hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #19661 from d10c/d10c/csharp/diff-informed

Browse Source 
C#: mass enable diff-informed data flow
This commit is contained in:
Nora Dimitrijević
2025-06-17 14:52:24 +02:00
committed by GitHub
parent 84a7975a63 f2085c2293
commit 79e982af38
26 changed files with 52 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
csharp/ql/lib/semmle/code/csharp/security/cryptography/EncryptionKeyDataFlowQuery.qll
View File

@@ -70,6 +70,8 @@ private module SymmetricKeyConfig implements DataFlow::ConfigSig {
/** Holds if the node is a key sanitizer. */
predicate isBarrier(DataFlow::Node sanitizer) { sanitizer instanceof KeySanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/cryptography/HardcodedSymmetricEncryptionKey.qll
View File

@@ -82,6 +82,8 @@ module HardcodedSymmetricEncryptionKey {
succ.asExpr() = mc
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/CleartextStorageQuery.qll
View File

@@ -32,6 +32,8 @@ private module ClearTextStorageConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/CodeInjectionQuery.qll
View File

@@ -33,6 +33,8 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/CommandInjectionQuery.qll
View File

@@ -42,6 +42,8 @@ module CommandInjectionConfig implements DataFlow::ConfigSig {
* `node` from the data flow graph.
*/
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ExposureOfPrivateInformationQuery.qll
View File

@@ -32,6 +32,8 @@ private module ExposureOfPrivateInformationConfig implements DataFlow::ConfigSig
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/LDAPInjectionQuery.qll
View File

@@ -45,6 +45,8 @@ module LdapInjectionConfig implements DataFlow::ConfigSig {
* `node` from the data flow graph.
*/
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/LogForgingQuery.qll
View File

@@ -35,6 +35,8 @@ private module LogForgingConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll
View File

@@ -39,6 +39,8 @@ private module MissingXmlValidationConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { exists(sink.(Sink).getReason()) }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ReDoSQuery.qll
View File

@@ -33,6 +33,8 @@ private module ReDoSConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/RegexInjectionQuery.qll
View File

@@ -33,6 +33,8 @@ private module RegexInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ResourceInjectionQuery.qll
View File

@@ -32,6 +32,8 @@ private module ResourceInjectionConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/SqlInjectionQuery.qll
View File

@@ -43,6 +43,8 @@ module SqlInjectionConfig implements DataFlow::ConfigSig {
* `node` from the data flow graph.
*/
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/TaintedPathQuery.qll
View File

@@ -35,6 +35,8 @@ private module TaintedPathConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/UrlRedirectQuery.qll
View File

@@ -37,6 +37,8 @@ private module UrlRedirectConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/XPathInjectionQuery.qll
View File

@@ -43,6 +43,8 @@ module XpathInjectionConfig implements DataFlow::ConfigSig {
* `node` from the data flow graph.
*/
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/lib/semmle/code/csharp/security/dataflow/ZipSlipQuery.qll
View File

@@ -30,6 +30,8 @@ private module ZipSlipConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/src/Likely Bugs/LeapYear/UnsafeYearConstruction.ql
View File

@@ -26,6 +26,8 @@ module UnsafeYearCreationFromArithmeticConfig implements DataFlow::ConfigSig {
oc.getObjectType().getABaseType*().hasFullyQualifiedName("System", "DateTime")
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
module UnsafeYearCreationFromArithmetic =

2
csharp/ql/src/Security Features/CWE-091/XMLInjection.ql
View File

@@ -45,6 +45,8 @@ module XmlInjectionConfig implements DataFlow::ConfigSig {
mc = node.asExpr()
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/src/Security Features/CWE-114/AssemblyPathInjection.ql
View File

@@ -41,6 +41,8 @@ module AssemblyPathInjectionConfig implements DataFlow::ConfigSig {
name = "UnsafeLoadFrom" and arg = 0
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/src/Security Features/CWE-134/UncontrolledFormatString.ql
View File

@@ -22,6 +22,8 @@ module FormatStringConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) {
sink.asExpr() = any(FormatStringParseCall call).getFormatExpr()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
module FormatString = TaintTracking::Global<FormatStringConfig>;

2
csharp/ql/src/Security Features/CWE-201/ExposureInTransmittedData.ql
View File

@@ -41,6 +41,8 @@ module ExposureInTransmittedDataConfig implements DataFlow::ConfigSig {
}
predicate isSink(DataFlow::Node sink) { sink instanceof RemoteFlowSink }
predicate observeDiffInformedIncrementalMode() { any() }
}
module ExposureInTransmittedData = TaintTracking::Global<ExposureInTransmittedDataConfig>;

2
csharp/ql/src/Security Features/CWE-209/ExceptionInformationExposure.ql
View File

@@ -59,6 +59,8 @@ module ExceptionInformationExposureConfig implements DataFlow::ConfigSig {
// Do not flow through Message
sanitizer.asExpr().getType().(RefType).getABaseType*() instanceof SystemExceptionClass
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/src/Security Features/CWE-327/DontInstallRootCert.ql
View File

@@ -37,6 +37,8 @@ module AddCertToRootStoreConfig implements DataFlow::ConfigSig {
sink.asExpr() = mc.getQualifier()
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
module AddCertToRootStore = DataFlow::Global<AddCertToRootStoreConfig>;

2
csharp/ql/src/Security Features/CWE-327/InsecureSQLConnection.ql
View File

@@ -40,6 +40,8 @@ module InsecureSqlConnectionConfig implements DataFlow::ConfigSig {
)
)
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**

2
csharp/ql/src/Security Features/InsecureRandomness.ql
View File

@@ -49,6 +49,8 @@ module Random {
// succ = array_or_indexer[pred] - use of random numbers in an index
succ.asExpr().(ElementAccess).getAnIndex() = pred.asExpr()
}
predicate observeDiffInformedIncrementalMode() { any() }
}
/**