hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: Set literals.

Browse Source
This commit is contained in:
Geoffrey White
2021-10-13 16:11:59 +01:00
parent 2e61ae244a
commit 3983587682
14 changed files with 108 additions and 460 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
csharp/ql/lib/semmle/code/csharp/Modifier.qll
View File

@@ -19,10 +19,5 @@ class Modifier extends Element, @modifier {
* An access modifier: `public`, `private`, `internal` or `protected`.
*/
class AccessModifier extends Modifier {
AccessModifier() {
hasName("public") or
hasName("private") or
hasName("internal") or
hasName("protected")
}
AccessModifier() { hasName(["public", "private", "internal", "protected"]) }
}

103
csharp/ql/lib/semmle/code/csharp/commons/Collections.qll
View File

@@ -3,23 +3,12 @@
import csharp
private string modifyMethodName() {
result = "Add" or
result = "AddFirst" or
result = "AddLast" or
result = "Clear" or
result = "Enqueue" or
result = "ExceptWith" or
result = "Insert" or
result = "IntersectWith" or
result = "Push" or
result = "Remove" or
result = "RemoveAt" or
result = "RemoveFirst" or
result = "RemoveLast" or
result = "Set" or
result = "SetAll" or
result = "SymmetricExceptWith" or
result = "UnionWith"
result =
[
"Add", "AddFirst", "AddLast", "Clear", "Enqueue", "ExceptWith", "Insert", "IntersectWith",
"Push", "Remove", "RemoveAt", "RemoveFirst", "RemoveLast", "Set", "SetAll",
"SymmetricExceptWith", "UnionWith"
]
}
/** A method call that modifies a collection. */
@@ -39,45 +28,27 @@ class CollectionModificationAccess extends Access {
}
private string collectionTypeName() {
result = "ArrayList" or
result = "BitArray" or
result = "Hashtable" or
result = "ICollection" or
result = "IDictionary" or
result = "IList" or
result = "Queue" or
result = "ReadOnlyCollectionBase" or
result = "SortedList" or
result = "Stack"
result =
[
"ArrayList", "BitArray", "Hashtable", "ICollection", "IDictionary", "IList", "Queue",
"ReadOnlyCollectionBase", "SortedList", "Stack"
]
}
private string collectionNamespaceName() {
result = "Mono.Collections" or
result = "System.Collections"
}
private string collectionNamespaceName() { result = ["Mono.Collections", "System.Collections"] }
private string genericCollectionNamespaceName() {
result = "Mono.Collections.Generic" or
result = "System.Collections.Generic"
result = ["Mono.Collections.Generic", "System.Collections.Generic"]
}
private string genericCollectionTypeName() {
result = "Dictionary<,>" or
result = "HashSet<>" or
result = "ICollection<>" or
result = "IDictionary<,>" or
result = "IList<>" or
result = "ISet<>" or
result = "LinkedList<>" or
result = "List<>" or
result = "Queue<>" or
result = "SortedDictionary<,>" or
result = "SortedList<,>" or
result = "SortedSet<>" or
result = "Stack<>" or
result = "SynchronizedCollection<>" or
result = "SynchronizedKeyedCollection<>" or
result = "SynchronizedReadOnlyCollection<>"
result =
[
"Dictionary<,>", "HashSet<>", "ICollection<>", "IDictionary<,>", "IList<>", "ISet<>",
"LinkedList<>", "List<>", "Queue<>", "SortedDictionary<,>", "SortedList<,>", "SortedSet<>",
"Stack<>", "SynchronizedCollection<>", "SynchronizedKeyedCollection<>",
"SynchronizedReadOnlyCollection<>"
]
}
/** A collection type. */
@@ -105,36 +76,18 @@ class EmptyCollectionCreation extends ObjectCreation {
}
private string readonlyMethodName() {
result = "BinarySearch" or
result = "Clone" or
result = "Contains" or
result = "ContainsKey" or
result = "ContainsValue" or
result = "CopyTo" or
result = "Equals" or
result = "FixedArray" or
result = "FixedSize" or
result = "Get" or
result = "GetEnumerator" or
result = "GetHashCode" or
result = "GetRange" or
result = "IndexOf" or
result = "IsProperSubsetOf" or
result = "IsProperSupersetOf" or
result = "IsSubsetOf" or
result = "IsSupersetOf" or
result = "LastIndexOf" or
result = "MemberwiseClone" or
result = "Peek" or
result = "ToArray" or
result = "ToString" or
result = "TryGetValue"
result =
[
"BinarySearch", "Clone", "Contains", "ContainsKey", "ContainsValue", "CopyTo", "Equals",
"FixedArray", "FixedSize", "Get", "GetEnumerator", "GetHashCode", "GetRange", "IndexOf",
"IsProperSubsetOf", "IsProperSupersetOf", "IsSubsetOf", "IsSupersetOf", "LastIndexOf",
"MemberwiseClone", "Peek", "ToArray", "ToString", "TryGetValue"
]
}
private string noAddMethodName() {
result = readonlyMethodName() or
result = "Dequeue" or
result = "Pop"
result = ["Dequeue", "Pop"]
}
/** Holds if `a` is an access that does not modify a collection. */

