hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Add some implicit toString data flow test cases.

Browse Source
This commit is contained in:
Michael Nebel
2025-01-08 14:06:29 +01:00
parent 6b182c5ebd
commit 261b8db144
3 changed files with 82 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
csharp/ql/test/library-tests/dataflow/implicittostring/implicitToString.cs Normal file
View File

@@ -0,0 +1,43 @@
using System;
public class TestClass
{
public class MyClass()
{
public override string ToString()
{
return "tainted";
}
}
public static void Sink(object o) { }
public void M1()
{
var x1 = new MyClass();
var x2 = "Hello" + x1.ToString();
Sink(x2);
}
public void M2()
{
var x1 = new MyClass();
var x2 = "Hello" + x1;
Sink(x2); // MISSING
}
public void M3()
{
var x1 = new MyClass();
var x2 = $"Hello {x1.ToString()}";
Sink(x2);
}
public void M4()
{
var x1 = new MyClass();
var x2 = $"Hello {x1}";
Sink(x2); // Missing
}
}

20
csharp/ql/test/library-tests/dataflow/implicittostring/implicitToString.expected Normal file
View File

@@ -0,0 +1,20 @@
models
edges
| implicitToString.cs:9:20:9:28 | "tainted" : String | implicitToString.cs:18:28:18:40 | call to method ToString : String | provenance | |
| implicitToString.cs:9:20:9:28 | "tainted" : String | implicitToString.cs:32:27:32:39 | call to method ToString : String | provenance | |
| implicitToString.cs:18:13:18:14 | access to local variable x2 : String | implicitToString.cs:19:14:19:15 | access to local variable x2 | provenance | |
| implicitToString.cs:18:28:18:40 | call to method ToString : String | implicitToString.cs:18:13:18:14 | access to local variable x2 : String | provenance | |
| implicitToString.cs:32:13:32:14 | access to local variable x2 : String | implicitToString.cs:33:14:33:15 | access to local variable x2 | provenance | |
| implicitToString.cs:32:27:32:39 | call to method ToString : String | implicitToString.cs:32:13:32:14 | access to local variable x2 : String | provenance | |
nodes
| implicitToString.cs:9:20:9:28 | "tainted" : String | semmle.label | "tainted" : String |
| implicitToString.cs:18:13:18:14 | access to local variable x2 : String | semmle.label | access to local variable x2 : String |
| implicitToString.cs:18:28:18:40 | call to method ToString : String | semmle.label | call to method ToString : String |
| implicitToString.cs:19:14:19:15 | access to local variable x2 | semmle.label | access to local variable x2 |
| implicitToString.cs:32:13:32:14 | access to local variable x2 : String | semmle.label | access to local variable x2 : String |
| implicitToString.cs:32:27:32:39 | call to method ToString : String | semmle.label | call to method ToString : String |
| implicitToString.cs:33:14:33:15 | access to local variable x2 | semmle.label | access to local variable x2 |
subpaths
#select
| implicitToString.cs:9:20:9:28 | "tainted" : String | implicitToString.cs:9:20:9:28 | "tainted" : String | implicitToString.cs:19:14:19:15 | access to local variable x2 | $@ | implicitToString.cs:19:14:19:15 | access to local variable x2 | access to local variable x2 |
| implicitToString.cs:9:20:9:28 | "tainted" : String | implicitToString.cs:9:20:9:28 | "tainted" : String | implicitToString.cs:33:14:33:15 | access to local variable x2 | $@ | implicitToString.cs:33:14:33:15 | access to local variable x2 | access to local variable x2 |

19
csharp/ql/test/library-tests/dataflow/implicittostring/implicitToString.ql Normal file
View File

@@ -0,0 +1,19 @@
import csharp
import utils.test.ProvenancePathGraph::ShowProvenance<Tt::PathNode, Tt::PathGraph>
module TtConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node src) { src.asExpr().(StringLiteral).getValue() = "tainted" }
predicate isSink(DataFlow::Node sink) {
exists(MethodCall mc |
mc.getTarget().hasUndecoratedName("Sink") and
mc.getAnArgument() = sink.asExpr()
)
}
}
module Tt = TaintTracking::Global<TtConfig>;
from Tt::PathNode source, Tt::PathNode sink
where Tt::flowPath(source, sink)
select source, source, sink, "$@", sink, sink.toString()