hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Also include property reads in possible new sink discovery. Only include public fields and properties.

Browse Source
This commit is contained in:
Michael Nebel
2022-03-24 13:37:16 +01:00
parent 8a65efbae4
commit 5970fd9904
4 changed files with 52 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
View File

@@ -1461,7 +1461,10 @@ private class InstanceFieldOrProperty extends FieldOrProperty {
InstanceFieldOrProperty() { not this.isStatic() }
}
private class FieldOrPropertyAccess extends AssignableAccess, QualifiableExpr {
/**
* An access to a field or a property.
*/
class FieldOrPropertyAccess extends AssignableAccess, QualifiableExpr {
FieldOrPropertyAccess() { this.getTarget() instanceof FieldOrProperty }
}

16
csharp/ql/src/utils/model-generator/internal/CaptureModelsSpecific.qll
View File

@@ -38,8 +38,20 @@ predicate isRelevantSinkKind(string kind) { any() }
class PropagateToSinkConfigurationSpecific extends TaintTracking::Configuration {
PropagateToSinkConfigurationSpecific() { this = "parameters or fields flowing into sinks" }
private predicate isRelevantMemberAccess(DataFlow::Node node) {
exists(MemberAccess access | access = node.asExpr() |
access.hasThisQualifier() and
access.getTarget().isEffectivelyPublic() and
(
access instanceof FieldAccess
or
access.getTarget().(Property).getSetter().isPublic()
)
)
}
override predicate isSource(DataFlow::Node source) {
(source.asExpr() instanceof FieldAccess or source instanceof DataFlow::ParameterNode) and
(isRelevantMemberAccess(source) or source instanceof DataFlow::ParameterNode) and
source.getEnclosingCallable().(Modifiable).isEffectivelyPublic() and
isRelevantForModels(source.getEnclosingCallable())
}
@@ -54,7 +66,7 @@ string asInputArgument(DataFlow::Node source) {
result = "Argument[" + pos + "]"
)
or
source.asExpr() instanceof FieldAccess and
source.asExpr() instanceof FieldOrPropertyAccess and
result = qualifierString()
}

1
csharp/ql/test/utils/model-generator/CaptureSinkModels.expected
View File

@@ -1,3 +1,4 @@
| Sinks;NewSinks;false;WrapFieldResponseWriteFile;();Argument[Qualifier];html |
| Sinks;NewSinks;false;WrapPropResponseWriteFile;();Argument[Qualifier];html |
| Sinks;NewSinks;false;WrapResponseWrite;(System.Object);Argument[0];html |
| Sinks;NewSinks;false;WrapResponseWriteFile;(System.String);Argument[0];html |

34
csharp/ql/test/utils/model-generator/Sinks.cs
View File

@@ -5,7 +5,12 @@ namespace Sinks;
public class NewSinks
{
private string tainted;
private string privateTainted;
public string tainted;
private string PrivateTaintedProp { get; set; }
public string TaintedProp { get; set; }
public string PrivateSetTaintedProp { get; private set; }
// New sink
public void WrapResponseWrite(object o)
@@ -35,4 +40,31 @@ public class NewSinks
response.WriteFile(tainted);
}
// NOT new sink as field is private
public void WrapPrivateFieldResponseWriteFile()
{
var response = new HttpResponse();
response.WriteFile(privateTainted);
}
// New sink
public void WrapPropResponseWriteFile()
{
var response = new HttpResponse();
response.WriteFile(TaintedProp);
}
// NOT new sink as property is private
public void WrapPrivatePropResponseWriteFile()
{
var response = new HttpResponse();
response.WriteFile(PrivateTaintedProp);
}
// NOT new sink as property setter is private
public void WrapPropPrivateSetResponseWriteFile()
{
var response = new HttpResponse();
response.WriteFile(PrivateSetTaintedProp);
}
}