24
csharp/ql/lib/semmle/code/csharp/frameworks/JsonNET.qll
View File

@@ -120,21 +120,13 @@ module JsonNET {
SerializedMember() {
// This member has a Json attribute
exists(Class attribute | attribute = this.getAnAttribute().getType() |
attribute.hasName("JsonPropertyAttribute")
or
attribute.hasName("JsonDictionaryAttribute")
or
attribute.hasName("JsonRequiredAttribute")
or
attribute.hasName("JsonArrayAttribute")
or
attribute.hasName("JsonConverterAttribute")
or
attribute.hasName("JsonExtensionDataAttribute")
or
attribute.hasName("SerializableAttribute") // System.SerializableAttribute
or
attribute.hasName("DataMemberAttribute") // System.DataMemberAttribute
attribute
.hasName([
"JsonPropertyAttribute", "JsonDictionaryAttribute", "JsonRequiredAttribute",
"JsonArrayAttribute", "JsonConverterAttribute", "JsonExtensionDataAttribute",
"SerializableAttribute", // System.SerializableAttribute
"DataMemberAttribute" // System.DataMemberAttribute
])
)
or
// This field is a member of an explicitly serialized type
@@ -175,7 +167,7 @@ module JsonNET {
/** Any attribute class that marks a member to not be serialized. */
private class NotSerializedAttributeClass extends JsonClass {
NotSerializedAttributeClass() {
this.hasName("JsonIgnoreAttribute") or this.hasName("NonSerializedAttribute")
this.hasName(["JsonIgnoreAttribute", "NonSerializedAttribute"])
}
}

10
csharp/ql/lib/semmle/code/csharp/frameworks/NHibernate.qll
View File

@@ -28,15 +28,7 @@ module NHibernate {
/** Gets a type parameter that specifies a mapped class. */
TypeParameter getAMappedObjectTp() {
exists(string methodName |
methodName = "Load<>"
or
methodName = "Merge<>"
or
methodName = "Get<>"
or
methodName = "Query<>"
|
exists(string methodName | methodName = ["Load<>", "Merge<>", "Get<>", "Query<>"] |
result = this.getAMethod(methodName).(UnboundGenericMethod).getTypeParameter(0)
)
}

