hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 13:15:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Re-factor LdapInjection to use the new API.

Browse Source
This commit is contained in:
Michael Nebel
2023-03-31 10:46:33 +02:00
parent 91150af11e
commit 73cd7519a2
3 changed files with 33 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll
View File

@@ -25,9 +25,11 @@ abstract class Sink extends DataFlow::ExprNode { }
abstract class Sanitizer extends DataFlow::ExprNode { } abstract class Sanitizer extends DataFlow::ExprNode { }
/** /**
* DEPRECATED: Use `LdapInjection` instead.
*
* A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries. * A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries.
*/ */
class TaintTrackingConfiguration extends TaintTracking::Configuration { deprecated class TaintTrackingConfiguration extends TaintTracking::Configuration {
TaintTrackingConfiguration() { this = "LDAPInjection" } TaintTrackingConfiguration() { this = "LDAPInjection" }
override predicate isSource(DataFlow::Node source) { source instanceof Source } override predicate isSource(DataFlow::Node source) { source instanceof Source }
@@ -37,6 +39,22 @@ class TaintTrackingConfiguration extends TaintTracking::Configuration {
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer } override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
} }
/**
* A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries.
*/
module LdapInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof Source }
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
}
/**
* A taint-tracking configuration for unvalidated user input that is used to construct LDAP queries.
*/
module LdapInjection = TaintTracking::Global<LdapInjectionConfig>;
/** A source of remote user input. */ /** A source of remote user input. */
class RemoteSource extends Source instanceof RemoteFlowSource { } class RemoteSource extends Source instanceof RemoteFlowSource { }

6
csharp/ql/src/Security Features/CWE-090/LDAPInjection.ql
View File

@@ -13,9 +13,9 @@
import csharp import csharp
import semmle.code.csharp.security.dataflow.LDAPInjectionQuery import semmle.code.csharp.security.dataflow.LDAPInjectionQuery
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph import LdapInjection::PathGraph
from TaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink from LdapInjection::PathNode source, LdapInjection::PathNode sink
where c.hasFlowPath(source, sink) where LdapInjection::flowPath(source, sink)
select sink.getNode(), source, sink, "This LDAP query depends on a $@.", source.getNode(), select sink.getNode(), source, sink, "This LDAP query depends on a $@.", source.getNode(),
"user-provided value" "user-provided value"

16
csharp/ql/src/Security Features/CWE-090/StoredLDAPInjection.ql
View File

@@ -14,13 +14,19 @@
import csharp import csharp
import semmle.code.csharp.security.dataflow.LDAPInjectionQuery import semmle.code.csharp.security.dataflow.LDAPInjectionQuery
import semmle.code.csharp.security.dataflow.flowsources.Stored import semmle.code.csharp.security.dataflow.flowsources.Stored
import semmle.code.csharp.dataflow.DataFlow::DataFlow::PathGraph import StoredLdapInjection::PathGraph
class StoredTaintTrackingConfiguration extends TaintTrackingConfiguration { module StoredLdapInjectionConfig implements DataFlow::ConfigSig {
override predicate isSource(DataFlow::Node source) { source instanceof StoredFlowSource } predicate isSource(DataFlow::Node source) { source instanceof StoredFlowSource }
predicate isSink = LdapInjectionConfig::isSink/1;
predicate isBarrier = LdapInjectionConfig::isBarrier/1;
} }
from StoredTaintTrackingConfiguration c, DataFlow::PathNode source, DataFlow::PathNode sink module StoredLdapInjection = TaintTracking::Global<StoredLdapInjectionConfig>;
where c.hasFlowPath(source, sink)
from StoredLdapInjection::PathNode source, StoredLdapInjection::PathNode sink
where StoredLdapInjection::flowPath(source, sink)
select sink.getNode(), source, sink, "This LDAP query depends on a $@.", source.getNode(), select sink.getNode(), source, sink, "This LDAP query depends on a $@.", source.getNode(),
"stored (potentially user-provided) value" "stored (potentially user-provided) value"