hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

C#: Add support for speculative taint flow.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2024-10-03 11:46:31 +02:00
parent 6c6b6061bc
commit 7b43100af5
1 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
csharp/ql/lib/semmle/code/csharp/dataflow/internal/TaintTrackingPrivate.qll
View File

@@ -169,3 +169,39 @@ private module Cached {
}
import Cached
import SpeculativeTaintFlow
private module SpeculativeTaintFlow {
private import semmle.code.csharp.dataflow.internal.ExternalFlow as ExternalFlow
private import semmle.code.csharp.dataflow.internal.FlowSummaryImpl as Impl
private predicate hasTarget(Call call) {
exists(Impl::Public::SummarizedCallable sc | sc.getACall() = call)
or
exists(Impl::Public::NeutralSummaryCallable nc | nc.getACall() = call)
or
call.getTarget().getUnboundDeclaration() instanceof ExternalFlow::SinkCallable
or
exists(FlowSummaryImpl::Public::NeutralSinkCallable sc | sc.getACall() = call)
}
predicate speculativeTaintStep(DataFlow::Node src, DataFlow::Node sink) {
exists(DataFlowCall call, Call srcCall, ArgumentPosition argpos |
not exists(viableCallable(call)) and
not hasTarget(srcCall) and
call.(NonDelegateDataFlowCall).getDispatchCall().getCall() = srcCall and
(srcCall instanceof ConstructorInitializer or srcCall instanceof MethodCall) and
src.(ArgumentNode).argumentOf(call, argpos) and
not src instanceof PostUpdateNodes::ObjectInitializerNode and
not src instanceof MallocNode
|
not argpos.isQualifier() and
sink.(PostUpdateNode)
.getPreUpdateNode()
.(ArgumentNode)
.argumentOf(call, any(ArgumentPosition qualpos | qualpos.isQualifier()))
or
sink.(OutNode).getCall(_) = call
)
}
}