36
csharp/ql/lib/semmle/code/csharp/security/PrivateData.qll
View File

@@ -14,26 +14,22 @@ import semmle.code.csharp.frameworks.system.windows.Forms
/** A string for `match` that identifies strings that look like they represent private data. */
private string privateNames() {
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
// Government identifiers, such as Social Security Numbers
result = "%social%security%number%" or
// Contact information, such as home addresses and telephone numbers
result = "%postcode%" or
result = "%zipcode%" or
result = "%telephone%" or
// Geographic location - where the user is (or was)
result = "%latitude%" or
result = "%longitude%" or
// Financial data - such as credit card numbers, salary, bank accounts, and debts
result = "%creditcard%" or
result = "%salary%" or
result = "%bankaccount%" or
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
result = "%email%" or
result = "%mobile%" or
result = "%employer%" or
// Health - medical conditions, insurance status, prescription records
result = "%medical%"
result =
[
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
// Government identifiers, such as Social Security Numbers
"%social%security%number%",
// Contact information, such as home addresses and telephone numbers
"%postcode%", "%zipcode%", "%telephone%",
// Geographic location - where the user is (or was)
"%latitude%", "%longitude%",
// Financial data - such as credit card numbers, salary, bank accounts, and debts
"%creditcard%", "%salary%", "%bankaccount%",
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
"%email%", "%mobile%", "%employer%",
// Health - medical conditions, insurance status, prescription records
"%medical%"
]
}
/** An expression that might contain private data. */

7
csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsinks/ExternalLocationSink.qll
View File

@@ -38,12 +38,7 @@ class TraceMessageSink extends ExternalLocationSink {
trace.hasQualifiedName("System.Diagnostics", "TraceSource")
|
this.getExpr() = trace.getAMethod().getACall().getArgumentForName(parameterName) and
(
parameterName = "format" or
parameterName = "args" or
parameterName = "message" or
parameterName = "category"
)
parameterName = ["format", "args", "message", "category"]
)
}
}

10
csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll
View File

@@ -43,15 +43,7 @@ class AspNetQueryStringMember extends Member {
* request.
*/
private string getHttpRequestFlowPropertyNames() {
result = "QueryString" or
result = "Headers" or
result = "RawUrl" or
result = "Url" or
result = "Cookies" or
result = "Form" or
result = "Params" or
result = "Path" or
result = "PathInfo"
result = ["QueryString", "Headers", "RawUrl", "Url", "Cookies", "Form", "Params", "Path", "PathInfo"]
}
/** A data flow source of remote user input (ASP.NET query string). */

