hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Add missing data-flow for switch expressions

Browse Source
This commit is contained in:
Tom Hvitved
2020-10-07 17:02:01 +02:00
parent 9c503c1591
commit 31816af11e
6 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
View File

@@ -171,6 +171,10 @@ module LocalFlow {
e1 = e2.(ArrayCreation).getInitializer() and
scope = e2 and
isSuccessor = false
or
e1 = e2.(SwitchExpr).getACase().getBody() and
scope = e2 and
isSuccessor = false
)
}

2
csharp/ql/test/library-tests/dataflow/global/DataFlow.expected
View File

@@ -60,3 +60,5 @@
| Splitting.cs:34:19:34:19 | access to local variable x |
| Splitting.cs:41:19:41:19 | access to local variable s |
| Splitting.cs:43:19:43:19 | access to local variable s |
| Splitting.cs:50:19:50:19 | access to local variable s |
| Splitting.cs:52:19:52:19 | access to local variable s |

7
csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected
View File

@@ -242,6 +242,8 @@ edges
| Splitting.cs:31:19:31:25 | [b (line 24): true] access to parameter tainted : String | Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element : String |
| Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | Splitting.cs:41:19:41:19 | access to local variable s |
| Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | Splitting.cs:43:19:43:19 | access to local variable s |
| Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:50:19:50:19 | access to local variable s |
| Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:52:19:52:19 | access to local variable s |
nodes
| Capture.cs:7:20:7:26 | tainted : String | semmle.label | tainted : String |
| Capture.cs:12:19:12:24 | access to local variable sink27 | semmle.label | access to local variable sink27 |
@@ -448,6 +450,9 @@ nodes
| Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | semmle.label | [b (line 37): true] "taint source" : String |
| Splitting.cs:41:19:41:19 | access to local variable s | semmle.label | access to local variable s |
| Splitting.cs:43:19:43:19 | access to local variable s | semmle.label | access to local variable s |
| Splitting.cs:48:36:48:49 | "taint source" : String | semmle.label | "taint source" : String |
| Splitting.cs:50:19:50:19 | access to local variable s | semmle.label | access to local variable s |
| Splitting.cs:52:19:52:19 | access to local variable s | semmle.label | access to local variable s |
#select
| Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x | Splitting.cs:24:28:24:34 | tainted : String | Splitting.cs:32:15:32:15 | [b (line 24): false] access to local variable x | [b (line 24): false] access to local variable x |
| Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | Splitting.cs:24:28:24:34 | tainted : String | Splitting.cs:32:15:32:15 | [b (line 24): true] access to local variable x | [b (line 24): true] access to local variable x |
@@ -456,6 +461,8 @@ nodes
| GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:19:15:19:29 | access to field SinkField0 | access to field SinkField0 |
| Splitting.cs:41:19:41:19 | access to local variable s | Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | Splitting.cs:41:19:41:19 | access to local variable s | access to local variable s |
| Splitting.cs:43:19:43:19 | access to local variable s | Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | Splitting.cs:43:19:43:19 | access to local variable s | access to local variable s |
| Splitting.cs:50:19:50:19 | access to local variable s | Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:50:19:50:19 | access to local variable s | access to local variable s |
| Splitting.cs:52:19:52:19 | access to local variable s | Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:52:19:52:19 | access to local variable s | access to local variable s |
| GlobalDataFlow.cs:72:15:72:19 | access to local variable sink0 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:72:15:72:19 | access to local variable sink0 | access to local variable sink0 |
| GlobalDataFlow.cs:74:15:74:19 | access to local variable sink1 | GlobalDataFlow.cs:18:27:18:40 | "taint source" : String | GlobalDataFlow.cs:74:15:74:19 | access to local variable sink1 | access to local variable sink1 |
| GlobalDataFlow.cs:191:15:191:20 | access to local variable sink10 | GlobalDataFlow.cs:338:16:338:29 | "taint source" : String | GlobalDataFlow.cs:191:15:191:20 | access to local variable sink10 | access to local variable sink10 |

4
csharp/ql/test/library-tests/dataflow/global/Splitting.cs
View File

@@ -47,8 +47,8 @@ class Splitting
{
var s = b switch { true => "taint source", false => "not tainted" };
if (b)
Check(s); // flow [MISSING]
Check(s); // flow
else
Check(s); // no flow
Check(s); // no flow [FALSE POSITIVE]
}
}

2
csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected
View File

@@ -64,3 +64,5 @@
| Splitting.cs:34:19:34:19 | access to local variable x |
| Splitting.cs:41:19:41:19 | access to local variable s |
| Splitting.cs:43:19:43:19 | access to local variable s |
| Splitting.cs:50:19:50:19 | access to local variable s |
| Splitting.cs:52:19:52:19 | access to local variable s |

7
csharp/ql/test/library-tests/dataflow/global/TaintTrackingPath.expected
View File

@@ -249,6 +249,8 @@ edges
| Splitting.cs:31:19:31:25 | [b (line 24): true] access to parameter tainted : String | Splitting.cs:31:17:31:26 | [b (line 24): true] dynamic access to element : String |
| Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | Splitting.cs:41:19:41:19 | access to local variable s |
| Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | Splitting.cs:43:19:43:19 | access to local variable s |
| Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:50:19:50:19 | access to local variable s |
| Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:52:19:52:19 | access to local variable s |
nodes
| Capture.cs:7:20:7:26 | tainted : String | semmle.label | tainted : String |
| Capture.cs:12:19:12:24 | access to local variable sink27 | semmle.label | access to local variable sink27 |
@@ -462,6 +464,9 @@ nodes
| Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | semmle.label | [b (line 37): true] "taint source" : String |
| Splitting.cs:41:19:41:19 | access to local variable s | semmle.label | access to local variable s |
| Splitting.cs:43:19:43:19 | access to local variable s | semmle.label | access to local variable s |
| Splitting.cs:48:36:48:49 | "taint source" : String | semmle.label | "taint source" : String |
| Splitting.cs:50:19:50:19 | access to local variable s | semmle.label | access to local variable s |
| Splitting.cs:52:19:52:19 | access to local variable s | semmle.label | access to local variable s |
#select
| Capture.cs:12:19:12:24 | access to local variable sink27 | Capture.cs:7:20:7:26 | tainted : String | Capture.cs:12:19:12:24 | access to local variable sink27 | access to local variable sink27 |
| Capture.cs:21:23:21:28 | access to local variable sink28 | Capture.cs:7:20:7:26 | tainted : String | Capture.cs:21:23:21:28 | access to local variable sink28 | access to local variable sink28 |
@@ -529,3 +534,5 @@ nodes
| Splitting.cs:34:19:34:19 | access to local variable x | Splitting.cs:24:28:24:34 | tainted : String | Splitting.cs:34:19:34:19 | access to local variable x | access to local variable x |
| Splitting.cs:41:19:41:19 | access to local variable s | Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | Splitting.cs:41:19:41:19 | access to local variable s | access to local variable s |
| Splitting.cs:43:19:43:19 | access to local variable s | Splitting.cs:39:21:39:34 | [b (line 37): true] "taint source" : String | Splitting.cs:43:19:43:19 | access to local variable s | access to local variable s |
| Splitting.cs:50:19:50:19 | access to local variable s | Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:50:19:50:19 | access to local variable s | access to local variable s |
| Splitting.cs:52:19:52:19 | access to local variable s | Splitting.cs:48:36:48:49 | "taint source" : String | Splitting.cs:52:19:52:19 | access to local variable s | access to local variable s |