C#: Convert Deserialization tests to use inline expectations.

csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.cs

@@ -11,11 +11,11 @@ class DeserializedDelegate
     {
         var formatter = new BinaryFormatter();
         // BAD
-        var a = (Func<int>)formatter.Deserialize(fs);
+        var a = (Func<int>)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
         // BAD
-        var b = (Expression<Func<int>>)formatter.Deserialize(fs);
+        var b = (Expression<Func<int>>)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
         // BAD
-        var c = (D)formatter.Deserialize(fs);
+        var c = (D)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
         // GOOD
         var d = (int)formatter.Deserialize(fs);
     }

csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegate.qlref

@@ -1 +1,4 @@
-Security Features/CWE-502/DeserializedDelegate.ql
+query: Security Features/CWE-502/DeserializedDelegate.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-502/DeserializedDelegate/DeserializedDelegateBad.cs

@@ -8,7 +8,7 @@ class Bad
     {
         var formatter = new BinaryFormatter();
         // BAD
-        var f = (Func<int>)formatter.Deserialize(fs);
+        var f = (Func<int>)formatter.Deserialize(fs); // $ Alert[cs/deserialized-delegate]
         return f();
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/BinaryFormatterBad.cs

@@ -7,6 +7,6 @@ class BadBinaryFormatter
     {
         var ds = new BinaryFormatter();
         // BAD
-        return ds.Deserialize(s);
+        return ds.Deserialize(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractJsonSerializerBad.cs

@@ -8,6 +8,6 @@ class BadDataContractJsonSerializer
     {
         var ds = new DataContractJsonSerializer(type);
         // BAD
-        return ds.ReadObject(s);
+        return ds.ReadObject(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/DataContractSerializerBad.cs

@@ -8,6 +8,6 @@ class BadDataContractSerializer
     {
         var ds = new DataContractSerializer(type);
         // BAD
-        return ds.ReadObject(s);
+        return ds.ReadObject(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/ResourceReaderBad.cs

@@ -6,11 +6,11 @@ class BadResourceReader
 {
     public static void Deserialize(Stream s)
     {
-        var ds = new ResourceReader(s);
+        var ds = new ResourceReader(s); // $ Alert[cs/unsafe-deserialization]
         // BAD
         var dict = ds.GetEnumerator();
         while (dict.MoveNext())
-            Console.WriteLine("   {0}: '{1}' (Type {2})", 
+            Console.WriteLine("   {0}: '{1}' (Type {2})",
                             dict.Key, dict.Value, dict.Value.GetType().Name);
         ds.Close();
     }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserialization.qlref

@@ -1 +1,4 @@
-Security Features/CWE-502/UnsafeDeserialization.ql
+query: Security Features/CWE-502/UnsafeDeserialization.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/UnsafeDeserializationBad.cs

@@ -6,6 +6,6 @@ class Bad
     {
         JavaScriptSerializer sr = new JavaScriptSerializer(new SimpleTypeResolver());
         // BAD
-        return sr.DeserializeObject(s);
+        return sr.DeserializeObject(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlObjectSerializerBad.cs

@@ -8,6 +8,6 @@ class BadXmlObjectSerializer
     {
         XmlObjectSerializer ds = new DataContractSerializer(type);
         // BAD
-        return ds.ReadObject(s);
+        return ds.ReadObject(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserialization/XmlSerializerBad.cs

@@ -8,6 +8,6 @@ class BadXmlSerializer
     {
         var ds = new XmlSerializer(type);
         // BAD
-        return ds.Deserialize(s);
+        return ds.Deserialize(s); // $ Alert[cs/unsafe-deserialization]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/BinaryFormatterUntrustedInputBad.cs

@@ -10,7 +10,7 @@ class BadBinaryFormatter1
     {
         var ds = new BinaryFormatter();
         // BAD
-        return ds.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(textBox.Text)));
+        return ds.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(textBox.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
     }
 }
 
@@ -20,6 +20,6 @@ class BadBinaryFormatter2
     {
         var ds = new BinaryFormatter();
         // BAD
-        return ds.Deserialize(new MemoryStream(Convert.FromBase64String(data.Text)));
+        return ds.Deserialize(new MemoryStream(Convert.FromBase64String(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractJsonSerializerUntrustedInputBad.cs

@@ -10,6 +10,6 @@ class BadDataContractJsonSerializer
     {
         var ds = new DataContractJsonSerializer(Type.GetType(type.Text));
         // BAD
-        return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+        return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/DataContractSerializerUntrustedInputBad.cs

@@ -10,6 +10,6 @@ class BadDataContractSerializer
     {
         var ds = new DataContractSerializer(Type.GetType(type.Text));
         // BAD
-        return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+        return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/ResourceReaderUntrustedInputBad.cs

@@ -8,11 +8,11 @@ class BadResourceReader
 {
     public static void Deserialize(TextBox data)
     {
-        var ds = new ResourceReader(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+        var ds = new ResourceReader(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
         // BAD
         var dict = ds.GetEnumerator();
         while (dict.MoveNext())
-            Console.WriteLine("   {0}: '{1}' (Type {2})", 
+            Console.WriteLine("   {0}: '{1}' (Type {2})",
                             dict.Key, dict.Value, dict.Value.GetType().Name);
         ds.Close();
     }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInput.qlref

@@ -1,2 +1,4 @@
 query: Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql
-postprocess: utils/test/PrettyPrintModels.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/UnsafeDeserializationUntrustedInputBad.cs

@@ -7,6 +7,6 @@ class Bad
     {
         JavaScriptSerializer sr = new JavaScriptSerializer(new SimpleTypeResolver());
         // BAD
-        return sr.DeserializeObject(textBox.Text);
+        return sr.DeserializeObject(textBox.Text); // $ Alert[cs/unsafe-deserialization-untrusted-input]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlObjectSerializerUntrustedInputBad.cs

@@ -10,6 +10,6 @@ class BadXmlObjectSerializer
     {
         XmlObjectSerializer ds = new DataContractSerializer(Type.GetType(type.Text));
         // BAD
-        return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+        return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlSerializerUntrustedInputBad.cs

@@ -10,6 +10,6 @@ class BadXmlSerializer
     {
         var ds = new XmlSerializer(Type.GetType(type.Text));
         // BAD
-        return ds.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
+        return ds.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
     }
 }

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/Test.cs

@@ -14,9 +14,9 @@ class Test
 
     public static object Deserialize2(TextBox data)
     {
-        return JsonConvert.DeserializeObject(data.Text, new JsonSerializerSettings
+        return JsonConvert.DeserializeObject(data.Text, new JsonSerializerSettings // $ Alert[cs/unsafe-deserialization-untrusted-input]
         {
-            TypeNameHandling = TypeNameHandling.Auto // BAD
+            TypeNameHandling = TypeNameHandling.Auto
         });
     }
 

csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInputNewtonsoftJson/UnsafeDeserializationUntrustedInput.qlref

@@ -1,2 +1,4 @@
 query: Security Features/CWE-502/UnsafeDeserializationUntrustedInput.ql
-postprocess: utils/test/PrettyPrintModels.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql