(9, nameof(VulnerableBlazorApp.Components.Name.TheName), Name);
builder.AddComponentParameter(9, nameof(VulnerableBlazorApp.Components.Name.TheName), Name); // $ Source=r4
builder.CloseComponent();
builder.CloseElement();
}
@@ -47,4 +47,4 @@ namespace VulnerableBlazorApp.Components
public List<string> Names { get; set; } = new List<string>();
}
}
}

View File

@@ -28,7 +28,7 @@ namespace VulnerableBlazorApp.Components
builder.OpenElement(6, "p");
builder.AddContent(7, "Name: ");
builder.OpenComponent<VulnerableBlazorApp.Components.Name>(8);
builder.AddComponentParameter(9, "TheName", Name);
builder.AddComponentParameter(9, "TheName", Name); // $ Source=r3
builder.CloseComponent();
builder.CloseElement();
}
@@ -47,4 +47,4 @@ namespace VulnerableBlazorApp.Components
public List<string> Names { get; set; } = new List<string>();
}
}
}

View File

@@ -1,2 +1,4 @@
query: Security Features/CWE-079/XSS.ql
postprocess: utils/test/PrettyPrintModels.ql
postprocess:
- utils/test/PrettyPrintModels.ql
- utils/test/InlineExpectationsTestQuery.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1 @@
shared/PrintAst.ql
query: shared/PrintAst.ql

View File

@@ -1 +1,2 @@
API Abuse/CallToGCCollect.ql
query: API Abuse/CallToGCCollect.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -4,6 +4,6 @@ class Bad
{
void M()
{
GC.Collect();
GC.Collect(); // $ Alert
}
}

View File

@@ -16,7 +16,7 @@ class Program
static void Main(string[] args)
{
// BAD: Call to obsolete method
ObsoleteMethod();
ObsoleteMethod(); // $ Alert
// GOOD: Call to non-obsolete method
NotObsoleteMethod();

View File

@@ -1 +1,2 @@
API Abuse/CallToObsoleteMethod.ql
query: API Abuse/CallToObsoleteMethod.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -4,7 +4,7 @@ class Bad
{
void M()
{
Logger.Log("Hello, World!");
Logger.Log("Hello, World!"); // $ Alert
}
static class Logger

View File

@@ -1,7 +1,7 @@
using System;
// BAD
class Incorrect
class Incorrect // $ Alert
{
public static bool operator ==(Incorrect a, Incorrect b) => default(bool);
public static bool operator !=(Incorrect a, Incorrect b) => !(a == b);
@@ -21,7 +21,7 @@ class Correct
}
// BAD: needs to redefine Equals
class IncorrectOverrides : Correct
class IncorrectOverrides : Correct // $ Alert
{
public static bool operator ==(IncorrectOverrides a, IncorrectOverrides b) => default(bool);
public static bool operator !=(IncorrectOverrides a, IncorrectOverrides b) => !(a == b);
@@ -47,7 +47,7 @@ class Program
}
// BAD: should also implement Equals.
class MyEquatable : IEquatable<MyEquatable>
class MyEquatable : IEquatable<MyEquatable> // $ Alert
{
public bool Equals(MyEquatable other)
{

View File

@@ -1 +1,2 @@
API Abuse/ClassDoesNotImplementEquals.ql
query: API Abuse/ClassDoesNotImplementEquals.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

View File

@@ -21,7 +21,7 @@ class Bad
}
}
class GasolineCar : Car
class GasolineCar : Car // $ Alert
{
protected bool unleaded;

View File

@@ -1 +1,2 @@
API Abuse/ClassImplementsICloneable.ql
query: API Abuse/ClassImplementsICloneable.ql
postprocess: utils/test/InlineExpectationsTestQuery.ql

Some files were not shown because too many files have changed in this diff Show More