hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

C#: update 'xss' sink kind to 'js-injection'

Browse Source
This commit is contained in:
Jami Cogswell
2023-05-16 13:32:29 -04:00
parent a0b502fa44
commit 74cd2407fb
6 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
csharp/ql/lib/ext/System.Net.Http.model.yml
View File

@@ -3,7 +3,7 @@ extensions:
pack: codeql/csharp-all
extensible: sinkModel
data:
- ["System.Net.Http", "StringContent", False, "StringContent", "", "", "Argument[0]", "xss", "manual"]
- ["System.Net.Http", "StringContent", False, "StringContent", "", "", "Argument[0]", "js-injection", "manual"]
- addsTo:
pack: codeql/csharp-all
extensible: summaryModel

4
csharp/ql/lib/ext/generated/dotnet_runtime.model.yml
View File

@@ -9,8 +9,8 @@ extensions:
data:
- ["System.Data.Odbc", "OdbcDataAdapter", false, "OdbcDataAdapter", "(System.String,System.Data.Odbc.OdbcConnection)", "", "Argument[0]", "sql-injection", "df-generated"]
- ["System.Data.Odbc", "OdbcDataAdapter", false, "OdbcDataAdapter", "(System.String,System.String)", "", "Argument[0]", "sql-injection", "df-generated"]
- ["System.Net.Http", "StringContent", false, "StringContent", "(System.String)", "", "Argument[0]", "xss", "df-generated"]
- ["System.Net.Http", "StringContent", false, "StringContent", "(System.String,System.Text.Encoding)", "", "Argument[0]", "xss", "df-generated"]
- ["System.Net.Http", "StringContent", false, "StringContent", "(System.String)", "", "Argument[0]", "js-injection", "df-generated"]
- ["System.Net.Http", "StringContent", false, "StringContent", "(System.String,System.Text.Encoding)", "", "Argument[0]", "js-injection", "df-generated"]
- ["System.Security.Cryptography", "AesCryptoServiceProvider", false, "CreateDecryptor", "(System.Byte[],System.Byte[])", "", "Argument[0]", "encryption-decryptor", "df-generated"]
- ["System.Security.Cryptography", "AesCryptoServiceProvider", false, "CreateEncryptor", "(System.Byte[],System.Byte[])", "", "Argument[0]", "encryption-encryptor", "df-generated"]
- ["System.Security.Cryptography", "AesCryptoServiceProvider", false, "set_Key", "(System.Byte[])", "", "Argument[0]", "encryption-keyprop", "df-generated"]

2
csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll
View File

@@ -211,7 +211,7 @@ module ModelValidation {
)
or
exists(string kind | sinkModel(_, _, _, _, _, _, _, kind, _) |
not kind = ["code-injection", "sql-injection", "xss", "remote", "html-injection"] and
not kind = ["code-injection", "sql-injection", "js-injection", "remote", "html-injection"] and
not kind.matches("encryption-%") and
result = "Invalid kind \"" + kind + "\" in sink model."
)

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSSinks.qll
View File

@@ -24,7 +24,7 @@ abstract class Sink extends DataFlow::ExprNode, RemoteFlowSink {
}
private class ExternalXssSink extends Sink {
ExternalXssSink() { sinkNode(this, "xss") }
ExternalXssSink() { sinkNode(this, "js-injection") }
}
private class HtmlSinkSink extends Sink instanceof HtmlSink {

2
csharp/ql/test/library-tests/dataflow/external-models/sinks.expected
View File

@@ -4,5 +4,5 @@ invalidModelRow
| Sinks.cs:11:13:11:41 | this access | remote |
| Sinks.cs:11:30:11:40 | access to local variable argToTagged | remote |
| Sinks.cs:14:27:14:36 | access to local variable fieldWrite | sql-injection |
| Sinks.cs:20:20:20:22 | access to local variable res | xss |
| Sinks.cs:20:20:20:22 | access to local variable res | js-injection |
| Sinks.cs:27:20:27:25 | access to local variable resTag | html-injection |

2
csharp/ql/test/library-tests/dataflow/external-models/sinks.ext.yml
View File

@@ -5,7 +5,7 @@ extensions:
data:
# "namespace", "type", "overrides", "name", "signature", "ext", "spec", "kind", "provenance"
- ["My.Qltest", "B", false, "Sink1", "(System.Object)", "", "Argument[0]", "code-injection", "manual"]
- ["My.Qltest", "B", false, "SinkMethod", "()", "", "ReturnValue", "xss", "manual"]
- ["My.Qltest", "B", false, "SinkMethod", "()", "", "ReturnValue", "js-injection", "manual"]
- ["My.Qltest", "SinkAttribute", false, "", "", "Attribute", "ReturnValue", "html-injection", "manual"]
- ["My.Qltest", "SinkAttribute", false, "", "", "Attribute", "Argument", "remote", "manual"]
- ["My.Qltest", "SinkAttribute", false, "", "", "Attribute", "", "sql-injection", "manual"]