hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20074 from d10c/d10c/diff-informed-phase-3-csharp

Browse Source 
C#: Diff-informed queries: phase 3 (non-trivial locations)
This commit is contained in:
Nora Dimitrijević
2025-08-15 12:07:47 +02:00
committed by GitHub
parent ec605b2c95 218fcbbec5
commit 8000e7c442
4 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
csharp/ql/lib/semmle/code/csharp/security/dataflow/ConditionalBypassQuery.qll
View File

@@ -39,6 +39,15 @@ private module ConditionalBypassConfig implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
Location getASelectedSinkLocation(DataFlow::Node sink) {
result = sink.getLocation()
or
// from ConditionalBypass.ql
result = sink.(Sink).getSensitiveMethodCall().getLocation()
}
}
/**

24
csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll
View File

@@ -59,6 +59,10 @@ private module TaintToObjectMethodTrackingConfig implements DataFlow::ConfigSig
predicate isSink(DataFlow::Node sink) { sink instanceof InstanceMethodSink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() {
any() // used in one of the disjuncts in UnsafeDeserializationUntrustedInput.ql
}
}
/**
@@ -77,6 +81,10 @@ private module JsonConvertTrackingConfig implements DataFlow::ConfigSig {
}
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() {
any() // used in one of the disjuncts in UnsafeDeserializationUntrustedInput.ql
}
}
/**
@@ -133,6 +141,10 @@ private module TypeNameTrackingConfig implements DataFlow::ConfigSig {
)
)
}
predicate observeDiffInformedIncrementalMode() {
none() // Only used as secondary config in UnsafeDeserializationUntrustedInput.ql
}
}
/**
@@ -149,6 +161,10 @@ private module TaintToConstructorOrStaticMethodTrackingConfig implements DataFlo
predicate isSink(DataFlow::Node sink) { sink instanceof ConstructorOrStaticMethodSink }
predicate isBarrier(DataFlow::Node node) { node instanceof Sanitizer }
predicate observeDiffInformedIncrementalMode() {
any() // used in one of the disjuncts in UnsafeDeserializationUntrustedInput.ql
}
}
/**
@@ -186,6 +202,10 @@ private module TaintToObjectTypeTrackingConfig implements DataFlow::ConfigSig {
oc.getObjectType() instanceof StrongTypeDeserializer
)
}
predicate observeDiffInformedIncrementalMode() {
none() // only used as secondary config in UnsafeDeserializationUntrustedInput.ql
}
}
/**
@@ -210,6 +230,10 @@ private module WeakTypeCreationToUsageTrackingConfig implements DataFlow::Config
sink.asExpr() = mc.getQualifier()
)
}
predicate observeDiffInformedIncrementalMode() {
none() // only used as secondary config in UnsafeDeserializationUntrustedInput.ql
}
}
/**

2
csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransformLambda.ql
View File

@@ -24,6 +24,8 @@ module NotThreadSafeCryptoUsageIntoParallelInvokeConfig implements DataFlow::Con
}
predicate isSink(DataFlow::Node sink) { sink instanceof ParallelSink }
predicate observeDiffInformedIncrementalMode() { any() }
}
module NotThreadSafeCryptoUsageIntoParallelInvoke =

6
csharp/ql/src/Security Features/CWE-798/HardcodedConnectionString.ql
View File

@@ -38,6 +38,12 @@ module ConnectionStringConfig implements DataFlow::ConfigSig {
}
predicate isBarrier(DataFlow::Node node) { node instanceof StringFormatSanitizer }
predicate observeDiffInformedIncrementalMode() { any() }
Location getASelectedSinkLocation(DataFlow::Node sink) {
any(Call call | call.getAnArgument() = sink.asExpr()).getLocation() = result
}
}
/**