207
csharp/ql/src/Bad Practices/Magic Constants/MagicConstants.qll
View File

@@ -7,179 +7,30 @@ import semmle.code.csharp.frameworks.System
*/
private predicate trivialPositiveIntValue(string s) {
s = "0" or
s = "1" or
s = "2" or
s = "3" or
s = "4" or
s = "5" or
s = "6" or
s = "7" or
s = "8" or
s = "9" or
s = "10" or
s = "11" or
s = "12" or
s = "13" or
s = "14" or
s = "15" or
s = "16" or
s = "17" or
s = "18" or
s = "19" or
s = "20" or
s = "16" or
s = "32" or
s = "64" or
s = "128" or
s = "256" or
s = "512" or
s = "1024" or
s = "2048" or
s = "4096" or
s = "16384" or
s = "32768" or
s = "65536" or
s = "1048576" or
s = "2147483648" or
s = "4294967296" or
s = "15" or
s = "31" or
s = "63" or
s = "127" or
s = "255" or
s = "511" or
s = "1023" or
s = "2047" or
s = "4095" or
s = "16383" or
s = "32767" or
s = "65535" or
s = "1048577" or
s = "2147483647" or
s = "4294967295" or
s = "0x00000001" or
s = "0x00000002" or
s = "0x00000004" or
s = "0x00000008" or
s = "0x00000010" or
s = "0x00000020" or
s = "0x00000040" or
s = "0x00000080" or
s = "0x00000100" or
s = "0x00000200" or
s = "0x00000400" or
s = "0x00000800" or
s = "0x00001000" or
s = "0x00002000" or
s = "0x00004000" or
s = "0x00008000" or
s = "0x00010000" or
s = "0x00020000" or
s = "0x00040000" or
s = "0x00080000" or
s = "0x00100000" or
s = "0x00200000" or
s = "0x00400000" or
s = "0x00800000" or
s = "0x01000000" or
s = "0x02000000" or
s = "0x04000000" or
s = "0x08000000" or
s = "0x10000000" or
s = "0x20000000" or
s = "0x40000000" or
s = "0x80000000" or
s = "0x00000001" or
s = "0x00000003" or
s = "0x00000007" or
s = "0x0000000f" or
s = "0x0000001f" or
s = "0x0000003f" or
s = "0x0000007f" or
s = "0x000000ff" or
s = "0x000001ff" or
s = "0x000003ff" or
s = "0x000007ff" or
s = "0x00000fff" or
s = "0x00001fff" or
s = "0x00003fff" or
s = "0x00007fff" or
s = "0x0000ffff" or
s = "0x0001ffff" or
s = "0x0003ffff" or
s = "0x0007ffff" or
s = "0x000fffff" or
s = "0x001fffff" or
s = "0x003fffff" or
s = "0x007fffff" or
s = "0x00ffffff" or
s = "0x01ffffff" or
s = "0x03ffffff" or
s = "0x07ffffff" or
s = "0x0fffffff" or
s = "0x1fffffff" or
s = "0x3fffffff" or
s = "0x7fffffff" or
s = "0xffffffff" or
s = "0x0001" or
s = "0x0002" or
s = "0x0004" or
s = "0x0008" or
s = "0x0010" or
s = "0x0020" or
s = "0x0040" or
s = "0x0080" or
s = "0x0100" or
s = "0x0200" or
s = "0x0400" or
s = "0x0800" or
s = "0x1000" or
s = "0x2000" or
s = "0x4000" or
s = "0x8000" or
s = "0x0001" or
s = "0x0003" or
s = "0x0007" or
s = "0x000f" or
s = "0x001f" or
s = "0x003f" or
s = "0x007f" or
s = "0x00ff" or
s = "0x01ff" or
s = "0x03ff" or
s = "0x07ff" or
s = "0x0fff" or
s = "0x1fff" or
s = "0x3fff" or
s = "0x7fff" or
s = "0xffff" or
s = "0x01" or
s = "0x02" or
s = "0x04" or
s = "0x08" or
s = "0x10" or
s = "0x20" or
s = "0x40" or
s = "0x80" or
s = "0x01" or
s = "0x03" or
s = "0x07" or
s = "0x0f" or
s = "0x1f" or
s = "0x3f" or
s = "0x7f" or
s = "0xff" or
s = "0x00" or
s = "10" or
s = "100" or
s = "1000" or
s = "10000" or
s = "100000" or
s = "1000000" or
s = "10000000" or
s = "100000000" or
s = "1000000000"
s =
[
"0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16",
"17", "18", "19", "20", "16", "32", "64", "128", "256", "512", "1024", "2048", "4096",
"16384", "32768", "65536", "1048576", "2147483648", "4294967296", "15", "31", "63", "127",
"255", "511", "1023", "2047", "4095", "16383", "32767", "65535", "1048577", "2147483647",
"4294967295", "0x00000001", "0x00000002", "0x00000004", "0x00000008", "0x00000010",
"0x00000020", "0x00000040", "0x00000080", "0x00000100", "0x00000200", "0x00000400",
"0x00000800", "0x00001000", "0x00002000", "0x00004000", "0x00008000", "0x00010000",
"0x00020000", "0x00040000", "0x00080000", "0x00100000", "0x00200000", "0x00400000",
"0x00800000", "0x01000000", "0x02000000", "0x04000000", "0x08000000", "0x10000000",
"0x20000000", "0x40000000", "0x80000000", "0x00000001", "0x00000003", "0x00000007",
"0x0000000f", "0x0000001f", "0x0000003f", "0x0000007f", "0x000000ff", "0x000001ff",
"0x000003ff", "0x000007ff", "0x00000fff", "0x00001fff", "0x00003fff", "0x00007fff",
"0x0000ffff", "0x0001ffff", "0x0003ffff", "0x0007ffff", "0x000fffff", "0x001fffff",
"0x003fffff", "0x007fffff", "0x00ffffff", "0x01ffffff", "0x03ffffff", "0x07ffffff",
"0x0fffffff", "0x1fffffff", "0x3fffffff", "0x7fffffff", "0xffffffff", "0x0001", "0x0002",
"0x0004", "0x0008", "0x0010", "0x0020", "0x0040", "0x0080", "0x0100", "0x0200", "0x0400",
"0x0800", "0x1000", "0x2000", "0x4000", "0x8000", "0x0001", "0x0003", "0x0007", "0x000f",
"0x001f", "0x003f", "0x007f", "0x00ff", "0x01ff", "0x03ff", "0x07ff", "0x0fff", "0x1fff",
"0x3fff", "0x7fff", "0xffff", "0x01", "0x02", "0x04", "0x08", "0x10", "0x20", "0x40", "0x80",
"0x01", "0x03", "0x07", "0x0f", "0x1f", "0x3f", "0x7f", "0xff", "0x00", "10", "100", "1000",
"10000", "100000", "1000000", "10000000", "100000000", "1000000000"
]
}
private predicate trivialIntValue(string s) {
@@ -193,15 +44,7 @@ private predicate intTrivial(Literal lit) {
}
private predicate powerOfTen(float f) {
f = 10 or
f = 100 or
f = 1000 or
f = 10000 or
f = 100000 or
f = 1000000 or
f = 10000000 or
f = 100000000 or
f = 1000000000
f = [10, 100, 1000, 10000, 100000, 1000000, 10000000, 100000000, 1000000000]
}
private predicate floatTrivial(Literal lit) {

15
csharp/ql/src/Bad Practices/Naming Conventions/DefaultControlNames.ql
View File

@@ -13,16 +13,11 @@
import csharp
predicate controlName(string prefix) {
prefix = "[Ll]abel" or
prefix = "[Bb]utton" or
prefix = "[Pp]anel" or
prefix = "[Rr]adio[Bb]utton" or
prefix = "[Pp]rop" or
prefix = "[Ss]atus[Ss]trip" or
prefix = "[Tt]able[Ll]ayout[Dd]esigner" or
prefix = "[Tt]ext[Bb]ox" or
prefix = "[Tt]ool[Ss]trip" or
prefix = "[Pp]icture[Bb]ox"
prefix =
[
"[Ll]abel", "[Bb]utton", "[Pp]anel", "[Rr]adio[Bb]utton", "[Pp]rop", "[Ss]atus[Ss]trip",
"[Tt]able[Ll]ayout[Dd]esigner", "[Tt]ext[Bb]ox", "[Tt]ool[Ss]trip", "[Pp]icture[Bb]ox"
]
}
predicate usedInHumanWrittenCode(Field f) {

11
csharp/ql/src/Bad Practices/Naming Conventions/VariableNameTooShort.ql
View File

@@ -34,16 +34,7 @@ select variable, "Variable name '" + name + "' is too short."
// Adjustable: acceptable short names
//
predicate allowedName(string name) {
name = "url" or
name = "cmd" or
name = "UK" or
name = "uri" or
name = "top" or
name = "row" or
name = "pin" or
name = "log" or
name = "key" or
name = "_"
name = ["url", "cmd", "UK", "uri", "top", "row", "pin", "log", "key", "_"]
}
//

27
csharp/ql/src/Dead Code/DeadStoreOfLocal.ql
View File

@@ -37,21 +37,11 @@ Expr getADelegateExpr(Callable c) {
*/
predicate nonEscapingCall(Call c) {
exists(string name | c.getTarget().hasName(name) |
name = "ForEach" or
name = "Count" or
name = "Any" or
name = "All" or
name = "Average" or
name = "Aggregate" or
name = "First" or
name = "Last" or
name = "FirstOrDefault" or
name = "LastOrDefault" or
name = "LongCount" or
name = "Max" or
name = "Single" or
name = "SingleOrDefault" or
name = "Sum"
name =
[
"ForEach", "Count", "Any", "All", "Average", "Aggregate", "First", "Last", "FirstOrDefault",
"LastOrDefault", "LongCount", "Max", "Single", "SingleOrDefault", "Sum"
]
)
}
@@ -116,12 +106,7 @@ class RelevantDefinition extends AssignableDefinition {
private predicate isDefaultLikeInitializer() {
this.isInitializer() and
exists(Expr e | e = this.getSource().stripCasts() |
exists(string val | val = e.getValue() |
val = "0" or
val = "-1" or
val = "" or
val = "false"
)
e.getValue() = ["0", "-1", "", "false"]
or
e instanceof NullLiteral
or

89
csharp/ql/src/Stubs/Stubs.qll
View File

@@ -612,83 +612,18 @@ private string stubImplementation(Virtualizable c) {
}
private predicate isKeyword(string s) {
s = "abstract" or
s = "as" or
s = "base" or
s = "bool" or
s = "break" or
s = "byte" or
s = "case" or
s = "catch" or
s = "char" or
s = "checked" or
s = "class" or
s = "const" or
s = "continue" or
s = "decimal" or
s = "default" or
s = "delegate" or
s = "do" or
s = "double" or
s = "else" or
s = "enum" or
s = "event" or
s = "explicit" or
s = "extern" or
s = "false" or
s = "finally" or
s = "fixed" or
s = "float" or
s = "for" or
s = "foreach" or
s = "goto" or
s = "if" or
s = "implicit" or
s = "in" or
s = "int" or
s = "interface" or
s = "internal" or
s = "is" or
s = "lock" or
s = "long" or
s = "namespace" or
s = "new" or
s = "null" or
s = "object" or
s = "operator" or
s = "out" or
s = "override" or
s = "params" or
s = "private" or
s = "protected" or
s = "public" or
s = "readonly" or
s = "ref" or
s = "return" or
s = "sbyte" or
s = "sealed" or
s = "short" or
s = "sizeof" or
s = "stackalloc" or
s = "static" or
s = "string" or
s = "struct" or
s = "switch" or
s = "this" or
s = "throw" or
s = "true" or
s = "try" or
s = "typeof" or
s = "uint" or
s = "ulong" or
s = "unchecked" or
s = "unsafe" or
s = "ushort" or
s = "using" or
s = "virtual" or
s = "void" or
s = "volatile" or
s = "while"
s =
[
"abstract", "as", "base", "bool", "break", "byte", "case", "catch", "char", "checked",
"class", "const", "continue", "decimal", "default", "delegate", "do", "double", "else",
"enum", "event", "explicit", "extern", "false", "finally", "fixed", "float", "for", "foreach",
"goto", "if", "implicit", "in", "int", "interface", "internal", "is", "lock", "long",
"namespace", "new", "null", "object", "operator", "out", "override", "params", "private",
"protected", "public", "readonly", "ref", "return", "sbyte", "sealed", "short", "sizeof",
"stackalloc", "static", "string", "struct", "switch", "this", "throw", "true", "try",
"typeof", "uint", "ulong", "unchecked", "unsafe", "ushort", "using", "virtual", "void",
"volatile", "while"
]
}
bindingset[s]

12
csharp/ql/test/library-tests/assemblies/CompareVersions.ql
View File

@@ -1,16 +1,8 @@
import csharp
Version getAVersion() {
result = "1.2" or
result = "1.2.0" or
result = "1.2.0.0" or
result = "1.3" or
result = "1.3.1" or
result = "1.3.1.2" or
result = "1.3.1.3" or
result = "1.3.2" or
result = "1.4" or
result = "2.3.1"
result =
["1.2", "1.2.0", "1.2.0.0", "1.3", "1.3.1", "1.3.1.2", "1.3.1.3", "1.3.2", "1.4", "2.3.1"]
}
from Version v1, Version v2

10
csharp/ql/test/library-tests/assemblies/ValidVersions.ql
View File

@@ -1,14 +1,6 @@
import csharp
from Version version
where
version = "1.2.3.4" or
version = "2.3.24" or
version = "1.2" or
version = "xxx" or
version = "1.x" or
version = "1" or
version = "" or
version = "1234.56"
where version = ["1.2.3.4", "2.3.24", "1.2", "xxx", "1.x", "1", "", "1234.56"]
select version, version.getMajor(), version.getMajorRevision(), version.getMinor(),
version.getMinorRevision()